diff --git a/.github/workflows/test-linux-perfetto.yml b/.github/workflows/test-linux-perfetto.yml
new file mode 100644
index 000000000000..70a92202c1c7
--- /dev/null
+++ b/.github/workflows/test-linux-perfetto.yml
@@ -0,0 +1,70 @@
+name: Test Linux (with Perfetto)
+
+on:
+  workflow_dispatch:
+  pull_request:
+    # Only targeting paths specific to the vendored version of Perfetto, `test-shared`
+    # is taking care of rest of the coverage.
+    paths:
+      - .github/workflows/test-linux-perfetto.yml
+      - common.gypi
+      - configure.py
+      - deps/perfetto/**
+      - node.gyp
+      - node.gypi
+      - tools/v8_gypfiles/v8.gyp
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+env:
+  PYTHON_VERSION: '3.14'
+  FLAKY_TESTS: keep_retrying
+  CLANG_VERSION: '19'
+  CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang-19
+  CXX: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang++-19
+  SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
+  SCCACHE_IDLE_TIMEOUT: '0'
+  RUSTC_VERSION: '1.86'
+
+permissions:
+  contents: read
+
+jobs:
+  test-perfetto:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+          path: node
+      - name: Install Clang ${{ env.CLANG_VERSION }}
+        uses: ./node/.github/actions/install-clang
+        with:
+          clang-version: ${{ env.CLANG_VERSION }}
+      - name: Install Rust ${{ env.RUSTC_VERSION }}
+        run: |
+          rustup override set "$RUSTC_VERSION"
+          rustup --version
+      - name: Set up Python ${{ env.PYTHON_VERSION }}
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          allow-prereleases: true
+      - name: Set up sccache
+        if: github.base_ref == 'main' || github.ref_name == 'main'
+        uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
+        with:
+          version: v0.17.0
+      - name: Build
+        working-directory: node
+        run: make build-ci -j4 V=1 CONFIG_FLAGS="--error-on-warn --v8-enable-temporal-support --with-perfetto"
+      - name: Test
+        working-directory: node
+        run: make test-ci -j1 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9"
+      - name: Ensure running tests did not cause any change in the tree
+        working-directory: node
+        run: git add -A && git diff --name-only --exit-code --staged
diff --git a/.github/workflows/test-shared.yml b/.github/workflows/test-shared.yml
index 1f1afdd89dd2..f7483103016f 100644
--- a/.github/workflows/test-shared.yml
+++ b/.github/workflows/test-shared.yml
@@ -29,10 +29,13 @@ on:
       - deps/nghttp2/**
       - deps/ngtcp2/**
       - deps/openssl/*/**
+      - deps/perfetto/**
       - deps/simdjson/**
       - deps/sqlite/**
       - deps/uv/**
       - deps/uvwasi/**
+      - deps/v8/third_party/abseil-cpp/**
+      - deps/v8/third_party/highway/**
       - deps/zlib/**
       - deps/zstd/**
       - doc/**
@@ -82,10 +85,13 @@ on:
       - deps/nghttp2/**
       - deps/ngtcp2/**
       - deps/openssl/*/**
+      - deps/perfetto/**
       - deps/simdjson/**
       - deps/sqlite/**
       - deps/uv/**
       - deps/uvwasi/**
+      - deps/v8/third_party/abseil-cpp/**
+      - deps/v8/third_party/highway/**
       - deps/zlib/**
       - deps/zstd/**
       - doc/**
diff --git a/.gitignore b/.gitignore
index 2a7ce3337021..9277cdf090f0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -121,6 +121,7 @@ tools/*/*.i.tmp
 /*.xml
 /v8*-tap.json
 /node_trace.*.log
+/node_trace.*.pftrace
 # coverage related
 /gcovr
 /build
diff --git a/CHANGELOG.md b/CHANGELOG.md
index da927c538e27..f79cc8671d8c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -41,7 +41,8 @@ release.
 </tr>
 <tr>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V26.md#26.8.2">26.8.2</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V26.md#26.9.0">26.9.0</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V26.md#26.8.2">26.8.2</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.8.1">26.8.1</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.8.0">26.8.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.7.0">26.7.0</a><br/>
diff --git a/LICENSE b/LICENSE
index 9cc3315dd388..67cd2feb69a9 100644
--- a/LICENSE
+++ b/LICENSE
@@ -2600,29 +2600,6 @@ The externally maintained libraries used by Node.js are:
     WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
   """
 
-- large_pages, located at src/large_pages, is licensed as follows:
-  """
-     Copyright (C) 2018 Intel Corporation
-
-     Permission is hereby granted, free of charge, to any person obtaining a copy
-     of this software and associated documentation files (the "Software"),
-     to deal in the Software without restriction, including without limitation
-     the rights to use, copy, modify, merge, publish, distribute, sublicense,
-     and/or sell copies of the Software, and to permit persons to whom
-     the Software is furnished to do so, subject to the following conditions:
-
-     The above copyright notice and this permission notice shall be included
-     in all copies or substantial portions of the Software.
-
-     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-     OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-     FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
-     THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
-     OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
-     ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
-     OR OTHER DEALINGS IN THE SOFTWARE.
-  """
-
 - caja, located at lib/internal/freeze_intrinsics.js, is licensed as follows:
   """
      Adapted from SES/Caja - Copyright (C) 2011 Google Inc.
diff --git a/Makefile b/Makefile
index 86410b7f9cbb..afa55b2da33e 100644
--- a/Makefile
+++ b/Makefile
@@ -1319,10 +1319,13 @@ ifeq ($(SKIP_SHARED_DEPS), 1)
 	$(RM) -r $(TARNAME)/deps/ngtcp2
 	find $(TARNAME)/deps/openssl -maxdepth 1 -type f ! -name 'nodejs-openssl.cnf' -exec $(RM) {} +
 	find $(TARNAME)/deps/openssl -mindepth 1 -maxdepth 1 -type d -exec $(RM) -r {} +
+	$(RM) -r $(TARNAME)/deps/perfetto
 	$(RM) -r $(TARNAME)/deps/simdjson
 	$(RM) -r $(TARNAME)/deps/sqlite
 	$(RM) -r $(TARNAME)/deps/uv
 	$(RM) -r $(TARNAME)/deps/uvwasi
+	$(RM) -r $(TARNAME)/deps/v8/third_party/abseil-cpp
+	$(RM) -r $(TARNAME)/deps/v8/third_party/highway
 	$(RM) -r $(TARNAME)/deps/zlib
 	$(RM) -r $(TARNAME)/deps/zstd
 else
diff --git a/SECURITY.md b/SECURITY.md
index 6a944e859015..17d35fd4432f 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -173,6 +173,28 @@ are not part of the Node.js documented API surface, are not enabled by
 default in production builds, and may have incomplete implementations or
 missing security hardening.
 
+### Security triage dispositions
+
+When triaging a report, the project classifies it into one of the following
+dispositions:
+
+* **Vulnerability**: A Node.js defect that is exploitable across a
+  Node.js-owned security boundary and meets the criteria under
+  [What constitutes a vulnerability](#what-constitutes-a-vulnerability),
+  including any applicable DoS criteria.
+* **Security-interest bug**: A real Node.js defect, or an API behavior likely
+  to cause security bugs in applications, that is not itself a vulnerability
+  under this threat model. These are fixed as regular bugs and do not
+  automatically receive a CVE, but should still be reported privately first
+  when they affect a common security control such as protocol interpretation,
+  permission enforcement, or certificate/TLS decisions.
+* **Common bug**: A correctness, robustness, or crash issue without a
+  Node.js-owned security boundary or a realistic cross-boundary attacker benefit.
+* **Invalid / out of scope**: A bug report that meets one of these criteria:
+  * Cannot be reproduced
+  * Is not a Node.js defect (e.g., an application bug)
+  * Is excluded by policy (e.g., experimental features)
+
 ### What constitutes a vulnerability
 
 Being able to cause the following through control of the elements that Node.js
@@ -351,6 +373,19 @@ the community they pose.
 * Code is trusted by Node.js. Therefore any scenario that requires a malicious
   third-party module cannot result in a vulnerability in Node.js.
 
+#### Same-process self-harm
+
+* Node.js trusts the code it is asked to run. A defect that can only be
+  triggered by JavaScript, WASM, native, addon, FFI, or dependency code already
+  executing in the target process is not a Node.js vulnerability merely because
+  that code can crash, corrupt, or confuse the process it already controls.
+  This includes forging an internal handle, reflecting or overwriting an
+  internal `Symbol()`, installing a `Symbol.hasInstance` hook, or reaching into
+  an internal binding.
+* Such issues may still be fixed as common bugs. They become vulnerabilities
+  only if the same defect is reachable from an element Node.js does not trust
+  without relying on an application-created boundary.
+
 #### Prototype Pollution Attacks (CWE-1321)
 
 * Node.js trusts the inputs provided to it by application code.
@@ -467,6 +502,21 @@ resources a Node.js process may access. It is designed to reduce the blast
 radius of mistakes in trusted application code, **not** to act as a security
 boundary against intentional misuse or a compromised process.
 
+Permission Model reports are triaged in three lanes:
+
+* **Vulnerability**: An element Node.js does not trust crosses a Node.js-owned
+  permission check without trusted code already executing in the protected
+  process.
+* **Security-interest bug**: Trusted application code uses documented, stable
+  APIs as intended, but Node.js fails to enforce a documented permission
+  invariant consistently — for example, one API enforces a check that an
+  equivalent API omits. These are fixed as hardening and are not automatically
+  CVE-class, because the Permission Model is not a sandbox against malicious
+  same-process code.
+* **Excluded**: Intentional misuse by code already running in the process,
+  operator-selected flags, a modified `execArgv`/`env`, or any expectation that
+  the Permission Model sandboxes malicious same-process code.
+
 The following are **not** vulnerabilities in Node.js:
 
 * **Operator-controlled flags**: Behavior unlocked by flags the operator
@@ -487,9 +537,14 @@ The following are **not** vulnerabilities in Node.js:
   symlinks that resolve within the allowed list are similarly not considered
   permission model bypasses.
 
-* **`worker_threads` with modified `execArgv`**: Workers inherit the permission
-  restrictions of their parent process. Passing an empty or modified `execArgv`
-  to a worker does not grant it additional permissions.
+* **`worker_threads` and the permission model**: Creating a worker is gated by
+  `--allow-worker`. A worker started with a modified `execArgv` or `env` may
+  start without inheriting the parent's permission configuration, so the
+  permission model does not reliably propagate to such workers. Because worker
+  creation already requires `--allow-worker`, and the Permission Model is not a
+  sandbox against intentional misuse by trusted code, this is not considered a
+  vulnerability. Applications that rely on the Permission Model must not grant
+  `--allow-worker` to code they do not trust.
 
 #### QUIC and HTTP/3
 
diff --git a/benchmark/README.md b/benchmark/README.md
index 2f52a44f251a..78a55fba453f 100644
--- a/benchmark/README.md
+++ b/benchmark/README.md
@@ -10,6 +10,7 @@ directory, see [the guide on benchmarks](../doc/contributing/writing-and-running
 ## Table of Contents
 
 * [File tree structure](#file-tree-structure)
+* [`node:bench` evaluation tools](#nodebench-evaluation-tools)
 * [Common API](#common-api)
 
 ## File tree structure
@@ -34,7 +35,7 @@ The actual benchmark scripts should be placed in their corresponding
 directories.
 
 * `_benchmark_progress.js`: implements the progress bar displayed
-  when running `compare.js`
+  when running `compare.js` and `scatter.js`
 * `_cli.js`: parses the command line arguments passed to `compare.js`,
   `run.js` and `scatter.js`
 * `_cli.R`: parses the command line arguments passed to `compare.R`
@@ -44,15 +45,92 @@ directories.
 * `common.js`: see [Common API](#common-api).
 * `compare.js`: command line tool for comparing performance between different
   Node.js binaries.
+* `compare-node-bench.js`: parallel comparison tool for explicit `node:bench`
+  files. It does not change or invoke `compare.js`.
 * `compare.R`: R script for statistically analyzing the output of
   `compare.js`
 * `run.js`: command line tool for running individual benchmark suite(s).
 * `scatter.js`: command line tool for comparing the performance
   between different parameters in benchmark configurations,
-  for example to analyze the time complexity.
+  for example to analyze the time complexity. Pass `--analyze` to
+  summarize the results without R.
+* `scatter-node-bench.js`: parallel scatter-data tool for an explicit
+  `node:bench` file. It does not change or invoke `scatter.js`.
 * `scatter.R`: R script for visualizing the output of `scatter.js` with
   scatter plots.
 
+## `node:bench` evaluation tools
+
+The `compare-node-bench.js` and `scatter-node-bench.js` tools run explicit
+`node:bench` files without changing the existing benchmark framework or its
+tools. Each repeated observation for a benchmark identity is collected by a
+separate process invocation with one measured sample. Benchmarks declared in
+the same file still execute serially in that process and can share JIT, garbage
+collector, heap, and cache state. This differs from legacy configuration-level
+process isolation and must be considered when comparing the frameworks.
+
+Compare two binaries and analyze the compatible CSV using `compare.R`:
+
+```console
+./node benchmark/compare-node-bench.js \
+  --old ./node-main --new ./node-pr --runs 30 -- \
+  benchmark/crypto/_create-hash.node-bench.js > compare-node-bench.csv
+Rscript benchmark/compare.R < compare-node-bench.csv
+```
+
+Pass `--analyze` to run the same Welch analysis inline. `--max-regression N`
+implies `--analyze` and makes the command fail only when the Holm-Bonferroni
+adjusted one-sided p-value against the `N%` threshold is below 0.05 and the full
+95% confidence interval is worse than `-N%`. Requiring both conditions prevents
+a noisy point estimate from failing a regression gate.
+
+```console
+./node benchmark/compare-node-bench.js \
+  --old ./node-main --new ./node-pr --runs 30 \
+  --max-regression 5 -- benchmark/crypto/_create-hash.node-bench.js
+```
+
+Collect parameter data for the parallel buffer benchmark and plot it using
+`scatter.R`:
+
+```console
+./node benchmark/scatter-node-bench.js --node ./node --runs 30 -- \
+  benchmark/buffers/_buffer-compare-offset.node-bench.js \
+  > scatter-node-bench.csv
+Rscript benchmark/scatter.R --xaxis size --category method \
+  --plot scatter-node-bench.png < scatter-node-bench.csv
+```
+
+Pass `--analyze` with an x-axis parameter to summarize the samples without R.
+The output includes mean and median confidence intervals, skew warnings, an
+optional bar chart, and Mann-Whitney U and Cliff's delta comparisons between
+consecutive x-axis values. Use `--category` for a second grouping parameter and
+`--no-chart` to omit the chart.
+
+Because configurations in one file share a process, inline analysis averages
+aggregated configurations into one value per outer process. Consecutive
+x-axis comparisons use alternating, disjoint process sets so the unpaired
+Mann-Whitney test does not treat correlated values as independent samples.
+
+```console
+./node benchmark/scatter-node-bench.js --runs 30 --analyze \
+  --xaxis size --category method -- \
+  benchmark/buffers/_buffer-compare-offset.node-bench.js
+```
+
+A file passed to `scatter-node-bench.js` must use one logical benchmark name.
+Parameter values distinguish its configurations. The tool rejects unstable
+identities and names or parameters that would merge unrelated CSV groups.
+
+The underscore-prefixed benchmark files are parallel ports used to compare the
+measurement frameworks. Legacy discovery ignores them, so the original files
+remain the source benchmarks for `run.js`, `compare.js`, and `scatter.js`. The
+ports use the platform-specific original relative filename as their benchmark
+name and preserve parameter column names to keep CSV grouping compatible. For
+a direct framework comparison, collect the same number of runs from an
+original benchmark with `scatter.js` and from its port with
+`scatter-node-bench.js`, then compare their rate distributions.
+
 ## Common API
 
 The common.js module is used by benchmarks for consistency across repeated
diff --git a/benchmark/_node-bench-analysis.js b/benchmark/_node-bench-analysis.js
new file mode 100644
index 000000000000..bf0f7402b791
--- /dev/null
+++ b/benchmark/_node-bench-analysis.js
@@ -0,0 +1,763 @@
+'use strict';
+
+const { createHistogram } = require('node:perf_hooks');
+const { inspect } = require('node:util');
+
+function createRateHistogram(rates, scale, figures) {
+  const histogram = createHistogram({ figures });
+  for (const rate of rates) {
+    const value = Math.max(1, Math.round(rate * scale));
+    if (!Number.isSafeInteger(value)) {
+      throw new RangeError('Benchmark rate is too large for the histogram scale');
+    }
+    histogram.record(value);
+  }
+  return histogram;
+}
+
+function holmAdjust(pValues) {
+  const order = pValues
+    .map((p, index) => ({ index, p }))
+    .sort((a, b) => a.p - b.p);
+  const adjusted = new Array(order.length);
+  let running = 0;
+  for (let index = 0; index < order.length; index++) {
+    running = Math.max(
+      running,
+      Math.min(1, (order.length - index) * order[index].p),
+    );
+    adjusted[order[index].index] = running;
+  }
+  return adjusted;
+}
+
+function thresholdPValue(oldRates, newHistogram, scale, maxRegression) {
+  const factor = 1 - maxRegression / 100;
+  if (factor <= 0) return 1;
+  const thresholdHistogram = createRateHistogram(
+    oldRates.map((rate) => rate * factor), scale, 3);
+  const result = thresholdHistogram.welchTest(newHistogram);
+  if (Number.isNaN(result.pValue)) return 1;
+  return result.tStatistic > 0 ?
+    result.pValue / 2 : 1 - result.pValue / 2;
+}
+
+function isRegressionFailure(row, maxRegression) {
+  return row.pThresholdAdjusted < 0.05 &&
+         row.improvement + row.ci95 < -maxRegression;
+}
+
+function analyzeCompare(samples, scale, maxRegression) {
+  const groups = new Map();
+  for (const sample of samples) {
+    let group = groups.get(sample.identity);
+    if (group === undefined) {
+      const suffix = sample.configuration === '' ?
+        '' : ` ${sample.configuration}`;
+      group = {
+        name: `${sample.name}${suffix}`,
+        new: [],
+        old: [],
+      };
+      groups.set(sample.identity, group);
+    }
+    group[sample.binary].push(sample.rate);
+  }
+
+  const rows = [];
+  let skipped = 0;
+  for (const { name, old: oldRates, new: newRates } of groups.values()) {
+    if (oldRates.length < 2 || newRates.length < 2) {
+      skipped++;
+      continue;
+    }
+
+    const oldHistogram = createRateHistogram(oldRates, scale, 3);
+    const newHistogram = createRateHistogram(newRates, scale, 3);
+    const oldMean = oldRates.reduce((sum, rate) => sum + rate, 0) /
+      oldRates.length;
+    const newMean = newRates.reduce((sum, rate) => sum + rate, 0) /
+      newRates.length;
+    const improvement = ((newMean - oldMean) / oldMean) * 100;
+    const w95 = oldHistogram.welchTest(newHistogram, { confidence: 0.95 });
+    const w99 = oldHistogram.welchTest(newHistogram, { confidence: 0.99 });
+    const w999 = oldHistogram.welchTest(newHistogram, { confidence: 0.999 });
+    let stars = '';
+    if (w95.pValue < 0.001) stars = '***';
+    else if (w95.pValue < 0.01) stars = ' **';
+    else if (w95.pValue < 0.05) stars = '  *';
+    const ciPercent = (result) => {
+      const half = (result.confidenceInterval.upper -
+                    result.confidenceInterval.lower) / 2;
+      return (half / (oldMean * scale)) * 100;
+    };
+    const row = {
+      ci95: ciPercent(w95),
+      ci99: ciPercent(w99),
+      ci999: ciPercent(w999),
+      improvement,
+      name,
+      pValue: Number.isNaN(w95.pValue) ? 1 : w95.pValue,
+      stars,
+    };
+    if (maxRegression !== undefined) {
+      row.pThreshold = thresholdPValue(
+        oldRates, newHistogram, scale, maxRegression);
+    }
+    rows.push(row);
+  }
+
+  const adjusted = holmAdjust(rows.map(({ pValue }) => pValue));
+  const thresholdAdjusted = maxRegression === undefined ? null :
+    holmAdjust(rows.map(({ pThreshold }) => pThreshold));
+  let underpowered = 0;
+  for (let index = 0; index < rows.length; index++) {
+    const row = rows[index];
+    row.pAdjusted = adjusted[index];
+    if (thresholdAdjusted !== null) {
+      row.pThresholdAdjusted = thresholdAdjusted[index];
+    }
+    row.inconclusive = maxRegression > 0 &&
+                       row.stars.trim() === '' &&
+                       row.ci95 > maxRegression;
+    if (row.inconclusive) underpowered++;
+  }
+
+  const output = [];
+  const maxNameLength = rows.reduce(
+    (maximum, { name }) => Math.max(maximum, name.length), 0);
+  const pad = (value, length) =>
+    value + ' '.repeat(Math.max(0, length - value.length));
+  const padStart = (value, length) =>
+    ' '.repeat(Math.max(0, length - value.length)) + value;
+  output.push(`${pad('', maxNameLength)}  confidence` +
+              '   improvement   accuracy (*)    (**)   (***)');
+  for (const row of rows) {
+    const improvement =
+      `${row.improvement >= 0 ? '+' : ''}${row.improvement.toFixed(2)} %`;
+    output.push(
+      `${pad(row.name, maxNameLength)}  ${pad(row.stars, 10)}` +
+      `  ${padStart(improvement, 11)}` +
+      `   ±${row.ci95.toFixed(2)}%` +
+      `  ±${row.ci99.toFixed(2)}%` +
+      `  ±${row.ci999.toFixed(2)}%` +
+      `${row.inconclusive ? '  (inconclusive)' : ''}`,
+    );
+  }
+
+  if (skipped > 0) {
+    output.push('');
+    output.push(
+      `Note: ${skipped} configuration${skipped === 1 ? ' was' : 's were'}` +
+      ' skipped because Welch\'s t-test requires at least 2 samples per' +
+      ' binary. Use --runs 2 or higher.',
+    );
+  }
+  printCompareChart(output, rows, maxNameLength);
+
+  output.push('');
+  output.push(
+    `Rates were scaled by ${scale}x into HdrHistogram (3 significant figures).`,
+    'Use --scale to adjust precision if needed.',
+    '',
+  );
+  const significant = rows.filter(({ pAdjusted }) => pAdjusted < 0.05).length;
+  output.push(
+    'The confidence markers above are per-benchmark and uncorrected. ' +
+    `After Holm-Bonferroni correction across ${rows.length} comparison` +
+    `${rows.length === 1 ? '' : 's'}, ${significant} remain` +
+    `${significant === 1 ? 's' : ''} significant at 5%.`,
+  );
+  if (maxRegression !== undefined) {
+    output.push(
+      `For --max-regression, one-sided p-values against the ` +
+      `${maxRegression}% threshold were corrected separately.`,
+    );
+  }
+
+  if (maxRegression > 0 && underpowered > 0) {
+    output.push('');
+    output.push(
+      `Note: ${underpowered} of ${rows.length} comparison` +
+      `${rows.length === 1 ? '' : 's'} could not resolve an effect as small ` +
+      `as ${maxRegression}% and are marked (inconclusive). Raise --runs to ` +
+      'narrow their confidence intervals.',
+    );
+  }
+
+  const failures = maxRegression !== undefined ?
+    rows.filter((row) => isRegressionFailure(row, maxRegression)) : [];
+  if (failures.length > 0) {
+    output.push('');
+    output.push(
+      `FAIL: ${failures.length} benchmark${failures.length === 1 ? '' : 's'}` +
+      ` regressed by more than ${maxRegression}% (the 95% interval excludes ` +
+      `the threshold and its one-sided test is family-wise corrected across ` +
+      `${rows.length} comparisons):`,
+    );
+    for (const failure of failures) {
+      output.push(
+        `  ${failure.name}  ${failure.improvement.toFixed(2)}% ` +
+        `(95% CI up to ${(failure.improvement + failure.ci95).toFixed(2)}%, ` +
+        `adjusted threshold p=` +
+        `${failure.pThresholdAdjusted.toExponential(2)})`,
+      );
+    }
+  }
+
+  return {
+    failed: failures.length > 0,
+    output: `${output.join('\n')}\n`,
+    rows,
+  };
+}
+
+function printCompareChart(output, rows, maxNameLength) {
+  if (rows.length === 0) return;
+  const width = 40;
+  const halfWidth = width / 2;
+  let maximum = 0;
+  for (const row of rows) {
+    maximum = Math.max(maximum, Math.abs(row.improvement) + row.ci95);
+  }
+  if (maximum === 0) maximum = 1;
+  const left = `-${maximum.toFixed(1)}%`;
+  const right = `+${maximum.toFixed(1)}%`;
+  const centerLabel = '0%';
+  const labelPadding = maxNameLength + 5;
+  output.push('');
+  output.push(
+    ' '.repeat(labelPadding) + left +
+    ' '.repeat(Math.max(
+      0, halfWidth - left.length - Math.floor(centerLabel.length / 2))) +
+    centerLabel +
+    ' '.repeat(Math.max(
+      0, halfWidth - Math.ceil(centerLabel.length / 2) - right.length)) +
+    right,
+  );
+  for (const row of rows) {
+    const center = halfWidth;
+    const result = center + (row.improvement / maximum) * halfWidth;
+    const lower = center +
+      ((row.improvement - row.ci95) / maximum) * halfWidth;
+    const upper = center +
+      ((row.improvement + row.ci95) / maximum) * halfWidth;
+    let bar = '';
+    for (let index = 0; index < width; index++) {
+      const position = index + 0.5;
+      if (index === Math.floor(center)) {
+        bar += '|';
+      } else if ((row.improvement >= 0 &&
+                  position > center && position <= result) ||
+                 (row.improvement < 0 &&
+                  position < center && position >= result)) {
+        bar += row.stars === '' ? '▓' : '█';
+      } else if (position >= lower && position <= upper) {
+        bar += '░';
+      } else {
+        bar += ' ';
+      }
+    }
+    const label = `${row.improvement >= 0 ? '+' : ''}` +
+      `${row.improvement.toFixed(2)}%`;
+    output.push(
+      `${row.name.padEnd(maxNameLength)}  ${bar}  ${label} ${row.stars.trim()}`,
+    );
+  }
+}
+
+function histogramScale(rates) {
+  let minimum = Infinity;
+  let maximum = 0;
+  for (const rate of rates) {
+    if (rate > 0 && rate < minimum) minimum = rate;
+    if (rate > maximum) maximum = rate;
+  }
+  if (!Number.isFinite(minimum) || maximum === 0) return 1;
+  let scale = 1;
+  while (minimum * scale < 1e6 && maximum * scale < 1e15) scale *= 10;
+  return scale;
+}
+
+function validateScatterParameters(samples, xAxis, category) {
+  if (category !== undefined && category === xAxis) {
+    throw new Error('--xaxis and --category must name different parameters');
+  }
+  for (const key of [xAxis, category]) {
+    if (key === undefined) continue;
+    if (samples.some(({ params }) =>
+      !Object.hasOwn(params, key))) {
+      const available = [...new Set(samples.flatMap(
+        ({ params }) => Object.keys(params)))].sort();
+      throw new Error(
+        `The variable '${key}' is not present in every configuration. ` +
+        `Available variables: ${available.join(', ')}`,
+      );
+    }
+  }
+}
+
+function analyzeScatter(samples, xAxis, category, showChart) {
+  validateScatterParameters(samples, xAxis, category);
+
+  const parameterNames = [...new Set(samples.flatMap(
+    ({ params }) => Object.keys(params)))];
+  const aggregated = parameterNames.filter((name) => {
+    if (name === xAxis || name === category) return false;
+    const first = samples[0].params[name];
+    return samples.some(({ params }) => params[name] !== first);
+  });
+  const groups = new Map();
+  for (const sample of samples) {
+    const xValue = sample.params[xAxis];
+    const categoryValue = category === undefined ?
+      undefined : sample.params[category];
+    const key = valueKey([xValue, categoryValue]);
+    let group = groups.get(key);
+    if (group === undefined) {
+      group = {
+        categoryValue,
+        members: [],
+        observations: new Map(),
+        xValue,
+      };
+      groups.set(key, group);
+    }
+    group.members.push(sample);
+    let rates = group.observations.get(sample.observation);
+    if (rates === undefined) {
+      rates = [];
+      group.observations.set(sample.observation, rates);
+    }
+    rates.push(sample.rate);
+  }
+  for (const group of groups.values()) {
+    group.processRates = [...group.observations].map(([observation, rates]) => ({
+      observation,
+      rate: rates.reduce((sum, rate) => sum + rate, 0) / rates.length,
+    }));
+    group.rates = group.processRates.map(({ rate }) => rate);
+  }
+
+  const scale = histogramScale(samples.map(({ rate }) => rate));
+  const compareValues = (a, b) => {
+    if (typeof a === 'number' && typeof b === 'number') return a - b;
+    return String(a).localeCompare(String(b));
+  };
+  const rows = [...groups.values()]
+    .sort((a, b) => compareValues(a.xValue, b.xValue) ||
+                    compareValues(a.categoryValue, b.categoryValue))
+    .map((group) => {
+      const histogram = createRateHistogram(group.rates, scale, 5);
+      const count = group.rates.length;
+      const mean = group.rates.reduce((sum, rate) => sum + rate, 0) / count;
+      const meanInterval = histogram.meanCI();
+      const confidenceInterval = count > 1 ?
+        (meanInterval.upper - meanInterval.lower) / (2 * scale) : NaN;
+      const medianInterval = histogram.percentileCI(50);
+      const median = rawMedian(group.rates);
+      const skewed = count > 1 &&
+        (Math.abs(histogram.skewness) > 1 ||
+         Math.abs(median - mean) > confidenceInterval);
+      return {
+        ...group,
+        confidenceInterval,
+        count,
+        histogram,
+        mean,
+        median,
+        medianLower: medianInterval.lower / scale,
+        medianUpper: medianInterval.upper / scale,
+        skewed,
+      };
+    });
+
+  const legend = assignLabels(rows, 'xValue', 'xLabel');
+  if (category !== undefined) {
+    legend.push(...assignLabels(rows, 'categoryValue', 'categoryLabel'));
+  }
+  const output = [];
+  const contamination = new Map();
+  for (const variable of aggregated) {
+    const share = varianceShare([...groups.values()], variable);
+    contamination.set(variable, share);
+    const percent = share === 1 ?
+      '100' : (share >= 0.995 ? '>99' : (share * 100).toFixed(0));
+    const suffix = Number.isNaN(share) ?
+      '' : ` (explains ${percent}% of within-group variance)`;
+    output.push(`aggregating variable: ${variable}${suffix}`);
+  }
+  const dominant = aggregated.filter(
+    (variable) => contamination.get(variable) > 0.5);
+  if (dominant.length > 0) {
+    output.push('');
+    wrapOutput(
+      output,
+      `${dominant.join(', ')} ${dominant.length === 1 ? 'explains' : 'explain'} ` +
+      'most of the spread within each group. Pin the parameter or use it as ' +
+      '--category; increasing --runs will not remove this source of variance.',
+    );
+  }
+  if (aggregated.length > 0) output.push('');
+  printScatterTable(output, rows, xAxis, category);
+  if (showChart) printScatterChart(output, rows, xAxis, category);
+  printScatterComparisons(output, rows, xAxis, category);
+  if (legend.length > 0) {
+    output.push('', 'Abbreviated values:');
+    for (const { full, label } of legend) {
+      output.push(`  ${label}`, `    = ${full}`);
+    }
+  }
+  const singleSample = rows.filter(({ count }) => count < 2).length;
+  if (singleSample > 0) {
+    output.push('');
+    wrapOutput(
+      output,
+      `Note: ${singleSample} group${singleSample === 1 ? ' has' : 's have'} ` +
+      'only one sample, so no confidence interval could be estimated. Use ' +
+      '--runs 2 or higher.',
+    );
+  }
+  if (rows.some(({ skewed }) => skewed)) {
+    output.push('');
+    wrapOutput(
+      output,
+      '(!) marks groups where the median falls outside the mean confidence ' +
+      'interval or the sample is strongly skewed. The median and its interval ' +
+      'describe the typical run better for those groups.',
+    );
+  }
+  return `${output.join('\n')}\n`;
+}
+
+function rawMedian(rates) {
+  const sorted = [...rates].sort((a, b) => a - b);
+  const middle = Math.floor(sorted.length / 2);
+  return sorted.length % 2 === 0 ?
+    (sorted[middle - 1] + sorted[middle]) / 2 : sorted[middle];
+}
+
+function valueKey(value) {
+  return JSON.stringify(value, (_, item) => {
+    if (typeof item === 'bigint') return { bigint: String(item) };
+    return item;
+  });
+}
+
+function varianceShare(groups, variable) {
+  let between = 0;
+  let total = 0;
+  for (const group of groups) {
+    if (group.members.length < 2) continue;
+    const mean = group.members.reduce(
+      (sum, sample) => sum + sample.rate, 0) / group.members.length;
+    const levels = new Map();
+    for (const sample of group.members) {
+      const key = valueKey(sample.params[variable]);
+      let level = levels.get(key);
+      if (level === undefined) {
+        level = { count: 0, sum: 0 };
+        levels.set(key, level);
+      }
+      level.count++;
+      level.sum += sample.rate;
+    }
+    for (const level of levels.values()) {
+      between += level.count * ((level.sum / level.count) - mean) ** 2;
+    }
+    for (const sample of group.members) total += (sample.rate - mean) ** 2;
+  }
+  return total === 0 ? NaN : Math.min(1, between / total);
+}
+
+function effectSizeLabel(delta) {
+  const absolute = Math.abs(delta);
+  if (absolute < 0.147) return 'negligible';
+  if (absolute < 0.33) return 'small';
+  if (absolute < 0.474) return 'medium';
+  return 'large';
+}
+
+const mannWhitneyFloors = new Map();
+function mannWhitneyFloor(firstCount, secondCount) {
+  const key = `${firstCount},${secondCount}`;
+  let floor = mannWhitneyFloors.get(key);
+  if (floor !== undefined) return floor;
+  const low = createHistogram({ figures: 5 });
+  const high = createHistogram({ figures: 5 });
+  for (let index = 0; index < firstCount; index++) low.record(10000 + index);
+  for (let index = 0; index < secondCount; index++) {
+    high.record(10000 + firstCount + index);
+  }
+  floor = high.mannWhitneyTest(low).pValue;
+  mannWhitneyFloors.set(key, floor);
+  return floor;
+}
+
+function printScatterComparisons(output, rows, xAxis, category) {
+  const usable = rows.filter(({ count }) => count > 1);
+  if (usable.length < 2) return;
+  const series = new Map();
+  for (const row of usable) {
+    const key = valueKey(row.categoryValue);
+    if (!series.has(key)) series.set(key, []);
+    series.get(key).push(row);
+  }
+  const sections = [];
+  let floor = 0;
+  for (const group of series.values()) {
+    if (group.length < 2) continue;
+    const entries = [];
+    for (let index = 1; index < group.length; index++) {
+      const previous = group[index - 1];
+      const current = group[index];
+      // Configurations in one file share a process. Split consecutive groups
+      // across disjoint outer-process sets so the unpaired test does not treat
+      // correlated observations as independent.
+      const parity = index % 2;
+      const previousRates = previous.processRates
+        .filter(({ observation }) => observation % 2 === parity)
+        .map(({ rate }) => rate);
+      const currentRates = current.processRates
+        .filter(({ observation }) => observation % 2 !== parity)
+        .map(({ rate }) => rate);
+      if (previousRates.length === 0 || currentRates.length === 0) continue;
+      const comparisonScale = histogramScale([
+        ...previousRates,
+        ...currentRates,
+      ]);
+      const previousHistogram =
+        createRateHistogram(previousRates, comparisonScale, 5);
+      const currentHistogram =
+        createRateHistogram(currentRates, comparisonScale, 5);
+      const { pValue } = currentHistogram.mannWhitneyTest(previousHistogram);
+      const delta = currentHistogram.cliffsD(previousHistogram);
+      const previousMean = previousRates.reduce(
+        (sum, rate) => sum + rate, 0) / previousRates.length;
+      const currentMean = currentRates.reduce(
+        (sum, rate) => sum + rate, 0) / currentRates.length;
+      const change = ((currentMean - previousMean) / previousMean) * 100;
+      floor = Math.max(
+        floor, mannWhitneyFloor(previousRates.length, currentRates.length));
+      let ratio = '';
+      let exponent = '';
+      if (typeof previous.xValue === 'number' &&
+          typeof current.xValue === 'number' &&
+          previous.xValue > 0 && current.xValue > 0 &&
+          previous.xValue !== current.xValue &&
+          previousMean > 0 && currentMean > 0) {
+        const xRatio = current.xValue / previous.xValue;
+        const value = Math.log(currentMean / previousMean) / Math.log(xRatio);
+        ratio = `${xRatio.toFixed(1)}x`;
+        exponent = `${value >= 0 ? '+' : ''}${value.toFixed(2)}`;
+      }
+      entries.push(
+        `    ${previous.xLabel} -> ${current.xLabel}` +
+        `  ${change >= 0 ? '+' : ''}${change.toFixed(2)}%` +
+        (exponent === '' ? '' : `  ${ratio}  exponent=${exponent}`) +
+        `  p=${pValue < 1e-4 ? pValue.toExponential(1) : pValue.toFixed(4)}` +
+        `  delta=${delta >= 0 ? '+' : ''}${delta.toFixed(3)}` +
+        ` (${effectSizeLabel(delta)})`,
+      );
+    }
+    if (entries.length > 0) {
+      sections.push({
+        entries,
+        heading: category === undefined ?
+          undefined : `${category}=${group[0].categoryLabel}`,
+      });
+    }
+  }
+  if (sections.length === 0) return;
+  output.push('', `Change between consecutive ${xAxis} values ` +
+                  `(Mann-Whitney U on disjoint process sets, Cliff's delta):`);
+  for (const section of sections) {
+    output.push('');
+    if (section.heading !== undefined) output.push(`  ${section.heading}`);
+    output.push(...section.entries);
+  }
+  if (floor >= 0.05) {
+    output.push('');
+    wrapOutput(
+      output,
+      `Warning: at this sample size the smallest p-value this test can ` +
+      `produce is ${floor.toFixed(4)}, so no comparison above can reach ` +
+      'significance. Raise --runs.',
+    );
+  } else if (floor >= 0.005) {
+    output.push('');
+    wrapOutput(
+      output,
+      `Note: at this sample size the smallest p-value this test can produce ` +
+      `is ${floor.toFixed(4)}. Raise --runs to strengthen non-significant ` +
+      'results.',
+    );
+  }
+}
+
+function formatRate(rate) {
+  return rate.toLocaleString('en-US', {
+    maximumFractionDigits: 1,
+    minimumFractionDigits: 1,
+  });
+}
+
+function displayWidth(value) {
+  return [...value].length;
+}
+
+function pad(value, width, right) {
+  const padding = ' '.repeat(Math.max(0, width - displayWidth(value)));
+  return right ? padding + value : value + padding;
+}
+
+function truncateMiddle(value, maximum = 24) {
+  const characters = [...value];
+  if (characters.length <= maximum) return value;
+  const retained = maximum - 3;
+  const head = Math.ceil(retained / 2);
+  const tail = Math.floor(retained / 2);
+  return `${characters.slice(0, head).join('')}...` +
+         characters.slice(-tail).join('');
+}
+
+function assignLabels(rows, valueName, labelName) {
+  const assigned = new Map();
+  const used = new Map();
+  const legend = [];
+  for (const row of rows) {
+    const key = valueKey(row[valueName]);
+    let label = assigned.get(key);
+    if (label === undefined) {
+      const full = typeof row[valueName] === 'string' ?
+        inspect(row[valueName]) : String(row[valueName]);
+      const abbreviated = truncateMiddle(full);
+      const collisions = used.get(abbreviated) ?? 0;
+      used.set(abbreviated, collisions + 1);
+      label = collisions === 0 ?
+        abbreviated : `${abbreviated}~${collisions + 1}`;
+      assigned.set(key, label);
+      if (label !== full) legend.push({ full, label });
+    }
+    row[labelName] = label;
+  }
+  return legend;
+}
+
+function printScatterTable(output, rows, xAxis, category) {
+  const header = [xAxis];
+  if (category !== undefined) header.push(category);
+  header.push(
+    'samples', 'rate', 'confidence.interval', 'median', 'median.interval', '');
+  const body = rows.map((row) => {
+    const values = [row.xLabel];
+    if (category !== undefined) values.push(row.categoryLabel);
+    const medianInterval = row.count > 1 ?
+      `[${(((row.medianLower - row.median) / row.median) * 100).toFixed(2)}%, ` +
+      `+${(((row.medianUpper - row.median) / row.median) * 100).toFixed(2)}%]` :
+      'NA';
+    values.push(
+      String(row.count),
+      formatRate(row.mean),
+      Number.isNaN(row.confidenceInterval) ?
+        'NA' :
+        `${formatRate(row.confidenceInterval)} ` +
+        `(±${((row.confidenceInterval / row.mean) * 100).toFixed(2)}%)`,
+      formatRate(row.median),
+      medianInterval,
+      row.skewed ? '(!)' : '',
+    );
+    return values;
+  });
+  const widths = header.map((value, index) => Math.max(
+    displayWidth(value),
+    ...body.map((values) => displayWidth(values[index])),
+  ));
+  const right = [typeof rows[0].xValue === 'number'];
+  if (category !== undefined) {
+    right.push(typeof rows[0].categoryValue === 'number');
+  }
+  right.push(true, true, true, true, true, false);
+  const format = (values) => values.map(
+    (value, index) => pad(value, widths[index], right[index])).join('  ').trimEnd();
+  output.push(format(header));
+  for (const values of body) output.push(format(values));
+}
+
+function printScatterChart(output, rows, xAxis, category) {
+  if (rows.length === 0) return;
+  const width = 40;
+  let maximum = 0;
+  for (const row of rows) {
+    maximum = Math.max(
+      maximum,
+      row.mean + (Number.isNaN(row.confidenceInterval) ?
+        0 : row.confidenceInterval),
+    );
+  }
+  if (maximum === 0) return;
+  const labels = rows.map((row) => {
+    let label = `${xAxis}=${row.xLabel}`;
+    if (category !== undefined) label += ` ${category}=${row.categoryLabel}`;
+    return truncateMiddle(label, 44);
+  });
+  const labelWidth = Math.max(...labels.map(displayWidth));
+  const rateWidth = Math.max(...rows.map(({ mean }) =>
+    displayWidth(formatRate(mean))));
+  const axis = formatRate(maximum);
+  const indent = ' '.repeat(labelWidth + 2);
+  output.push(
+    '',
+    'Rate in operations/second; longer is faster. │ marks the mean and the',
+    'shaded band (░) is its 95% confidence interval.',
+    '',
+    `${indent}0${' '.repeat(Math.max(1, width - 1 - displayWidth(axis)))}${axis}`,
+    `${indent}+${'-'.repeat(width - 2)}+`,
+  );
+  let previous;
+  for (let index = 0; index < rows.length; index++) {
+    const row = rows[index];
+    if (previous !== undefined && previous !== row.xValue) output.push('');
+    previous = row.xValue;
+    const interval = Number.isNaN(row.confidenceInterval) ?
+      0 : row.confidenceInterval;
+    const end = (row.mean / maximum) * width;
+    const lower = ((row.mean - interval) / maximum) * width;
+    const upper = ((row.mean + interval) / maximum) * width;
+    const meanCell = Math.min(width - 1, Math.floor(end));
+    let bar = '';
+    for (let cell = 0; cell < width; cell++) {
+      const position = cell + 0.5;
+      if (cell === meanCell) bar += '│';
+      else if (position >= lower && position <= upper) bar += '░';
+      else if (position <= end) bar += '█';
+      else bar += ' ';
+    }
+    output.push(
+      `${pad(labels[index], labelWidth, false)}  ${bar}  ` +
+      pad(formatRate(row.mean), rateWidth, true),
+    );
+  }
+}
+
+function wrapOutput(output, text, width = 76) {
+  let line = '';
+  for (const word of text.split(/\s+/)) {
+    if (line === '') line = word;
+    else if (displayWidth(line) + displayWidth(word) + 1 <= width) {
+      line += ` ${word}`;
+    } else {
+      output.push(line);
+      line = word;
+    }
+  }
+  if (line !== '') output.push(line);
+}
+
+module.exports = {
+  analyzeCompare,
+  analyzeScatter,
+  holmAdjust,
+  isRegressionFailure,
+  validateScatterParameters,
+};
diff --git a/benchmark/_node-bench.js b/benchmark/_node-bench.js
new file mode 100644
index 000000000000..ecf383e3bc30
--- /dev/null
+++ b/benchmark/_node-bench.js
@@ -0,0 +1,160 @@
+'use strict';
+
+const { spawn } = require('node:child_process');
+const path = require('node:path');
+const { inspect } = require('node:util');
+
+function parseInteger(value, defaultValue, name, minimum) {
+  if (value === undefined) return defaultValue;
+  if (!/^(?:0|[1-9]\d*)$/.test(value)) {
+    throw new TypeError(`${name} must be an integer`);
+  }
+  const number = Number(value);
+  if (!Number.isSafeInteger(number) || number < minimum) {
+    throw new RangeError(`${name} must be at least ${minimum}`);
+  }
+  return number;
+}
+
+function parseNumber(value, defaultValue, name, minimum) {
+  if (value === undefined) return defaultValue;
+  if (value.trim() === '') throw new TypeError(`${name} must be a number`);
+  const number = Number(value);
+  if (!Number.isFinite(number)) throw new TypeError(`${name} must be a number`);
+  if (number < minimum) {
+    throw new RangeError(`${name} must be at least ${minimum}`);
+  }
+  return number;
+}
+
+function csvEncode(value) {
+  if (typeof value === 'number' || typeof value === 'boolean') {
+    return String(value);
+  }
+  const string = String(value);
+  return `"${string.replace(/"/g, '""')}"`;
+}
+
+function formatConfiguration(params) {
+  return Object.keys(params)
+    .map((key) => `${key}=${inspect(params[key])}`)
+    .join(' ');
+}
+
+function durationToSeconds(duration) {
+  if (!/^\d+$/.test(duration)) {
+    throw new TypeError(`Invalid benchmark duration '${duration}'`);
+  }
+  const padded = duration.padStart(10, '0');
+  return `${padded.slice(0, -9)}.${padded.slice(-9)}`;
+}
+
+function runBenchmark(binary, file, options) {
+  const args = [
+    ...options.nodeArgs,
+    '--no-warnings',
+    '--experimental-bench',
+    '--bench',
+    '--bench-reporter=json',
+    '--bench-samples=1',
+    `--bench-warmup=${options.warmup}`,
+  ];
+  if (options.namePattern !== undefined) {
+    args.push(`--bench-name-pattern=${options.namePattern}`);
+  }
+  args.push('--', path.resolve(file));
+
+  return new Promise((resolve, reject) => {
+    const child = spawn(binary, args, {
+      env: process.env,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (data) => { stdout += data; });
+    child.stderr.on('data', (data) => { stderr += data; });
+    child.once('error', reject);
+    child.once('close', (code, signal) => {
+      let records;
+      try {
+        records = stdout.trim().split('\n')
+          .filter((line) => line.length > 0)
+          .map((line) => JSON.parse(line));
+      } catch (error) {
+        reject(new Error(
+          `Could not parse benchmark output from '${binary}': ${error.message}`,
+          { cause: error },
+        ));
+        return;
+      }
+
+      const summary = records.findLast(
+        ({ type }) => type === 'bench:summary')?.data;
+      if (code !== 0 || signal !== null || summary?.success !== true) {
+        const diagnostics = records
+          .filter(({ type }) => type === 'bench:diagnostic')
+          .map(({ data }) => data.message)
+          .join('\n');
+        const status = signal === null ? `exit code ${code}` : `signal ${signal}`;
+        const details = stderr || diagnostics;
+        reject(new Error(
+          `Benchmark '${file}' failed with ${status}` +
+          (details ? `:\n${details}` : ''),
+        ));
+        return;
+      }
+
+      const samples = [];
+      for (const record of records) {
+        if (record.type !== 'bench:complete' ||
+            record.data.skip !== undefined) {
+          continue;
+        }
+        if (record.data.error !== undefined) {
+          reject(new Error(
+            `Benchmark '${record.data.name}' failed: ` +
+            record.data.error.message,
+          ));
+          return;
+        }
+        if (record.data.samples.length !== 1) {
+          reject(new Error(
+            `Benchmark '${record.data.name}' did not produce exactly one sample`,
+          ));
+          return;
+        }
+        const sample = record.data.samples[0];
+        if (!Number.isFinite(sample.rate)) {
+          reject(new Error(
+            `Benchmark '${record.data.name}' produced a non-finite rate`,
+          ));
+          return;
+        }
+        samples.push({
+          configuration: formatConfiguration(record.data.params),
+          duration: durationToSeconds(sample.duration_ns),
+          identity: record.data.benchId,
+          logicalIdentity: JSON.stringify([
+            record.data.file,
+            record.data.parentId,
+            record.data.name,
+          ]),
+          name: record.data.name,
+          params: record.data.params,
+          rate: sample.rate,
+        });
+      }
+      resolve(samples);
+    });
+  });
+}
+
+module.exports = {
+  csvEncode,
+  parseInteger,
+  parseNumber,
+  runBenchmark,
+};
diff --git a/benchmark/buffers/_buffer-compare-offset.node-bench.js b/benchmark/buffers/_buffer-compare-offset.node-bench.js
new file mode 100644
index 000000000000..b16c3a3da7db
--- /dev/null
+++ b/benchmark/buffers/_buffer-compare-offset.node-bench.js
@@ -0,0 +1,37 @@
+'use strict';
+
+const { bench } = require('node:bench');
+const path = require('node:path');
+
+const methods = ['offset', 'slice'];
+const sizes = [16, 512, 4096, 16386];
+const n = 1e6;
+const name = path.join('buffers', 'buffer-compare-offset.js');
+
+function compareUsingSlice(b0, b1, len, iterations) {
+  for (let i = 0; i < iterations; i++)
+    Buffer.compare(b0.slice(1, len), b1.slice(1, len));
+}
+
+function compareUsingOffset(b0, b1, len, iterations) {
+  for (let i = 0; i < iterations; i++)
+    b0.compare(b1, 1, len, 1, len);
+}
+
+for (const method of methods) {
+  for (const size of sizes) {
+    const compare = method === 'slice' ?
+      compareUsingSlice : compareUsingOffset;
+
+    bench(name, {
+      params: { method, n, size },
+    }, (b) => {
+      b.start();
+      compare(Buffer.alloc(size, 'a'),
+              Buffer.alloc(size, 'b'),
+              size >> 1,
+              n);
+      b.end(n);
+    });
+  }
+}
diff --git a/benchmark/compare-node-bench.js b/benchmark/compare-node-bench.js
new file mode 100644
index 000000000000..295f15f0fdc1
--- /dev/null
+++ b/benchmark/compare-node-bench.js
@@ -0,0 +1,118 @@
+'use strict';
+
+const path = require('node:path');
+const CLI = require('./_cli.js');
+const { analyzeCompare } = require('./_node-bench-analysis.js');
+const {
+  csvEncode,
+  parseInteger,
+  parseNumber,
+  runBenchmark,
+} = require('./_node-bench.js');
+
+const cli = new CLI(`usage: ./node compare-node-bench.js [options] [--] <file> ...
+  Run explicit node:bench files repeatedly with two Node.js binaries. Each
+  observation runs in a fresh process. Output is compatible with compare.R,
+  or --analyze can summarize it directly.
+
+  --new          binary     new Node.js binary (required)
+  --old          binary     old Node.js binary (required)
+  --runs         30         observations per binary
+  --warmup       0          warmup samples before each observation
+  --name-pattern pattern    only run matching benchmarks
+  --node-arg     argument   pass an argument to both binaries (repeatable)
+  --analyze                 analyze with Welch's t-test instead of writing CSV
+  --scale        1000       rate multiplier used for histogram precision
+  --max-regression N        fail if a family-wise significant regression's
+                            95% confidence interval is entirely beyond N%
+                            (implies --analyze)
+`, { arrayArgs: ['node-arg'], boolArgs: ['analyze'] });
+
+if (!cli.optional.new || !cli.optional.old || cli.items.length === 0) {
+  cli.abort(cli.usage);
+}
+
+async function main() {
+  const runs = parseInteger(cli.optional.runs, 30, '--runs', 1);
+  const warmup = parseInteger(cli.optional.warmup, 0, '--warmup', 0);
+  const scale = parseInteger(cli.optional.scale, 1000, '--scale', 1);
+  const hasMaxRegression = cli.optional['max-regression'] !== undefined;
+  const maxRegression = parseNumber(
+    cli.optional['max-regression'], 0, '--max-regression', 0);
+  const analyze = !!cli.optional.analyze || hasMaxRegression;
+  const options = {
+    namePattern: cli.optional['name-pattern'],
+    nodeArgs: cli.optional['node-arg'],
+    warmup,
+  };
+  const binaries = [
+    { label: 'old', path: cli.optional.old },
+    { label: 'new', path: cli.optional.new },
+  ];
+  const rows = [];
+  const counts = new Map();
+  const csvGroups = new Map();
+
+  for (const file of cli.items) {
+    const resolved = path.resolve(file);
+    for (let run = 0; run < runs; run++) {
+      const order = run % 2 === 0 ? binaries : [binaries[1], binaries[0]];
+      for (const binary of order) {
+        const samples = await runBenchmark(binary.path, resolved, options);
+        for (const sample of samples) {
+          const identity = JSON.stringify([resolved, sample.identity]);
+          const csvGroup = JSON.stringify([
+            sample.name,
+            sample.configuration,
+          ]);
+          const groupedIdentity = csvGroups.get(csvGroup);
+          if (groupedIdentity !== undefined && groupedIdentity !== identity) {
+            throw new Error(
+              `Distinct benchmarks would share the CSV group '${sample.name} ` +
+              `${sample.configuration}'`,
+            );
+          }
+          csvGroups.set(csvGroup, identity);
+          let count = counts.get(identity);
+          if (count === undefined) {
+            count = { name: sample.name, new: 0, old: 0 };
+            counts.set(identity, count);
+          }
+          count[binary.label]++;
+          rows.push({ binary: binary.label, ...sample });
+        }
+      }
+    }
+  }
+
+  if (rows.length === 0) {
+    throw new Error('No benchmark samples were produced');
+  }
+  for (const count of counts.values()) {
+    if (count.old !== runs || count.new !== runs) {
+      throw new Error(
+        `Benchmark '${count.name}' was not reported by both binaries in every run`,
+      );
+    }
+  }
+
+  if (analyze) {
+    const result = analyzeCompare(
+      rows, scale, hasMaxRegression ? maxRegression : undefined);
+    process.stdout.write(result.output);
+    if (result.failed) process.exitCode = 1;
+    return;
+  }
+
+  const output = ['"binary","filename","configuration","rate","time"'];
+  for (const row of rows) {
+    output.push(`${csvEncode(row.binary)},${csvEncode(row.name)},` +
+                `${csvEncode(row.configuration)},${row.rate},${row.duration}`);
+  }
+  process.stdout.write(`${output.join('\n')}\n`);
+}
+
+main().catch((error) => {
+  console.error(error.stack);
+  process.exitCode = 1;
+});
diff --git a/benchmark/compare.js b/benchmark/compare.js
index 6aaaee7a9190..77874e8af6c1 100644
--- a/benchmark/compare.js
+++ b/benchmark/compare.js
@@ -159,6 +159,27 @@ if (showProgress) {
   });
 })(kStartOfQueue);
 
+// Holm-Bonferroni step-down adjustment. Controls the probability of *any*
+// false positive across the whole comparison set, which is what a pass/fail
+// gate needs: an uncorrected suite of 169 comparisons at 5% has a 99.98%
+// chance of flagging something that is not there. Uniformly more powerful
+// than plain Bonferroni, and makes no assumption about independence.
+function holmAdjust(pValues) {
+  const order = pValues
+    .map((p, i) => ({ p, i }))
+    .sort((a, b) => a.p - b.p);
+  const m = order.length;
+  const adjusted = new Array(m);
+  let running = 0;
+  for (let k = 0; k < m; k++) {
+    // Step down, enforcing monotonicity so an adjusted value can never be
+    // smaller than one belonging to a more significant raw p-value.
+    running = Math.max(running, Math.min(1, (m - k) * order[k].p));
+    adjusted[order[k].i] = running;
+  }
+  return adjusted;
+}
+
 function printAnalysis(results, scale, maxRegression) {
   const { createHistogram } = require('node:perf_hooks');
 
@@ -217,6 +238,25 @@ function printAnalysis(results, scale, maxRegression) {
     if (name.length > maxNameLen) maxNameLen = name.length;
   }
 
+  // Adjust for the size of the comparison set. The raw p-value answers "is
+  // this one benchmark different", but a suite is read as a whole, so the
+  // relevant question is "is anything here different".
+  const adjusted = holmAdjust(rows.map((r) => r.pValue));
+  for (let i = 0; i < rows.length; i++) rows[i].pAdjusted = adjusted[i];
+
+  // A comparison can only rule out an effect it was able to resolve. Where no
+  // threshold has been given there is no definition of "worth detecting", so
+  // nothing is claimed. `maxRegression` is exactly such a declaration, so it
+  // is reused rather than inventing a second constant.
+  const resolution = maxRegression > 0 ? maxRegression : null;
+  let underpowered = 0;
+  for (const row of rows) {
+    row.inconclusive = resolution !== null &&
+                       row.stars.trim() === '' &&
+                       row.ci95 > resolution;
+    if (row.inconclusive) underpowered++;
+  }
+
   // Print header.
   const pad = (s, n) => s + ' '.repeat(Math.max(0, n - s.length));
   const rpad = (s, n) => ' '.repeat(Math.max(0, n - s.length)) + s;
@@ -231,7 +271,8 @@ function printAnalysis(results, scale, maxRegression) {
       `  ${rpad(imp, 11)}` +
       `   ±${row.ci95.toFixed(2)}%` +
       `  ±${row.ci99.toFixed(2)}%` +
-      `  ±${row.ci999.toFixed(2)}%`,
+      `  ±${row.ci999.toFixed(2)}%` +
+      `${row.inconclusive ? '  (inconclusive)' : ''}`,
     );
   }
 
@@ -252,6 +293,7 @@ function printAnalysis(results, scale, maxRegression) {
     `Rates were scaled by ${scale}x into HdrHistogram (3 significant figures).\n` +
     `Use --scale to adjust precision if needed.\n`,
   );
+  const anyFamilyWise = rows.filter((r) => r.pAdjusted < 0.05).length;
   console.log(
     `Be aware that when doing many comparisons the risk of a false-positive\n` +
     `result increases. In this case, there are ${rows.length} comparisons, ` +
@@ -261,23 +303,56 @@ function printAnalysis(results, scale, maxRegression) {
     `  ${(rows.length * 0.01).toFixed(2)} false positives, when considering ` +
     `a   1% risk acceptance (**, ***),\n` +
     `  ${(rows.length * 0.001).toFixed(2)} false positives, when considering ` +
-    `a 0.1% risk acceptance (***)`,
+    `a 0.1% risk acceptance (***)\n` +
+    `\nThe stars above are per-benchmark and uncorrected. Adjusting for the ` +
+    `size of\nthis comparison set (Holm-Bonferroni), ${anyFamilyWise} ` +
+    `comparison${anyFamilyWise === 1 ? '' : 's'} remain${anyFamilyWise === 1 ? 's' : ''} ` +
+    `significant at 5%.\n--max-regression uses the corrected values.`,
   );
 
-  // Gate: exit with error if any significant regression exceeds the limit.
+  // Gate: exit with error if any regression is shown to exceed the limit.
   if (maxRegression > 0) {
+    if (underpowered > 0) {
+      console.log('');
+      console.log(
+        `Note: ${underpowered} of ${rows.length} comparison` +
+        `${rows.length === 1 ? '' : 's'} could not resolve an effect as ` +
+        `small as ${maxRegression}%, and are marked (inconclusive). They are ` +
+        `not\nevidence of no regression -- the samples are too noisy to tell. ` +
+        `Raise --runs,\nor pin cores with --set CPUSET, to narrow them.`,
+      );
+    }
+
+    // Two conditions, both required.
+    //
+    // The confidence interval must lie entirely beyond the threshold. A small
+    // p-value only says the effect is not exactly zero; claiming it exceeds
+    // `maxRegression` is a statement about magnitude, so the interval has to
+    // exclude that magnitude. Testing the point estimate instead systematically
+    // fires on the noisiest benchmarks, because a large point estimate is
+    // easiest to obtain when the interval is wide.
+    //
+    // The p-value must also survive adjustment for the size of the comparison
+    // set, so that a suite of hundreds of benchmarks does not fail purely
+    // because one of them drifted.
     const failures = rows.filter(
-      (r) => r.stars.trim() !== '' && r.improvement < -maxRegression,
+      (r) => r.pAdjusted < 0.05 && r.improvement + r.ci95 < -maxRegression,
     );
+
     if (failures.length > 0) {
       console.log('');
       console.log(
         `FAIL: ${failures.length} benchmark${failures.length === 1 ? '' : 's'}` +
-        ` showed a statistically significant regression exceeding` +
-        ` ${maxRegression}%:`,
+        ` regressed by more than ${maxRegression}%` +
+        ` (interval excludes the threshold,\n` +
+        `family-wise corrected across ${rows.length} comparisons):`,
       );
       for (const f of failures) {
-        console.log(`  ${f.name}  ${f.improvement.toFixed(2)}%`);
+        console.log(
+          `  ${f.name}  ${f.improvement.toFixed(2)}% ` +
+          `(95% CI up to ${(f.improvement + f.ci95).toFixed(2)}%, ` +
+          `adjusted p=${f.pAdjusted.toExponential(2)})`,
+        );
       }
       process.exitCode = 1;
     }
diff --git a/benchmark/crypto/_create-hash.node-bench.js b/benchmark/crypto/_create-hash.node-bench.js
new file mode 100644
index 000000000000..4481bc6c6527
--- /dev/null
+++ b/benchmark/crypto/_create-hash.node-bench.js
@@ -0,0 +1,19 @@
+'use strict';
+
+const assert = require('node:assert');
+const { bench } = require('node:bench');
+const { createHash } = require('node:crypto');
+const path = require('node:path');
+
+const n = 1e5;
+const name = path.join('crypto', 'create-hash.js');
+
+bench(name, { params: { n } }, (b) => {
+  const array = [];
+  for (let i = 0; i < n; ++i) array.push(null);
+  b.start();
+  for (let i = 0; i < n; ++i)
+    array[i] = createHash('sha1');
+  b.end(n);
+  assert.strictEqual(typeof array[n - 1], 'object');
+});
diff --git a/benchmark/crypto/class-construction.js b/benchmark/crypto/class-construction.js
new file mode 100644
index 000000000000..fe03b1a43cd2
--- /dev/null
+++ b/benchmark/crypto/class-construction.js
@@ -0,0 +1,86 @@
+'use strict';
+
+const common = require('../common.js');
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const fixtureDir = path.resolve(__dirname, '../../test/fixtures/keys');
+const certificate = fs.readFileSync(path.join(fixtureDir, 'agent1-cert.pem'));
+const dhPrime = crypto.getDiffieHellman('modp14').getPrime();
+const key = Buffer.alloc(32, 0x01);
+const keyObject = crypto.createSecretKey(key);
+const hmacAlgorithm = { name: 'HMAC', hash: 'SHA-256' };
+const keyUsages = ['sign'];
+const iv = Buffer.alloc(16, 0x02);
+
+const iterations = {
+  Certificate: 1e7,
+  Cipheriv: 1e5,
+  Decipheriv: 1e5,
+  DiffieHellman: 10,
+  DiffieHellmanGroup: 2e5,
+  ECDH: 2e5,
+  Hash: 1e5,
+  Hmac: 5e4,
+  KeyObject: 1e5,
+  Sign: 1e5,
+  Verify: 1e5,
+  CryptoKey: 5e4,
+  X509Certificate: 5e3,
+};
+
+const bench = common.createBenchmark(main, {
+  type: Object.keys(iterations),
+  n: [...new Set(Object.values(iterations))],
+}, {
+  combinationFilter({ type, n }) {
+    // Benchmark test mode reduces numeric options to 1.
+    return n === 1 || iterations[type] === n;
+  },
+});
+
+function construct(type) {
+  switch (type) {
+    case 'Certificate':
+      return new crypto.Certificate();
+    case 'Cipheriv':
+      return crypto.createCipheriv('aes-256-ctr', key, iv);
+    case 'Decipheriv':
+      return crypto.createDecipheriv('aes-256-ctr', key, iv);
+    case 'DiffieHellman':
+      return crypto.createDiffieHellman(dhPrime);
+    case 'DiffieHellmanGroup':
+      return crypto.getDiffieHellman('modp14');
+    case 'ECDH':
+      return crypto.createECDH('prime256v1');
+    case 'Hash':
+      return crypto.createHash('sha256');
+    case 'Hmac':
+      return crypto.createHmac('sha256', key);
+    case 'KeyObject':
+      return crypto.createSecretKey(key);
+    case 'Sign':
+      return crypto.createSign('sha256');
+    case 'Verify':
+      return crypto.createVerify('sha256');
+    case 'CryptoKey':
+      return keyObject.toCryptoKey(hmacAlgorithm, true, keyUsages);
+    case 'X509Certificate':
+      return new crypto.X509Certificate(certificate);
+    default:
+      throw new Error(`Unsupported class: ${type}`);
+  }
+}
+
+function main({ type, n }) {
+  const instances = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    instances[i] = construct(type);
+  bench.end(n);
+
+  assert.strictEqual(typeof instances[n - 1], 'object');
+}
diff --git a/benchmark/crypto/class-methods.js b/benchmark/crypto/class-methods.js
new file mode 100644
index 000000000000..9db499b7d1a9
--- /dev/null
+++ b/benchmark/crypto/class-methods.js
@@ -0,0 +1,206 @@
+'use strict';
+
+const common = require('../common.js');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const fixtureDir = path.resolve(__dirname, '../../test/fixtures/keys');
+const certificate = fs.readFileSync(path.join(fixtureDir, 'agent1-cert.pem'));
+const key = Buffer.alloc(32, 0x01);
+const hmacAlgorithm = { name: 'HMAC', hash: 'SHA-256' };
+const keyUsages = ['sign'];
+const iv = Buffer.alloc(16, 0x02);
+const input = Buffer.alloc(16, 0x03);
+
+const iterations = {
+  'Cipheriv-update': 1e6,
+  'Decipheriv-update': 1e6,
+  'DiffieHellman-getGenerator': 2e5,
+  'DiffieHellmanGroup-getGenerator': 2e6,
+  'ECDH-getPrivateKey': 2e6,
+  'Hash-update': 5e6,
+  'Hmac-update': 5e6,
+  'KeyObject-equals': 2e6,
+  'KeyObject-symmetricKeySize-first': 1e5,
+  'KeyObject-type-first': 1e5,
+  'KeyObject-type': 1e8,
+  'Sign-update': 5e6,
+  'Verify-update': 5e6,
+  'CryptoKey-toKeyObject': 2e5,
+  'CryptoKey-algorithm-first': 1e5,
+  'CryptoKey-extractable-first': 1e5,
+  'CryptoKey-type-first': 1e5,
+  'CryptoKey-usages-first': 1e5,
+  'CryptoKey-type': 1e8,
+  'X509Certificate-checkHost': 1e6,
+  'X509Certificate-publicKey-first': 5e3,
+  'X509Certificate-publicKey': 1e8,
+  'X509Certificate-subject-first': 5e3,
+  'X509Certificate-subject': 1e8,
+};
+
+const bench = common.createBenchmark(main, {
+  operation: Object.keys(iterations),
+  n: [...new Set(Object.values(iterations))],
+}, {
+  combinationFilter({ operation, n }) {
+    // Benchmark test mode reduces numeric options to 1.
+    return n === 1 || iterations[operation] === n;
+  },
+});
+
+function setup(operation) {
+  switch (operation) {
+    case 'Cipheriv-update': {
+      const cipher = crypto.createCipheriv('aes-256-ctr', key, iv);
+      return {
+        run: () => cipher.update(input),
+        finish: () => cipher.final(),
+      };
+    }
+    case 'Decipheriv-update': {
+      const decipher = crypto.createDecipheriv('aes-256-ctr', key, iv);
+      return {
+        run: () => decipher.update(input),
+        finish: () => decipher.final(),
+      };
+    }
+    case 'DiffieHellman-getGenerator': {
+      const dh = crypto.createDiffieHellman(
+        crypto.getDiffieHellman('modp14').getPrime());
+      return { run: () => dh.getGenerator() };
+    }
+    case 'DiffieHellmanGroup-getGenerator': {
+      const dh = crypto.getDiffieHellman('modp14');
+      return { run: () => dh.getGenerator() };
+    }
+    case 'ECDH-getPrivateKey': {
+      const ecdh = crypto.createECDH('prime256v1');
+      ecdh.generateKeys();
+      return { run: () => ecdh.getPrivateKey() };
+    }
+    case 'Hash-update': {
+      const hash = crypto.createHash('sha256');
+      return {
+        run: () => hash.update(input),
+        finish: () => hash.digest(),
+      };
+    }
+    case 'Hmac-update': {
+      const hmac = crypto.createHmac('sha256', key);
+      return {
+        run: () => hmac.update(input),
+        finish: () => hmac.digest(),
+      };
+    }
+    case 'KeyObject-equals': {
+      const keyObject = crypto.createSecretKey(key);
+      return { run: () => keyObject.equals(keyObject) };
+    }
+    case 'KeyObject-symmetricKeySize-first': {
+      return { run: () => crypto.createSecretKey(key).symmetricKeySize };
+    }
+    case 'KeyObject-type-first': {
+      return { run: () => crypto.createSecretKey(key).type };
+    }
+    case 'KeyObject-type': {
+      const keyObjects = Array.from(
+        { length: 64 }, () => crypto.createSecretKey(key));
+      for (const keyObject of keyObjects) {
+        if (keyObject.type !== 'secret')
+          throw new Error('Unexpected KeyObject type');
+      }
+      let index = 0;
+      return { run: () => keyObjects[index++ & 63].type };
+    }
+    case 'Sign-update': {
+      const sign = crypto.createSign('sha256');
+      return { run: () => sign.update(input) };
+    }
+    case 'Verify-update': {
+      const verify = crypto.createVerify('sha256');
+      return { run: () => verify.update(input) };
+    }
+    case 'CryptoKey-toKeyObject': {
+      const keyObject = crypto.createSecretKey(key);
+      const cryptoKey = keyObject.toCryptoKey(
+        hmacAlgorithm, true, keyUsages);
+      return { run: () => crypto.KeyObject.from(cryptoKey) };
+    }
+    case 'CryptoKey-algorithm-first':
+    case 'CryptoKey-extractable-first':
+    case 'CryptoKey-type-first':
+    case 'CryptoKey-usages-first': {
+      const keyObject = crypto.createSecretKey(key);
+      const property = operation.slice('CryptoKey-'.length, -'-first'.length);
+      return {
+        run: () => keyObject.toCryptoKey(
+          hmacAlgorithm, true, keyUsages)[property],
+      };
+    }
+    case 'CryptoKey-type': {
+      const keyObject = crypto.createSecretKey(key);
+      const cryptoKeys = Array.from(
+        { length: 64 },
+        () => keyObject.toCryptoKey(hmacAlgorithm, true, keyUsages));
+      for (const cryptoKey of cryptoKeys) {
+        if (cryptoKey.type !== 'secret')
+          throw new Error('Unexpected CryptoKey type');
+      }
+      let index = 0;
+      return { run: () => cryptoKeys[index++ & 63].type };
+    }
+    case 'X509Certificate-checkHost': {
+      const x509 = new crypto.X509Certificate(certificate);
+      return { run: () => x509.checkHost('agent1') };
+    }
+    case 'X509Certificate-publicKey-first': {
+      return {
+        run: () => new crypto.X509Certificate(certificate).publicKey,
+      };
+    }
+    case 'X509Certificate-publicKey': {
+      const certificates = Array.from(
+        { length: 64 }, () => new crypto.X509Certificate(certificate));
+      for (const x509 of certificates) {
+        if (x509.publicKey === undefined)
+          throw new Error('Missing certificate public key');
+      }
+      let index = 0;
+      return { run: () => certificates[index++ & 63].publicKey };
+    }
+    case 'X509Certificate-subject-first': {
+      return {
+        run: () => new crypto.X509Certificate(certificate).subject,
+      };
+    }
+    case 'X509Certificate-subject': {
+      const certificates = Array.from(
+        { length: 64 }, () => new crypto.X509Certificate(certificate));
+      for (const x509 of certificates) {
+        if (x509.subject === undefined)
+          throw new Error('Missing certificate subject');
+      }
+      let index = 0;
+      return { run: () => certificates[index++ & 63].subject };
+    }
+    default:
+      throw new Error(`Unsupported operation: ${operation}`);
+  }
+}
+
+function main({ operation, n }) {
+  const state = setup(operation);
+  let result;
+
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    result = state.run();
+  bench.end(n);
+
+  if (state.finish)
+    state.finish();
+  if (result === state)
+    throw new Error('Unexpected benchmark result');
+}
diff --git a/benchmark/crypto/create-cipheriv.js b/benchmark/crypto/create-cipheriv.js
new file mode 100644
index 000000000000..7774e393b403
--- /dev/null
+++ b/benchmark/crypto/create-cipheriv.js
@@ -0,0 +1,62 @@
+'use strict';
+
+const common = require('../common.js');
+const assert = require('node:assert');
+const {
+  createCipheriv,
+  createDecipheriv,
+  getCiphers,
+} = require('node:crypto');
+
+const configurations = {
+  'aes-128-cbc': { keyLength: 16, ivLength: 16 },
+  'aes-128-gcm': { keyLength: 16, ivLength: 12 },
+  'aes-128-cbc-cts': { keyLength: 16, ivLength: 16 },
+  'aes-128-wrap-inv': { keyLength: 16, ivLength: 8 },
+  'aes128-wrap-inv': {
+    keyLength: 16,
+    ivLength: 8,
+    warmupCipher: 'aes-128-wrap-inv',
+  },
+};
+
+const ciphers = ['aes-128-cbc', 'aes-128-gcm'];
+const availableCiphers = new Set(getCiphers());
+for (const cipher of [
+  'aes-128-cbc-cts',
+  'aes-128-wrap-inv',
+  'aes128-wrap-inv',
+]) {
+  if (availableCiphers.has(cipher)) {
+    ciphers.push(cipher);
+  }
+}
+
+const bench = common.createBenchmark(main, {
+  n: [1e5],
+  cipher: ciphers,
+  operation: ['encrypt', 'decrypt'],
+});
+
+function main({ n, cipher, operation }) {
+  const {
+    keyLength,
+    ivLength,
+    warmupCipher = cipher,
+  } = configurations[cipher];
+  const key = Buffer.alloc(keyLength);
+  const iv = Buffer.alloc(ivLength);
+  const results = new Array(n);
+  const method = operation === 'encrypt' ? createCipheriv : createDecipheriv;
+
+  const warmup = method(warmupCipher, key, iv);
+  assert.strictEqual(typeof warmup, 'object');
+
+  bench.start();
+  for (let i = 0; i < n; ++i) {
+    results[i] = method(cipher, key, iv);
+  }
+  bench.end(n);
+
+  assert.strictEqual(typeof results[n - 1], 'object');
+}
diff --git a/benchmark/crypto/ecdh-compute-secret.js b/benchmark/crypto/ecdh-compute-secret.js
new file mode 100644
index 000000000000..3061c5b2cc36
--- /dev/null
+++ b/benchmark/crypto/ecdh-compute-secret.js
@@ -0,0 +1,117 @@
+'use strict';
+
+const common = require('../common.js');
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+
+const kCurve = 'prime256v1';
+const kPeerPoolSize = 32;
+const scenarios = [
+  'first-after-generate',
+  'full-lifecycle',
+  'reused-local-same-peer',
+  'reused-local-peer-pool',
+];
+
+const bench = common.createBenchmark(main, {
+  scenario: scenarios,
+  n: [5_000],
+}, {
+  test: { scenario: 'first-after-generate', n: 1 },
+});
+
+function generateContext() {
+  const context = crypto.createECDH(kCurve);
+  context.generateKeys();
+  return context;
+}
+
+function verifySecret(secret, local, peer) {
+  assert.deepStrictEqual(secret, peer.computeSecret(local.getPublicKey()));
+}
+
+function firstAfterGenerate(n) {
+  const peer = generateContext();
+  const peerPublicKey = peer.getPublicKey();
+  const warmup = generateContext();
+  warmup.computeSecret(peerPublicKey);
+
+  const locals = Array.from({ length: n }, generateContext);
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++)
+    secrets[i] = locals[i].computeSecret(peerPublicKey);
+  bench.end(n);
+
+  verifySecret(secrets[n - 1], locals[n - 1], peer);
+}
+
+function fullLifecycle(n) {
+  const peer = generateContext();
+  const peerPublicKey = peer.getPublicKey();
+  const warmup = generateContext();
+  warmup.computeSecret(peerPublicKey);
+
+  const locals = new Array(n);
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    const local = locals[i] = generateContext();
+    secrets[i] = local.computeSecret(peerPublicKey);
+  }
+  bench.end(n);
+
+  verifySecret(secrets[n - 1], locals[n - 1], peer);
+}
+
+function reusedLocalSamePeer(n) {
+  const local = generateContext();
+  const peer = generateContext();
+  const peerPublicKey = peer.getPublicKey();
+  local.computeSecret(peerPublicKey);
+
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++)
+    secrets[i] = local.computeSecret(peerPublicKey);
+  bench.end(n);
+
+  verifySecret(secrets[n - 1], local, peer);
+}
+
+function reusedLocalPeerPool(n) {
+  const local = generateContext();
+  const peers = Array.from(
+    { length: Math.min(n, kPeerPoolSize) },
+    generateContext);
+  const peerPublicKeys = peers.map((peer) => peer.getPublicKey());
+  local.computeSecret(peerPublicKeys[0]);
+
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++)
+    secrets[i] = local.computeSecret(peerPublicKeys[i % peers.length]);
+  bench.end(n);
+
+  const lastPeer = peers[(n - 1) % peers.length];
+  verifySecret(secrets[n - 1], local, lastPeer);
+}
+
+function main({ scenario, n }) {
+  switch (scenario) {
+    case 'first-after-generate':
+      return firstAfterGenerate(n);
+    case 'full-lifecycle':
+      return fullLifecycle(n);
+    case 'reused-local-same-peer':
+      return reusedLocalSamePeer(n);
+    case 'reused-local-peer-pool':
+      return reusedLocalPeerPool(n);
+    default:
+      throw new Error(`Unsupported scenario: ${scenario}`);
+  }
+}
diff --git a/benchmark/crypto/mac.js b/benchmark/crypto/mac.js
new file mode 100644
index 000000000000..d1028fa414e6
--- /dev/null
+++ b/benchmark/crypto/mac.js
@@ -0,0 +1,254 @@
+'use strict';
+
+const common = require('../common.js');
+const { hasOpenSSL } = require('../../test/common/crypto.js');
+const assert = require('node:assert');
+const {
+  createHmac,
+  createMac,
+  getMacs,
+} = require('node:crypto');
+
+if (!hasOpenSSL(3) ||
+    process.features.openssl_is_boringssl ||
+    typeof createMac !== 'function' ||
+    typeof getMacs !== 'function') {
+  console.log('Skipping: generic MAC API requires OpenSSL >= 3');
+  process.exit(0);
+}
+
+const operations = [
+  'get-macs-cold',
+  'get-macs-warm',
+  'create-cold',
+  'create-warm',
+  'hmac-lifecycle',
+  'mac-lifecycle',
+  'mac-stream-lifecycle',
+  'update',
+  'stream',
+  'final-buffer',
+  'final-hex',
+];
+const configurations = {
+  'hmac-sha256': {
+    algorithm: 'HMAC',
+    key: Buffer.alloc(32, 0x42),
+    options: { digest: 'SHA256' },
+  },
+  'kmac-128': {
+    algorithm: 'KMAC-128',
+    key: Buffer.alloc(32, 0x42),
+    options: { outputLength: 32 },
+  },
+};
+
+const bench = common.createBenchmark(main, {
+  operation: operations,
+  algorithm: Object.keys(configurations),
+  length: [0, 64, 4096],
+  n: [1, 10_000, 20_000, 500_000],
+}, {
+  combinationFilter({ operation, algorithm, length, n }) {
+    if (operation === 'get-macs-cold') {
+      return algorithm === 'hmac-sha256' && length === 0 && n === 1;
+    }
+    if (operation === 'get-macs-warm') {
+      return algorithm === 'hmac-sha256' && length === 0 && n === 500_000;
+    }
+    if (operation === 'create-cold')
+      return length === 0 && n === 1;
+    if (operation === 'create-warm')
+      return length === 0 && n === 20_000;
+    if (operation === 'hmac-lifecycle') {
+      return algorithm === 'hmac-sha256' && n === 10_000;
+    }
+    if (operation === 'mac-lifecycle' ||
+        operation === 'mac-stream-lifecycle') {
+      return n === 10_000;
+    }
+    if (operation === 'update' || operation === 'stream') {
+      return length === 64 && n === 500_000;
+    }
+    if (operation === 'final-buffer' || operation === 'final-hex') {
+      return algorithm === 'hmac-sha256' &&
+             length === 64 &&
+             n === 20_000;
+    }
+    return false;
+  },
+  test: {
+    operation: ['create-cold'],
+    algorithm: ['hmac-sha256'],
+    length: [0],
+    n: [1],
+  },
+});
+
+function main({ operation, algorithm, length, n }) {
+  const configuration = configurations[algorithm];
+  const data = Buffer.alloc(length, 0x61);
+
+  switch (operation) {
+    case 'get-macs-cold':
+      measureGetMacs(n, false);
+      break;
+    case 'get-macs-warm':
+      measureGetMacs(n, true);
+      break;
+    case 'create-cold':
+      measureCreate(configuration, n, false);
+      break;
+    case 'create-warm':
+      measureCreate(configuration, n, true);
+      break;
+    case 'hmac-lifecycle':
+      measureHmacLifecycle(configuration, data, n);
+      break;
+    case 'mac-lifecycle':
+      measureMacLifecycle(configuration, data, n);
+      break;
+    case 'mac-stream-lifecycle':
+      measureMacStreamLifecycle(configuration, data, n);
+      break;
+    case 'update':
+      measureUpdate(configuration, data, n);
+      break;
+    case 'stream':
+      measureStream(configuration, data, n);
+      break;
+    case 'final-buffer':
+      measureFinal(configuration, data, n);
+      break;
+    case 'final-hex':
+      measureFinal(configuration, data, n, 'hex');
+      break;
+    default:
+      throw new Error(`unknown operation: ${operation}`);
+  }
+}
+
+function measureGetMacs(n, warm) {
+  if (warm)
+    getMacs();
+
+  let result;
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    result = getMacs();
+  bench.end(n);
+
+  assert(Array.isArray(result));
+}
+
+function measureCreate({ algorithm, key, options }, n, warm) {
+  if (warm)
+    createMac(algorithm, key, options).final();
+
+  const contexts = new Array(n);
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    contexts[i] = createMac(algorithm, key, options);
+  bench.end(n);
+
+  assert.strictEqual(typeof contexts[n - 1], 'object');
+}
+
+function measureHmacLifecycle({ key, options }, data, n) {
+  createHmac(options.digest, key).update(data).digest();
+
+  let result;
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    result = createHmac(options.digest, key).update(data).digest();
+  bench.end(n);
+
+  assert(Buffer.isBuffer(result));
+}
+
+function measureMacLifecycle({ algorithm, key, options }, data, n) {
+  createMac(algorithm, key, options).update(data).final();
+
+  let result;
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    result = createMac(algorithm, key, options).update(data).final();
+  bench.end(n);
+
+  assert(Buffer.isBuffer(result));
+}
+
+function measureMacStreamLifecycle({ algorithm, key, options }, data, n) {
+  const warmup = createMac(algorithm, key, options);
+  warmup.end(data);
+  warmup.read();
+
+  let result;
+  bench.start();
+  for (let i = 0; i < n; ++i) {
+    const context = createMac(algorithm, key, options);
+    context.end(data);
+    result = context.read();
+  }
+  bench.end(n);
+
+  assert(Buffer.isBuffer(result));
+}
+
+function measureUpdate({ algorithm, key, options }, data, n) {
+  const warmup = createMac(algorithm, key, options);
+  warmup.update(data).final();
+
+  const context = createMac(algorithm, key, options);
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    context.update(data);
+  bench.end(n);
+
+  assert(Buffer.isBuffer(context.final()));
+}
+
+function measureStream({ algorithm, key, options }, data, n) {
+  const warmup = createMac(algorithm, key, options);
+  warmup.end(data);
+  warmup.read();
+
+  const context = createMac(algorithm, key, options);
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    context.write(data);
+  bench.end(n);
+
+  context.end();
+  assert(Buffer.isBuffer(context.read()));
+}
+
+function measureFinal({ algorithm, key, options }, data, n, encoding) {
+  const warmup = createMac(algorithm, key, options).update(data);
+  if (encoding === undefined)
+    warmup.final();
+  else
+    warmup.final(encoding);
+
+  const contexts = new Array(n);
+  for (let i = 0; i < n; ++i)
+    contexts[i] = createMac(algorithm, key, options).update(data);
+
+  let result;
+  if (encoding === undefined) {
+    bench.start();
+    for (let i = 0; i < n; ++i)
+      result = contexts[i].final();
+    bench.end(n);
+  } else {
+    bench.start();
+    for (let i = 0; i < n; ++i)
+      result = contexts[i].final(encoding);
+    bench.end(n);
+  }
+
+  if (encoding === undefined)
+    assert(Buffer.isBuffer(result));
+  else
+    assert.strictEqual(typeof result, 'string');
+}
diff --git a/benchmark/diagnostics_channel/tracing-channel-promise.js b/benchmark/diagnostics_channel/tracing-channel-promise.js
new file mode 100644
index 000000000000..594043d63fe4
--- /dev/null
+++ b/benchmark/diagnostics_channel/tracing-channel-promise.js
@@ -0,0 +1,53 @@
+'use strict';
+
+const common = require('../common.js');
+const dc = require('node:diagnostics_channel');
+
+const bench = common.createBenchmark(main, {
+  n: [1e7],
+  context: ['omitted', 'undefined', 'provided'],
+  subscribers: [0, 1],
+});
+
+function noop() {}
+
+const thenable = {
+  then(onResolve) {
+    onResolve(undefined);
+  },
+};
+
+function returnThenable() {
+  return thenable;
+}
+
+function main({ n, context, subscribers }) {
+  const channel = dc.tracingChannel('test');
+  const providedContext = { __proto__: null };
+
+  if (subscribers) {
+    channel.subscribe({ start: noop });
+  }
+
+  bench.start();
+  switch (context) {
+    case 'omitted':
+      for (let i = 0; i < n; i++) {
+        channel.tracePromise(returnThenable);
+      }
+      break;
+    case 'undefined':
+      for (let i = 0; i < n; i++) {
+        channel.tracePromise(returnThenable, undefined);
+      }
+      break;
+    case 'provided':
+      for (let i = 0; i < n; i++) {
+        channel.tracePromise(returnThenable, providedContext);
+      }
+      break;
+    default:
+      throw new Error(`Unsupported context value: ${context}`);
+  }
+  bench.end(n);
+}
diff --git a/benchmark/diagnostics_channel/tracing-channel-sync.js b/benchmark/diagnostics_channel/tracing-channel-sync.js
new file mode 100644
index 000000000000..bfd9dd939cc0
--- /dev/null
+++ b/benchmark/diagnostics_channel/tracing-channel-sync.js
@@ -0,0 +1,43 @@
+'use strict';
+
+const common = require('../common.js');
+const dc = require('node:diagnostics_channel');
+
+const bench = common.createBenchmark(main, {
+  n: [1e7],
+  context: ['omitted', 'undefined', 'provided'],
+  subscribers: [0, 1],
+});
+
+function noop() {}
+
+function main({ n, context, subscribers }) {
+  const channel = dc.tracingChannel('test');
+  const providedContext = { __proto__: null };
+
+  if (subscribers) {
+    channel.subscribe({ start: noop });
+  }
+
+  bench.start();
+  switch (context) {
+    case 'omitted':
+      for (let i = 0; i < n; i++) {
+        channel.traceSync(noop);
+      }
+      break;
+    case 'undefined':
+      for (let i = 0; i < n; i++) {
+        channel.traceSync(noop, undefined);
+      }
+      break;
+    case 'provided':
+      for (let i = 0; i < n; i++) {
+        channel.traceSync(noop, providedContext);
+      }
+      break;
+    default:
+      throw new Error(`Unsupported context value: ${context}`);
+  }
+  bench.end(n);
+}
diff --git a/benchmark/ffi/add-64.js b/benchmark/ffi/add-64.js
index 1af3de2296a5..d3b8f9e21e03 100644
--- a/benchmark/ffi/add-64.js
+++ b/benchmark/ffi/add-64.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-f32.js b/benchmark/ffi/add-f32.js
index a958e80c1819..afb42a4a48e5 100644
--- a/benchmark/ffi/add-f32.js
+++ b/benchmark/ffi/add-f32.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-f64.js b/benchmark/ffi/add-f64.js
index f4e1dbac4ac3..a4aec85fa935 100644
--- a/benchmark/ffi/add-f64.js
+++ b/benchmark/ffi/add-f64.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-i16.js b/benchmark/ffi/add-i16.js
index 8cd6f989e180..0ce2530d5d33 100644
--- a/benchmark/ffi/add-i16.js
+++ b/benchmark/ffi/add-i16.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-i32.js b/benchmark/ffi/add-i32.js
index 9a77a6f998f7..451c0c4e0836 100644
--- a/benchmark/ffi/add-i32.js
+++ b/benchmark/ffi/add-i32.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-i64.js b/benchmark/ffi/add-i64.js
index 753a300b4394..b72e399d4135 100644
--- a/benchmark/ffi/add-i64.js
+++ b/benchmark/ffi/add-i64.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-i8.js b/benchmark/ffi/add-i8.js
index 9e506b2ad76f..b0b0111f88c7 100644
--- a/benchmark/ffi/add-i8.js
+++ b/benchmark/ffi/add-i8.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-u16.js b/benchmark/ffi/add-u16.js
index 2c1408a355a2..26161815bde7 100644
--- a/benchmark/ffi/add-u16.js
+++ b/benchmark/ffi/add-u16.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-u64.js b/benchmark/ffi/add-u64.js
index 260d24971610..6a021ad5c854 100644
--- a/benchmark/ffi/add-u64.js
+++ b/benchmark/ffi/add-u64.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-u8.js b/benchmark/ffi/add-u8.js
index 3525d4c3d263..3c9512a7869b 100644
--- a/benchmark/ffi/add-u8.js
+++ b/benchmark/ffi/add-u8.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/buffer-first-byte-direct.js b/benchmark/ffi/buffer-first-byte-direct.js
index 60370419edb7..d09706144702 100644
--- a/benchmark/ffi/buffer-first-byte-direct.js
+++ b/benchmark/ffi/buffer-first-byte-direct.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/buffer-first-byte.js b/benchmark/ffi/buffer-first-byte.js
index 311cd8e89fac..02b8f190d5e9 100644
--- a/benchmark/ffi/buffer-first-byte.js
+++ b/benchmark/ffi/buffer-first-byte.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/buffer-sum-direct.js b/benchmark/ffi/buffer-sum-direct.js
index 73b6d149cb76..425832330047 100644
--- a/benchmark/ffi/buffer-sum-direct.js
+++ b/benchmark/ffi/buffer-sum-direct.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/buffer-sum.js b/benchmark/ffi/buffer-sum.js
index e4108db09a65..fd5ba47363d0 100644
--- a/benchmark/ffi/buffer-sum.js
+++ b/benchmark/ffi/buffer-sum.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/get-function.js b/benchmark/ffi/get-function.js
index 3c1e2e974ce6..939c1630ab64 100644
--- a/benchmark/ffi/get-function.js
+++ b/benchmark/ffi/get-function.js
@@ -16,8 +16,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 const bench = common.createBenchmark(main, {
   signature: ['fast', 'slow'],
   n: [1e3],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/getpid.js b/benchmark/ffi/getpid.js
index 8008f407305e..3463a4afe807 100644
--- a/benchmark/ffi/getpid.js
+++ b/benchmark/ffi/getpid.js
@@ -5,8 +5,6 @@ const ffi = require('node:ffi');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 const { lib, functions } = ffi.dlopen(null, {
diff --git a/benchmark/ffi/identity-i32.js b/benchmark/ffi/identity-i32.js
index 0014d652777f..388645e328a2 100644
--- a/benchmark/ffi/identity-i32.js
+++ b/benchmark/ffi/identity-i32.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/invoke-function.js b/benchmark/ffi/invoke-function.js
index ae8d5b2ef795..9e461680b7ee 100644
--- a/benchmark/ffi/invoke-function.js
+++ b/benchmark/ffi/invoke-function.js
@@ -23,7 +23,7 @@ const bench = common.createBenchmark(main, {
   n: [1e7],
   symbol: ['call_int_callback', 'sum_8_i32'],
 }, {
-  flags: ['--experimental-ffi', '--no-warnings'],
+  flags: ['--no-warnings'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/many-args.js b/benchmark/ffi/many-args.js
index bc269ace0c3e..7cd5a4d685ce 100644
--- a/benchmark/ffi/many-args.js
+++ b/benchmark/ffi/many-args.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/noop-void.js b/benchmark/ffi/noop-void.js
index b9dd68636254..ff606ebb8586 100644
--- a/benchmark/ffi/noop-void.js
+++ b/benchmark/ffi/noop-void.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/pointer-bigint.js b/benchmark/ffi/pointer-bigint.js
index 9ea01d28490e..6be9577f45b7 100644
--- a/benchmark/ffi/pointer-bigint.js
+++ b/benchmark/ffi/pointer-bigint.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/pointer-buffer-direct.js b/benchmark/ffi/pointer-buffer-direct.js
index 681800c6e02d..0813e732d6ae 100644
--- a/benchmark/ffi/pointer-buffer-direct.js
+++ b/benchmark/ffi/pointer-buffer-direct.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/pointer-buffer.js b/benchmark/ffi/pointer-buffer.js
index 4aa038558367..e19a1a035388 100644
--- a/benchmark/ffi/pointer-buffer.js
+++ b/benchmark/ffi/pointer-buffer.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/pointer-null.js b/benchmark/ffi/pointer-null.js
index c9836b12604e..975e03b739f4 100644
--- a/benchmark/ffi/pointer-null.js
+++ b/benchmark/ffi/pointer-null.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/string-equals-hello-buffer-direct.js b/benchmark/ffi/string-equals-hello-buffer-direct.js
index 0a4ea8b97112..a05902a54f1f 100644
--- a/benchmark/ffi/string-equals-hello-buffer-direct.js
+++ b/benchmark/ffi/string-equals-hello-buffer-direct.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/string-equals-hello-buffer.js b/benchmark/ffi/string-equals-hello-buffer.js
index 7757586d472c..eb7839d48508 100644
--- a/benchmark/ffi/string-equals-hello-buffer.js
+++ b/benchmark/ffi/string-equals-hello-buffer.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/string-first-char-buffer-direct.js b/benchmark/ffi/string-first-char-buffer-direct.js
index 693705c94587..641084cdf632 100644
--- a/benchmark/ffi/string-first-char-buffer-direct.js
+++ b/benchmark/ffi/string-first-char-buffer-direct.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/string-first-char-buffer.js b/benchmark/ffi/string-first-char-buffer.js
index e8a79ac41ad6..cac665039390 100644
--- a/benchmark/ffi/string-first-char-buffer.js
+++ b/benchmark/ffi/string-first-char-buffer.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/string-length-buffer-direct.js b/benchmark/ffi/string-length-buffer-direct.js
index cfbb819d8026..b2de28b209e8 100644
--- a/benchmark/ffi/string-length-buffer-direct.js
+++ b/benchmark/ffi/string-length-buffer-direct.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/string-length-buffer.js b/benchmark/ffi/string-length-buffer.js
index 3b0ea8aef13a..36d11db86420 100644
--- a/benchmark/ffi/string-length-buffer.js
+++ b/benchmark/ffi/string-length-buffer.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/string-length-string-direct.js b/benchmark/ffi/string-length-string-direct.js
index cfbb819d8026..b2de28b209e8 100644
--- a/benchmark/ffi/string-length-string-direct.js
+++ b/benchmark/ffi/string-length-string-direct.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/string-length-string.js b/benchmark/ffi/string-length-string.js
index 9cddfdf4e950..23284973405d 100644
--- a/benchmark/ffi/string-length-string.js
+++ b/benchmark/ffi/string-length-string.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/sum-3-i32.js b/benchmark/ffi/sum-3-i32.js
index 174979183819..9e3f842b54ca 100644
--- a/benchmark/ffi/sum-3-i32.js
+++ b/benchmark/ffi/sum-3-i32.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/sum-5-i32.js b/benchmark/ffi/sum-5-i32.js
index ecc784a3d045..490691ad2b33 100644
--- a/benchmark/ffi/sum-5-i32.js
+++ b/benchmark/ffi/sum-5-i32.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/sum-8-i32.js b/benchmark/ffi/sum-8-i32.js
index 8c740030307a..b1d53d693bfa 100644
--- a/benchmark/ffi/sum-8-i32.js
+++ b/benchmark/ffi/sum-8-i32.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/sum-buffer.js b/benchmark/ffi/sum-buffer.js
index 60e25a854185..da87aa28ebd4 100644
--- a/benchmark/ffi/sum-buffer.js
+++ b/benchmark/ffi/sum-buffer.js
@@ -7,8 +7,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 const bench = common.createBenchmark(main, {
   size: [64, 1024, 16384],
   n: [1e6],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/fs/bench-cp.js b/benchmark/fs/bench-cp.js
new file mode 100644
index 000000000000..ffaeb87705f5
--- /dev/null
+++ b/benchmark/fs/bench-cp.js
@@ -0,0 +1,33 @@
+'use strict';
+
+// fs.promises.cp() of a directory tree.
+
+const common = require('../common');
+const fs = require('fs');
+const path = require('path');
+const tmpdir = require('../../test/common/tmpdir');
+
+const bench = common.createBenchmark(main, {
+  files: [500],
+  n: [3],
+});
+
+function prepareSource(files) {
+  const src = tmpdir.resolve('cp-src');
+  for (let i = 0; i < files; i++) {
+    const dir = path.join(src, `dir-${i % 10}`, `sub-${i % 7}`);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, `file-${i}.js`), 'x'.repeat(1024 + (i % 512)));
+  }
+  return src;
+}
+
+async function main({ files, n }) {
+  tmpdir.refresh();
+  const src = prepareSource(files);
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    await fs.promises.cp(src, tmpdir.resolve(`cp-dest-${i}`), { recursive: true });
+  }
+  bench.end(n);
+}
diff --git a/benchmark/fs/bench-glob.js b/benchmark/fs/bench-glob.js
index 74612701e218..4652a48f5241 100644
--- a/benchmark/fs/bench-glob.js
+++ b/benchmark/fs/bench-glob.js
@@ -16,6 +16,7 @@ const configs = {
   dir: ['lib'],
   pattern: ['**/*', '*.js', '**/**.js'],
   mode: ['sync', 'promise', 'callback'],
+  maxDepth: ['default', '2'],
   recursive: ['true', 'false'],
 };
 
@@ -23,8 +24,11 @@ const bench = common.createBenchmark(main, configs);
 
 async function main(config) {
   const fullPath = path.resolve(benchmarkDirectory, config.dir);
-  const { pattern, recursive, mode } = config;
+  const { pattern, recursive, mode, maxDepth } = config;
   const options = { cwd: fullPath, recursive };
+  if (maxDepth !== 'default') {
+    options.maxDepth = Number(maxDepth);
+  }
   const callback = (resolve, reject) => {
     glob(pattern, options, (err, matches) => {
       if (err) {
@@ -44,7 +48,10 @@ async function main(config) {
         noDead = globSync(pattern, options);
         break;
       case 'promise':
-        noDead = await globAsync(pattern, options);
+        noDead = [];
+        for await (const match of globAsync(pattern, options)) {
+          noDead.push(match);
+        }
         break;
       case 'callback':
         noDead = await new Promise(callback);
diff --git a/benchmark/fs/bench-readdir-recursive.js b/benchmark/fs/bench-readdir-recursive.js
new file mode 100644
index 000000000000..6ed56995dcea
--- /dev/null
+++ b/benchmark/fs/bench-readdir-recursive.js
@@ -0,0 +1,47 @@
+'use strict';
+
+const common = require('../common');
+const fs = require('fs');
+const path = require('path');
+const assert = require('assert');
+
+const bench = common.createBenchmark(main, {
+  n: [10],
+  dir: ['lib', 'test/parallel', 'test'],
+  mode: ['sync', 'callback', 'promise'],
+  withFileTypes: ['true', 'false'],
+});
+
+async function main({ n, dir, mode, withFileTypes }) {
+  withFileTypes = withFileTypes === 'true';
+  const fullPath = path.resolve(__dirname, '../../', dir);
+  const options = { recursive: true, withFileTypes };
+  let entries;
+
+  bench.start();
+  switch (mode) {
+    case 'sync':
+      for (let i = 0; i < n; i++) {
+        entries = fs.readdirSync(fullPath, options);
+      }
+      break;
+    case 'callback':
+      for (let i = 0; i < n; i++) {
+        entries = await new Promise((resolve, reject) => {
+          fs.readdir(fullPath, options, (err, result) => {
+            if (err) reject(err);
+            else resolve(result);
+          });
+        });
+      }
+      break;
+    case 'promise':
+      for (let i = 0; i < n; i++) {
+        entries = await fs.promises.readdir(fullPath, options);
+      }
+      break;
+  }
+  bench.end(n);
+
+  assert.ok(entries.length > 0);
+}
diff --git a/benchmark/fs/bench-readdir.js b/benchmark/fs/bench-readdir.js
index e276653f4584..8fa0e7a3cbdc 100644
--- a/benchmark/fs/bench-readdir.js
+++ b/benchmark/fs/bench-readdir.js
@@ -8,18 +8,16 @@ const bench = common.createBenchmark(main, {
   n: [10],
   dir: [ 'lib', 'test/parallel'],
   withFileTypes: ['true', 'false'],
-  recursive: ['true', 'false'],
 });
 
-function main({ n, dir, withFileTypes, recursive }) {
+function main({ n, dir, withFileTypes }) {
   withFileTypes = withFileTypes === 'true';
-  recursive = recursive === 'true';
   const fullPath = path.resolve(__dirname, '../../', dir);
   bench.start();
   (function r(cntr) {
     if (cntr-- <= 0)
       return bench.end(n);
-    fs.readdir(fullPath, { withFileTypes, recursive }, () => {
+    fs.readdir(fullPath, { withFileTypes }, () => {
       r(cntr);
     });
   }(n));
diff --git a/benchmark/fs/bench-readdirSync.js b/benchmark/fs/bench-readdirSync.js
index ce34e083cb53..8ae1d061d1f1 100644
--- a/benchmark/fs/bench-readdirSync.js
+++ b/benchmark/fs/bench-readdirSync.js
@@ -8,17 +8,15 @@ const bench = common.createBenchmark(main, {
   n: [10],
   dir: [ 'lib', 'test/parallel'],
   withFileTypes: ['true', 'false'],
-  recursive: ['true', 'false'],
 });
 
 
-function main({ n, dir, withFileTypes, recursive }) {
+function main({ n, dir, withFileTypes }) {
   withFileTypes = withFileTypes === 'true';
-  recursive = recursive === 'true';
   const fullPath = path.resolve(__dirname, '../../', dir);
   bench.start();
   for (let i = 0; i < n; i++) {
-    fs.readdirSync(fullPath, { withFileTypes, recursive });
+    fs.readdirSync(fullPath, { withFileTypes });
   }
   bench.end(n);
 }
diff --git a/benchmark/fs/bench-watch-recursive.js b/benchmark/fs/bench-watch-recursive.js
new file mode 100644
index 000000000000..45ed0871718e
--- /dev/null
+++ b/benchmark/fs/bench-watch-recursive.js
@@ -0,0 +1,23 @@
+'use strict';
+
+// Setting up (and tearing down) a recursive fs.watch() on a directory tree.
+// On Linux and other platforms without a native recursive watcher this is
+// implemented in JavaScript on top of per-directory watchers.
+
+const common = require('../common');
+const fs = require('fs');
+const path = require('path');
+
+const bench = common.createBenchmark(main, {
+  n: [5],
+  dir: ['lib', 'test/fixtures'],
+});
+
+function main({ n, dir }) {
+  const fullPath = path.resolve(__dirname, '../../', dir);
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    fs.watch(fullPath, { recursive: true }).close();
+  }
+  bench.end(n);
+}
diff --git a/benchmark/http2/full-duplex.js b/benchmark/http2/full-duplex.js
new file mode 100644
index 000000000000..d2fec719f95a
--- /dev/null
+++ b/benchmark/http2/full-duplex.js
@@ -0,0 +1,71 @@
+'use strict';
+
+const common = require('../common.js');
+const fixtures = require('../../test/common/fixtures');
+
+const bench = common.createBenchmark(main, {
+  n: [100],
+  streams: [2],
+  size: [4 * 1024 * 1024],
+  // Use the HTTP/2 protocol default.
+  window: [65535],
+}, {
+  test: { size: 128 * 1024, window: 65535 },
+});
+
+function main({ n, streams, size, window }) {
+  const http2 = require('http2');
+  const payload = Buffer.alloc(size);
+  const server = http2.createSecureServer({
+    key: fixtures.readKey('agent1-key.pem'),
+    cert: fixtures.readKey('agent1-cert.pem'),
+    settings: { initialWindowSize: window },
+  });
+
+  let completed = 0;
+  let batches = 0;
+
+  function onTransferComplete() {
+    if (++completed !== streams * 2)
+      return;
+
+    if (++batches === n) {
+      // Report combined upload and download throughput in MiB/s.
+      bench.end(n * streams * size * 2 / (1024 * 1024));
+      client.close();
+      server.close();
+      return;
+    }
+
+    startBatch();
+  }
+
+  server.on('stream', (stream) => {
+    stream.resume();
+    stream.on('end', onTransferComplete);
+    stream.respond();
+    stream.end(payload);
+  });
+
+  let client;
+  function startBatch() {
+    completed = 0;
+    for (let i = 0; i < streams; i++) {
+      const request = client.request({ ':method': 'POST' });
+      request.resume();
+      request.on('end', onTransferComplete);
+      request.end(payload);
+    }
+  }
+
+  server.listen(0, () => {
+    client = http2.connect(`https://localhost:${server.address().port}`, {
+      rejectUnauthorized: false,
+      settings: { initialWindowSize: window },
+    });
+    client.on('connect', () => {
+      bench.start();
+      startBatch();
+    });
+  });
+}
diff --git a/benchmark/misc/startup-core.js b/benchmark/misc/startup-core.js
index 414b00176ad2..d673d415b505 100644
--- a/benchmark/misc/startup-core.js
+++ b/benchmark/misc/startup-core.js
@@ -64,6 +64,7 @@ function main({ n, script, mode }) {
   const warmup = 3;
   const state = { n, finished: -warmup };
   if (mode === 'worker') {
+    // eslint-disable-next-line no-global-assign
     Worker = require('worker_threads').Worker;
     spawnWorker(script, bench, state);
   } else {
diff --git a/benchmark/module/module-require-source-map.js b/benchmark/module/module-require-source-map.js
new file mode 100644
index 000000000000..8353ab39fc82
--- /dev/null
+++ b/benchmark/module/module-require-source-map.js
@@ -0,0 +1,77 @@
+'use strict';
+
+// Loading modules that carry source maps, with source map support enabled.
+// This is the cost paid at startup by applications bundled or transpiled with
+// source maps; the maps are only consulted if a stack trace is generated.
+
+const fs = require('fs');
+const path = require('path');
+const common = require('../common.js');
+const tmpdir = require('../../test/common/tmpdir');
+const benchmarkDirectory = tmpdir.resolve('nodejs-benchmark-module-source-map');
+
+const bench = common.createBenchmark(main, {
+  sourceMap: ['none', 'inline', 'external'],
+  n: [1000],
+}, {
+  setup(configs) {
+    tmpdir.refresh();
+    const maxN = configs.reduce((max, c) => Math.max(max, c.n), 0);
+    createModules(maxN);
+  },
+});
+
+function moduleSource(i) {
+  const methods = [];
+  for (let m = 0; m < 40; m++) {
+    methods.push(`  method${m}(input) { return [].concat(input).map((item) => ({ item, m: ${m}, service: ${i} })); }`);
+  }
+  return `'use strict';
+class Service${i} {
+  constructor(options = {}) { this.options = { retries: 3, ...options }; }
+${methods.join('\n')}
+}
+function helper${i}(list) { return list.filter(Boolean).slice(0, ${i % 7}); }
+module.exports = { Service${i}, helper${i} };
+`;
+}
+
+function sourceMapFor(i, source) {
+  return JSON.stringify({
+    version: 3,
+    file: `${i}.js`,
+    sources: [`../src/${i}.ts`],
+    sourcesContent: [source],
+    names: [],
+    mappings: 'AAAA;' + 'AACA,MAAM;'.repeat(44),
+  });
+}
+
+function createModules(n) {
+  for (const kind of ['none', 'inline', 'external']) {
+    const dir = path.join(benchmarkDirectory, kind);
+    fs.mkdirSync(dir, { recursive: true });
+    for (let i = 0; i < n; i++) {
+      const source = moduleSource(i);
+      let trailer = '';
+      if (kind === 'inline') {
+        const data = Buffer.from(sourceMapFor(i, source)).toString('base64');
+        trailer = `//# sourceMappingURL=data:application/json;base64,${data}\n`;
+      } else if (kind === 'external') {
+        fs.writeFileSync(path.join(dir, `${i}.js.map`), sourceMapFor(i, source));
+        trailer = `//# sourceMappingURL=${i}.js.map\n`;
+      }
+      fs.writeFileSync(path.join(dir, `${i}.js`), source + trailer);
+    }
+  }
+}
+
+function main({ sourceMap, n }) {
+  process.setSourceMapsEnabled(true);
+  const dir = path.join(benchmarkDirectory, sourceMap);
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    require(path.join(dir, `${i}.js`));
+  }
+  bench.end(n);
+}
diff --git a/benchmark/quic/h3-request.js b/benchmark/quic/h3-request.js
new file mode 100644
index 000000000000..f96a18407ae1
--- /dev/null
+++ b/benchmark/quic/h3-request.js
@@ -0,0 +1,150 @@
+'use strict';
+
+// Measures a complete HTTP/3 exchange: establish a session, send one request
+// and read the whole response. Run in two modes, so the cost of a resumed
+// 0-RTT session can be compared against a full handshake.
+//
+// The 0-RTT mode needs a session ticket, which can only come from an earlier
+// connection. That first connection is made during warmup, outside the
+// measured region, so what is timed is only the resumed exchange.
+
+const common = require('../common.js');
+const fixtures = require('../../test/common/fixtures');
+const { createPrivateKey } = require('crypto');
+
+const bench = common.createBenchmark(main, {
+  // '0rtt' resumes from a ticket and sends the request in the very first
+  // flight; '1rtt' is a fresh session each time. 0-RTT is listed first so
+  // that it is the mode the benchmark CI test exercises.
+  mode: ['0rtt', '1rtt'],
+  n: [500],
+}, { flags: ['--experimental-quic', '--experimental-stream-iter',
+             '--no-warnings'] });
+
+async function main({ mode, n }) {
+  const { listen, connect } = require('node:quic');
+  const { bytes } = require('stream/iter');
+
+  const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+  const cert = fixtures.readKey('agent1-cert.pem');
+  const body = new TextEncoder().encode('x'.repeat(256));
+  const decoder = new TextDecoder();
+
+  const request = {
+    ':method': 'GET',
+    ':path': '/',
+    ':scheme': 'https',
+    ':authority': 'localhost',
+  };
+
+  const endpoint = await listen((session) => {
+    session.opened.catch(() => {});
+    session.closed.catch(() => {});
+    session.onstream = (stream) => { stream.closed.catch(() => {}); };
+  }, {
+    sni: { '*': { keys: [key], certs: [cert] } },
+    onheaders() {
+      this.sendHeaders({ ':status': '200' });
+      this.writer.writeSync(body);
+      this.writer.endSync();
+    },
+    endpoint: {
+      maxConnectionsPerHost: 0xFFFF,
+      maxConnectionsTotal: 0xFFFF,
+      sessionCreationRate: 1_000_000,
+      sessionCreationBurst: 1_000_000,
+    },
+  });
+
+  const address = endpoint.address;
+  let received = 0;
+  const onheaders = () => { received++; };
+
+  // A full handshake, one request, one response. When resume is supplied the
+  // request goes out in the first flight, before the handshake completes.
+  async function exchange(resume) {
+    const session = await connect(address, {
+      servername: 'localhost',
+      verifyPeer: 'manual',
+      alpn: 'h3',
+      ...resume,
+    });
+    const stream = await session.createBidirectionalStream({
+      headers: request,
+      onheaders,
+    });
+    if (resume === undefined) await session.opened;
+    const response = decoder.decode(await bytes(stream));
+    if (response.length !== body.length) {
+      throw new Error(`short response: ${response.length}`);
+    }
+    session.close();
+    await session.closed.catch(() => {});
+    return session;
+  }
+
+  // Collect a ticket for the 0-RTT mode from a connection that is not timed.
+  let resume;
+  if (mode === '0rtt') {
+    const { promise, resolve } = Promise.withResolvers();
+    let ticket;
+    let token;
+    const session = await connect(address, {
+      servername: 'localhost',
+      verifyPeer: 'manual',
+      alpn: 'h3',
+      onsessionticket(value) {
+        ticket ??= value;
+        if (token !== undefined) resolve();
+      },
+      onnewtoken(value) {
+        token ??= value;
+        if (ticket !== undefined) resolve();
+      },
+    });
+    await session.opened;
+    await promise;
+    session.close();
+    await session.closed.catch(() => {});
+    resume = { sessionTicket: ticket, token };
+  }
+
+  // The timed 0-RTT exchanges deliberately never await session.opened, since
+  // waiting for the handshake is exactly what 0-RTT avoids. That leaves no
+  // opportunity to notice early data being refused, so check separately -
+  // otherwise a ticket the server stopped accepting would quietly turn this
+  // into a measurement of the 1-RTT path.
+  async function checkEarlyDataAccepted() {
+    const session = await connect(address, {
+      servername: 'localhost',
+      verifyPeer: 'manual',
+      alpn: 'h3',
+      ...resume,
+    });
+    const stream = await session.createBidirectionalStream({
+      headers: request,
+      onheaders,
+    });
+    const info = await session.opened;
+    await bytes(stream);
+    session.close();
+    await session.closed.catch(() => {});
+    if (!info.earlyDataAccepted) {
+      throw new Error('0-RTT was not accepted, benchmark would be invalid');
+    }
+  }
+
+  for (let i = 0; i < 20; i++) await exchange(resume);
+  if (mode === '0rtt') await checkEarlyDataAccepted();
+
+  received = 0;
+  bench.start();
+  for (let i = 0; i < n; i++) await exchange(resume);
+  bench.end(n);
+
+  if (received !== n) throw new Error(`missing responses: ${received}/${n}`);
+  // The ticket is reused for every iteration, so confirm it was still being
+  // accepted at the end of the run and not just at the start.
+  if (mode === '0rtt') await checkEarlyDataAccepted();
+  await endpoint.close();
+}
diff --git a/benchmark/quic/handshake.js b/benchmark/quic/handshake.js
new file mode 100644
index 000000000000..9f0404008e03
--- /dev/null
+++ b/benchmark/quic/handshake.js
@@ -0,0 +1,74 @@
+'use strict';
+
+// Measures the cost of establishing QUIC sessions: how many complete
+// handshakes per second a single endpoint can serve, for raw QUIC and for
+// HTTP/3. Nothing is sent on the session beyond what the protocol itself
+// requires, so this isolates connection setup rather than data transfer.
+
+const common = require('../common.js');
+const fixtures = require('../../test/common/fixtures');
+const { createPrivateKey } = require('crypto');
+
+const bench = common.createBenchmark(main, {
+  // 'raw' negotiates a non-HTTP ALPN and does no application work.
+  // 'h3' negotiates HTTP/3, so the server also builds an nghttp3 connection
+  // and its control/QPACK streams for every session.
+  protocol: ['raw', 'h3'],
+  concurrency: [1, 10],
+  n: [1000],
+}, { flags: ['--experimental-quic', '--no-warnings'] });
+
+async function main({ protocol, concurrency, n }) {
+  const { listen, connect } = require('node:quic');
+
+  const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+  const cert = fixtures.readKey('agent1-cert.pem');
+  const alpn = protocol === 'h3' ? 'h3' : 'quic-bench';
+
+  const endpoint = await listen((session) => {
+    // A benchmark peer never reads these; swallow so a torn-down session
+    // cannot produce an unhandled rejection.
+    session.opened.catch(() => {});
+    session.closed.catch(() => {});
+  }, {
+    sni: { '*': { keys: [key], certs: [cert] } },
+    alpn: [alpn],
+    // The defaults rate-limit session creation per host, which a benchmark
+    // hammering a single address would otherwise trip.
+    endpoint: {
+      maxConnectionsPerHost: 0xFFFF,
+      maxConnectionsTotal: 0xFFFF,
+      sessionCreationRate: 1_000_000,
+      sessionCreationBurst: 1_000_000,
+    },
+  });
+
+  const address = endpoint.address;
+
+  async function handshake() {
+    const session = await connect(address, {
+      servername: 'localhost',
+      verifyPeer: 'manual',
+      alpn,
+    });
+    await session.opened;
+    session.close();
+    await session.closed.catch(() => {});
+  }
+
+  async function run(count) {
+    for (let i = 0; i < count; i += concurrency) {
+      const batch = Math.min(concurrency, count - i);
+      await Promise.all(Array.from({ length: batch }, handshake));
+    }
+  }
+
+  // Warm up the TLS and QUIC machinery before measuring.
+  await run(Math.min(100, n));
+
+  bench.start();
+  await run(n);
+  bench.end(n);
+
+  await endpoint.close();
+}
diff --git a/benchmark/scatter-node-bench.js b/benchmark/scatter-node-bench.js
new file mode 100644
index 000000000000..4527ecc6b8b4
--- /dev/null
+++ b/benchmark/scatter-node-bench.js
@@ -0,0 +1,131 @@
+'use strict';
+
+const CLI = require('./_cli.js');
+const {
+  analyzeScatter,
+  validateScatterParameters,
+} = require('./_node-bench-analysis.js');
+const {
+  csvEncode,
+  parseInteger,
+  runBenchmark,
+} = require('./_node-bench.js');
+
+const cli = new CLI(`usage: ./node scatter-node-bench.js [options] [--] <file>
+  Run an explicit node:bench file repeatedly and output each independent
+  observation with its benchmark parameters as CSV, or summarize the results
+  directly with --analyze.
+
+  --node         ./node     Node.js binary
+  --runs         30         number of observations
+  --warmup       0          warmup samples before each observation
+  --name-pattern pattern    only run matching benchmarks
+  --node-arg     argument   pass an argument to the binary (repeatable)
+  --analyze                 print a statistical summary instead of CSV
+  --xaxis        parameter  parameter to group by with --analyze (required)
+  --category     parameter  optional second grouping parameter
+  --no-chart                omit the analysis bar chart
+`, {
+  arrayArgs: ['node-arg'],
+  boolArgs: ['analyze', 'no-chart'],
+});
+
+if (cli.items.length !== 1) cli.abort(cli.usage);
+if (cli.optional.analyze && cli.optional.xaxis === undefined) {
+  cli.abort('--analyze requires --xaxis <parameter>');
+}
+
+async function main() {
+  const runs = parseInteger(cli.optional.runs, 30, '--runs', 1);
+  const warmup = parseInteger(cli.optional.warmup, 0, '--warmup', 0);
+  const options = {
+    namePattern: cli.optional['name-pattern'],
+    nodeArgs: cli.optional['node-arg'],
+    warmup,
+  };
+  const binary = cli.optional.node || process.execPath;
+  const rows = [];
+  const paramNames = new Set();
+  const csvGroups = new Map();
+  let expectedIdentities;
+  let logicalIdentity;
+
+  for (let run = 0; run < runs; run++) {
+    const samples = await runBenchmark(binary, cli.items[0], options);
+    if (run === 0 && cli.optional.analyze) {
+      validateScatterParameters(
+        samples, cli.optional.xaxis, cli.optional.category);
+    }
+    const identities = new Set();
+    for (const sample of samples) {
+      if (logicalIdentity !== undefined &&
+          logicalIdentity !== sample.logicalIdentity) {
+        throw new Error(
+          'scatter-node-bench.js requires one logical benchmark name per file',
+        );
+      }
+      logicalIdentity = sample.logicalIdentity;
+      if (identities.has(sample.identity)) {
+        throw new Error(`Benchmark '${sample.name}' was reported more than once`);
+      }
+      identities.add(sample.identity);
+      const csvGroup = JSON.stringify([sample.name, sample.params]);
+      const groupedIdentity = csvGroups.get(csvGroup);
+      if (groupedIdentity !== undefined &&
+          groupedIdentity !== sample.identity) {
+        throw new Error(
+          `Distinct benchmarks would share the CSV group '${sample.name}'`,
+        );
+      }
+      csvGroups.set(csvGroup, sample.identity);
+      rows.push({ ...sample, observation: run });
+      for (const name of Object.keys(sample.params)) paramNames.add(name);
+    }
+    if (expectedIdentities === undefined) {
+      expectedIdentities = identities;
+    } else if (identities.size !== expectedIdentities.size ||
+               ![...identities].every((id) => expectedIdentities.has(id))) {
+      throw new Error('The set of reported benchmarks changed between runs');
+    }
+  }
+  if (rows.length === 0) {
+    throw new Error('No benchmark samples were produced');
+  }
+
+  const params = [...paramNames].sort();
+  if (cli.optional.analyze) {
+    const output = analyzeScatter(
+      rows,
+      cli.optional.xaxis,
+      cli.optional.category,
+      !cli.optional['no-chart'],
+    );
+    process.stdout.write(output);
+    return;
+  }
+
+  for (const name of params) {
+    if (name === 'filename' || name === 'rate' || name === 'time') {
+      throw new Error(`Benchmark parameter '${name}' is reserved in scatter CSV`);
+    }
+  }
+  const header = ['filename', ...params, 'rate', 'time']
+    .map(csvEncode)
+    .join(',');
+  const output = [header];
+  for (const row of rows) {
+    const values = [
+      csvEncode(row.name),
+      ...params.map((name) => csvEncode(row.params[name] ?? '')),
+      row.rate,
+      row.duration,
+    ];
+    output.push(values.join(','));
+  }
+  process.stdout.write(`${output.join('\n')}\n`);
+}
+
+main().catch((error) => {
+  console.error(error.stack);
+  process.exitCode = 1;
+});
diff --git a/benchmark/scatter.js b/benchmark/scatter.js
index 858169d7d68c..cb1df965b70f 100644
--- a/benchmark/scatter.js
+++ b/benchmark/scatter.js
@@ -1,62 +1,167 @@
 'use strict';
 
-const fork = require('child_process').fork;
+const { spawn, fork } = require('node:child_process');
+const { createHistogram } = require('node:perf_hooks');
+const { inspect } = require('util');
 const path = require('path');
 const CLI = require('./_cli.js');
+const BenchmarkProgress = require('./_benchmark_progress.js');
 
 //
 // Parse arguments
 //
 const cli = new CLI(`usage: ./node scatter.js [options] [--] <filename>
   Run the benchmark script <filename> many times and output the rate (ops/s)
-  together with the benchmark variables as a csv.
+  together with the benchmark variables as a csv, which can be processed using
+  for example 'scatter.R'. Use --analyze to summarize the results directly
+  without R.
 
   --runs 30              number of samples
   --set  variable=value  set benchmark variable (can be repeated)
-`, { arrayArgs: ['set'] });
+  --no-progress          don't show benchmark progress indicator
+  --analyze              print a statistical summary (mean rate and confidence
+                         interval per group) instead of csv output
+  --xaxis     variable   variable to group by when using --analyze (required
+                         by --analyze)
+  --category  variable   additional variable to group by when using --analyze
+  --no-chart             don't print the bar chart when using --analyze
+
+  Examples:
+    --set CPUSET=0            Runs benchmarks on CPU core 0.
+    --set CPUSET=0-2          Specifies that benchmarks should run on CPU cores 0 to 2.
+
+  Note: The CPUSET format should match the specifications of the 'taskset' command
+`, {
+  arrayArgs: ['set'],
+  boolArgs: ['no-progress', 'analyze', 'no-chart'],
+});
 
 if (cli.items.length !== 1) {
   cli.abort(cli.usage);
 }
 
-// Create queue from the benchmarks list such both node versions are tested
-// `runs` amount of times each.
 const filepath = path.resolve(cli.items[0]);
-const name = filepath.slice(__dirname.length + 1);
+const name = path.relative(__dirname, filepath);
 const runs = cli.optional.runs ? parseInt(cli.optional.runs, 10) : 30;
+const analyze = !!cli.optional.analyze;
+const showChart = !cli.optional['no-chart'];
+const xAxis = cli.optional.xaxis;
+const category = cli.optional.category;
+
+// Grouping is what makes the summary meaningful, so --analyze needs to know
+// which variable is the independent one. There is no sensible default: the
+// answer depends entirely on what is being measured.
+if (analyze && !xAxis) {
+  cli.abort(
+    `--analyze requires --xaxis <variable>
+
+  --xaxis names the benchmark variable to summarize against; --category
+  optionally breaks each point down by a second variable. Both must be
+  configuration variables of this benchmark -- the keys passed to
+  createBenchmark() at the top of the benchmark file. Nearly every
+  benchmark defines 'n'; parameter sweeps add a size or mode variable
+  such as 'len', 'size' or 'encoding'.
+
+  Example:
+    ./node benchmark/scatter.js --analyze --xaxis n ${name}
+`,
+  );
+}
+
+// When --analyze is set, collect results rather than streaming csv.
+const samples = analyze ? [] : null;
 
 let printHeader = true;
 
 function csvEncodeValue(value) {
-  if (typeof value === 'number') {
+  // Benchmark configuration values are numbers, booleans or strings
+  // (see the config parsing in common.js). Only strings need quoting,
+  // but anything unexpected is stringified rather than crashing the run.
+  if (typeof value === 'number' || typeof value === 'boolean') {
     return value.toString();
   }
-  return `"${value.replace(/"/g, '""')}"`;
+  return `"${String(value).replace(/"/g, '""')}"`;
+}
+
+// Note: BenchmarkProgress reports progress per file; scatter.js only ever
+// runs one file, so every queue entry shares the same filename.
+const queue = [];
+for (let iter = 0; iter < runs; iter++) {
+  queue.push({ filename: name, iter });
+}
+
+const kStartOfQueue = 0;
+
+const showProgress = !cli.optional['no-progress'];
+let progress;
+if (showProgress) {
+  progress = new BenchmarkProgress(queue, [name], { analyze });
+  progress.startQueue(kStartOfQueue);
 }
 
 (function recursive(i) {
-  const child = fork(path.resolve(__dirname, filepath), cli.optional.set);
+  const cpuCore = cli.getCpuCoreSetting();
+  let child;
+  if (cpuCore !== null) {
+    const spawnArgs = ['-c', cpuCore, process.execPath, filepath, ...cli.optional.set];
+    child = spawn('taskset', spawnArgs, {
+      env: process.env,
+      stdio: ['inherit', 'inherit', 'inherit', 'ipc'],
+    });
+  } else {
+    child = fork(filepath, cli.optional.set);
+  }
 
   child.on('message', (data) => {
-    if (data.type !== 'report') {
+    if (data.type === 'config') {
+      if (showProgress) {
+        progress.startSubqueue(data, i);
+      }
       return;
     }
 
-    // print csv header
-    if (printHeader) {
-      const confHeader = Object.keys(data.conf)
-        .map(csvEncodeValue)
-        .join(', ');
-      console.log(`"filename", ${confHeader}, "rate", "time"`);
-      printHeader = false;
+    if (data.type !== 'report') {
+      return;
     }
 
-    // print data row
-    const confData = Object.keys(data.conf)
-      .map((key) => csvEncodeValue(data.conf[key]))
-      .join(', ');
+    if (analyze) {
+      // Validate the grouping variables against the first result rather than
+      // at the end. A typo in --xaxis is otherwise not reported until the
+      // whole run has finished, which can be many minutes of wasted work.
+      if (samples.length === 0) {
+        const confKeys = Object.keys(data.conf);
+        for (const key of [xAxis, category]) {
+          if (key !== undefined && !confKeys.includes(key)) {
+            child.kill();
+            cli.abort(
+              `The variable "${key}" is not a configuration of ${name}.\n` +
+              `Available variables: ${confKeys.join(', ')}`,
+            );
+          }
+        }
+      }
+      samples.push(data);
+    } else {
+      // print csv header
+      if (printHeader) {
+        const confHeader = Object.keys(data.conf)
+          .map(csvEncodeValue)
+          .join(',');
+        console.log(`"filename",${confHeader},"rate","time"`);
+        printHeader = false;
+      }
+
+      // print data row
+      const confData = Object.keys(data.conf)
+        .map((key) => csvEncodeValue(data.conf[key]))
+        .join(',');
 
-    console.log(`"${name}", ${confData}, ${data.rate}, ${data.time}`);
+      console.log(`"${name}",${confData},${data.rate},${data.time}`);
+    }
+
+    if (showProgress) {
+      progress.completeConfig(data);
+    }
   });
 
   child.once('close', (code) => {
@@ -64,10 +169,768 @@ function csvEncodeValue(value) {
       process.exit(code);
       return;
     }
+    if (showProgress) {
+      progress.completeRun(queue[i]);
+    }
 
     // If there are more benchmarks execute the next
     if (i + 1 < runs) {
       recursive(i + 1);
+    } else if (analyze) {
+      printAnalysis(samples, xAxis, category);
     }
   });
-})(0);
+})(kStartOfQueue);
+
+//
+// Statistics
+//
+// scatter.R obtains the t quantile from R's qt(); without R it has to be
+// computed here. The Student's t tail probability is an incomplete beta
+// function, which is evaluated directly, and the quantile is recovered by
+// bisecting it. Bisection rather than an inverse-beta routine because the
+// cost is irrelevant at this scale and the error bound is explicit.
+//
+
+// Lanczos approximation, g=7, n=9.
+function logGamma(x) {
+  const g = [
+    676.5203681218851, -1259.1392167224028, 771.32342877765313,
+    -176.61502916214059, 12.507343278686905, -0.13857109526572012,
+    9.9843695780195716e-6, 1.5056327351493116e-7,
+  ];
+  if (x < 0.5) {
+    // Reflection formula.
+    return Math.log(Math.PI / Math.sin(Math.PI * x)) - logGamma(1 - x);
+  }
+  x -= 1;
+  let a = 0.99999999999980993;
+  const t = x + 7.5;
+  for (let i = 0; i < g.length; i++) {
+    a += g[i] / (x + i + 1);
+  }
+  return 0.5 * Math.log(2 * Math.PI) + (x + 0.5) * Math.log(t) - t + Math.log(a);
+}
+
+// Continued fraction for the incomplete beta function (Lentz's algorithm).
+function betaContinuedFraction(x, a, b) {
+  const tiny = 1e-30;
+  const qab = a + b;
+  const qap = a + 1;
+  const qam = a - 1;
+  let c = 1;
+  let d = 1 - qab * x / qap;
+  if (Math.abs(d) < tiny) d = tiny;
+  d = 1 / d;
+  let h = d;
+  for (let m = 1; m <= 300; m++) {
+    const m2 = 2 * m;
+    let aa = m * (b - m) * x / ((qam + m2) * (a + m2));
+    d = 1 + aa * d;
+    if (Math.abs(d) < tiny) d = tiny;
+    c = 1 + aa / c;
+    if (Math.abs(c) < tiny) c = tiny;
+    d = 1 / d;
+    h *= d * c;
+    aa = -(a + m) * (qab + m) * x / ((a + m2) * (qap + m2));
+    d = 1 + aa * d;
+    if (Math.abs(d) < tiny) d = tiny;
+    c = 1 + aa / c;
+    if (Math.abs(c) < tiny) c = tiny;
+    d = 1 / d;
+    const del = d * c;
+    h *= del;
+    if (Math.abs(del - 1) < 1e-14) break;
+  }
+  return h;
+}
+
+// Regularized incomplete beta function I_x(a, b).
+function incompleteBeta(x, a, b) {
+  if (x <= 0) return 0;
+  if (x >= 1) return 1;
+  const lbeta = logGamma(a + b) - logGamma(a) - logGamma(b);
+  // Use the continued fraction on whichever side converges quickly.
+  if (x < (a + 1) / (a + b + 2)) {
+    return Math.exp(lbeta + a * Math.log(x) + b * Math.log(1 - x)) *
+           betaContinuedFraction(x, a, b) / a;
+  }
+  return 1 - Math.exp(lbeta + b * Math.log(1 - x) + a * Math.log(x)) *
+             betaContinuedFraction(1 - x, b, a) / b;
+}
+
+// Two-tailed probability P(|T| > t) for Student's t with v degrees of freedom.
+function tTailProbability(t, v) {
+  return incompleteBeta(v / (v + t * t), v / 2, 0.5);
+}
+
+// Quantile of Student's t: the value q with P(T <= q) = p, for p > 0.5.
+// Equivalent to R's qt(p, v). Accurate to ~1e-6 over the range used here.
+function tQuantile(p, v) {
+  const alpha = 2 * (1 - p);
+  let lo = 0;
+  let hi = 1e3;
+  for (let i = 0; i < 200; i++) {
+    const mid = (lo + hi) / 2;
+    if (tTailProbability(mid, v) > alpha) {
+      lo = mid;
+    } else {
+      hi = mid;
+    }
+  }
+  return (lo + hi) / 2;
+}
+
+function printAnalysis(samples, xAxis, category) {
+  if (samples.length === 0) {
+    console.error('No benchmark results were reported.');
+    process.exitCode = 1;
+    return;
+  }
+
+  // The grouping variables were already validated against the first result.
+  const confKeys = Object.keys(samples[0].conf);
+
+  // Every variable that is neither a grouping variable nor constant across
+  // the run is averaged over. Report them: an aggregated variable can hide a
+  // real effect, and the reader has no other way to know it happened.
+  const aggregated = confKeys.filter((key) => {
+    if (key === xAxis || key === category) return false;
+    const first = samples[0].conf[key];
+    return samples.some((s) => s.conf[key] !== first);
+  });
+
+  // Group by the grouping variables. The full sample is retained, not just
+  // the rate, so the aggregated variables can be accounted for below.
+  const groups = new Map();
+  for (const sample of samples) {
+    const xValue = sample.conf[xAxis];
+    const catValue = category === undefined ? undefined : sample.conf[category];
+    const key = `${String(xValue)}\u0000${String(catValue)}`;
+    let group = groups.get(key);
+    if (group === undefined) {
+      group = { xValue, catValue, rates: [], members: [] };
+      groups.set(key, group);
+    }
+    group.rates.push(sample.rate);
+    group.members.push(sample);
+  }
+
+  // Naming an aggregated variable is not enough: if it drives most of the
+  // spread within a group, every interval below is reporting that variable
+  // rather than the benchmark's noise, and no number of --runs will shrink
+  // it. Quantify the share so the reader can tell those cases apart.
+  const contamination = new Map();
+  for (const variable of aggregated) {
+    contamination.set(variable, varianceShare([...groups.values()], variable));
+  }
+
+  for (const variable of aggregated) {
+    const share = contamination.get(variable);
+    // Rounding 99.7% up to "100%" would claim the residual noise is zero.
+    const percent = share === 1 ?
+      '100' :
+      (share >= 0.995 ? '>99' : (share * 100).toFixed(0));
+    const suffix = Number.isNaN(share) ?
+      '' :
+      ` (explains ${percent}% of within-group variance)`;
+    console.log(`aggregating variable: ${variable}${suffix}`);
+  }
+
+  // Aggregation that dominates the spread is the single most common reason
+  // for uselessly wide intervals, and the usual reaction -- raising --runs --
+  // cannot help, because the spread is a real effect of a variable that has
+  // been averaged over rather than sampling noise.
+  const dominant = aggregated.filter((v) => contamination.get(v) > 0.5);
+  if (dominant.length > 0) {
+    console.log('');
+    const one = dominant.length === 1;
+    printWrapped(
+      `Note: ${dominant.join(', ')} ${one ? 'explains' : 'explain'} most of ` +
+      `the spread within each group, so the intervals below describe ` +
+      `${one ? 'that variable' : 'those variables'} rather than the ` +
+      `benchmark's own noise, and more --runs will not narrow them. Pin ` +
+      `${one ? 'it' : 'them'} with --set ${dominant[0]}=<value>, or pass as ` +
+      `--category, for intervals that can be acted on.`,
+    );
+  }
+
+  if (aggregated.length > 0) {
+    console.log('');
+  }
+
+  const compare = (a, b) => {
+    if (typeof a === 'number' && typeof b === 'number') return a - b;
+    return String(a).localeCompare(String(b));
+  };
+
+  const scale = histogramScale(samples.map((s) => s.rate));
+
+  const rows = [...groups.values()]
+    .sort((a, b) => compare(a.xValue, b.xValue) ||
+                    compare(a.catValue, b.catValue))
+    .map((group) => {
+      const rates = group.rates;
+      const n = rates.length;
+      const mean = rates.reduce((a, b) => a + b, 0) / n;
+
+      // Confidence interval of the mean, matching scatter.R: the sample
+      // standard error scaled by the t quantile at 97.5%. Computed from the
+      // raw samples rather than the histogram, which stores bucketed values.
+      // Undefined for a single sample, where there is no spread to estimate.
+      let ci = NaN;
+      if (n > 1) {
+        const variance =
+          rates.reduce((sum, r) => sum + (r - mean) ** 2, 0) / (n - 1);
+        ci = Math.sqrt(variance / n) * tQuantile(0.975, n - 1);
+      }
+
+      // The histogram supplies the statistics that have no closed form here:
+      // an exact-binomial interval on the median, and the shape measures used
+      // to decide whether the mean is worth trusting.
+      const histogram = createHistogram({ figures: 5 });
+      for (const rate of rates) {
+        histogram.record(Math.max(1, Math.round(rate * scale)));
+      }
+
+      const medianCI = histogram.percentileCI(50);
+      const median = medianCI.value / scale;
+      const skewness = n > 1 ? histogram.skewness : NaN;
+
+      // A summary is suspect when the two estimates of the centre disagree by
+      // more than the uncertainty claimed for one of them, or when the sample
+      // is badly asymmetric. Either way the mean is being moved by the tail
+      // rather than describing the bulk of the runs.
+      const skewed = n > 1 &&
+        (Math.abs(skewness) > 1 || Math.abs(median - mean) > ci);
+
+      return {
+        ...group,
+        n,
+        mean,
+        ci,
+        histogram,
+        median,
+        medianLower: medianCI.lower / scale,
+        medianUpper: medianCI.upper / scale,
+        skewness,
+        skewed,
+      };
+    });
+
+  // Values are rendered through short labels so that long or non-printable
+  // configuration values cannot break the layout.
+  const legend = assignLabels(rows, 'xValue', 'xLabel');
+  if (category !== undefined) {
+    legend.push(...assignLabels(rows, 'catValue', 'catLabel'));
+  }
+
+  printTable(rows, xAxis, category);
+
+  if (showChart) {
+    printChart(rows, xAxis, category);
+  }
+
+  printComparisons(rows, xAxis, category);
+  printLegend(legend);
+
+  const singleSample = rows.filter((r) => r.n < 2).length;
+  if (singleSample > 0) {
+    console.log('');
+    printWrapped(
+      `Note: ${singleSample} group${singleSample === 1 ? ' has' : 's have'} ` +
+      `only one sample, so no confidence interval could be estimated. ` +
+      `Use --runs 2 or higher.`,
+    );
+  }
+
+  if (rows.some((r) => r.skewed)) {
+    console.log('');
+    printWrapped(
+      `(!) marks groups where the median falls outside the mean's confidence ` +
+      `interval, or the sample is strongly skewed (|skewness| > 1). For those ` +
+      `rows the mean is being pulled by a few slow or fast runs, so the ` +
+      `median and its interval describe the typical run better. This is ` +
+      `usually GC or JIT tiering; more --runs will not necessarily make it ` +
+      `go away.`,
+    );
+  }
+}
+
+// HdrHistogram records positive integers with a fixed number of significant
+// figures, so precision is relative and large rates need no scaling at all.
+// Small rates do: without scaling, anything below 1 op/s rounds to the same
+// bucket and the group collapses to a single value. Scale up until the
+// smallest rate carries enough digits for rounding to be irrelevant.
+function histogramScale(rates) {
+  let min = Infinity;
+  let max = 0;
+  for (const rate of rates) {
+    if (rate > 0 && rate < min) min = rate;
+    if (rate > max) max = rate;
+  }
+  if (!Number.isFinite(min) || max === 0) return 1;
+
+  let scale = 1;
+  while (min * scale < 1e6 && max * scale < 1e15) {
+    scale *= 10;
+  }
+  return scale;
+}
+
+// Share of the within-group variance attributable to one aggregated
+// variable, pooled over groups. This is a one-way eta squared: the spread
+// between that variable's levels divided by the total spread inside the
+// group. Computed per variable and independently, so when two aggregated
+// variables are correlated their shares overlap and do not sum to one.
+function varianceShare(groups, variable) {
+  let between = 0;
+  let total = 0;
+
+  for (const group of groups) {
+    const members = group.members;
+    if (members.length < 2) continue;
+
+    const groupMean =
+      members.reduce((sum, s) => sum + s.rate, 0) / members.length;
+
+    // Partition the group by the level of this variable.
+    const levels = new Map();
+    for (const sample of members) {
+      const key = String(sample.conf[variable]);
+      let level = levels.get(key);
+      if (level === undefined) {
+        level = { sum: 0, count: 0 };
+        levels.set(key, level);
+      }
+      level.sum += sample.rate;
+      level.count++;
+    }
+
+    // A variable with a single level inside this group explains nothing
+    // here, but the group still contributes to the total spread.
+    for (const level of levels.values()) {
+      const levelMean = level.sum / level.count;
+      between += level.count * (levelMean - groupMean) ** 2;
+    }
+    for (const sample of members) {
+      total += (sample.rate - groupMean) ** 2;
+    }
+  }
+
+  if (total === 0) return NaN;
+  return Math.min(1, between / total);
+}
+
+// The smallest p-value the Mann-Whitney implementation can return for these
+// sample sizes, found by giving it perfectly separated groups. Below a
+// certain size that floor sits above 0.05, meaning no effect of any
+// magnitude can be reported as significant; a non-significant result then
+// says nothing at all. Derived from the implementation rather than the exact
+// combinatorial bound because it uses a normal approximation.
+const mannWhitneyFloors = new Map();
+function mannWhitneyFloor(nA, nB) {
+  const key = `${nA},${nB}`;
+  let floor = mannWhitneyFloors.get(key);
+  if (floor === undefined) {
+    // Values must stay distinct after the histogram's 5-significant-figure
+    // rounding, or they collapse into ties and the tie correction reports a
+    // floor lower than the test can actually reach. The 10000 range is exact
+    // at that precision, and the two runs cannot overlap.
+    const low = createHistogram({ figures: 5 });
+    const high = createHistogram({ figures: 5 });
+    for (let i = 0; i < nA; i++) low.record(10000 + i);
+    for (let i = 0; i < nB; i++) high.record(10000 + nA + i);
+    floor = high.mannWhitneyTest(low).pValue;
+    mannWhitneyFloors.set(key, floor);
+  }
+  return floor;
+}
+
+// Cliff's delta magnitude thresholds (Romano et al.), the conventional
+// reading of the statistic.
+function effectSizeLabel(delta) {
+  const d = Math.abs(delta);
+  if (d < 0.147) return 'negligible';
+  if (d < 0.33) return 'small';
+  if (d < 0.474) return 'medium';
+  return 'large';
+}
+
+// The question scatter.js exists to answer is whether a parameter changes the
+// rate, which the per-group table only hints at through overlapping intervals.
+// Compare consecutive x-axis values directly, holding the category fixed.
+// Mann-Whitney rather than a t-test because a parameter sweep routinely
+// changes the shape and spread of the distribution, not just its centre.
+function printComparisons(rows, xAxis, category) {
+  const usable = rows.filter((row) => row.n > 1);
+  if (usable.length < 2) return;
+
+  // Partition by category so each series is a sweep over the x-axis alone.
+  const series = new Map();
+  for (const row of usable) {
+    const key = String(row.catValue);
+    if (!series.has(key)) series.set(key, []);
+    series.get(key).push(row);
+  }
+
+  const lines = [];
+  let floor = 0;
+  for (const group of series.values()) {
+    if (group.length < 2) continue;
+
+    const entries = [];
+    for (let i = 1; i < group.length; i++) {
+      const previous = group[i - 1];
+      const current = group[i];
+      const { pValue } = current.histogram.mannWhitneyTest(previous.histogram);
+      const delta = current.histogram.cliffsD(previous.histogram);
+      const change = ((current.mean - previous.mean) / previous.mean) * 100;
+
+      floor = Math.max(floor, mannWhitneyFloor(previous.n, current.n));
+
+      // How the rate scales with the parameter over this step, which is the
+      // complexity question these sweeps are usually run to answer. Reported
+      // per step rather than as one fit across the whole sweep: a single
+      // exponent spanning a curve that changes regime describes neither.
+      let ratio = '';
+      let exponent = '';
+      if (typeof previous.xValue === 'number' &&
+          typeof current.xValue === 'number' &&
+          previous.xValue > 0 && current.xValue > 0 &&
+          previous.xValue !== current.xValue &&
+          previous.mean > 0 && current.mean > 0) {
+        const xRatio = current.xValue / previous.xValue;
+        const value = Math.log(current.mean / previous.mean) /
+                      Math.log(xRatio);
+        ratio = `${xRatio.toFixed(1)}x`;
+        exponent = `${value >= 0 ? '+' : ''}${value.toFixed(2)}`;
+      }
+
+      entries.push({
+        transition: `${previous.xLabel} -> ${current.xLabel}`,
+        change: `${change >= 0 ? '+' : ''}${change.toFixed(2)}%`,
+        ratio,
+        exponent,
+        pValue: pValue < 1e-4 ? pValue.toExponential(1) : pValue.toFixed(4),
+        delta: `${delta >= 0 ? '+' : ''}${delta.toFixed(3)}`,
+        label: effectSizeLabel(delta),
+      });
+    }
+
+    if (entries.length > 0) {
+      lines.push({
+        heading: category === undefined ?
+          null :
+          `${category}=${group[0].catLabel}`,
+        entries,
+      });
+    }
+  }
+
+  if (lines.length === 0) return;
+
+  const all = lines.flatMap((l) => l.entries);
+  const widths = {
+    transition: Math.max(...all.map((e) => displayWidth(e.transition))),
+    change: Math.max(...all.map((e) => displayWidth(e.change))),
+    ratio: Math.max(...all.map((e) => displayWidth(e.ratio))),
+    exponent: Math.max(...all.map((e) => displayWidth(e.exponent))),
+    pValue: Math.max(...all.map((e) => displayWidth(e.pValue))),
+    delta: Math.max(...all.map((e) => displayWidth(e.delta))),
+  };
+  const rpad = (s, n) => padTo(s, n, true);
+  const pad = (s, n) => padTo(s, n, false);
+
+  console.log('');
+  console.log(`Change between consecutive ${xAxis} values ` +
+              `(Mann-Whitney U, Cliff's delta):`);
+
+  for (const { heading, entries } of lines) {
+    console.log('');
+    if (heading !== null) {
+      console.log(`  ${heading}`);
+    }
+    for (const entry of entries) {
+      console.log(
+        `    ${pad(entry.transition, widths.transition)}` +
+        `  ${rpad(entry.change, widths.change)}` +
+        (widths.exponent > 0 ?
+          `  ${rpad(entry.ratio, widths.ratio)}` +
+          `  exponent=${rpad(entry.exponent, widths.exponent)}` :
+          '') +
+        `  p=${rpad(entry.pValue, widths.pValue)}` +
+        `  delta=${rpad(entry.delta, widths.delta)} (${entry.label})`,
+      );
+    }
+  }
+
+  // A p-value has to be read against what the test could have produced. Below
+  // a certain sample size the floor sits above the threshold, and "not
+  // significant" then carries no information whatsoever.
+  if (floor >= 0.05) {
+    console.log('');
+    printWrapped(
+      `Warning: at this sample size the smallest p-value this test can ` +
+      `produce is ${floor.toFixed(4)}, so no comparison above can reach ` +
+      `significance however large the real effect is. Treat every p-value ` +
+      `here as uninformative and raise --runs.`,
+    );
+  } else if (floor >= 0.005) {
+    console.log('');
+    printWrapped(
+      `Note: at this sample size the smallest p-value this test can produce ` +
+      `is ${floor.toFixed(4)}. A non-significant result above is therefore ` +
+      `weak evidence of no change rather than evidence of none; raise ` +
+      `--runs to strengthen it.`,
+    );
+  }
+}
+
+function formatRate(rate) {
+  return rate.toLocaleString('en-US', {
+    minimumFractionDigits: 1,
+    maximumFractionDigits: 1,
+  });
+}
+
+// Widest a single variable value may be before it is abbreviated. Benchmark
+// values are usually short (`16`, `'ascii'`), but some are long enough to
+// destroy the layout on their own, so there has to be a ceiling.
+const kMaxValueWidth = 24;
+
+// Widest a composed chart label may be, since it can hold two values.
+const kMaxChartLabelWidth = 44;
+
+// Widths are measured in code points, not UTF-16 code units: several
+// benchmarks use emoji and CJK in their configurations, and counting those
+// as two would misalign every column to their right.
+function displayWidth(text) {
+  return [...text].length;
+}
+
+function padTo(text, width, alignRight) {
+  const padding = ' '.repeat(Math.max(0, width - displayWidth(text)));
+  return alignRight ? padding + text : text + padding;
+}
+
+// Drop out the middle rather than the tail: benchmark values that share a
+// long prefix are common, and a head-only truncation would render them
+// identical. Slicing by code point rather than by index so that an astral
+// character cannot be cut in half into a lone surrogate.
+function truncateMiddle(text, maxWidth) {
+  const chars = [...text];
+  if (chars.length <= maxWidth) return text;
+  const keep = maxWidth - 3;
+  const head = Math.ceil(keep / 2);
+  const tail = Math.floor(keep / 2);
+  return `${chars.slice(0, head).join('')}...` +
+         `${chars.slice(chars.length - tail).join('')}`;
+}
+
+// Configuration values are not guaranteed to be printable: strings may carry
+// newlines or tabs (see benchmark/mime/mimetype-instantiation.js), which
+// would otherwise split a table row across several lines. inspect() escapes
+// them and quotes strings, matching how compare.js renders configurations.
+function displayValue(value) {
+  const text = typeof value === 'string' ? inspect(value) : String(value);
+  return { text: truncateMiddle(text, kMaxValueWidth), full: text };
+}
+
+// Assigns a short, unique, printable label to every distinct value of one
+// grouping variable, and collects the abbreviated ones for a legend so the
+// full value is still recoverable from the output.
+function assignLabels(rows, valueField, labelField) {
+  const assigned = new Map();
+  const used = new Map();
+  const legend = [];
+
+  for (const row of rows) {
+    const key = String(row[valueField]);
+    let label = assigned.get(key);
+
+    if (label === undefined) {
+      const { text, full } = displayValue(row[valueField]);
+      // Two different values can abbreviate to the same text; keep them
+      // distinguishable so the table cannot show one group twice.
+      const collisions = used.get(text) ?? 0;
+      used.set(text, collisions + 1);
+      label = collisions === 0 ? text : `${text}~${collisions + 1}`;
+      assigned.set(key, label);
+      if (text !== full) legend.push({ label, full });
+    }
+
+    row[labelField] = label;
+  }
+
+  return legend;
+}
+
+// Notes interpolate variable names and sample sizes, so their length is not
+// known when they are written. Wrapping here rather than hand-placing
+// newlines, which overflow as soon as an interpolated value is longer than
+// the author guessed.
+function printWrapped(text, width = 76) {
+  let line = '';
+  for (const word of text.split(/\s+/)) {
+    if (line === '') {
+      line = word;
+    } else if (displayWidth(line) + 1 + displayWidth(word) <= width) {
+      line += ` ${word}`;
+    } else {
+      console.log(line);
+      line = word;
+    }
+  }
+  if (line !== '') console.log(line);
+}
+
+function printLegend(legend) {
+  if (legend.length === 0) return;
+  console.log('');
+  console.log('Abbreviated values:');
+  for (const { label, full } of legend) {
+    console.log(`  ${label}`);
+    console.log(`    = ${full}`);
+  }
+}
+
+function printTable(rows, xAxis, category) {
+  const header = [xAxis];
+  if (category !== undefined) header.push(category);
+  header.push('samples', 'rate', 'confidence.interval',
+              'median', 'median.interval', '');
+
+  // Numbers line up on the right, text reads better on the left. The grouping
+  // columns can be either, so they follow the type of the underlying value.
+  const alignRight = [typeof rows[0].xValue === 'number'];
+  if (category !== undefined) {
+    alignRight.push(typeof rows[0].catValue === 'number');
+  }
+  alignRight.push(true, true, true, true, true, false);
+
+  const body = rows.map((row) => {
+    const cells = [row.xLabel];
+    if (category !== undefined) cells.push(row.catLabel);
+
+    // The median interval is asymmetric, so it is shown as a relative range
+    // rather than a single half-width.
+    const medianInterval = row.n > 1 ?
+      `[${(((row.medianLower - row.median) / row.median) * 100).toFixed(2)}%, ` +
+      `+${(((row.medianUpper - row.median) / row.median) * 100).toFixed(2)}%]` :
+      'NA';
+
+    cells.push(
+      String(row.n),
+      formatRate(row.mean),
+      // Absolute for parity with scatter.R, relative because that is what
+      // tells you whether the rate beside it is worth reading. Kept in one
+      // column so every column has a header of its own.
+      Number.isNaN(row.ci) ?
+        'NA' :
+        `${formatRate(row.ci)} (±${((row.ci / row.mean) * 100).toFixed(2)}%)`,
+      formatRate(row.median),
+      medianInterval,
+      row.skewed ? '(!)' : '',
+    );
+    return cells;
+  });
+
+  const widths = header.map((_, col) => Math.max(
+    displayWidth(header[col]),
+    ...body.map((cells) => displayWidth(cells[col])),
+  ));
+
+  const line = (cells) => cells
+    .map((cell, col) => padTo(cell, widths[col], alignRight[col]))
+    .join('  ')
+    .trimEnd();
+
+  console.log(line(header));
+  for (const cells of body) {
+    console.log(line(cells));
+  }
+}
+
+function printChart(rows, xAxis, category) {
+  if (rows.length === 0) return;
+
+  const barWidth = 40;
+  // Bars are drawn from zero so that the visual length is proportional to the
+  // rate. A truncated axis would exaggerate small differences.
+  let maxRate = 0;
+  for (const row of rows) {
+    const extent = row.mean + (Number.isNaN(row.ci) ? 0 : row.ci);
+    if (extent > maxRate) maxRate = extent;
+  }
+  if (maxRate === 0) return;
+
+  const labels = rows.map((row) => {
+    const parts = [`${xAxis}=${row.xLabel}`];
+    if (category !== undefined) parts.push(`${category}=${row.catLabel}`);
+    return truncateMiddle(parts.join(' '), kMaxChartLabelWidth);
+  });
+  const labelWidth = Math.max(...labels.map(displayWidth));
+  const rateWidth = Math.max(
+    ...rows.map((r) => displayWidth(formatRate(r.mean))));
+
+  const pad = (s, n) => padTo(s, n, false);
+  const rpad = (s, n) => padTo(s, n, true);
+
+  const axisRight = formatRate(maxRate);
+  const indent = ' '.repeat(labelWidth + 2);
+
+  console.log('');
+  console.log('Rate in operations/second; longer is faster. \u2502 marks the ' +
+              'mean and the');
+  console.log('shaded band (\u2591) is its 95% confidence interval, so bars ' +
+              'whose bands');
+  console.log('overlap are not clearly different.');
+  console.log('');
+  console.log(
+    `${indent}0` +
+    `${' '.repeat(Math.max(1, barWidth - 1 - displayWidth(axisRight)))}` +
+    `${axisRight}`,
+  );
+  console.log(`${indent}+${'-'.repeat(Math.max(0, barWidth - 2))}+`);
+
+  let previousX;
+  for (let i = 0; i < rows.length; i++) {
+    const row = rows[i];
+
+    // A blank line between x-axis values, so the categories being compared at
+    // each point stay visually grouped.
+    if (previousX !== undefined && row.xValue !== previousX) {
+      console.log('');
+    }
+    previousX = row.xValue;
+
+    const barEnd = (row.mean / maxRate) * barWidth;
+    const ci = Number.isNaN(row.ci) ? 0 : row.ci;
+    const ciLeft = ((row.mean - ci) / maxRate) * barWidth;
+    const ciRight = ((row.mean + ci) / maxRate) * barWidth;
+
+    // Without an explicit marker the mean is invisible, because the shaded
+    // interval is drawn over the solid bar and straddles it.
+    const meanCell = Math.min(barWidth - 1, Math.floor(barEnd));
+
+    let bar = '';
+    for (let x = 0; x < barWidth; x++) {
+      const pos = x + 0.5; // Center of this character cell.
+      if (x === meanCell) {
+        bar += '\u2502'; // The mean itself.
+      } else if (pos >= ciLeft && pos <= ciRight) {
+        bar += '\u2591'; // Light shade marks the confidence interval.
+      } else if (pos <= barEnd) {
+        bar += '\u2588';
+      } else {
+        bar += ' ';
+      }
+    }
+
+    console.log(
+      `${pad(labels[i], labelWidth)}  ${bar}  ` +
+      `${rpad(formatRate(row.mean), rateWidth)}`,
+    );
+  }
+}
diff --git a/benchmark/vfs/module-graph.js b/benchmark/vfs/module-graph.js
new file mode 100644
index 000000000000..aee5e8616198
--- /dev/null
+++ b/benchmark/vfs/module-graph.js
@@ -0,0 +1,62 @@
+'use strict';
+const path = require('path');
+const { pathToFileURL } = require('url');
+const common = require('../common.js');
+
+const bench = common.createBenchmark(main, {
+  type: ['cjs', 'esm'],
+  files: [1e2, 1e3],
+  n: [10],
+}, { flags: ['--experimental-vfs', '--no-warnings'] });
+
+// Builds a module graph of `files` packages, each with its own package.json,
+// an index requiring a package-local file and a shared root module, and an
+// entry point that pulls in every package.
+function buildGraph(layer, files, type) {
+  const entryRequires = [];
+  if (type === 'esm') {
+    layer.writeFileSync('/package.json', '{"type":"module"}');
+  }
+  layer.writeFileSync('/shared.js',
+                      type === 'cjs' ? 'module.exports = 0;' : 'export default 0;');
+  for (let i = 0; i < files; i++) {
+    layer.mkdirSync(`/${i}`, { recursive: true });
+    if (type === 'cjs') {
+      layer.writeFileSync(`/${i}/package.json`, '{"main":"index.js"}');
+      layer.writeFileSync(`/${i}/lib.js`, 'module.exports = 1;');
+      layer.writeFileSync(
+        `/${i}/index.js`,
+        'require("./lib.js"); require("../shared.js"); module.exports = __filename;');
+      entryRequires.push(`require('./${i}/');`);
+    } else {
+      layer.writeFileSync(`/${i}/package.json`, '{"type":"module"}');
+      layer.writeFileSync(`/${i}/lib.js`, 'export default 1;');
+      layer.writeFileSync(
+        `/${i}/index.js`,
+        'import "./lib.js"; import "../shared.js"; export default import.meta.url;');
+      entryRequires.push(`import './${i}/index.js';`);
+    }
+  }
+  layer.writeFileSync('/entry.js', entryRequires.join('\n'));
+}
+
+async function main({ n, type, files }) {
+  const vfs = require('node:vfs');
+  const layer = vfs.create();
+  buildGraph(layer, files, type);
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    const mountPoint = layer.mount();
+    const entry = path.join(mountPoint, 'entry.js');
+    if (type === 'cjs') {
+      require(entry);
+    } else {
+      await import(pathToFileURL(entry).href);
+    }
+    // Unmounting purges the module caches for the mount prefix, so every
+    // iteration is a cold load of the full graph.
+    layer.unmount();
+  }
+  bench.end(n * files);
+}
diff --git a/benchmark/webstreams/adapters.js b/benchmark/webstreams/adapters.js
new file mode 100644
index 000000000000..ae97e4928f88
--- /dev/null
+++ b/benchmark/webstreams/adapters.js
@@ -0,0 +1,106 @@
+'use strict';
+const common = require('../common.js');
+const {
+  Readable,
+  Writable,
+} = require('node:stream');
+const {
+  ReadableStream,
+  WritableStream,
+} = require('node:stream/web');
+
+const bench = common.createBenchmark(main, {
+  n: [1e5],
+  kind: [
+    'readable-to-web',
+    'readable-from-web',
+    'writable-to-web',
+    'writable-from-web',
+  ],
+});
+
+async function readableToWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  let i = 0;
+  const streamReadable = new Readable({
+    read() {
+      if (i++ < n)
+        this.push(chunk);
+      else
+        this.push(null);
+    },
+  });
+  const reader = Readable.toWeb(streamReadable).getReader();
+  bench.start();
+  while (!(await reader.read()).done);
+  bench.end(n);
+}
+
+function readableFromWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  let i = 0;
+  const readableStream = new ReadableStream({
+    pull(controller) {
+      if (i++ < n)
+        controller.enqueue(chunk);
+      else
+        controller.close();
+    },
+  });
+  const streamReadable = Readable.fromWeb(readableStream);
+  bench.start();
+  streamReadable.on('data', () => {});
+  streamReadable.on('end', () => bench.end(n));
+}
+
+async function writableToWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  const streamWritable = new Writable({
+    write(chunk, encoding, callback) {
+      callback();
+    },
+  });
+  const writer = Writable.toWeb(streamWritable).getWriter();
+  bench.start();
+  for (let i = 0; i < n; i++)
+    await writer.write(chunk);
+  await writer.close();
+  bench.end(n);
+}
+
+function writableFromWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  const writableStream = new WritableStream({
+    write() {},
+  });
+  const streamWritable = Writable.fromWeb(writableStream);
+  bench.start();
+  let i = 0;
+  function writeLoop() {
+    while (i++ < n) {
+      if (!streamWritable.write(chunk)) {
+        streamWritable.once('drain', writeLoop);
+        return;
+      }
+    }
+    streamWritable.end(() => bench.end(n));
+  }
+  writeLoop();
+}
+
+function main({ n, kind }) {
+  switch (kind) {
+    case 'readable-to-web':
+      readableToWeb(n);
+      break;
+    case 'readable-from-web':
+      readableFromWeb(n);
+      break;
+    case 'writable-to-web':
+      writableToWeb(n);
+      break;
+    case 'writable-from-web':
+      writableFromWeb(n);
+      break;
+  }
+}
diff --git a/common.gypi b/common.gypi
index 1729bfd3cb00..e6a17d3505a5 100644
--- a/common.gypi
+++ b/common.gypi
@@ -17,6 +17,7 @@
     'emulator%': [],
 
     'node_shared%': 'false',
+    'node_enable_v8debughelper%': 'false',
     'node_enable_experimentals%': 'false',
     'force_dynamic_crt%': 0,
     'node_use_v8_platform%': 'true',
@@ -42,7 +43,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.28',
+    'v8_embedder_string': '-node.32',
 
     ##### V8 defaults for Node.js #####
 
@@ -654,7 +655,9 @@
             'cflags!': [ '-pthread' ],
             'ldflags!': [ '-pthread' ],
           }],
-          [ 'node_shared=="true"', {
+          # The V8 static libraries get linked into libv8_debug_helper, so they
+          # have to be position independent too.
+          [ 'node_shared=="true" or node_enable_v8debughelper=="true"', {
             'cflags': [ '-fPIC' ],
             'ldflags': [ '-fPIC' ],
           }],
diff --git a/configure.py b/configure.py
index b663ba85f58e..84a688917efe 100755
--- a/configure.py
+++ b/configure.py
@@ -282,6 +282,28 @@
     help='Use the specified path to system CA (PEM format) in addition to '
          'the OpenSSL supplied CA store or compiled-in Mozilla CA copy.')
 
+shared_optgroup.add_argument('--shared-abseil',
+    action='store_true',
+    dest='shared_abseil',
+    default=None,
+    help='link to a shared Abseil DLL instead of static linking')
+
+shared_optgroup.add_argument('--shared-abseil-includes',
+    action='store',
+    dest='shared_abseil_includes',
+    help='directory containing Abseil header files')
+
+shared_optgroup.add_argument('--shared-abseil-libname',
+    action='store',
+    dest='shared_abseil_libname',
+    default=None,
+    help='alternative lib name to link to [default: %(default)s]')
+
+shared_optgroup.add_argument('--shared-abseil-libpath',
+    action='store',
+    dest='shared_abseil_libpath',
+    help='a directory to search for the shared Abseil DLL')
+
 shared_optgroup.add_argument('--shared-gtest',
     action='store_true',
     dest='shared_gtest',
@@ -326,11 +348,27 @@
     dest='shared_hdr_histogram_libpath',
     help='a directory to search for the shared HdrHistogram DLL')
 
-parser.add_argument('--experimental-http-parser',
+shared_optgroup.add_argument('--shared-highway',
     action='store_true',
-    dest='experimental_http_parser',
+    dest='shared_highway',
     default=None,
-    help='(no-op)')
+    help='link to a shared Highway (hwy) DLL instead of static linking')
+
+shared_optgroup.add_argument('--shared-highway-includes',
+    action='store',
+    dest='shared_highway_includes',
+    help='directory containing Highway header files')
+
+shared_optgroup.add_argument('--shared-highway-libname',
+    action='store',
+    dest='shared_highway_libname',
+    default='hwy',
+    help='alternative lib name to link to [default: %(default)s]')
+
+shared_optgroup.add_argument('--shared-highway-libpath',
+    action='store',
+    dest='shared_highway_libpath',
+    help='a directory to search for the shared Highway DLL')
 
 shared_optgroup.add_argument('--shared-http-parser',
     action='store_true',
@@ -508,6 +546,29 @@
     dest='shared_openssl_libpath',
     help='a directory to search for the shared OpenSSL DLLs')
 
+shared_optgroup.add_argument('--shared-perfetto',
+    action='store_true',
+    dest='shared_perfetto',
+    default=None,
+    help='link to a shared perfetto SDK instead of the one in deps/perfetto '
+         '(requires --with-perfetto)')
+
+shared_optgroup.add_argument('--shared-perfetto-includes',
+    action='store',
+    dest='shared_perfetto_includes',
+    help='directory containing perfetto header files')
+
+shared_optgroup.add_argument('--shared-perfetto-libname',
+    action='store',
+    dest='shared_perfetto_libname',
+    default='perfetto',
+    help='alternative lib name to link to [default: %(default)s]')
+
+shared_optgroup.add_argument('--shared-perfetto-libpath',
+    action='store',
+    dest='shared_perfetto_libpath',
+    help='a directory to search for the shared perfetto DLL')
+
 shared_optgroup.add_argument('--shared-uvwasi',
     action='store_true',
     dest='shared_uvwasi',
@@ -812,6 +873,13 @@
     default=None,
     help=argparse.SUPPRESS)  # Undocumented.
 
+parser.add_argument('--enable-v8debughelper',
+    action='store_true',
+    dest='enable_v8debughelper',
+    default=None,
+    help='Build V8\'s debug helper as a shared library, loadable by a debugger '
+         'extension.')
+
 parser.add_argument('--enable-trace-maps',
     action='store_true',
     dest='trace_maps',
@@ -834,7 +902,7 @@
     action='store_true',
     dest='pointer_compression_shared_cage',
     default=None,
-    help='[Experimental] Use V8 pointer compression with shared cage (requires --experimental-enable-pointer-compression)')
+    help='[Experimental] Use V8 pointer compression with a shared cage and enable the V8 sandbox (requires --experimental-enable-pointer-compression)')
 
 parser.add_argument('--v8-options',
     action='store',
@@ -884,13 +952,13 @@
     action='store_true',
     dest='node_use_large_pages',
     default=None,
-    help='This option has no effect. --use-largepages is now a runtime option.')
+    help='This option is no longer supported and a no-op.')
 
 parser.add_argument('--use-largepages-script-lld',
     action='store_true',
     dest='node_use_large_pages_script_lld',
     default=None,
-    help='This option has no effect. --use-largepages is now a runtime option.')
+    help='This option is no longer supported and a no-op.')
 
 parser.add_argument('--use-section-ordering-file',
     action='store',
@@ -1022,33 +1090,12 @@
     default=None,
     help='enable Control Flow Guard (CFG)')
 
-# Dummy option for backwards compatibility
-parser.add_argument('--without-report',
-    action='store_true',
-    dest='unused_without_report',
-    default=None,
-    help=argparse.SUPPRESS)
-
-parser.add_argument('--with-snapshot',
-    action='store_true',
-    dest='unused_with_snapshot',
-    default=None,
-    help=argparse.SUPPRESS)
-
-parser.add_argument('--without-snapshot',
-    action='store_true',
-    dest='unused_without_snapshot',
-    default=None,
-    help=argparse.SUPPRESS)
-
 parser.add_argument('--without-siphash',
     action='store_true',
     dest='without_siphash',
     default=None,
     help=argparse.SUPPRESS)
 
-# End dummy list.
-
 parser.add_argument('--without-ssl',
     action='store_true',
     dest='without_ssl',
@@ -1079,6 +1126,12 @@
     default=None,
     help='build with experimental QUIC support')
 
+parser.add_argument('--experimental-dtls',
+    action='store_true',
+    dest='experimental_dtls',
+    default=None,
+    help='build with experimental DTLS support')
+
 parser.add_argument('--ninja',
     action='store_true',
     dest='use_ninja',
@@ -1900,8 +1953,6 @@ def configure_node(o):
                      else target_arch != host_arch)
   if cross_compiling:
     os.environ['GYP_CROSSCOMPILE'] = "1"
-  if options.unused_without_snapshot:
-    warn('building --without-snapshot is no longer possible')
 
   o['variables']['want_separate_host_toolset'] = int(cross_compiling)
 
@@ -2041,10 +2092,8 @@ def configure_node(o):
 
   if options.node_use_large_pages or options.node_use_large_pages_script_lld:
     warn('''The `--use-largepages` and `--use-largepages-script-lld` options
-         have no effect during build time. Support for mapping to large pages is
-         now a runtime option of Node.js. Run `node --use-largepages` or add
-         `--use-largepages` to the `NODE_OPTIONS` environment variable once
-         Node.js is built to enable mapping to large pages.''')
+         have no effect. Mapping the Node.js static code to large pages is
+         no longer supported.''')
 
   if options.no_ifaddrs:
     o['defines'] += ['SUNOS_NO_IFADDRS']
@@ -2195,16 +2244,10 @@ def configure_v8(o, configs):
                                          flavor not in ('aix', 'os400', 'zos') and
                                          o['variables']['target_arch'] in maglev_enabled_architectures)
   o['variables']['v8_enable_pointer_compression'] = 1 if options.enable_pointer_compression else 0
-  # Using the sandbox requires always allocating array buffer backing stores in the sandbox.
-  # We currently have many backing stores tied to pointers from C++ land that are not
-  # even necessarily dynamic (e.g. in static storage) for fast communication between JS and C++.
-  # Until we manage to get rid of all those, v8_enable_sandbox cannot be used.
-  # Note that enabling pointer compression without enabling sandbox is unsupported by V8,
-  # so this can be broken at any time.
-  o['variables']['v8_enable_sandbox'] = 0
-  # We set v8_enable_pointer_compression_shared_cage to 0 always, even when
-  # pointer compression is enabled so that we don't accidentally enable shared
-  # cage mode when pointer compression is on.
+  # Like V8's own default, the sandbox goes with the shared pointer compression
+  # cage. Multi-cage builds give every IsolateGroup its own sandbox, which the
+  # array buffer allocator does not know about yet.
+  o['variables']['v8_enable_sandbox'] = 1 if options.pointer_compression_shared_cage else 0
   o['variables']['v8_enable_pointer_compression_shared_cage'] = 1 if options.pointer_compression_shared_cage else 0
   o['variables']['v8_enable_external_code_space'] = 1 if options.enable_pointer_compression else 0
   o['variables']['v8_enable_31bit_smis_on_64bit_arch'] = 1 if options.enable_pointer_compression else 0
@@ -2229,6 +2272,7 @@ def configure_v8(o, configs):
   o['variables']['force_dynamic_crt'] = 1 if options.shared else 0
   o['variables']['node_enable_d8'] = b(options.enable_d8)
   o['variables']['node_enable_v8windbg'] = b(options.enable_v8windbg)
+  o['variables']['node_enable_v8debughelper'] = b(options.enable_v8debughelper)
   if options.enable_d8:
     o['variables']['test_isolation_mode'] = 'noop'  # Needed by d8.gyp.
   if options.without_bundled_v8:
@@ -2236,6 +2280,8 @@ def configure_v8(o, configs):
       raise Exception('--enable-d8 is incompatible with --without-bundled-v8.')
     if options.enable_v8windbg:
       raise Exception('--enable-v8windbg is incompatible with --without-bundled-v8.')
+    if options.enable_v8debughelper:
+      raise Exception('--enable-v8debughelper is incompatible with --without-bundled-v8.')
     (pkg_libs, pkg_cflags, pkg_libpath, _) = pkg_config("v8")
     if pkg_libs and pkg_libpath:
       output['libraries'] += [pkg_libpath] + pkg_libs.split()
@@ -2343,6 +2389,15 @@ def configure_lief(o):
 
   configure_library('lief', o, pkgname='LIEF')
 
+def configure_perfetto(o):
+  if not options.with_perfetto:
+    if options.shared_perfetto:
+      error('--shared-perfetto requires --with-perfetto')
+    o['variables']['node_shared_perfetto'] = b(False)
+    return
+
+  configure_library('perfetto', o)
+
 def configure_sqlite(o):
   o['variables']['node_use_sqlite'] = b(not options.without_sqlite)
   if options.without_sqlite:
@@ -2398,6 +2453,10 @@ def configure_quic(o):
   o['variables']['node_use_quic'] = b(options.experimental_quic and
                                       not options.without_ssl)
 
+def configure_dtls(o):
+  o['variables']['node_use_dtls'] = b(options.experimental_dtls and
+                                      not options.without_ssl)
+
 def configure_static(o):
   if options.fully_static or options.partly_static:
     if flavor == 'mac':
@@ -2835,6 +2894,71 @@ def make_bin_override():
 configure_library('zlib', output)
 configure_library('http_parser', output, pkgname='libllhttp')
 configure_library('libuv', output)
+configure_library('abseil', output, pkgname=[
+  'absl_absl_check',
+  'absl_absl_log',
+  'absl_absl_vlog_is_on',
+  'absl_algorithm_container',
+  'absl_algorithm',
+  'absl_any_invocable',
+  'absl_base',
+  'absl_bind_front',
+  'absl_bits',
+  'absl_btree',
+  'absl_charset',
+  'absl_cleanup',
+  'absl_config',
+  'absl_cord',
+  'absl_core_headers',
+  'absl_die_if_null',
+  'absl_dynamic_annotations',
+  'absl_failure_signal_handler',
+  'absl_fast_type_id',
+  'absl_fixed_array',
+  'absl_flat_hash_map',
+  'absl_flat_hash_set',
+  'absl_function_ref',
+  'absl_has_ostream_operator',
+  'absl_hash_container_defaults',
+  'absl_hash',
+  'absl_inlined_vector',
+  'absl_int128',
+  'absl_layout',
+  'absl_leak_check',
+  'absl_linked_hash_map',
+  'absl_linked_hash_set',
+  'absl_log_entry',
+  'absl_log_globals',
+  'absl_log_initialize',
+  'absl_log_severity',
+  'absl_log_sink_registry',
+  'absl_log_sink',
+  'absl_memory',
+  'absl_no_destructor',
+  'absl_node_hash_map',
+  'absl_node_hash_set',
+  'absl_nullability',
+  'absl_optional',
+  'absl_overload',
+  'absl_prefetch',
+  'absl_random_bit_gen_ref',
+  'absl_random_distributions',
+  'absl_random_random',
+  'absl_raw_logging_internal',
+  'absl_span',
+  'absl_stacktrace',
+  'absl_status',
+  'absl_statusor',
+  'absl_str_format',
+  'absl_string_view',
+  'absl_strings',
+  'absl_symbolize',
+  'absl_synchronization',
+  'absl_time',
+  'absl_type_traits',
+  'absl_utility',
+  'absl_variant',
+])
 configure_library('ada', output)
 configure_library('simdjson', output)
 configure_library('simdutf', output)
@@ -2842,12 +2966,14 @@ def make_bin_override():
 configure_library('cares', output, pkgname='libcares')
 configure_library('gtest', output)
 configure_library('hdr_histogram', output)
+configure_library('highway', output, pkgname='libhwy')
 configure_library('merve', output)
 configure_library('nbytes', output)
 configure_library('nghttp2', output, pkgname='libnghttp2')
 configure_library('nghttp3', output, pkgname='libnghttp3')
 configure_library('ngtcp2', output, pkgname='libngtcp2')
 configure_lief(output);
+configure_perfetto(output);
 configure_sqlite(output);
 configure_ffi(output);
 configure_library('temporal_capi', output)
@@ -2856,6 +2982,7 @@ def make_bin_override():
 configure_v8(output, configurations)
 configure_openssl(output)
 configure_quic(output)
+configure_dtls(output)
 configure_intl(output)
 configure_static(output)
 configure_inspector(output)
diff --git a/deps/brotli/unofficial.gni b/deps/brotli/unofficial.gni
index 91001fa43ea4..0c6a7bd8c450 100644
--- a/deps/brotli/unofficial.gni
+++ b/deps/brotli/unofficial.gni
@@ -4,36 +4,49 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
-template("brotli_gn_build") {
-  config("brotli_config") {
-    include_dirs = [ "c/include" ]
-  }
+import("../../node.gni")
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("brotli.gyp") ],
-                            "scope",
-                            [ "brotli.gyp" ])
-
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":brotli_config" ]
-    sources = gypi_values.brotli_sources
-    if (is_linux) {
-      defines = [ "OS_LINUX" ]
-    } else if (is_mac) {
-      defines = [ "OS_MACOSX" ]
-    } else if (target_os == "freebsd") {
-      defines = [ "OS_FREEBSD" ]
+template("brotli_gn_build") {
+  if (node_shared_brotli) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("brotli_config") {
+      packages = [ "libbrotlidec", "libbrotlienc" ]
     }
-    if (is_linux) {
-      libs = [ "m" ]
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":brotli_config" ]
     }
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-implicit-fallthrough",
-        "-Wno-unreachable-code",
-        "-Wno-unreachable-code-return",
-      ]
+  } else {
+    config("brotli_config") {
+      include_dirs = [ "c/include" ]
+    }
+
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("brotli.gyp") ],
+                              "scope",
+                              [ "brotli.gyp" ])
+
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":brotli_config" ]
+      sources = gypi_values.brotli_sources
+      if (is_linux) {
+        defines = [ "OS_LINUX" ]
+      } else if (is_mac) {
+        defines = [ "OS_MACOSX" ]
+      } else if (target_os == "freebsd") {
+        defines = [ "OS_FREEBSD" ]
+      }
+      if (is_linux) {
+        libs = [ "m" ]
+      }
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-implicit-fallthrough",
+          "-Wno-unreachable-code",
+          "-Wno-unreachable-code-return",
+        ]
+      }
     }
   }
 }
diff --git a/deps/cares/unofficial.gni b/deps/cares/unofficial.gni
index e02d7f425194..364df1f312e2 100644
--- a/deps/cares/unofficial.gni
+++ b/deps/cares/unofficial.gni
@@ -4,78 +4,91 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
-template("cares_gn_build") {
-  config("cares_config") {
-    include_dirs = [ "include" ]
-    if (!is_component_build) {
-      defines = [ "CARES_STATICLIB" ]
-    }
-  }
-
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("cares.gyp") ],
-                            "scope",
-                            [ "cares.gyp" ])
+import("../../node.gni")
 
-  component(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":cares_config" ]
-    if (is_component_build) {
-      defines = [ "CARES_BUILDING_LIBRARY" ]
-    } else {
-      defines = []
+template("cares_gn_build") {
+  if (node_shared_cares) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("cares_config") {
+      packages = [ "libcares" ]
     }
-    if (is_win) {
-      defines += [ "CARES_PULL_WS2TCPIP_H=1" ]
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":cares_config" ]
     }
-    if (is_posix) {
-      defines += [
-        "_DARWIN_USE_64_BIT_INODE=1",
-        "_LARGEFILE_SOURCE",
-        "_FILE_OFFSET_BITS=64",
-        "_GNU_SOURCE",
-        "HAVE_CONFIG_H",
-      ]
+  } else {
+    config("cares_config") {
+      include_dirs = [ "include" ]
+      if (!is_component_build) {
+        defines = [ "CARES_STATICLIB" ]
+      }
     }
 
-    include_dirs = [
-      "src/lib",
-      "src/lib/include",
-    ]
-    if (is_win) {
-      include_dirs += [ "config/win32" ]
-    } else if (is_linux) {
-      include_dirs += [ "config/linux" ]
-    } else if (is_mac) {
-      include_dirs += [ "config/darwin" ]
-    }
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("cares.gyp") ],
+                              "scope",
+                              [ "cares.gyp" ])
 
-    if (is_win) {
-      libs = [
-        "ws2_32.lib",
-        "iphlpapi.lib",
-      ]
-    }
+    component(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":cares_config" ]
+      if (is_component_build) {
+        defines = [ "CARES_BUILDING_LIBRARY" ]
+      } else {
+        defines = []
+      }
+      if (is_win) {
+        defines += [ "CARES_PULL_WS2TCPIP_H=1" ]
+      }
+      if (is_posix) {
+        defines += [
+          "_DARWIN_USE_64_BIT_INODE=1",
+          "_LARGEFILE_SOURCE",
+          "_FILE_OFFSET_BITS=64",
+          "_GNU_SOURCE",
+          "HAVE_CONFIG_H",
+        ]
+      }
 
-    sources = gypi_values.cares_sources_common
-    if (is_linux) {
-      sources += [ "config/linux/ares_config.h" ]
-    }
-    if (is_mac) {
-      sources += gypi_values.cares_sources_mac
-    }
+      include_dirs = [
+        "src/lib",
+        "src/lib/include",
+      ]
+      if (is_win) {
+        include_dirs += [ "config/win32" ]
+      } else if (is_linux) {
+        include_dirs += [ "config/linux" ]
+      } else if (is_mac) {
+        include_dirs += [ "config/darwin" ]
+      }
 
-    if (is_clang) {
       if (is_win) {
-        cflags_c = [
-          "-Wno-macro-redefined",
-        ]
-      } else {
-        cflags_c = [
-          "-Wno-implicit-fallthrough",
-          "-Wno-unreachable-code",
+        libs = [
+          "ws2_32.lib",
+          "iphlpapi.lib",
         ]
       }
+
+      sources = gypi_values.cares_sources_common
+      if (is_linux) {
+        sources += [ "config/linux/ares_config.h" ]
+      }
+      if (is_mac) {
+        sources += gypi_values.cares_sources_mac
+      }
+
+      if (is_clang) {
+        if (is_win) {
+          cflags_c = [
+            "-Wno-macro-redefined",
+          ]
+        } else {
+          cflags_c = [
+            "-Wno-implicit-fallthrough",
+            "-Wno-unreachable-code",
+          ]
+        }
+      }
     }
   }
 }
diff --git a/deps/googletest/include/gtest/gtest-assertion-result.h b/deps/googletest/include/gtest/gtest-assertion-result.h
index a72ac939102e..882e9849353a 100644
--- a/deps/googletest/include/gtest/gtest-assertion-result.h
+++ b/deps/googletest/include/gtest/gtest-assertion-result.h
@@ -143,13 +143,9 @@ class GTEST_API_ [[nodiscard]] AssertionResult {
   // Used in EXPECT_TRUE/FALSE(assertion_result).
   AssertionResult(const AssertionResult& other);
 
-// C4800 is a level 3 warning in Visual Studio 2015 and earlier.
-// This warning is not emitted in Visual Studio 2017.
-// This warning is off by default starting in Visual Studio 2019 but can be
-// enabled with command-line options.
-#if defined(_MSC_VER) && (_MSC_VER < 1910 || _MSC_VER >= 1920)
+  // C4800 is off by default starting in Visual Studio 2019 but can be
+  // enabled with command-line options.
   GTEST_DISABLE_MSC_WARNINGS_PUSH_(4800 /* forcing value to bool */)
-#endif
 
   // Used in the EXPECT_TRUE/FALSE(bool_expression).
   //
@@ -171,9 +167,7 @@ class GTEST_API_ [[nodiscard]] AssertionResult {
                              int> = 0>
   explicit AssertionResult(const T& success) : success_(success) {}
 
-#if defined(_MSC_VER) && (_MSC_VER < 1910 || _MSC_VER >= 1920)
   GTEST_DISABLE_MSC_WARNINGS_POP_()
-#endif
 
   // Assignment operator.
   AssertionResult& operator=(AssertionResult other) {
diff --git a/deps/googletest/include/gtest/gtest-matchers.h b/deps/googletest/include/gtest/gtest-matchers.h
index b5950425cc69..4d7a541d0f1f 100644
--- a/deps/googletest/include/gtest/gtest-matchers.h
+++ b/deps/googletest/include/gtest/gtest-matchers.h
@@ -52,16 +52,9 @@
 #include "gtest/internal/gtest-internal.h"
 #include "gtest/internal/gtest-port.h"
 
-// MSVC warning C5046 is new as of VS2017 version 15.8.
-#if defined(_MSC_VER) && _MSC_VER >= 1915
-#define GTEST_MAYBE_5046_ 5046
-#else
-#define GTEST_MAYBE_5046_
-#endif
-
 GTEST_DISABLE_MSC_WARNINGS_PUSH_(
-    4251 GTEST_MAYBE_5046_ /* class A needs to have dll-interface to be used by
-                              clients of class B */
+    // class A needs to have dll-interface to be used by clients of class B
+    4251 5046
     /* Symbol involving type with internal linkage not defined */)
 
 namespace testing {
diff --git a/deps/googletest/include/gtest/gtest-printers.h b/deps/googletest/include/gtest/gtest-printers.h
index f647ee691263..1288313b99ff 100644
--- a/deps/googletest/include/gtest/gtest-printers.h
+++ b/deps/googletest/include/gtest/gtest-printers.h
@@ -104,6 +104,8 @@
 #ifndef GOOGLETEST_INCLUDE_GTEST_GTEST_PRINTERS_H_
 #define GOOGLETEST_INCLUDE_GTEST_GTEST_PRINTERS_H_
 
+#include <stdint.h>
+
 #include <any>
 #include <functional>
 #include <memory>
@@ -279,15 +281,13 @@ struct ProtobufPrinter {
 
 struct ConvertibleToIntegerPrinter {
   // Since T has no << operator or PrintTo() but can be implicitly
-  // converted to BiggestInt, we print it as a BiggestInt.
+  // converted to intmax_t, we print it as an intmax_t.
   //
   // Most likely T is an enum type (either named or unnamed), in which
   // case printing it as an integer is the desired behavior.  In case
   // T is not an enum, printing it as an integer is the best we can do
   // given that it has no user-defined printer.
-  static void PrintValue(internal::BiggestInt value, ::std::ostream* os) {
-    *os << value;
-  }
+  static void PrintValue(intmax_t value, ::std::ostream* os) { *os << value; }
 };
 
 struct ConvertibleToStringViewPrinter {
@@ -347,7 +347,7 @@ struct FindFirstPrinter<
 //  - Print object pointers.
 //  - Print protocol buffers.
 //  - Use the stream operator, if available.
-//  - Print types convertible to BiggestInt.
+//  - Print types convertible to intmax_t.
 //  - Print types convertible to StringView, if available.
 //  - Fallback to printing the raw bytes of the object.
 template <typename T>
diff --git a/deps/googletest/include/gtest/gtest.h b/deps/googletest/include/gtest/gtest.h
index 9fe7fb44239e..7c003c5d60e3 100644
--- a/deps/googletest/include/gtest/gtest.h
+++ b/deps/googletest/include/gtest/gtest.h
@@ -1419,14 +1419,14 @@ class [[nodiscard]] EqHelper {
   }
 
   // With this overloaded version, we allow anonymous enums to be used
-  // in {ASSERT|EXPECT}_EQ when compiled with gcc 4, as anonymous
-  // enums can be implicitly cast to BiggestInt.
+  // in {ASSERT|EXPECT}_EQ when compiled with gcc 4, as anonymous enums can be
+  // implicitly cast to intmax_t.
   //
   // Even though its body looks the same as the above version, we
   // cannot merge the two, as it will make anonymous enums unhappy.
   static AssertionResult Compare(const char* lhs_expression,
-                                 const char* rhs_expression, BiggestInt lhs,
-                                 BiggestInt rhs) {
+                                 const char* rhs_expression, intmax_t lhs,
+                                 intmax_t rhs) {
     return CmpHelperEQ(lhs_expression, rhs_expression, lhs, rhs);
   }
 
diff --git a/deps/googletest/include/gtest/internal/gtest-port.h b/deps/googletest/include/gtest/internal/gtest-port.h
index 94a56ce3dd9b..154be3c16029 100644
--- a/deps/googletest/include/gtest/internal/gtest-port.h
+++ b/deps/googletest/include/gtest/internal/gtest-port.h
@@ -236,7 +236,6 @@
 // Integer types:
 //   TypeWithSize   - maps an integer to a int type.
 //   TimeInMillis   - integers of known sizes.
-//   BiggestInt     - the biggest signed integer type.
 //
 // Command-line utilities:
 //   GetInjectableArgvs() - returns the command line as a vector of strings.
@@ -342,13 +341,6 @@
 #define GTEST_INIT_GOOGLE_TEST_NAME_ "testing::InitGoogleTest"
 #endif  // !defined(GTEST_INIT_GOOGLE_TEST_NAME_)
 
-// Determines the version of gcc that is used to compile this.
-#ifdef __GNUC__
-// 40302 means version 4.3.2.
-#define GTEST_GCC_VER_ \
-  (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
-#endif  // __GNUC__
-
 // Macros for disabling Microsoft Visual C++ warnings.
 //
 //   GTEST_DISABLE_MSC_WARNINGS_PUSH_(4800 4385)
@@ -456,14 +448,6 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 #if defined(_MSC_VER) && defined(_CPPUNWIND)
 // MSVC defines _CPPUNWIND to 1 if and only if exceptions are enabled.
 #define GTEST_HAS_EXCEPTIONS 1
-#elif defined(__BORLANDC__)
-// C++Builder's implementation of the STL uses the _HAS_EXCEPTIONS
-// macro to enable exceptions, so we'll do the same.
-// Assumes that exceptions are enabled by default.
-#ifndef _HAS_EXCEPTIONS
-#define _HAS_EXCEPTIONS 1
-#endif  // _HAS_EXCEPTIONS
-#define GTEST_HAS_EXCEPTIONS _HAS_EXCEPTIONS
 #elif defined(__clang__)
 // clang defines __EXCEPTIONS if and only if exceptions are enabled before clang
 // 220714, but if and only if cleanups are enabled after that. In Obj-C++ files,
@@ -481,23 +465,11 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 #elif defined(__GNUC__) && defined(__EXCEPTIONS) && __EXCEPTIONS
 // gcc defines __EXCEPTIONS to 1 if and only if exceptions are enabled.
 #define GTEST_HAS_EXCEPTIONS 1
-#elif defined(__SUNPRO_CC)
-// Sun Pro CC supports exceptions.  However, there is no compile-time way of
-// detecting whether they are enabled or not.  Therefore, we assume that
-// they are enabled unless the user tells us otherwise.
-#define GTEST_HAS_EXCEPTIONS 1
-#elif defined(__IBMCPP__) && defined(__EXCEPTIONS) && __EXCEPTIONS
-// xlC defines __EXCEPTIONS to 1 if and only if exceptions are enabled.
-#define GTEST_HAS_EXCEPTIONS 1
-#elif defined(__HP_aCC)
-// Exception handling is in effect by default in HP aCC compiler. It has to
-// be turned of by +noeh compiler option if desired.
-#define GTEST_HAS_EXCEPTIONS 1
 #else
 // For other compilers, we assume exceptions are disabled to be
 // conservative.
 #define GTEST_HAS_EXCEPTIONS 0
-#endif  // defined(_MSC_VER) || defined(__BORLANDC__)
+#endif  // defined(_MSC_VER) && defined(_CPPUNWIND)
 #endif  // GTEST_HAS_EXCEPTIONS
 
 // MSVC either defines wchar_t as a typedef of unsigned short, or as a native
@@ -621,16 +593,6 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 
 #define GTEST_HAS_RTTI __has_feature(cxx_rtti)
 
-// Starting with version 9.0 IBM Visual Age defines __RTTI_ALL__ to 1 if
-// both the typeid and dynamic_cast features are present.
-#elif defined(__IBMCPP__) && (__IBMCPP__ >= 900)
-
-#ifdef __RTTI_ALL__
-#define GTEST_HAS_RTTI 1
-#else
-#define GTEST_HAS_RTTI 0
-#endif
-
 #else
 
 // For all other compilers, we assume RTTI is enabled.
@@ -752,8 +714,7 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 
 // Typed tests need <typeinfo> and variadic macros, which GCC, VC++ 8.0,
 // Sun Pro CC, IBM Visual Age, and HP aCC support.
-#if defined(__GNUC__) || defined(_MSC_VER) || defined(__SUNPRO_CC) || \
-    defined(__IBMCPP__) || defined(__HP_aCC)
+#if defined(__GNUC__) || defined(_MSC_VER)
 #define GTEST_HAS_TYPED_TEST 1
 #define GTEST_HAS_TYPED_TEST_P 1
 #endif
@@ -867,8 +828,7 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 #ifndef GTEST_HAS_SEH
 // The user didn't tell us, so we need to figure it out.
 
-#if defined(_MSC_VER) || defined(__BORLANDC__)
-// These two compilers are known to support SEH.
+#ifdef _MSC_VER
 #define GTEST_HAS_SEH 1
 #else
 // Assume no SEH.
@@ -2146,12 +2106,6 @@ inline bool IsDir(const StatStruct& st) { return S_ISDIR(st.st_mode); }
 
 #ifdef GTEST_OS_WINDOWS
 
-#ifdef __BORLANDC__
-inline int DoIsATTY(int fd) { return isatty(fd); }
-inline int StrCaseCmp(const char* s1, const char* s2) {
-  return stricmp(s1, s2);
-}
-#else  // !__BORLANDC__
 #if defined(GTEST_OS_WINDOWS_MOBILE) || defined(GTEST_OS_ZOS) || \
     defined(GTEST_OS_IOS) || defined(GTEST_OS_WINDOWS_PHONE) ||  \
     defined(GTEST_OS_WINDOWS_RT) || defined(ESP_PLATFORM)
@@ -2162,7 +2116,6 @@ inline int DoIsATTY(int fd) { return _isatty(fd); }
 inline int StrCaseCmp(const char* s1, const char* s2) {
   return _stricmp(s1, s2);
 }
-#endif  // __BORLANDC__
 
 #else
 
@@ -2264,11 +2217,6 @@ inline const char* GetEnv(const char* name) {
   // We are on an embedded platform, which has no environment variables.
   static_cast<void>(name);  // To prevent 'unused argument' warning.
   return nullptr;
-#elif defined(__BORLANDC__) || defined(__SunOS_5_8) || defined(__SunOS_5_9)
-  // Environment variables which we programmatically clear will be set to the
-  // empty string rather than unset (NULL).  Handle that case.
-  const char* const env = getenv(name);
-  return (env != nullptr && env[0] != '\0') ? env : nullptr;
 #else
   return getenv(name);
 #endif
@@ -2303,14 +2251,6 @@ GTEST_DISABLE_DEPRECATED_POP_()
 #define GTEST_SNPRINTF_ snprintf
 #endif
 
-// The biggest signed integer type the compiler supports.
-//
-// long long is guaranteed to be at least 64-bits in C++11.
-using BiggestInt = long long;  // NOLINT
-
-// The maximum number a BiggestInt can represent.
-constexpr BiggestInt kMaxBiggestInt = (std::numeric_limits<BiggestInt>::max)();
-
 // This template class serves as a compile-time function from size to
 // type.  It maps a size in bytes to a primitive type with that
 // size. e.g.
diff --git a/deps/googletest/include/gtest/internal/gtest-string.h b/deps/googletest/include/gtest/internal/gtest-string.h
index 2363034fc0db..d0652c13c68e 100644
--- a/deps/googletest/include/gtest/internal/gtest-string.h
+++ b/deps/googletest/include/gtest/internal/gtest-string.h
@@ -43,11 +43,6 @@
 #ifndef GOOGLETEST_INCLUDE_GTEST_INTERNAL_GTEST_STRING_H_
 #define GOOGLETEST_INCLUDE_GTEST_INTERNAL_GTEST_STRING_H_
 
-#ifdef __BORLANDC__
-// string.h is not guaranteed to provide strcpy on C++ Builder.
-#include <mem.h>
-#endif
-
 #include <string.h>
 
 #include <cstdint>
diff --git a/deps/googletest/include/gtest/internal/gtest-type-util.h b/deps/googletest/include/gtest/internal/gtest-type-util.h
index 78da05316d6b..fb4d6823744e 100644
--- a/deps/googletest/include/gtest/internal/gtest-type-util.h
+++ b/deps/googletest/include/gtest/internal/gtest-type-util.h
@@ -47,8 +47,6 @@
 // libstdc++ (which is where cxxabi.h comes from).
 #if GTEST_HAS_CXXABI_H_
 #include <cxxabi.h>
-#elif defined(__HP_aCC)
-#include <acxx_demangle.h>
 #endif  // GTEST_HASH_CXXABI_H_
 
 namespace testing {
@@ -90,13 +88,11 @@ inline std::string CanonicalizeForStdLibVersioning(std::string s) {
 // GetTypeName(const std::type_info&) returns a human-readable name of type T.
 inline std::string GetTypeName(const std::type_info& type) {
   const char* const name = type.name();
-#if GTEST_HAS_CXXABI_H_ || defined(__HP_aCC)
+#if GTEST_HAS_CXXABI_H_
   int status = 0;
   // gcc's implementation of typeid(T).name() mangles the type name,
   // so we have to demangle it.
-#if GTEST_HAS_CXXABI_H_
   using abi::__cxa_demangle;
-#endif  // GTEST_HAS_CXXABI_H_
   char* const readable_name = __cxa_demangle(name, nullptr, nullptr, &status);
   const std::string name_str(status == 0 ? readable_name : name);
   free(readable_name);
@@ -117,7 +113,7 @@ inline std::string GetTypeName(const std::type_info& type) {
   return s;
 #else
   return name;
-#endif  // GTEST_HAS_CXXABI_H_ || __HP_aCC
+#endif  // GTEST_HAS_CXXABI_H_
 }
 #endif  // GTEST_HAS_RTTI
 
diff --git a/deps/googletest/src/gtest-port.cc b/deps/googletest/src/gtest-port.cc
index 5aa800305c7a..be5b16e76d3e 100644
--- a/deps/googletest/src/gtest-port.cc
+++ b/deps/googletest/src/gtest-port.cc
@@ -1242,14 +1242,14 @@ static std::string GetCapturedStream(CapturedStream** captured_stream) {
   return content;
 }
 
-#if defined(_MSC_VER) || defined(__BORLANDC__)
-// MSVC and C++Builder do not provide a definition of STDERR_FILENO.
+#if defined(_MSC_VER)
+// MSVC does not provide a definition of STDERR_FILENO.
 const int kStdOutFileno = 1;
 const int kStdErrFileno = 2;
 #else
 const int kStdOutFileno = STDOUT_FILENO;
 const int kStdErrFileno = STDERR_FILENO;
-#endif  // defined(_MSC_VER) || defined(__BORLANDC__)
+#endif  // defined(_MSC_VER)
 
 // Starts capturing stdout.
 void CaptureStdout() {
diff --git a/deps/googletest/src/gtest.cc b/deps/googletest/src/gtest.cc
index 30a2bb7de0bc..47c60da22916 100644
--- a/deps/googletest/src/gtest.cc
+++ b/deps/googletest/src/gtest.cc
@@ -5289,17 +5289,8 @@ void TestEventListeners::SuppressEventForwarding(bool suppress) {
 // call this before main() starts, from which point on the return
 // value will never change.
 UnitTest* UnitTest::GetInstance() {
-  // CodeGear C++Builder insists on a public destructor for the
-  // default implementation.  Use this implementation to keep good OO
-  // design with private destructor.
-
-#if defined(__BORLANDC__)
-  static UnitTest* const instance = new UnitTest;
-  return instance;
-#else
   static UnitTest instance;
   return &instance;
-#endif  // defined(__BORLANDC__)
 }
 
 // Gets the number of successful test suites.
diff --git a/deps/histogram/unofficial.gni b/deps/histogram/unofficial.gni
index 1173ab298ae7..fd8c3a276bcb 100644
--- a/deps/histogram/unofficial.gni
+++ b/deps/histogram/unofficial.gni
@@ -4,29 +4,42 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("histogram_gn_build") {
-  config("histogram_config") {
-    include_dirs = [ "include" ]
-  }
+  if (node_shared_hdr_histogram) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("histogram_config") {
+      packages = [ "hdr_histogram" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":histogram_config" ]
+    }
+  } else {
+    config("histogram_config") {
+      include_dirs = [ "include" ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("histogram.gyp") ],
-                            "scope",
-                            [ "histogram.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("histogram.gyp") ],
+                              "scope",
+                              [ "histogram.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":histogram_config" ]
-    sources = gypi_values.histogram_sources
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-atomic-alignment",
-        "-Wno-incompatible-pointer-types",
-        "-Wno-unused-function",
-      ]
-    }
-    if (is_linux) {
-      libs = [ "atomic" ]
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":histogram_config" ]
+      sources = gypi_values.histogram_sources
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-atomic-alignment",
+          "-Wno-incompatible-pointer-types",
+          "-Wno-unused-function",
+        ]
+      }
+      if (is_linux) {
+        libs = [ "atomic" ]
+      }
     }
   }
 }
diff --git a/deps/llhttp/unofficial.gni b/deps/llhttp/unofficial.gni
index fdce32e59764..28257dcb33ae 100644
--- a/deps/llhttp/unofficial.gni
+++ b/deps/llhttp/unofficial.gni
@@ -4,26 +4,39 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("llhttp_gn_build") {
-  config("llhttp_config") {
-    include_dirs = [ "include" ]
-  }
+  if (node_shared_http_parser) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("llhttp_config") {
+      packages = [ "libllhttp" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":llhttp_config" ]
+    }
+  } else {
+    config("llhttp_config") {
+      include_dirs = [ "include" ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("llhttp.gyp") ],
-                            "scope",
-                            [ "llhttp.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("llhttp.gyp") ],
+                              "scope",
+                              [ "llhttp.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":llhttp_config" ]
-    include_dirs = [ "include" ]
-    sources = gypi_values.llhttp_sources
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-implicit-fallthrough",
-        "-Wno-unreachable-code",
-      ]
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":llhttp_config" ]
+      include_dirs = [ "include" ]
+      sources = gypi_values.llhttp_sources
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-implicit-fallthrough",
+          "-Wno-unreachable-code",
+        ]
+      }
     }
   }
 }
diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
index fb7446578f57..20f22e614525 100644
--- a/deps/ncrypto/ncrypto.cc
+++ b/deps/ncrypto/ncrypto.cc
@@ -14,9 +14,11 @@
 #endif
 #include <algorithm>
 #include <array>
+#include <atomic>
 #include <climits>
 #include <cstring>
 #include <string_view>
+#include <vector>
 #if OPENSSL_VERSION_MAJOR >= 3
 #include <openssl/core_names.h>
 #include <openssl/params.h>
@@ -129,6 +131,31 @@ struct OpenSSLBufferDeleter {
 };
 using OpenSSLBufferPointer =
     std::unique_ptr<unsigned char, OpenSSLBufferDeleter>;
+
+struct RsaOtherPrimeParamNames {
+  const char* factor;
+  const char* exponent;
+  const char* coefficient;
+};
+
+#define RSA_OTHER_PRIME_PARAM_NAMES(prime, coefficient)                        \
+  {                                                                            \
+    OSSL_PKEY_PARAM_RSA_FACTOR #prime, OSSL_PKEY_PARAM_RSA_EXPONENT #prime,    \
+        OSSL_PKEY_PARAM_RSA_COEFFICIENT #coefficient                           \
+  }
+
+constexpr std::array<RsaOtherPrimeParamNames, 8> kRsaOtherPrimeParamNames = {{
+    RSA_OTHER_PRIME_PARAM_NAMES(3, 2),
+    RSA_OTHER_PRIME_PARAM_NAMES(4, 3),
+    RSA_OTHER_PRIME_PARAM_NAMES(5, 4),
+    RSA_OTHER_PRIME_PARAM_NAMES(6, 5),
+    RSA_OTHER_PRIME_PARAM_NAMES(7, 6),
+    RSA_OTHER_PRIME_PARAM_NAMES(8, 7),
+    RSA_OTHER_PRIME_PARAM_NAMES(9, 8),
+    RSA_OTHER_PRIME_PARAM_NAMES(10, 9),
+}};
+
+#undef RSA_OTHER_PRIME_PARAM_NAMES
 #endif
 
 static constexpr int kX509NameFlagsRFC2253WithinUtf8JSON =
@@ -507,23 +534,43 @@ DataPointer DataPointer::resize(size_t len) {
 }
 
 // ============================================================================
-bool isFipsEnabled() {
-  ClearErrorOnReturn clear_error_on_return;
+namespace {
+// This generation only coordinates cache invalidation. It does not make
+// OpenSSL default property changes safe to race with crypto operations.
+std::atomic<uint64_t> fips_state_generation{0};
+
+bool isFipsEnabledRaw() {
 #if OPENSSL_VERSION_MAJOR >= 3
   return EVP_default_properties_is_fips_enabled(nullptr) == 1;
 #else
   return FIPS_mode() == 1;
 #endif
 }
+}  // namespace
+
+bool isFipsEnabled() {
+  ClearErrorOnReturn clear_error_on_return;
+  return isFipsEnabledRaw();
+}
 
 bool setFipsEnabled(bool enable, CryptoErrorList* errors) {
-  if (isFipsEnabled() == enable) return true;
+  const bool was_enabled = isFipsEnabled();
+  if (was_enabled == enable) return true;
   ClearErrorOnReturn clearErrorOnReturn(errors);
 #if OPENSSL_VERSION_MAJOR >= 3
-  return EVP_default_properties_enable_fips(nullptr, enable ? 1 : 0) == 1;
+  const bool success =
+      EVP_default_properties_enable_fips(nullptr, enable ? 1 : 0) == 1;
 #else
-  return FIPS_mode_set(enable ? 1 : 0) == 1;
+  const bool success = FIPS_mode_set(enable ? 1 : 0) == 1;
 #endif
+  if (success && isFipsEnabledRaw() != was_enabled) {
+    fips_state_generation.fetch_add(1, std::memory_order_release);
+  }
+  return success;
+}
+
+uint64_t getFipsStateGeneration() {
+  return fips_state_generation.load(std::memory_order_acquire);
 }
 
 bool testFipsEnabled() {
@@ -3060,6 +3107,19 @@ EVPKeyPointer EVPKeyPointer::NewRSA(const Rsa& rsa) {
             bld.get(), OSSL_PKEY_PARAM_RSA_COEFFICIENT1, private_key.qi) != 1) {
       return {};
     }
+
+    const auto other_prime_infos = rsa.getOtherPrimeInfos();
+    if (other_prime_infos.size() > kRsaOtherPrimeParamNames.size()) return {};
+    for (size_t i = 0; i < other_prime_infos.size(); i++) {
+      const auto& info = other_prime_infos[i];
+      const auto& names = kRsaOtherPrimeParamNames[i];
+      if (info.r == nullptr || info.d == nullptr || info.t == nullptr ||
+          OSSL_PARAM_BLD_push_BN(bld.get(), names.factor, info.r) != 1 ||
+          OSSL_PARAM_BLD_push_BN(bld.get(), names.exponent, info.d) != 1 ||
+          OSSL_PARAM_BLD_push_BN(bld.get(), names.coefficient, info.t) != 1) {
+        return {};
+      }
+    }
     selection = EVP_PKEY_KEYPAIR;
   }
 
@@ -4406,13 +4466,211 @@ bool SSLCtxPointer::setCipherSuites(const char* ciphers) {
 
 // ============================================================================
 
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+namespace {
+constexpr char AsciiToLower(char c) {
+  return c >= 'A' && c <= 'Z' ? c + ('a' - 'A') : c;
+}
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+constexpr auto kUnsupportedCipherFlags =
+    EVP_CIPH_FLAG_CIPHER_WITH_MAC | EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK;
+
+bool HasUnsupportedCipherFlags(const EVP_CIPHER* cipher) {
+  return (EVP_CIPHER_get_flags(cipher) & kUnsupportedCipherFlags) != 0;
+}
+
+bool IsSupportedLegacyCipher(const EVP_CIPHER* cipher) {
+  return cipher != nullptr && cipher != EVP_enc_null() &&
+         !HasUnsupportedCipherFlags(cipher);
+}
+
+bool IsSupportedFetchedCipher(const EVP_CIPHER* cipher) {
+  if (cipher == nullptr || EVP_CIPHER_is_a(cipher, "NULL") ||
+      HasUnsupportedCipherFlags(cipher)) {
+    return false;
+  }
+
+#ifdef OSSL_CIPHER_PARAM_ENCRYPT_THEN_MAC
+  int encrypt_then_mac = 0;
+  OSSL_PARAM params[] = {
+      OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_ENCRYPT_THEN_MAC,
+                               &encrypt_then_mac),
+      OSSL_PARAM_construct_end(),
+  };
+  if (EVP_CIPHER_get_params(const_cast<EVP_CIPHER*>(cipher), params) == 1 &&
+      encrypt_then_mac != 0) {
+    return false;
+  }
+#endif
+
+  return true;
+}
+
+void PushAlgorithmAlias(const char* name, void* arg) {
+  if (name == nullptr) return;
+  static_cast<std::vector<std::string>*>(arg)->emplace_back(name);
+}
+#endif
+}  // namespace
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
 Cipher::Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher)
     : cipher_(cipher.get()), fetched_cipher_(std::move(cipher)) {}
 #endif
 
+size_t CaseInsensitiveNameHash::operator()(
+    std::string_view name) const noexcept {
+  size_t hash = 5381;
+  for (char c : name) hash = ((hash << 5) + hash) ^ AsciiToLower(c);
+  return hash;
+}
+
+bool CaseInsensitiveNameEqual::operator()(std::string_view lhs,
+                                          std::string_view rhs) const noexcept {
+  if (lhs.size() != rhs.size()) return false;
+  for (size_t n = 0; n < lhs.size(); n++) {
+    if (AsciiToLower(lhs[n]) != AsciiToLower(rhs[n])) return false;
+  }
+  return true;
+}
+
+DigestCache::Result DigestCache::lookup(const char* name,
+                                        uint64_t generation) const {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (generation_ != generation) return {};
+  const auto it = aliases_.find(name);
+  if (it == aliases_.end()) return {};
+  return lookup(it->second, generation);
+#else
+  static_cast<void>(name);
+  static_cast<void>(generation);
+  return {};
+#endif
+}
+
+DigestCache::Result DigestCache::insert(const char* name,
+                                        const EVP_MD* digest,
+                                        uint64_t generation) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (generation_ != generation || name == nullptr || digest == nullptr) {
+    return {};
+  }
+
+  const char* canonical_name = EVP_MD_get0_name(digest);
+  const OSSL_PROVIDER* provider = EVP_MD_get0_provider(digest);
+  if (canonical_name == nullptr || provider == nullptr) return {};
+
+  for (size_t index = 0; index < digests_.size(); index++) {
+    const EVP_MD* cached = digests_[index].get();
+    if (cached == nullptr) continue;
+    const char* cached_name = EVP_MD_get0_name(cached);
+    if (EVP_MD_get0_provider(cached) == provider && cached_name != nullptr &&
+        CaseInsensitiveNameEqual()(cached_name, canonical_name)) {
+      const int32_t id = static_cast<int32_t>(first_id_ + index);
+      aliases_.insert_or_assign(name, id);
+      return {cached, id};
+    }
+  }
+
+  if (next_id_ == UINT32_MAX ||
+      EVP_MD_up_ref(const_cast<EVP_MD*>(digest)) != 1) {
+    return {};
+  }
+
+  digests_.emplace_back(const_cast<EVP_MD*>(digest));
+  const int32_t id = static_cast<int32_t>(next_id_++);
+  const size_t index = digests_.size() - 1;
+
+  std::vector<std::string> aliases;
+  EVP_MD_names_do_all(digests_[index].get(), PushAlgorithmAlias, &aliases);
+  for (const std::string& alias : aliases) aliases_.emplace(alias, id);
+  aliases_.insert_or_assign(name, id);
+
+  return {digests_[index].get(), id};
+#else
+  static_cast<void>(name);
+  static_cast<void>(digest);
+  static_cast<void>(generation);
+  return {};
+#endif
+}
+
+void DigestCache::reset(uint64_t generation) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (generation_ == generation) return;
+  aliases_.clear();
+  digests_.clear();
+  first_id_ = next_id_;
+#endif
+  generation_ = generation;
+}
+
+const DigestCache::AliasMap& DigestCache::aliases() const {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  return aliases_;
+#else
+  static const AliasMap empty;
+  return empty;
+#endif
+}
+
+const EVP_CIPHER* CipherCache::lookup(const char* name, uint64_t generation) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (generation_ != generation) {
+    aliases_.clear();
+    ciphers_.clear();
+    generation_ = generation;
+  }
+
+  const auto it = aliases_.find(name);
+  if (it == aliases_.end()) return nullptr;
+  if (it->second >= ciphers_.size()) return nullptr;
+  return ciphers_[it->second].get();
+#else
+  static_cast<void>(name);
+  static_cast<void>(generation);
+  return nullptr;
+#endif
+}
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+const EVP_CIPHER* CipherCache::insert(
+    const char* name,
+    DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free>&& cipher,
+    uint64_t generation) {
+  if (generation_ != generation || cipher == nullptr) return nullptr;
+
+  const char* canonical_name = EVP_CIPHER_get0_name(cipher.get());
+  const OSSL_PROVIDER* provider = EVP_CIPHER_get0_provider(cipher.get());
+  if (canonical_name != nullptr && provider != nullptr) {
+    for (size_t id = 0; id < ciphers_.size(); id++) {
+      const EVP_CIPHER* cached = ciphers_[id].get();
+      const char* cached_name = EVP_CIPHER_get0_name(cached);
+      if (EVP_CIPHER_get0_provider(cached) == provider &&
+          cached_name != nullptr &&
+          CaseInsensitiveNameEqual()(cached_name, canonical_name)) {
+        aliases_.insert_or_assign(name, id);
+        return cached;
+      }
+    }
+  }
+
+  ciphers_.emplace_back(std::move(cipher));
+  const size_t id = ciphers_.size() - 1;
+
+  std::vector<std::string> aliases;
+  EVP_CIPHER_names_do_all(ciphers_[id].get(), PushAlgorithmAlias, &aliases);
+  for (const std::string& alias : aliases) {
+    aliases_.emplace(alias, id);
+  }
+  aliases_.insert_or_assign(name, id);
+
+  return ciphers_[id].get();
+}
+#endif
+
 Cipher::Cipher(const Cipher& other) : cipher_(other.cipher_) {
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
   if (other.fetched_cipher_ != nullptr) {
     if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
       fetched_cipher_.reset(other.fetched_cipher_.get());
@@ -4425,7 +4683,7 @@ Cipher::Cipher(const Cipher& other) : cipher_(other.cipher_) {
 
 Cipher& Cipher::operator=(const Cipher& other) {
   if (this == &other) return *this;
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
   if (other.fetched_cipher_ != nullptr) {
     if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
       fetched_cipher_.reset(other.fetched_cipher_.get());
@@ -4442,40 +4700,59 @@ Cipher& Cipher::operator=(const Cipher& other) {
   return *this;
 }
 
-const Cipher Cipher::FromName(const char* name) {
+const Cipher Cipher::FromName(const char* name, CipherCache* cache) {
   const EVP_CIPHER* cipher = EVP_get_cipherbyname(name);
-  if (cipher != nullptr) return Cipher(cipher);
+  if (cipher != nullptr) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    if (!IsSupportedLegacyCipher(cipher)) return Cipher();
+#endif
+    return Cipher(cipher);
+  }
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  // A resolution that overlaps a FIPS transition may use either property
+  // state. The cache retains the generation observed here, so the first
+  // resolution begun after the transition clears any stale entries.
+  const uint64_t generation = getFipsStateGeneration();
+  if (cache != nullptr) {
+    if (const EVP_CIPHER* cached = cache->lookup(name, generation)) {
+      return Cipher(cached);
+    }
+  }
 
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
   MarkPopErrorOnReturn mark_pop_error_on_return;
   DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched(
       EVP_CIPHER_fetch(nullptr, name, nullptr));
-  if (fetched == nullptr) return Cipher();
+  if (!IsSupportedFetchedCipher(fetched.get())) return Cipher();
 
-  const int mode = EVP_CIPHER_mode(fetched.get());
-  const bool is_siv_mode =
-#if OPENSSL_WITH_AES_SIV
-      mode == EVP_CIPH_SIV_MODE ||
-#endif
-#if OPENSSL_WITH_AES_GCM_SIV
-      mode == EVP_CIPH_GCM_SIV_MODE ||
-#endif
-      false;
-  if (is_siv_mode) return Cipher(std::move(fetched));
+  if (cache != nullptr && generation == getFipsStateGeneration()) {
+    if (const EVP_CIPHER* cached =
+            cache->insert(name, std::move(fetched), generation)) {
+      return Cipher(cached);
+    }
+  }
 
-  return Cipher();
+  return Cipher(std::move(fetched));
 #else
+  static_cast<void>(cache);
   return Cipher();
 #endif
 }
 
-const Cipher Cipher::FromNid(int nid) {
+const Cipher Cipher::FromNid(int nid, CipherCache* cache) {
   const EVP_CIPHER* cipher = EVP_get_cipherbynid(nid);
-  if (cipher != nullptr) return Cipher(cipher);
+  if (cipher != nullptr) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    if (!IsSupportedLegacyCipher(cipher)) return Cipher();
+#endif
+    return Cipher(cipher);
+  }
 
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
   const char* name = OBJ_nid2sn(nid);
-  if (name != nullptr) return FromName(name);
+  if (name != nullptr) return FromName(name, cache);
+#else
+  static_cast<void>(cache);
 #endif
 
   return Cipher();
@@ -4485,27 +4762,79 @@ const Cipher Cipher::FromCtx(const CipherCtxPointer& ctx) {
   return Cipher(GetCipherCtxCipher(ctx.get()));
 }
 
-const Cipher Cipher::EMPTY = Cipher();
-const Cipher Cipher::AES_128_CBC = Cipher::FromNid(NID_aes_128_cbc);
-const Cipher Cipher::AES_192_CBC = Cipher::FromNid(NID_aes_192_cbc);
-const Cipher Cipher::AES_256_CBC = Cipher::FromNid(NID_aes_256_cbc);
-const Cipher Cipher::AES_128_CTR = Cipher::FromNid(NID_aes_128_ctr);
-const Cipher Cipher::AES_192_CTR = Cipher::FromNid(NID_aes_192_ctr);
-const Cipher Cipher::AES_256_CTR = Cipher::FromNid(NID_aes_256_ctr);
-const Cipher Cipher::AES_128_GCM = Cipher::FromNid(NID_aes_128_gcm);
-const Cipher Cipher::AES_192_GCM = Cipher::FromNid(NID_aes_192_gcm);
-const Cipher Cipher::AES_256_GCM = Cipher::FromNid(NID_aes_256_gcm);
-const Cipher Cipher::AES_128_KW = Cipher::FromNid(NID_id_aes128_wrap);
-const Cipher Cipher::AES_192_KW = Cipher::FromNid(NID_id_aes192_wrap);
-const Cipher Cipher::AES_256_KW = Cipher::FromNid(NID_id_aes256_wrap);
+namespace {
+template <int nid>
+const Cipher& GetPredefinedCipher() {
+  static const Cipher cipher = Cipher::FromNid(nid);
+  return cipher;
+}
+}  // namespace
+
+const Cipher& Cipher::AES_128_CBC() {
+  return GetPredefinedCipher<NID_aes_128_cbc>();
+}
+
+const Cipher& Cipher::AES_192_CBC() {
+  return GetPredefinedCipher<NID_aes_192_cbc>();
+}
+
+const Cipher& Cipher::AES_256_CBC() {
+  return GetPredefinedCipher<NID_aes_256_cbc>();
+}
+
+const Cipher& Cipher::AES_128_CTR() {
+  return GetPredefinedCipher<NID_aes_128_ctr>();
+}
+
+const Cipher& Cipher::AES_192_CTR() {
+  return GetPredefinedCipher<NID_aes_192_ctr>();
+}
+
+const Cipher& Cipher::AES_256_CTR() {
+  return GetPredefinedCipher<NID_aes_256_ctr>();
+}
+
+const Cipher& Cipher::AES_128_GCM() {
+  return GetPredefinedCipher<NID_aes_128_gcm>();
+}
+
+const Cipher& Cipher::AES_192_GCM() {
+  return GetPredefinedCipher<NID_aes_192_gcm>();
+}
+
+const Cipher& Cipher::AES_256_GCM() {
+  return GetPredefinedCipher<NID_aes_256_gcm>();
+}
+
+const Cipher& Cipher::AES_128_KW() {
+  return GetPredefinedCipher<NID_id_aes128_wrap>();
+}
+
+const Cipher& Cipher::AES_192_KW() {
+  return GetPredefinedCipher<NID_id_aes192_wrap>();
+}
+
+const Cipher& Cipher::AES_256_KW() {
+  return GetPredefinedCipher<NID_id_aes256_wrap>();
+}
 
 #ifndef OPENSSL_IS_BORINGSSL
-const Cipher Cipher::AES_128_OCB = Cipher::FromNid(NID_aes_128_ocb);
-const Cipher Cipher::AES_192_OCB = Cipher::FromNid(NID_aes_192_ocb);
-const Cipher Cipher::AES_256_OCB = Cipher::FromNid(NID_aes_256_ocb);
+const Cipher& Cipher::AES_128_OCB() {
+  return GetPredefinedCipher<NID_aes_128_ocb>();
+}
+
+const Cipher& Cipher::AES_192_OCB() {
+  return GetPredefinedCipher<NID_aes_192_ocb>();
+}
+
+const Cipher& Cipher::AES_256_OCB() {
+  return GetPredefinedCipher<NID_aes_256_ocb>();
+}
 #endif
 
-const Cipher Cipher::CHACHA20_POLY1305 = Cipher::FromNid(NID_chacha20_poly1305);
+const Cipher& Cipher::CHACHA20_POLY1305() {
+  return GetPredefinedCipher<NID_chacha20_poly1305>();
+}
 
 bool Cipher::isGcmMode() const {
   if (!cipher_) return false;
@@ -4527,6 +4856,15 @@ bool Cipher::isCcmMode() const {
   return getMode() == EVP_CIPH_CCM_MODE;
 }
 
+bool Cipher::isCtsMode() const {
+  if (!cipher_) return false;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  return (EVP_CIPHER_get_flags(cipher_) & EVP_CIPH_FLAG_CTS) != 0;
+#else
+  return false;
+#endif
+}
+
 bool Cipher::isOcbMode() const {
   if (!cipher_) return false;
   return getMode() == EVP_CIPH_OCB_MODE;
@@ -4631,7 +4969,7 @@ const char* Cipher::getName() const {
     const char* name = OBJ_nid2sn(nid);
     if (name != nullptr) return name;
   }
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
   return EVP_CIPHER_get0_name(cipher_);
 #else
   return {};
@@ -4728,11 +5066,57 @@ bool CipherCtxPointer::setAeadTagLength(size_t length) {
       ctx_.get(), EVP_CTRL_AEAD_SET_TAG, length, nullptr);
 }
 
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+namespace {
+// OSSL_CIPHER_PARAM_XTS_STANDARD is not defined by OpenSSL 3.0. Use its
+// parameter name directly so custom 3.0 providers can advertise it too.
+constexpr char kCipherParamXtsStandard[] = "xts_standard";
+
+bool SetCipherCtxStringParam(EVP_CIPHER_CTX* ctx,
+                             const char* key,
+                             const char* value) {
+  if (ctx == nullptr || value == nullptr) return false;
+
+  const OSSL_PARAM* settable = EVP_CIPHER_CTX_settable_params(ctx);
+  const OSSL_PARAM* descriptor =
+      settable == nullptr ? nullptr : OSSL_PARAM_locate_const(settable, key);
+  if (descriptor == nullptr ||
+      descriptor->data_type != OSSL_PARAM_UTF8_STRING) {
+    return false;
+  }
+
+  OSSL_PARAM params[] = {
+      OSSL_PARAM_construct_utf8_string(key, const_cast<char*>(value), 0),
+      OSSL_PARAM_END,
+  };
+  return EVP_CIPHER_CTX_set_params(ctx, params) == 1;
+}
+}  // namespace
+#endif
+
+bool CipherCtxPointer::setCtsMode(const char* mode) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  return SetCipherCtxStringParam(ctx_.get(), OSSL_CIPHER_PARAM_CTS_MODE, mode);
+#else
+  static_cast<void>(mode);
+  return false;
+#endif
+}
+
 bool CipherCtxPointer::setPadding(bool padding) {
   if (!ctx_) return false;
   return EVP_CIPHER_CTX_set_padding(ctx_.get(), padding);
 }
 
+bool CipherCtxPointer::setXtsStandard(const char* standard) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  return SetCipherCtxStringParam(ctx_.get(), kCipherParamXtsStandard, standard);
+#else
+  static_cast<void>(standard);
+  return false;
+#endif
+}
+
 int CipherCtxPointer::getBlockSize() const {
   if (!ctx_) return 0;
   return EVP_CIPHER_CTX_block_size(ctx_.get());
@@ -4758,6 +5142,16 @@ bool CipherCtxPointer::isCcmMode() const {
   return getMode() == EVP_CIPH_CCM_MODE;
 }
 
+bool CipherCtxPointer::isCtsMode() const {
+  if (!ctx_) return false;
+  return Cipher::FromCtx(*this).isCtsMode();
+}
+
+bool CipherCtxPointer::isXtsMode() const {
+  if (!ctx_) return false;
+  return getMode() == EVP_CIPH_XTS_MODE;
+}
+
 bool CipherCtxPointer::isWrapMode() const {
   if (!ctx_) return false;
   return getMode() == EVP_CIPH_WRAP_MODE;
@@ -5779,6 +6173,11 @@ DataPointer CipherImpl(const EVPKeyPointer& key,
 }
 }  // namespace
 
+Rsa::OtherPrimeInfoPointer::OtherPrimeInfoPointer(BignumPointer&& r,
+                                                  BignumPointer&& d,
+                                                  BignumPointer&& t)
+    : r(r.release()), d(d.release()), t(t.release()) {}
+
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
 namespace {
 int DigestAlgorithmIdentifierToNid(const unsigned char* data, size_t size) {
@@ -6007,6 +6406,19 @@ Rsa::Rsa(const EVP_PKEY* pkey) : Rsa() {
     return;
   }
 
+  for (const auto& names : kRsaOtherPrimeParamNames) {
+    OtherPrimeInfoPointer info;
+    if (!GetOptionalPKeyBnParam(pkey, names.factor, &info.r) ||
+        !GetOptionalPKeyBnParam(pkey, names.exponent, &info.d) ||
+        !GetOptionalPKeyBnParam(pkey, names.coefficient, &info.t)) {
+      return;
+    }
+
+    if (!info.r && !info.d && !info.t) break;
+    if (!info.r || !info.d || !info.t) return;
+    other_prime_infos_.push_back(std::move(info));
+  }
+
   if (type == EVP_PKEY_RSA_PSS) {
     MarkPopErrorOnReturn pop_errors;
     PssParams params;
@@ -6045,6 +6457,35 @@ const Rsa::PrivateKey Rsa::getPrivateKey() const {
 #endif
 }
 
+const Rsa::OtherPrimeInfos Rsa::getOtherPrimeInfos() const {
+  OtherPrimeInfos infos;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  infos.reserve(other_prime_infos_.size());
+  for (const auto& info : other_prime_infos_) {
+    infos.push_back({info.r.get(), info.d.get(), info.t.get()});
+  }
+#elif NCRYPTO_USE_LEGACY_OPENSSL
+  if (rsa_ == nullptr) return infos;
+  const int count = RSA_get_multi_prime_extra_count(rsa_);
+  if (count <= 0) return infos;
+
+  std::vector<const BIGNUM*> factors(count);
+  std::vector<const BIGNUM*> exponents(count);
+  std::vector<const BIGNUM*> coefficients(count);
+  if (RSA_get0_multi_prime_factors(rsa_, factors.data()) != 1 ||
+      RSA_get0_multi_prime_crt_params(
+          rsa_, exponents.data(), coefficients.data()) != 1) {
+    return {};
+  }
+
+  infos.reserve(count);
+  for (int i = 0; i < count; i++) {
+    infos.push_back({factors[i], exponents[i], coefficients[i]});
+  }
+#endif
+  return infos;
+}
+
 const std::optional<Rsa::PssParams> Rsa::getPssParams() const {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   return pss_params_;
@@ -6146,15 +6587,20 @@ bool Rsa::setPrivateKey(BignumPointer&& d,
                         BignumPointer&& p,
                         BignumPointer&& dp,
                         BignumPointer&& dq,
-                        BignumPointer&& qi) {
+                        BignumPointer&& qi,
+                        OtherPrimeInfoPointers&& other_prime_infos) {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   if (!d || !q || !p || !dp || !dq || !qi) return false;
+  for (const auto& info : other_prime_infos) {
+    if (!info.r || !info.d || !info.t) return false;
+  }
   d_.reset(d.release());
   q_.reset(q.release());
   p_.reset(p.release());
   dp_.reset(dp.release());
   dq_.reset(dq.release());
   qi_.reset(qi.release());
+  other_prime_infos_ = std::move(other_prime_infos);
   rsa_ = n_ != nullptr && e_ != nullptr;
   return rsa_;
 #else
@@ -6176,6 +6622,37 @@ bool Rsa::setPrivateKey(BignumPointer&& d,
   dp.release();
   dq.release();
   qi.release();
+
+#if NCRYPTO_USE_LEGACY_OPENSSL
+  if (!other_prime_infos.empty()) {
+    std::vector<BIGNUM*> factors;
+    std::vector<BIGNUM*> exponents;
+    std::vector<BIGNUM*> coefficients;
+    factors.reserve(other_prime_infos.size());
+    exponents.reserve(other_prime_infos.size());
+    coefficients.reserve(other_prime_infos.size());
+    for (const auto& info : other_prime_infos) {
+      if (!info.r || !info.d || !info.t) return false;
+      factors.push_back(info.r.get());
+      exponents.push_back(info.d.get());
+      coefficients.push_back(info.t.get());
+    }
+    if (RSA_set0_multi_prime_params(const_cast<RSA*>(rsa_),
+                                    factors.data(),
+                                    exponents.data(),
+                                    coefficients.data(),
+                                    static_cast<int>(factors.size())) != 1) {
+      return false;
+    }
+    for (auto& info : other_prime_infos) {
+      info.r.release();
+      info.d.release();
+      info.t.release();
+    }
+  }
+#else
+  if (!other_prime_infos.empty()) return false;
+#endif
   return true;
 #endif
 }
@@ -6229,23 +6706,7 @@ struct CipherCallbackContext {
   void operator()(const char* name) { cb(name); }
 };
 
-#if OPENSSL_WITH_AES_SIV
-constexpr const char* kProviderOnlyAesSivCiphers[] = {
-    "aes-128-siv",
-    "aes-192-siv",
-    "aes-256-siv",
-};
-#endif
-
-#if OPENSSL_WITH_AES_GCM_SIV
-constexpr const char* kProviderOnlyAesGcmSivCiphers[] = {
-    "aes-128-gcm-siv",
-    "aes-192-gcm-siv",
-    "aes-256-gcm-siv",
-};
-#endif
-
-#if OPENSSL_VERSION_MAJOR >= 3
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
 template <class TypeName,
           TypeName* fetch_type(OSSL_LIB_CTX*, const char*, const char*),
           void free_type(TypeName*),
@@ -6269,13 +6730,49 @@ void array_push_back(const TypeName* evp_ref,
   // instance if the algorithm is supported by the public OpenSSL APIs (some
   // algorithms are used internally by OpenSSL and are also passed to this
   // callback).
-  TypeName* fetched = fetch_type(nullptr, real_name, nullptr);
-  if (fetched == nullptr) return;
+  DeleteFnPtr<TypeName, free_type> fetched(
+      fetch_type(nullptr, real_name, nullptr));
+  if (!IsSupportedFetchedCipher(fetched.get())) return;
 
-  free_type(fetched);
   auto& cb = *(static_cast<CipherCallbackContext*>(arg));
   cb(from);
 }
+
+void array_push_back_provider_name(const char* name, void* arg) {
+  if (name == nullptr) return;
+
+  const std::string_view name_view(name);
+  const bool is_dotted_decimal =
+      name_view.find('.') != std::string_view::npos &&
+      std::all_of(name_view.begin(), name_view.end(), [](unsigned char c) {
+        return (c >= '0' && c <= '9') || c == '.';
+      });
+  if (is_dotted_decimal) return;
+
+  std::string normalized_name(name_view);
+  std::transform(normalized_name.begin(),
+                 normalized_name.end(),
+                 normalized_name.begin(),
+                 [](unsigned char c) {
+                   if (c >= 'A' && c <= 'Z') {
+                     return static_cast<char>(c + ('a' - 'A'));
+                   }
+                   return static_cast<char>(c);
+                 });
+  auto& cb = *(static_cast<CipherCallbackContext*>(arg));
+  cb(normalized_name.c_str());
+}
+
+void array_push_back_provider(EVP_CIPHER* cipher, void* arg) {
+  const char* name = EVP_CIPHER_get0_name(cipher);
+  if (name == nullptr) return;
+
+  DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched(
+      EVP_CIPHER_fetch(nullptr, name, nullptr));
+  if (!IsSupportedFetchedCipher(fetched.get())) return;
+
+  EVP_CIPHER_names_do_all(fetched.get(), array_push_back_provider_name, arg);
+}
 #else
 template <class TypeName>
 void array_push_back(const TypeName* evp_ref,
@@ -6301,7 +6798,7 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
   }
 #else
   EVP_CIPHER_do_all_sorted(
-#if OPENSSL_VERSION_MAJOR >= 3
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
       array_push_back<EVP_CIPHER,
                       EVP_CIPHER_fetch,
                       EVP_CIPHER_free,
@@ -6311,23 +6808,8 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
       array_push_back<EVP_CIPHER>,
 #endif
       &context);
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
-  auto maybe_push_provider_only_cipher = [&](const char* name) {
-    EVP_CIPHER* cipher = EVP_CIPHER_fetch(nullptr, name, nullptr);
-    if (cipher == nullptr) return;
-    EVP_CIPHER_free(cipher);
-    context.cb(name);
-  };
-#endif
-#if OPENSSL_WITH_AES_SIV
-  for (const char* name : kProviderOnlyAesSivCiphers) {
-    maybe_push_provider_only_cipher(name);
-  }
-#endif
-#if OPENSSL_WITH_AES_GCM_SIV
-  for (const char* name : kProviderOnlyAesGcmSivCiphers) {
-    maybe_push_provider_only_cipher(name);
-  }
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  EVP_CIPHER_do_all_provided(nullptr, array_push_back_provider, &context);
 #endif
 #endif
 }
@@ -6479,11 +6961,19 @@ EVP_MD_CTX* EVPMDCtxPointer::release() {
   return ctx_.release();
 }
 
-bool EVPMDCtxPointer::digestInit(const Digest& digest) {
+bool EVPMDCtxPointer::digestInit(const EVP_MD* digest) {
   if (!ctx_) return false;
   return EVP_DigestInit_ex(ctx_.get(), digest, nullptr) > 0;
 }
 
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(4, 0)
+bool EVPMDCtxPointer::digestInit(const EVP_MD* digest,
+                                 const OSSL_PARAM* params) {
+  if (!ctx_) return false;
+  return EVP_DigestInit_ex2(ctx_.get(), digest, params) > 0;
+}
+#endif
+
 bool EVPMDCtxPointer::digestUpdate(const Buffer<const void>& in) {
   if (!ctx_) return false;
   return EVP_DigestUpdate(ctx_.get(), in.data, in.len) > 0;
@@ -6832,6 +7322,79 @@ EVPMacPointer EVPMacPointer::Fetch(const char* algorithm) {
   return EVPMacPointer(EVP_MAC_fetch(nullptr, algorithm, nullptr));
 }
 
+MacKind MacCache::GetKind(EVP_MAC* mac) {
+  if (EVP_MAC_is_a(mac, OSSL_MAC_NAME_HMAC)) return MacKind::kHmac;
+  if (EVP_MAC_is_a(mac, OSSL_MAC_NAME_CMAC)) return MacKind::kCmac;
+  if (EVP_MAC_is_a(mac, OSSL_MAC_NAME_GMAC)) return MacKind::kGmac;
+  return MacKind::kOther;
+}
+
+MacCache::Result MacCache::lookup(const char* name, uint64_t generation) const {
+  if (generation_ != generation || name == nullptr) return {};
+  const auto it = aliases_.find(name);
+  if (it == aliases_.end()) return {};
+  return lookup(it->second, generation);
+}
+
+MacCache::Result MacCache::insert(const char* name,
+                                  EVPMacPointer&& mac,
+                                  uint64_t generation) {
+  if (generation_ != generation || generation != getFipsStateGeneration() ||
+      name == nullptr || mac == nullptr) {
+    return {};
+  }
+
+  const char* canonical_name = EVP_MAC_get0_name(mac.get());
+  const OSSL_PROVIDER* provider = EVP_MAC_get0_provider(mac.get());
+  if (canonical_name == nullptr || provider == nullptr) return {};
+
+  for (size_t index = 0; index < macs_.size(); index++) {
+    EVP_MAC* cached = macs_[index].mac.get();
+    if (cached == nullptr) continue;
+    const char* cached_name = EVP_MAC_get0_name(cached);
+    if (EVP_MAC_get0_provider(cached) == provider && cached_name != nullptr &&
+        CaseInsensitiveNameEqual()(cached_name, canonical_name)) {
+      if (generation != getFipsStateGeneration()) return {};
+      const int32_t id = static_cast<int32_t>(first_id_ + index);
+      aliases_.insert_or_assign(name, id);
+      return {cached, id, macs_[index].kind};
+    }
+  }
+
+  if (next_id_ == UINT32_MAX) return {};
+
+  std::vector<std::string> aliases;
+  {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+    if (EVP_MAC_names_do_all(mac.get(), PushAlgorithmAlias, &aliases) != 1) {
+      return {};
+    }
+  }
+  if (generation != getFipsStateGeneration()) return {};
+
+  const MacKind kind = GetKind(mac.get());
+  macs_.push_back({std::move(mac), kind});
+  const int32_t id = static_cast<int32_t>(next_id_++);
+  const size_t index = macs_.size() - 1;
+
+  for (const std::string& alias : aliases) aliases_.emplace(alias, id);
+  aliases_.insert_or_assign(name, id);
+
+  return {macs_[index].mac.get(), id, kind};
+}
+
+void MacCache::reset(uint64_t generation) {
+  if (generation_ == generation) return;
+  aliases_.clear();
+  macs_.clear();
+  first_id_ = next_id_;
+  generation_ = generation;
+}
+
+const MacCache::AliasMap& MacCache::aliases() const {
+  return aliases_;
+}
+
 EVPMacCtxPointer::EVPMacCtxPointer(EVP_MAC_CTX* ctx) : ctx_(ctx) {}
 
 EVPMacCtxPointer::EVPMacCtxPointer(EVPMacCtxPointer&& other) noexcept
@@ -6859,22 +7422,42 @@ EVP_MAC_CTX* EVPMacCtxPointer::release() {
 bool EVPMacCtxPointer::init(const Buffer<const void>& key,
                             const OSSL_PARAM* params) {
   if (!ctx_) return false;
-  return EVP_MAC_init(ctx_.get(),
-                      static_cast<const unsigned char*>(key.data),
-                      key.len,
-                      params) == 1;
+
+  static constexpr unsigned char kEmptyKey = 0;
+  const unsigned char* key_data = static_cast<const unsigned char*>(key.data);
+  if (key_data == nullptr) {
+    if (key.len != 0) return false;
+    key_data = &kEmptyKey;
+  }
+
+  return EVP_MAC_init(ctx_.get(), key_data, key.len, params) == 1;
 }
 
 bool EVPMacCtxPointer::update(const Buffer<const void>& data) {
   if (!ctx_) return false;
+  if (data.len == 0) return true;
+  if (data.data == nullptr) return false;
   return EVP_MAC_update(ctx_.get(),
                         static_cast<const unsigned char*>(data.data),
                         data.len) == 1;
 }
 
+size_t EVPMacCtxPointer::getSize() const {
+  return ctx_ ? EVP_MAC_CTX_get_mac_size(ctx_.get()) : 0;
+}
+
+const OSSL_PARAM* EVPMacCtxPointer::getSettableParams() const {
+  return ctx_ ? EVP_MAC_CTX_settable_params(ctx_.get()) : nullptr;
+}
+
 DataPointer EVPMacCtxPointer::final(size_t length) {
   if (!ctx_) return {};
-  auto buf = DataPointer::Alloc(length);
+
+  // DataPointer uses a null allocation to represent failure. Retain a
+  // one-byte allocation for a successful zero-length result while passing the
+  // requested zero capacity to OpenSSL. A non-null output pointer is required
+  // to actually finalize; nullptr only queries the output length.
+  auto buf = DataPointer::Alloc(length == 0 ? 1 : length);
   if (!buf) return {};
 
   size_t result_len = length;
@@ -6884,8 +7467,9 @@ DataPointer EVPMacCtxPointer::final(size_t length) {
                     length) != 1) {
     return {};
   }
+  if (result_len > length) return {};
 
-  return buf;
+  return buf.resize(result_len);
 }
 
 EVPMacCtxPointer EVPMacCtxPointer::New(EVP_MAC* mac) {
@@ -7009,7 +7593,10 @@ DataPointer xofHashDigest(const Buffer<const unsigned char>& buf,
   if (ctx.digestInit(md) != 1) {
     return {};
   }
-  if (ctx.digestUpdate(reinterpret_cast<const Buffer<const void>&>(buf)) != 1) {
+  if (ctx.digestUpdate(Buffer<const void>{
+          .data = buf.data,
+          .len = buf.len,
+      }) != 1) {
     return {};
   }
   return ctx.digestFinal(output_length);
@@ -7145,14 +7732,86 @@ size_t Digest::size() const {
   return EVP_MD_size(md_);
 }
 
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+Digest::Digest(DeleteFnPtr<EVP_MD, EVP_MD_free> md)
+    : md_(md.get()), fetched_md_(std::move(md)) {}
+#endif
+
+Digest::Digest(const Digest& other) : md_(other.md_) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (other.fetched_md_ != nullptr) {
+    if (EVP_MD_up_ref(other.fetched_md_.get()) == 1) {
+      fetched_md_.reset(other.fetched_md_.get());
+    } else {
+      md_ = nullptr;
+    }
+  }
+#endif
+}
+
+Digest& Digest::operator=(const Digest& other) {
+  if (this == &other) return *this;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (other.fetched_md_ != nullptr) {
+    if (EVP_MD_up_ref(other.fetched_md_.get()) == 1) {
+      fetched_md_.reset(other.fetched_md_.get());
+    } else {
+      fetched_md_.reset();
+      md_ = nullptr;
+      return *this;
+    }
+  } else {
+    fetched_md_.reset();
+  }
+#endif
+  md_ = other.md_;
+  return *this;
+}
+
 const Digest Digest::MD5 = Digest(EVP_md5());
 const Digest Digest::SHA1 = Digest(EVP_sha1());
 const Digest Digest::SHA256 = Digest(EVP_sha256());
 const Digest Digest::SHA384 = Digest(EVP_sha384());
 const Digest Digest::SHA512 = Digest(EVP_sha512());
 
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+namespace {
+bool IsSupportedDigest(const EVP_MD* md) {
+  if (md == nullptr || EVP_MD_is_a(md, "NULL")) return false;
+
+  // OpenSSL currently crashes when ML-DSA-MU finalizes an empty input. Keep it
+  // unavailable until the provider implementation is fixed.
+  // https://github.com/openssl/openssl/issues/32445
+  if (EVP_MD_is_a(md, "ML-DSA-MU")) return false;
+
+  return true;
+}
+}  // namespace
+#endif
+
 const Digest Digest::FromName(const char* name) {
-  return ncrypto::getDigestByName(name);
+  const EVP_MD* md = ncrypto::getDigestByName(name);
+  if (md != nullptr) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    if (md == EVP_md_null()) return Digest();
+#endif
+    return Digest(md);
+  }
+
+  return Fetch(name);
+}
+
+const Digest Digest::Fetch(const char* name) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  MarkPopErrorOnReturn mark_pop_error_on_return;
+  DeleteFnPtr<EVP_MD, EVP_MD_free> fetched(
+      EVP_MD_fetch(nullptr, name, nullptr));
+  if (IsSupportedDigest(fetched.get())) {
+    return Digest(std::move(fetched));
+  }
+#endif
+
+  return Digest();
 }
 
 // ============================================================================
diff --git a/deps/ncrypto/ncrypto.h b/deps/ncrypto/ncrypto.h
index 58e32cc18fc7..6b1edceed061 100644
--- a/deps/ncrypto/ncrypto.h
+++ b/deps/ncrypto/ncrypto.h
@@ -13,12 +13,15 @@
 #include <openssl/ssl.h>
 #include <openssl/x509.h>
 #include <cstddef>
+#include <cstdint>
 #include <functional>
 #include <list>
 #include <memory>
 #include <optional>
 #include <string>
 #include <string_view>
+#include <unordered_map>
+#include <vector>
 #if defined(NCRYPTO_ENGINE_COMPAT) && NCRYPTO_ENGINE_COMPAT &&                 \
     !defined(OPENSSL_NO_ENGINE)
 #include <openssl/engine.h>
@@ -363,6 +366,7 @@ class DataPointer;
 class DHPointer;
 class ECKeyPointer;
 class EVPKeyPointer;
+class MacCache;
 class EVPMacCtxPointer;
 class EVPMacPointer;
 class EVPMDCtxPointer;
@@ -397,9 +401,12 @@ class Digest final {
   static constexpr size_t MAX_SIZE = EVP_MAX_MD_SIZE;
   Digest() = default;
   Digest(const EVP_MD* md) : md_(md) {}
-  Digest(const Digest&) = default;
-  Digest& operator=(const Digest&) = default;
+  Digest(const Digest& other);
+  Digest& operator=(const Digest& other);
   inline Digest& operator=(const EVP_MD* md) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    fetched_md_.reset();
+#endif
     md_ = md;
     return *this;
   }
@@ -418,9 +425,72 @@ class Digest final {
   static const Digest SHA512;
 
   static const Digest FromName(const char* name);
+  static const Digest Fetch(const char* name);
 
  private:
   const EVP_MD* md_ = nullptr;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  explicit Digest(DeleteFnPtr<EVP_MD, EVP_MD_free> md);
+  DeleteFnPtr<EVP_MD, EVP_MD_free> fetched_md_;
+#endif
+};
+
+struct CaseInsensitiveNameHash {
+  using is_transparent = void;
+  size_t operator()(std::string_view name) const noexcept;
+};
+
+struct CaseInsensitiveNameEqual {
+  using is_transparent = void;
+  bool operator()(std::string_view lhs, std::string_view rhs) const noexcept;
+};
+
+class DigestCache final {
+ public:
+  struct Result {
+    const EVP_MD* digest = nullptr;
+    int32_t id = -1;
+  };
+
+  using AliasMap = std::unordered_map<std::string,
+                                      int32_t,
+                                      CaseInsensitiveNameHash,
+                                      CaseInsensitiveNameEqual>;
+
+  DigestCache() = default;
+  NCRYPTO_DISALLOW_COPY_AND_MOVE(DigestCache)
+
+  Result lookup(const char* name, uint64_t generation) const;
+  inline Result lookup(int32_t id, uint64_t generation) const {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    if (generation_ != generation || id == -1) return {};
+    const uint32_t unsigned_id = static_cast<uint32_t>(id);
+    if (unsigned_id < first_id_) return {};
+    const size_t index = unsigned_id - first_id_;
+    if (index >= digests_.size()) return {};
+    return {digests_[index].get(), id};
+#else
+    static_cast<void>(id);
+    static_cast<void>(generation);
+    return {};
+#endif
+  }
+  Result insert(const char* name, const EVP_MD* digest, uint64_t generation);
+  void reset(uint64_t generation);
+  const AliasMap& aliases() const;
+
+ private:
+  uint64_t generation_ = 0;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  using EVPMDPointer = DeleteFnPtr<EVP_MD, EVP_MD_free>;
+
+  // IDs are not reused across generations because JavaScript caches them
+  // independently in each Realm.
+  uint32_t first_id_ = 0;
+  uint32_t next_id_ = 0;
+  std::vector<EVPMDPointer> digests_;
+  AliasMap aliases_;
+#endif
 };
 
 // Computes a fixed-length digest.
@@ -431,6 +501,32 @@ DataPointer xofHashDigest(const Buffer<const unsigned char>& data,
                           const EVP_MD* md,
                           size_t length);
 
+class CipherCache final {
+ public:
+  CipherCache() = default;
+  NCRYPTO_DISALLOW_COPY_AND_MOVE(CipherCache)
+
+  const EVP_CIPHER* lookup(const char* name, uint64_t generation);
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  const EVP_CIPHER* insert(const char* name,
+                           DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free>&& cipher,
+                           uint64_t generation);
+#endif
+
+ private:
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  using EVPCipherPointer = DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free>;
+
+  uint64_t generation_ = 0;
+  std::vector<EVPCipherPointer> ciphers_;
+  std::unordered_map<std::string,
+                     size_t,
+                     CaseInsensitiveNameHash,
+                     CaseInsensitiveNameEqual>
+      aliases_;
+#endif
+};
+
 class Cipher final {
  public:
   static constexpr size_t MAX_KEY_LENGTH = EVP_MAX_KEY_LENGTH;
@@ -452,7 +548,7 @@ class Cipher final {
   Cipher(const Cipher& other);
   Cipher& operator=(const Cipher& other);
   inline Cipher& operator=(const EVP_CIPHER* cipher) {
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
     fetched_cipher_.reset();
 #endif
     cipher_ = cipher;
@@ -476,6 +572,7 @@ class Cipher final {
   bool isWrapMode() const;
   bool isCtrMode() const;
   bool isCcmMode() const;
+  bool isCtsMode() const;
   bool isOcbMode() const;
   bool isSivMode() const;
   bool isGcmSivMode() const;
@@ -489,8 +586,8 @@ class Cipher final {
                  unsigned char* key,
                  unsigned char* iv) const;
 
-  static const Cipher FromName(const char* name);
-  static const Cipher FromNid(int nid);
+  static const Cipher FromName(const char* name, CipherCache* cache = nullptr);
+  static const Cipher FromNid(int nid, CipherCache* cache = nullptr);
   static const Cipher FromCtx(const CipherCtxPointer& ctx);
 
   using CipherNameCallback = std::function<void(const char* name)>;
@@ -499,28 +596,24 @@ class Cipher final {
   // is able to do so.
   static void ForEach(CipherNameCallback callback);
 
-  // Utilities to get various ciphers by type. If the underlying
-  // implementation does not support the requested cipher, then
-  // the result will be an empty Cipher object whose bool operator
-  // will return false.
-
-  static const Cipher EMPTY;
-  static const Cipher AES_128_CBC;
-  static const Cipher AES_192_CBC;
-  static const Cipher AES_256_CBC;
-  static const Cipher AES_128_CTR;
-  static const Cipher AES_192_CTR;
-  static const Cipher AES_256_CTR;
-  static const Cipher AES_128_GCM;
-  static const Cipher AES_192_GCM;
-  static const Cipher AES_256_GCM;
-  static const Cipher AES_128_KW;
-  static const Cipher AES_192_KW;
-  static const Cipher AES_256_KW;
-  static const Cipher AES_128_OCB;
-  static const Cipher AES_192_OCB;
-  static const Cipher AES_256_OCB;
-  static const Cipher CHACHA20_POLY1305;
+  // Lazily resolves common ciphers. If the underlying implementation does not
+  // support the requested cipher, the returned Cipher will be empty.
+  static const Cipher& AES_128_CBC();
+  static const Cipher& AES_192_CBC();
+  static const Cipher& AES_256_CBC();
+  static const Cipher& AES_128_CTR();
+  static const Cipher& AES_192_CTR();
+  static const Cipher& AES_256_CTR();
+  static const Cipher& AES_128_GCM();
+  static const Cipher& AES_192_GCM();
+  static const Cipher& AES_256_GCM();
+  static const Cipher& AES_128_KW();
+  static const Cipher& AES_192_KW();
+  static const Cipher& AES_256_KW();
+  static const Cipher& AES_128_OCB();
+  static const Cipher& AES_192_OCB();
+  static const Cipher& AES_256_OCB();
+  static const Cipher& CHACHA20_POLY1305();
 
   struct CipherParams {
     int padding;
@@ -550,7 +643,7 @@ class Cipher final {
 
  private:
   const EVP_CIPHER* cipher_ = nullptr;
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
   explicit Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher);
   DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched_cipher_;
 #endif
@@ -631,6 +724,23 @@ class Rsa final {
     const BIGNUM* dq;
     const BIGNUM* qi;
   };
+  struct OtherPrimeInfo {
+    const BIGNUM* r;
+    const BIGNUM* d;
+    const BIGNUM* t;
+  };
+  struct OtherPrimeInfoPointer {
+    OtherPrimeInfoPointer() = default;
+    OtherPrimeInfoPointer(BignumPointer&& r,
+                          BignumPointer&& d,
+                          BignumPointer&& t);
+
+    DeleteFnPtr<BIGNUM, BN_clear_free> r;
+    DeleteFnPtr<BIGNUM, BN_clear_free> d;
+    DeleteFnPtr<BIGNUM, BN_clear_free> t;
+  };
+  using OtherPrimeInfos = std::vector<OtherPrimeInfo>;
+  using OtherPrimeInfoPointers = std::vector<OtherPrimeInfoPointer>;
   struct PssParams {
     std::string_view digest = "sha1";
     std::optional<std::string_view> mgf1_digest = "sha1";
@@ -639,6 +749,7 @@ class Rsa final {
 
   const PublicKey getPublicKey() const;
   const PrivateKey getPrivateKey() const;
+  const OtherPrimeInfos getOtherPrimeInfos() const;
   const std::optional<PssParams> getPssParams() const;
 
   bool setPublicKey(BignumPointer&& n, BignumPointer&& e);
@@ -647,7 +758,8 @@ class Rsa final {
                      BignumPointer&& p,
                      BignumPointer&& dp,
                      BignumPointer&& dq,
-                     BignumPointer&& qi);
+                     BignumPointer&& qi,
+                     OtherPrimeInfoPointers&& other_prime_infos = {});
 
   using CipherParams = Cipher::CipherParams;
 
@@ -672,6 +784,7 @@ class Rsa final {
   DeleteFnPtr<BIGNUM, BN_clear_free> dp_;
   DeleteFnPtr<BIGNUM, BN_clear_free> dq_;
   DeleteFnPtr<BIGNUM, BN_clear_free> qi_;
+  OtherPrimeInfoPointers other_prime_infos_;
   std::optional<PssParams> pss_params_;
 #else
   OSSL3_CONST RSA* rsa_;
@@ -940,7 +1053,9 @@ class CipherCtxPointer final {
   bool setIvLength(size_t length);
   bool setAeadTag(const Buffer<const char>& tag);
   bool setAeadTagLength(size_t length);
+  bool setCtsMode(const char* mode);
   bool setPadding(bool padding);
+  bool setXtsStandard(const char* standard);
   bool init(const Cipher& cipher,
             bool encrypt,
             const unsigned char* key = nullptr,
@@ -953,6 +1068,8 @@ class CipherCtxPointer final {
   bool isGcmMode() const;
   bool isOcbMode() const;
   bool isCcmMode() const;
+  bool isCtsMode() const;
+  bool isXtsMode() const;
   bool isWrapMode() const;
   bool isSivMode() const;
   bool isGcmSivMode() const;
@@ -1690,7 +1807,16 @@ class EVPMDCtxPointer final {
   void reset(EVP_MD_CTX* ctx = nullptr);
   EVP_MD_CTX* release();
 
-  bool digestInit(const Digest& digest);
+  bool digestInit(const EVP_MD* digest);
+  inline bool digestInit(const Digest& digest) {
+    return digestInit(digest.get());
+  }
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(4, 0)
+  bool digestInit(const EVP_MD* digest, const OSSL_PARAM* params);
+  inline bool digestInit(const Digest& digest, const OSSL_PARAM* params) {
+    return digestInit(digest.get(), params);
+  }
+#endif
   bool digestUpdate(const Buffer<const void>& in);
   DataPointer digestFinal(size_t length);
   bool digestFinalInto(Buffer<void>* buf);
@@ -1782,6 +1908,61 @@ class EVPMacPointer final {
   DeleteFnPtr<EVP_MAC, EVP_MAC_free> mac_;
 };
 
+enum class MacKind : uint8_t {
+  kOther,
+  kHmac,
+  kCmac,
+  kGmac,
+};
+
+class MacCache final {
+ public:
+  struct Result {
+    // Borrowed from the cache and valid until the cache is reset. Creating an
+    // EVP_MAC_CTX takes an independent reference to the method.
+    EVP_MAC* mac = nullptr;
+    int32_t id = -1;
+    MacKind kind = MacKind::kOther;
+  };
+
+  using AliasMap = std::unordered_map<std::string,
+                                      int32_t,
+                                      CaseInsensitiveNameHash,
+                                      CaseInsensitiveNameEqual>;
+
+  MacCache() = default;
+  NCRYPTO_DISALLOW_COPY_AND_MOVE(MacCache)
+
+  Result lookup(const char* name, uint64_t generation) const;
+  inline Result lookup(int32_t id, uint64_t generation) const {
+    if (generation_ != generation || id == -1) return {};
+    const uint32_t unsigned_id = static_cast<uint32_t>(id);
+    if (unsigned_id < first_id_) return {};
+    const size_t index = unsigned_id - first_id_;
+    if (index >= macs_.size()) return {};
+    return {macs_[index].mac.get(), id, macs_[index].kind};
+  }
+  Result insert(const char* name, EVPMacPointer&& mac, uint64_t generation);
+  void reset(uint64_t generation);
+  const AliasMap& aliases() const;
+  static MacKind GetKind(EVP_MAC* mac);
+
+ private:
+  struct Entry {
+    EVPMacPointer mac;
+    MacKind kind;
+  };
+
+  uint64_t generation_ = 0;
+
+  // IDs are not reused across generations because JavaScript may cache them
+  // independently in each Realm.
+  uint32_t first_id_ = 0;
+  uint32_t next_id_ = 0;
+  std::vector<Entry> macs_;
+  AliasMap aliases_;
+};
+
 class EVPMacCtxPointer final {
  public:
   EVPMacCtxPointer() = default;
@@ -1800,6 +1981,8 @@ class EVPMacCtxPointer final {
 
   bool init(const Buffer<const void>& key, const OSSL_PARAM* params = nullptr);
   bool update(const Buffer<const void>& data);
+  size_t getSize() const;
+  const OSSL_PARAM* getSettableParams() const;
   DataPointer final(size_t length);
 
   static EVPMacCtxPointer New(EVP_MAC* mac);
@@ -1836,6 +2019,14 @@ class HMACCtxPointer final {
 };
 #endif  // OPENSSL_WITH_EVP_MAC
 
+#if !OPENSSL_WITH_EVP_MAC
+class MacCache final {
+ public:
+  MacCache() = default;
+  NCRYPTO_DISALLOW_COPY_AND_MOVE(MacCache)
+};
+#endif
+
 #ifndef OPENSSL_NO_ENGINE
 class EnginePointer final {
  public:
@@ -1880,6 +2071,8 @@ bool isFipsEnabled();
 
 bool setFipsEnabled(bool enabled, CryptoErrorList* errors);
 
+uint64_t getFipsStateGeneration();
+
 bool testFipsEnabled();
 
 // ============================================================================
diff --git a/deps/nghttp2/unofficial.gni b/deps/nghttp2/unofficial.gni
index 4558fbbf5e5f..d37754f59124 100644
--- a/deps/nghttp2/unofficial.gni
+++ b/deps/nghttp2/unofficial.gni
@@ -4,40 +4,53 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("nghttp2_gn_build") {
-  config("nghttp2_config") {
-    include_dirs = [ "lib/includes" ]
-    if (!is_component_build) {
-      defines = [ "NGHTTP2_STATICLIB" ]
+  if (node_shared_nghttp2) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("nghttp2_config") {
+      packages = [ "libnghttp2" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":nghttp2_config" ]
+    }
+  } else {
+    config("nghttp2_config") {
+      include_dirs = [ "lib/includes" ]
+      if (!is_component_build) {
+        defines = [ "NGHTTP2_STATICLIB" ]
+      }
     }
-  }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("nghttp2.gyp") ],
-                            "scope",
-                            [ "nghttp2.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("nghttp2.gyp") ],
+                              "scope",
+                              [ "nghttp2.gyp" ])
 
-  component(target_name) {
-    forward_variables_from(invoker, "*")
+    component(target_name) {
+      forward_variables_from(invoker, "*")
 
-    public_configs = [ ":nghttp2_config" ]
-    defines = [
-      "_U_",
-      "HAVE_CONFIG_H"
-    ]
-    if (is_component_build) {
-      defines += [ "BUILDING_NGHTTP2" ]
-    }
+      public_configs = [ ":nghttp2_config" ]
+      defines = [
+        "_U_",
+        "HAVE_CONFIG_H"
+      ]
+      if (is_component_build) {
+        defines += [ "BUILDING_NGHTTP2" ]
+      }
 
-    sources = gypi_values.nghttp2_sources
+      sources = gypi_values.nghttp2_sources
 
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-implicit-fallthrough",
-        # Ref https://github.com/nghttp2/nghttp2/pull/2258
-        # This can be removed when the above PR is ingested.
-        "-Wno-extra-semi",
-      ]
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-implicit-fallthrough",
+          # Ref https://github.com/nghttp2/nghttp2/pull/2258
+          # This can be removed when the above PR is ingested.
+          "-Wno-extra-semi",
+        ]
+      }
     }
   }
 }
diff --git a/deps/simdjson/simdjson.cpp b/deps/simdjson/simdjson.cpp
index 92d971fd448b..71f443b3d2bb 100644
--- a/deps/simdjson/simdjson.cpp
+++ b/deps/simdjson/simdjson.cpp
@@ -1,4 +1,4 @@
-/* auto-generated on 2026-08-24 17:10:01 -0400. version 4.6.9 Do not edit! */
+/* auto-generated on 2026-09-04 16:04:31 -0400. version 4.6.11 Do not edit! */
 /* including simdjson.cpp:  */
 /* begin file simdjson.cpp */
 #define SIMDJSON_SRC_SIMDJSON_CPP
@@ -240,7 +240,7 @@ using std::size_t;
 #endif
 #elif defined(__PPC64__) || defined(_M_PPC64)
 #define SIMDJSON_IS_PPC64 1
-#if defined(__ALTIVEC__)
+#if defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #define SIMDJSON_IS_PPC64_VMX 1
 #endif // defined(__ALTIVEC__)
 #else
@@ -10052,9 +10052,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -10065,6 +10070,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -13541,7 +13547,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -13575,7 +13588,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -13597,7 +13610,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -13976,11 +13989,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -14005,6 +14013,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -14021,7 +14035,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -16588,9 +16602,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -16601,6 +16620,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -19936,7 +19956,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -19970,7 +19997,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -19992,7 +20019,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -20371,11 +20398,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -20400,6 +20422,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -20416,7 +20444,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -22979,9 +23007,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -22992,6 +23025,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -26326,7 +26360,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -26360,7 +26401,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -26382,7 +26423,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -26761,11 +26802,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -26790,6 +26826,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -26806,7 +26848,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -29527,9 +29569,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -29540,6 +29587,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -32987,7 +33035,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -33021,7 +33076,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -33043,7 +33098,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -33422,11 +33477,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -33451,6 +33501,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -33467,7 +33523,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -36435,9 +36491,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -36448,6 +36509,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -40210,7 +40272,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -40244,7 +40313,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -40266,7 +40335,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -40645,11 +40714,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -40674,6 +40738,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -40690,7 +40760,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -43189,9 +43259,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -43202,6 +43277,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -46464,7 +46540,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -46498,7 +46581,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -46520,7 +46603,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -46899,11 +46982,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -46928,6 +47006,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -46944,7 +47028,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -49380,9 +49464,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -49393,6 +49482,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -52622,7 +52712,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -52656,7 +52753,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -52678,7 +52775,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -53057,11 +53154,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -53086,6 +53178,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -53102,7 +53200,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -55559,9 +55657,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -55572,6 +55675,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -59199,7 +59303,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -59233,7 +59344,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -59255,7 +59366,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -59634,11 +59745,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -59663,6 +59769,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -59679,7 +59791,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -61715,9 +61827,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -61728,6 +61845,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -63685,7 +63803,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -63719,7 +63844,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -63741,7 +63866,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -64949,8 +65074,8 @@ simdjson_inline void validate_utf8_character() {
   // 2-byte
   if ((buf[idx] & 0x20) == 0) {
     // missing continuation
-    if (simdjson_unlikely(idx+1 > len || !is_continuation(buf[idx+1]))) {
-      if (idx+1 > len && is_streaming(partial)) { idx = len; return; }
+    if (simdjson_unlikely(idx+1 >= len || !is_continuation(buf[idx+1]))) {
+      if (idx+1 >= len && is_streaming(partial)) { idx = len; return; }
       error = UTF8_ERROR;
       idx++;
       return;
@@ -64964,8 +65089,8 @@ simdjson_inline void validate_utf8_character() {
   // 3-byte
   if ((buf[idx] & 0x10) == 0) {
     // missing continuation
-    if (simdjson_unlikely(idx+2 > len || !is_continuation(buf[idx+1]) || !is_continuation(buf[idx+2]))) {
-      if (idx+2 > len && is_streaming(partial)) { idx = len; return; }
+    if (simdjson_unlikely(idx+2 >= len || !is_continuation(buf[idx+1]) || !is_continuation(buf[idx+2]))) {
+      if (idx+2 >= len && is_streaming(partial)) { idx = len; return; }
       error = UTF8_ERROR;
       idx++;
       return;
@@ -64980,8 +65105,8 @@ simdjson_inline void validate_utf8_character() {
 
   // 4-byte
   // missing continuation
-  if (simdjson_unlikely(idx+3 > len || !is_continuation(buf[idx+1]) || !is_continuation(buf[idx+2]) || !is_continuation(buf[idx+3]))) {
-    if (idx+2 > len && is_streaming(partial)) { idx = len; return; }
+  if (simdjson_unlikely(idx+3 >= len || !is_continuation(buf[idx+1]) || !is_continuation(buf[idx+2]) || !is_continuation(buf[idx+3]))) {
+    if (idx+3 >= len && is_streaming(partial)) { idx = len; return; }
     error = UTF8_ERROR;
     idx++;
     return;
@@ -65103,9 +65228,15 @@ simdjson_warn_unused simdjson_inline error_code scan() {
       add_structural();
     // Primitive or invalid character (invalid characters will be checked in stage 2)
     } else {
-      // Anything else, add the structural and go until we find the next one
+      // Anything else, add the structural and go until we find the next one.
+      // We also stop on '"' so that an unclosed string still reaches
+      // validate_string(); a quote swallowed by the run would hide it. A
+      // quote cannot occur inside a valid primitive. We deliberately do not
+      // stop on every ESC_ASCII character: that also covers a backslash and the
+      // control characters, and ending the run there makes the fallback
+      // disagree with the SIMD kernels.
       add_structural();
-      while (idx+1<len && !char_is_space_or_operator(buf[idx+1])) {
+      while (idx+1<len && !char_is_space_or_operator(buf[idx+1]) && buf[idx+1] != '"') {
         idx++;
       };
     }
@@ -65125,7 +65256,7 @@ simdjson_warn_unused simdjson_inline error_code scan() {
       if (simdjson_unlikely(parser.n_structural_indexes == 0)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
diff --git a/deps/simdjson/simdjson.h b/deps/simdjson/simdjson.h
index 55346b59ef59..43fe09631c01 100644
--- a/deps/simdjson/simdjson.h
+++ b/deps/simdjson/simdjson.h
@@ -1,4 +1,4 @@
-/* auto-generated on 2026-08-24 17:10:01 -0400. version 4.6.9 Do not edit! */
+/* auto-generated on 2026-09-04 16:04:31 -0400. version 4.6.11 Do not edit! */
 /* including simdjson.h:  */
 /* begin file simdjson.h */
 #ifndef SIMDJSON_H
@@ -260,7 +260,7 @@ using std::size_t;
 #endif
 #elif defined(__PPC64__) || defined(_M_PPC64)
 #define SIMDJSON_IS_PPC64 1
-#if defined(__ALTIVEC__)
+#if defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #define SIMDJSON_IS_PPC64_VMX 1
 #endif // defined(__ALTIVEC__)
 #else
@@ -2538,7 +2538,7 @@ namespace std {
 #define SIMDJSON_SIMDJSON_VERSION_H
 
 /** The version of simdjson being used (major.minor.revision) */
-#define SIMDJSON_VERSION "4.6.9"
+#define SIMDJSON_VERSION "4.6.11"
 
 namespace simdjson {
 enum {
@@ -2553,7 +2553,7 @@ enum {
   /**
    * The revision (major.minor.REVISION) of simdjson being used.
    */
-  SIMDJSON_VERSION_REVISION = 9
+  SIMDJSON_VERSION_REVISION = 11
 };
 } // namespace simdjson
 
@@ -4734,6 +4734,7 @@ inline char *allocate_padded_buffer(size_t length) noexcept {
 inline padded_string::padded_string() noexcept = default;
 inline padded_string::padded_string(size_t length) noexcept
     : viable_size(length), data_ptr(internal::allocate_padded_buffer(length)) {
+  if (data_ptr == nullptr) { viable_size = 0; }
 }
 inline padded_string::padded_string(const char *data, size_t length) noexcept
     : viable_size(length), data_ptr(internal::allocate_padded_buffer(length)) {
@@ -6351,6 +6352,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
   /**
@@ -9945,6 +9958,9 @@ simdjson_inline size_t document_stream::iterator::current_index() const noexcept
 
 simdjson_inline std::string_view document_stream::iterator::source() const noexcept {
   const char* start = reinterpret_cast<const char*>(stream->buf) + current_index();
+  if (stream->error) {
+    return std::string_view(start, stream->len - current_index());
+  }
   bool object_or_array = ((*start == '[') || (*start == '{'));
   if(object_or_array) {
     size_t next_doc_index = stream->batch_start + stream->parser->implementation->structural_indexes[stream->parser->implementation->next_structural_index - 1];
@@ -14993,9 +15009,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -15006,6 +15027,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -17206,9 +17228,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -17219,6 +17246,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -19906,9 +19934,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -19919,6 +19952,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -22606,9 +22640,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -22619,6 +22658,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -25421,9 +25461,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -25434,6 +25479,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -28553,9 +28599,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -28566,6 +28617,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -31185,9 +31237,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -31198,6 +31255,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -33795,9 +33853,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -33808,6 +33871,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -36422,9 +36486,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -36435,6 +36504,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -39845,7 +39915,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -41940,7 +42010,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -44522,7 +44592,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -47104,7 +47174,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -49801,7 +49871,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -52815,7 +52885,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -55303,7 +55373,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -57814,7 +57884,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -60329,7 +60399,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -66951,6 +67021,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -70987,7 +71069,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -80330,6 +80412,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -84366,7 +84460,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -94196,6 +94290,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -98232,7 +98338,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -108062,6 +108168,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -112098,7 +112216,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -122043,6 +122161,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -126079,7 +126209,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -136341,6 +136471,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -140377,7 +140519,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -150113,6 +150255,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -154149,7 +154303,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -163908,6 +164062,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -167944,7 +168110,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -177707,6 +177873,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -181743,7 +181921,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
diff --git a/deps/sqlite/unofficial.gni b/deps/sqlite/unofficial.gni
index 0e62accfb699..a0957c5769d6 100644
--- a/deps/sqlite/unofficial.gni
+++ b/deps/sqlite/unofficial.gni
@@ -4,47 +4,67 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("sqlite_gn_build") {
-  config("sqlite_config") {
-    include_dirs = [ "." ]
-    defines = [
-      "SQLITE_ENABLE_COLUMN_METADATA",
-      "SQLITE_ENABLE_DBSTAT_VTAB",
-      "SQLITE_ENABLE_FTS3",
-      "SQLITE_ENABLE_FTS3_PARENTHESIS",
-      "SQLITE_ENABLE_FTS5",
-      "SQLITE_ENABLE_GEOPOLY",
-      "SQLITE_ENABLE_MATH_FUNCTIONS",
-      "SQLITE_ENABLE_PERCENTILE",
-      "SQLITE_ENABLE_PREUPDATE_HOOK",
-      "SQLITE_ENABLE_RBU",
-      "SQLITE_ENABLE_RTREE",
-      "SQLITE_ENABLE_SESSION",
-    ]
-  }
+  if (node_shared_sqlite) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("sqlite_config") {
+      packages = [ "sqlite3" ]
+    }
+    # sqlite3.h only declares the session extension when this is defined.
+    config("sqlite_defines") {
+      defines = [ "SQLITE_ENABLE_SESSION" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [
+        ":sqlite_config",
+        ":sqlite_defines",
+      ]
+    }
+  } else {
+    config("sqlite_config") {
+      include_dirs = [ "." ]
+      defines = [
+        "SQLITE_ENABLE_COLUMN_METADATA",
+        "SQLITE_ENABLE_DBSTAT_VTAB",
+        "SQLITE_ENABLE_FTS3",
+        "SQLITE_ENABLE_FTS3_PARENTHESIS",
+        "SQLITE_ENABLE_FTS5",
+        "SQLITE_ENABLE_GEOPOLY",
+        "SQLITE_ENABLE_MATH_FUNCTIONS",
+        "SQLITE_ENABLE_PERCENTILE",
+        "SQLITE_ENABLE_PREUPDATE_HOOK",
+        "SQLITE_ENABLE_RBU",
+        "SQLITE_ENABLE_RTREE",
+        "SQLITE_ENABLE_SESSION",
+      ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("sqlite.gyp") ],
-                            "scope",
-                            [ "sqlite.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("sqlite.gyp") ],
+                              "scope",
+                              [ "sqlite.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":sqlite_config" ]
-    sources = gypi_values.sqlite_sources
-    cflags_c = [
-      "-Wno-implicit-fallthrough",
-      "-Wno-unreachable-code-return",
-      "-Wno-unreachable-code-break",
-      "-Wno-unreachable-code",
-    ]
-    if (is_win) {
-      cflags_c += [
-        "-Wno-sign-compare",
-        "-Wno-unused-but-set-variable",
-        "-Wno-unused-function",
-        "-Wno-unused-variable",
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":sqlite_config" ]
+      sources = gypi_values.sqlite_sources
+      cflags_c = [
+        "-Wno-implicit-fallthrough",
+        "-Wno-unreachable-code-return",
+        "-Wno-unreachable-code-break",
+        "-Wno-unreachable-code",
       ]
+      if (is_win) {
+        cflags_c += [
+          "-Wno-sign-compare",
+          "-Wno-unused-but-set-variable",
+          "-Wno-unused-function",
+          "-Wno-unused-variable",
+        ]
+      }
     }
   }
 }
diff --git a/deps/uv/unofficial.gni b/deps/uv/unofficial.gni
index 0944d6ddd241..a2891887839b 100644
--- a/deps/uv/unofficial.gni
+++ b/deps/uv/unofficial.gni
@@ -4,113 +4,126 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
-template("uv_gn_build") {
-  config("uv_external_config") {
-    include_dirs = [ "include" ]
-    if (is_clang || !is_win) {
-      cflags_cc = [
-        "-Wno-deprecated-pragma",  # for using ENODATA in errno.h
-      ]
-    }
-  }
-
-  config("uv_internal_config") {
-    include_dirs = [
-      "include",
-      "src",
-    ]
+import("../../node.gni")
 
-    defines = [ "BUILDING_UV_SHARED" ]  # always export symbols
-    if (is_posix) {
-      defines += [
-        "_LARGEFILE_SOURCE",
-        "_FILE_OFFSET_BITS=64",
-      ]
+template("uv_gn_build") {
+  if (node_shared_libuv) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("uv_external_config") {
+      packages = [ "libuv" ]
     }
-    if (is_linux) {
-      defines += [
-        "_POSIX_C_SOURCE=200112",
-        "_GNU_SOURCE",
-      ]
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":uv_external_config" ]
     }
-    if (is_apple) {
-      defines += [
-        "_DARWIN_USE_64_BIT_INODE=1",
-        "_DARWIN_UNLIMITED_SELECT=1",
-      ]
+  } else {
+    config("uv_external_config") {
+      include_dirs = [ "include" ]
+      if (is_clang || !is_win) {
+        cflags_cc = [
+          "-Wno-deprecated-pragma",  # for using ENODATA in errno.h
+        ]
+      }
     }
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-deprecated-declarations",
-        "-Wno-extra-semi",
-        "-Wno-implicit-fallthrough",
-        "-Wno-missing-braces",
-        "-Wno-sign-compare",
-        "-Wno-string-conversion",
-        "-Wno-shadow",
-        "-Wno-unreachable-code",
-        "-Wno-unreachable-code-return",
-        "-Wno-unused-but-set-parameter",
-        "-Wno-unused-but-set-variable",
-        "-Wno-unused-function",
-        "-Wno-unused-result",
-        "-Wno-unused-variable",
+
+    config("uv_internal_config") {
+      include_dirs = [
+        "include",
+        "src",
       ]
+
+      defines = [ "BUILDING_UV_SHARED" ]  # always export symbols
+      if (is_posix) {
+        defines += [
+          "_LARGEFILE_SOURCE",
+          "_FILE_OFFSET_BITS=64",
+        ]
+      }
+      if (is_linux) {
+        defines += [
+          "_POSIX_C_SOURCE=200112",
+          "_GNU_SOURCE",
+        ]
+      }
+      if (is_apple) {
+        defines += [
+          "_DARWIN_USE_64_BIT_INODE=1",
+          "_DARWIN_UNLIMITED_SELECT=1",
+        ]
+      }
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-deprecated-declarations",
+          "-Wno-extra-semi",
+          "-Wno-implicit-fallthrough",
+          "-Wno-missing-braces",
+          "-Wno-sign-compare",
+          "-Wno-string-conversion",
+          "-Wno-shadow",
+          "-Wno-unreachable-code",
+          "-Wno-unreachable-code-return",
+          "-Wno-unused-but-set-parameter",
+          "-Wno-unused-but-set-variable",
+          "-Wno-unused-function",
+          "-Wno-unused-result",
+          "-Wno-unused-variable",
+        ]
+      }
     }
-  }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("uv.gyp") ],
-                            "scope",
-                            [ "uv.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("uv.gyp") ],
+                              "scope",
+                              [ "uv.gyp" ])
 
-  component(target_name) {
-    forward_variables_from(invoker, "*")
+    component(target_name) {
+      forward_variables_from(invoker, "*")
 
-    configs += [ ":uv_internal_config" ]
-    public_configs = [ ":uv_external_config" ]
+      configs += [ ":uv_internal_config" ]
+      public_configs = [ ":uv_external_config" ]
 
-    if (is_posix) {
-      configs -= [ "//build/config/gcc:symbol_visibility_hidden" ]
-      configs += [ "//build/config/gcc:symbol_visibility_default" ]
-    }
+      if (is_posix) {
+        configs -= [ "//build/config/gcc:symbol_visibility_hidden" ]
+        configs += [ "//build/config/gcc:symbol_visibility_default" ]
+      }
 
-    if (is_win) {
-      libs = [
-        "advapi32.lib",
-        "iphlpapi.lib",
-        "psapi.lib",
-        "shell32.lib",
-        "user32.lib",
-        "userenv.lib",
-        "ws2_32.lib",
-      ]
-    }
-    if (is_posix) {
-      ldflags = [ "-pthread" ]
-    }
-    if (is_linux) {
-      libs = [
-        "m",
-        "dl",
-        "rt",
-      ]
-    }
+      if (is_win) {
+        libs = [
+          "advapi32.lib",
+          "iphlpapi.lib",
+          "psapi.lib",
+          "shell32.lib",
+          "user32.lib",
+          "userenv.lib",
+          "ws2_32.lib",
+        ]
+      }
+      if (is_posix) {
+        ldflags = [ "-pthread" ]
+      }
+      if (is_linux) {
+        libs = [
+          "m",
+          "dl",
+          "rt",
+        ]
+      }
 
-    sources = gypi_values.uv_sources_common
-    if (is_win) {
-      sources += gypi_values.uv_sources_win
-    }
-    if (is_posix) {
-      sources += gypi_values.uv_sources_posix +
-                 [ "src/unix/proctitle.c" ]
-    }
-    if (is_linux) {
-      sources += gypi_values.uv_sources_linux
-    }
-    if (is_apple) {
-      sources += gypi_values.uv_sources_apple +
-                 gypi_values.uv_sources_bsd_common
+      sources = gypi_values.uv_sources_common
+      if (is_win) {
+        sources += gypi_values.uv_sources_win
+      }
+      if (is_posix) {
+        sources += gypi_values.uv_sources_posix +
+                   [ "src/unix/proctitle.c" ]
+      }
+      if (is_linux) {
+        sources += gypi_values.uv_sources_linux
+      }
+      if (is_apple) {
+        sources += gypi_values.uv_sources_apple +
+                   gypi_values.uv_sources_bsd_common
+      }
     }
   }
 }
diff --git a/deps/v8/src/api/api.cc b/deps/v8/src/api/api.cc
index fbd628370c0b..48da5b35b872 100644
--- a/deps/v8/src/api/api.cc
+++ b/deps/v8/src/api/api.cc
@@ -3741,14 +3741,6 @@ bool Value::IsTypedArray() const {
 TYPED_ARRAYS_BASE(VALUE_IS_TYPED_ARRAY)
 #undef VALUE_IS_TYPED_ARRAY
 
-bool Value::IsFloat16Array() const {
-  auto obj = *Utils::OpenDirectHandle(this);
-  return i::IsJSTypedArray(obj) &&
-         i::Cast<i::JSTypedArray>(obj)->type() == i::kExternalFloat16Array &&
-         Utils::ApiCheck(i::v8_flags.js_float16array, "Value::IsFloat16Array",
-                         "Float16Array is not supported");
-}
-
 bool Value::IsDataView() const {
   auto obj = *Utils::OpenDirectHandle(this);
   return IsJSDataView(obj) || IsJSRabGsabDataView(obj);
@@ -4292,16 +4284,6 @@ void v8::TypedArray::CheckCast(Value* that) {
 TYPED_ARRAYS_BASE(CHECK_TYPED_ARRAY_CAST)
 #undef CHECK_TYPED_ARRAY_CAST
 
-void v8::Float16Array::CheckCast(Value* that) {
-  Utils::ApiCheck(i::v8_flags.js_float16array, "v8::Float16Array::Cast",
-                  "Float16Array is not supported");
-  auto obj = *Utils::OpenDirectHandle(that);
-  Utils::ApiCheck(
-      i::IsJSTypedArray(obj) &&
-          i::Cast<i::JSTypedArray>(obj)->type() == i::kExternalFloat16Array,
-      "v8::Float16Array::Cast()", "Value is not a Float16Array");
-}
-
 void v8::DataView::CheckCast(Value* that) {
   auto obj = *Utils::OpenDirectHandle(that);
   Utils::ApiCheck(i::IsJSDataView(obj) || IsJSRabGsabDataView(obj),
@@ -9347,44 +9329,6 @@ static_assert(v8::TypedArray::kMaxByteLength == i::JSTypedArray::kMaxByteLength,
 TYPED_ARRAYS_BASE(TYPED_ARRAY_NEW)
 #undef TYPED_ARRAY_NEW
 
-Local<Float16Array> Float16Array::New(Local<ArrayBuffer> array_buffer,
-                                      size_t byte_offset, size_t length) {
-  Utils::ApiCheck(i::v8_flags.js_float16array, "v8::Float16Array::New",
-                  "Float16Array is not supported");
-  i::Isolate* i_isolate = i::Isolate::Current();
-  ApiRuntimeCallStatsScope rcs_scope(i_isolate, RCCId::kAPI_Float16Array_New);
-  EnterV8NoScriptNoExceptionScope api_scope(i_isolate);
-  if (!Utils::ApiCheck(
-          length <= kMaxLength,
-          "v8::Float16Array::New(Local<ArrayBuffer>, size_t, size_t)",
-          "length exceeds max allowed value")) {
-    return {};
-  }
-  auto buffer = Utils::OpenDirectHandle(*array_buffer);
-  i::DirectHandle<i::JSTypedArray> obj = i_isolate->factory()->NewJSTypedArray(
-      i::kExternalFloat16Array, buffer, byte_offset, length);
-  return Utils::ToLocalFloat16Array(obj);
-}
-Local<Float16Array> Float16Array::New(
-    Local<SharedArrayBuffer> shared_array_buffer, size_t byte_offset,
-    size_t length) {
-  Utils::ApiCheck(i::v8_flags.js_float16array, "v8::Float16Array::New",
-                  "Float16Array is not supported");
-  i::Isolate* i_isolate = i::Isolate::Current();
-  ApiRuntimeCallStatsScope rcs_scope(i_isolate, RCCId::kAPI_Float16Array_New);
-  EnterV8NoScriptNoExceptionScope api_scope(i_isolate);
-  if (!Utils::ApiCheck(
-          length <= kMaxLength,
-          "v8::Float16Array::New(Local<SharedArrayBuffer>, size_t, size_t)",
-          "length exceeds max allowed value")) {
-    return {};
-  }
-  auto buffer = Utils::OpenDirectHandle(*shared_array_buffer);
-  i::DirectHandle<i::JSTypedArray> obj = i_isolate->factory()->NewJSTypedArray(
-      i::kExternalFloat16Array, buffer, byte_offset, length);
-  return Utils::ToLocalFloat16Array(obj);
-}
-
 // TODO(v8:11111): Support creating length tracking DataViews via the API.
 Local<DataView> DataView::New(Local<ArrayBuffer> array_buffer,
                               size_t byte_offset, size_t byte_length) {
diff --git a/deps/v8/src/builtins/builtins.cc b/deps/v8/src/builtins/builtins.cc
index 34424db08dc0..0b6e43dde6ea 100644
--- a/deps/v8/src/builtins/builtins.cc
+++ b/deps/v8/src/builtins/builtins.cc
@@ -863,12 +863,6 @@ Builtins::JSBuiltinStateFlags Builtins::GetJSBuiltinState(Builtin builtin) {
       RETURN_FLAG_DEPENDENT_BUILTIN_STATE(
           v8_flags.js_explicit_resource_management);
 
-    // --js-float16array
-    case Builtin::kMathF16round:
-    case Builtin::kDataViewPrototypeGetFloat16:
-    case Builtin::kDataViewPrototypeSetFloat16:
-      RETURN_FLAG_DEPENDENT_BUILTIN_STATE(v8_flags.js_float16array);
-
     // --js-base-64
     case Builtin::kUint8ArrayFromBase64:
     case Builtin::kUint8ArrayFromHex:
diff --git a/deps/v8/src/deoptimizer/translated-state.cc b/deps/v8/src/deoptimizer/translated-state.cc
index a8c87dbd0242..6aa94999ac28 100644
--- a/deps/v8/src/deoptimizer/translated-state.cc
+++ b/deps/v8/src/deoptimizer/translated-state.cc
@@ -1889,6 +1889,31 @@ Address TranslatedState::DecompressIfNeeded(intptr_t value) {
   }
 }
 
+// static
+std::optional<Tagged<Object>> TranslatedState::TryResolveTaggedValue(
+    DeoptTranslationIterator* it, Address fp,
+    Tagged<DeoptimizationLiteralArray> literals) {
+  TranslationOpcode opcode = it->NextOpcode();
+  switch (opcode) {
+    case TranslationOpcode::LITERAL: {
+      int literal_index = it->NextOperand();
+      return literals->get(literal_index);
+    }
+    case TranslationOpcode::TAGGED_STACK_SLOT: {
+      int slot_offset =
+          OptimizedJSFrame::StackSlotOffsetRelativeToFp(it->NextOperand());
+      intptr_t value = *reinterpret_cast<intptr_t*>(fp + slot_offset);
+      return Tagged<Object>(DecompressIfNeeded(value));
+    }
+    default:
+      // Any other encoding (unboxed numerics, register-resident values,
+      // captured objects, etc.) requires the full TranslatedState path to
+      // materialize. Caller should fall back.
+      it->SkipOperands(TranslationOpcodeOperandCount(opcode));
+      return std::nullopt;
+  }
+}
+
 TranslatedState::TranslatedState(const JavaScriptFrame* frame)
     : purpose_(kFrameInspection) {
   int deopt_index = SafepointEntry::kNoDeoptIndex;
diff --git a/deps/v8/src/deoptimizer/translated-state.h b/deps/v8/src/deoptimizer/translated-state.h
index dfa5f11e8209..07daaf4be395 100644
--- a/deps/v8/src/deoptimizer/translated-state.h
+++ b/deps/v8/src/deoptimizer/translated-state.h
@@ -511,6 +511,17 @@ class TranslatedState {
   void VerifyMaterializedObjects();
   bool DoUpdateFeedback(DeoptimizeReason reason);
 
+  // Resolves one deopt translation value opcode to a raw Tagged<Object>,
+  // reading from the live frame if needed.  Only LITERAL and
+  // TAGGED_STACK_SLOT can be resolved cheaply; for any other opcode the
+  // iterator is left positioned just past the opcode and std::nullopt is
+  // returned so the caller can fall back to the full materialization path.
+  static std::optional<Tagged<Object>> TryResolveTaggedValue(
+      DeoptTranslationIterator* it, Address fp,
+      Tagged<DeoptimizationLiteralArray> literals);
+
+  static Address DecompressIfNeeded(intptr_t value);
+
  private:
   friend TranslatedValue;
 
@@ -529,7 +540,6 @@ class TranslatedState {
       int frame_index, DeoptTranslationIterator* iterator,
       const DeoptimizationLiteralProvider& literal_array, Address fp,
       RegisterValues* registers, FILE* trace_file);
-  Address DecompressIfNeeded(intptr_t value);
   void CreateArgumentsElementsTranslatedValues(int frame_index,
                                                Address input_frame_pointer,
                                                CreateArgumentsType type,
diff --git a/deps/v8/src/execution/frames.cc b/deps/v8/src/execution/frames.cc
index 110abb96f250..f587dd49e36d 100644
--- a/deps/v8/src/execution/frames.cc
+++ b/deps/v8/src/execution/frames.cc
@@ -3179,7 +3179,118 @@ FrameSummaries OptimizedJSFrame::Summarize(bool never_allocate) const {
         "Missing deoptimization information for OptimizedJSFrame::Summarize.");
   }
 
-  // Prepare iteration over translation. We must not materialize values here
+  // Lightweight walk: iterate frame headers only, resolving just the
+  // function and receiver from the live frame via ResolveTaggedValue.
+  // This avoids the expensive TranslatedState::Init + Prepare path that
+  // would parse every value in every inlined frame.
+
+  Tagged<DeoptimizationLiteralArray> literal_array = data->LiteralArray();
+
+  // Lightweight walk: resolve function and receiver from live frame headers
+  // and build JavaScriptFrameSummary objects directly.
+  bool needs_full_walk = false;
+  {
+    DisallowGarbageCollection no_gc;
+    DeoptimizationFrameTranslation::Iterator it(
+        data->FrameTranslation(), data->TranslationIndex(deopt_index).value());
+    bool is_constructor = IsConstructor();
+    int remaining = it.EnterBeginOpcode().total_frame_count;
+
+    while (remaining > 0) {
+      TranslationOpcode opcode = it.SeekNextFrame();
+      remaining--;
+
+      if (opcode == TranslationOpcode::CONSTRUCT_CREATE_STUB_FRAME ||
+          opcode == TranslationOpcode::CONSTRUCT_INVOKE_STUB_FRAME) {
+        is_constructor = true;
+        it.SkipOperands(TranslationOpcodeOperandCount(opcode));
+        continue;
+      }
+
+      if (!IsTranslationJsFrameOpcode(opcode)) {
+#if V8_ENABLE_WEBASSEMBLY
+        // Wasm-inlined-into-JS frames need the full TranslatedState
+        // machinery to produce WasmFrameSummary entries.
+        if (opcode == TranslationOpcode::WASM_INLINED_INTO_JS_FRAME) {
+          needs_full_walk = true;
+          break;
+        }
+#endif
+        it.SkipOperands(TranslationOpcodeOperandCount(opcode));
+        continue;
+      }
+
+      bool is_builtin_cont =
+          (opcode == TranslationOpcode::JAVASCRIPT_BUILTIN_CONTINUATION_FRAME ||
+           opcode == TranslationOpcode::
+                         JAVASCRIPT_BUILTIN_CONTINUATION_WITH_CATCH_FRAME);
+
+      int bytecode_offset = it.NextOperand();
+      int sfi_id = it.NextOperand();
+      Tagged<SharedFunctionInfo> sfi =
+          Cast<SharedFunctionInfo>(literal_array->get(sfi_id));
+
+      // Skip remaining header operands to reach the values.
+      it.SkipOperands(TranslationOpcodeOperandCount(opcode) - 2);
+
+      // Resolve closure and receiver from the live frame.  The closure is
+      // always tagged (LITERAL or TAGGED_STACK_SLOT), but the receiver is
+      // just parameter 0 of the (possibly inlined) frame and may be encoded
+      // in any representation the optimizer chose (e.g. DOUBLE_STACK_SLOT
+      // for an unboxed Float64). Fall back to the full materialization path
+      // in that case.
+      std::optional<Tagged<Object>> function_obj =
+          TranslatedState::TryResolveTaggedValue(&it, fp(), literal_array);
+      DCHECK(function_obj.has_value());
+      DCHECK(IsJSFunction(*function_obj));
+      std::optional<Tagged<Object>> receiver_obj =
+          TranslatedState::TryResolveTaggedValue(&it, fp(), literal_array);
+      if (!receiver_obj.has_value()) {
+        needs_full_walk = true;
+        break;
+      }
+
+      Tagged<AbstractCode> abstract_code;
+      int code_offset;
+      if (is_builtin_cont) {
+        code_offset = 0;
+        abstract_code = Cast<AbstractCode>(
+            isolate()->builtins()->code(Builtins::GetBuiltinFromBytecodeOffset(
+                BytecodeOffset(bytecode_offset))));
+      } else {
+        code_offset = bytecode_offset;
+        abstract_code = Cast<AbstractCode>(sfi->GetBytecodeArray(isolate()));
+      }
+
+      DirectHandle<FixedArray> params = GetParameters(never_allocate);
+      FrameSummary::JavaScriptFrameSummary summary(
+          isolate(), *receiver_obj, Cast<JSFunction>(*function_obj),
+          abstract_code, code_offset, is_constructor, *params);
+      summaries.frames.push_back(summary);
+      is_constructor = false;
+    }
+
+    if (!needs_full_walk && is_constructor) {
+      summaries.top_frame_is_construct_call = true;
+    }
+  }  // no_gc scope ends.
+
+  if (needs_full_walk) {
+    return SummarizeFull(data, deopt_index, never_allocate);
+  }
+
+  return summaries;
+}
+
+FrameSummaries OptimizedJSFrame::SummarizeFull(Tagged<DeoptimizationData> data,
+                                               int deopt_index,
+                                               bool never_allocate) const {
+  FrameSummaries summaries;
+
+  DCHECK_NE(deopt_index, SafepointEntry::kNoDeoptIndex);
+  DCHECK(!data.is_null());
+
+  // Prepare iteration over translation.  We must not materialize values here
   // because we do not deoptimize the function.
   TranslatedState translated(this);
   translated.Prepare(fp());
@@ -3204,7 +3315,21 @@ FrameSummaries OptimizedJSFrame::Summarize(bool never_allocate) const {
       // Get the correct receiver in the optimized frame.
       static_assert(TranslatedFrame::kReceiverIsFirstParameterInJSFrames);
       CHECK(!translated_values->IsMaterializedObject());
-      DirectHandle<Object> receiver = translated_values->GetValue();
+      // Check GetRawValue() against arguments_marker() first to see whether
+      // calling GetValue() allocates.
+      Tagged<Object> receiver_obj = translated_values->GetRawValue();
+      DirectHandle<Object> receiver;
+      if (receiver_obj == ReadOnlyRoots(isolate()).arguments_marker() &&
+          never_allocate) {
+        // Calling GetValue() would definitely trigger allocation but with
+        // `never_allocate` allocations are not allowed. Simply pick `undefined`
+        // as receiver instead even though it is off. `never_allocate` is
+        // currently only used for OOM stacks, where we don't even emit the
+        // receiver but want to see as many stack frames as possible.
+        receiver = isolate()->factory()->undefined_value();
+      } else {
+        receiver = translated_values->GetValue();
+      }
       translated_values++;
 
       // Determine the underlying code object and the position within it from
@@ -3311,24 +3436,20 @@ int TurbofanJSFrame::FindReturnPCForTrampoline(Tagged<Code> code,
   return safepoints.find_return_pc(trampoline_pc);
 }
 
-Tagged<DeoptimizationData> OptimizedJSFrame::GetDeoptimizationData(
-    Tagged<Code> code, int* deopt_index) const {
-  DCHECK(is_optimized());
-
-  Address pc = maybe_unauthenticated_pc();
-
-  DCHECK(code->contains(isolate(), pc));
+// static
+Tagged<DeoptimizationData> OptimizedJSFrame::GetDeoptimizationDataForPC(
+    Isolate* isolate, Tagged<Code> code, Address pc, int* deopt_index) {
+  DCHECK(code->contains(isolate, pc));
   DCHECK(CodeKindCanDeoptimize(code->kind()));
-
   if (code->is_maglevved()) {
     MaglevSafepointEntry safepoint_entry =
-        code->GetMaglevSafepointEntry(isolate(), pc);
+        code->GetMaglevSafepointEntry(isolate, pc);
     if (safepoint_entry.has_deoptimization_index()) {
       *deopt_index = safepoint_entry.deoptimization_index();
       return code->deoptimization_data();
     }
   } else {
-    SafepointEntry safepoint_entry = code->GetSafepointEntry(isolate(), pc);
+    SafepointEntry safepoint_entry = code->GetSafepointEntry(isolate, pc);
     if (safepoint_entry.has_deoptimization_index()) {
       *deopt_index = safepoint_entry.deoptimization_index();
       return code->deoptimization_data();
@@ -3338,6 +3459,14 @@ Tagged<DeoptimizationData> OptimizedJSFrame::GetDeoptimizationData(
   return {};
 }
 
+Tagged<DeoptimizationData> OptimizedJSFrame::GetDeoptimizationData(
+    Tagged<Code> code, int* deopt_index) const {
+  DCHECK(is_optimized());
+  Address pc = maybe_unauthenticated_pc();
+  DCHECK(code->contains(isolate(), pc));
+  return GetDeoptimizationDataForPC(isolate(), code, pc, deopt_index);
+}
+
 void OptimizedJSFrame::GetFunctions(
     std::vector<Tagged<SharedFunctionInfo>>* functions) const {
   DCHECK(functions->empty());
diff --git a/deps/v8/src/execution/frames.h b/deps/v8/src/execution/frames.h
index 017613a7305a..550fdde93671 100644
--- a/deps/v8/src/execution/frames.h
+++ b/deps/v8/src/execution/frames.h
@@ -1169,6 +1169,11 @@ class OptimizedJSFrame : public JavaScriptFrame {
   Tagged<DeoptimizationData> GetDeoptimizationData(Tagged<Code> code,
                                                    int* deopt_index) const;
 
+  // Like GetDeoptimizationData, but takes an explicit PC instead of reading
+  // it from the frame.  Can be used without a live frame.
+  static Tagged<DeoptimizationData> GetDeoptimizationDataForPC(
+      Isolate* isolate, Tagged<Code> code, Address pc, int* deopt_index);
+
   static int StackSlotOffsetRelativeToFp(int slot_index);
 
   // Lookup exception handler for current {pc}, returns -1 if none found.
@@ -1178,6 +1183,13 @@ class OptimizedJSFrame : public JavaScriptFrame {
   virtual int FindReturnPCForTrampoline(Tagged<Code> code,
                                         int trampoline_pc) const = 0;
 
+ private:
+  // Full TranslatedState-based walk, used as fallback when the lightweight
+  // path in Summarize() encounters frames it cannot handle (e.g.
+  // wasm-inlined-into-JS frames).
+  FrameSummaries SummarizeFull(Tagged<DeoptimizationData> data, int deopt_index,
+                               bool never_allocate) const;
+
  protected:
   inline explicit OptimizedJSFrame(StackFrameIteratorBase* iterator);
 };
diff --git a/deps/v8/src/execution/isolate.cc b/deps/v8/src/execution/isolate.cc
index 06fa14bf6b10..74762de5a9aa 100644
--- a/deps/v8/src/execution/isolate.cc
+++ b/deps/v8/src/execution/isolate.cc
@@ -878,18 +878,21 @@ class CallSiteBuilder {
     // framework and library code, and stack depth tends to be more than
     // a dozen frames, so we over-allocate a bit here to avoid growing
     // the elements array in the common case.
-    elements_ = isolate->factory()->NewFixedArray(std::min(64, limit));
+    elements_ = isolate->factory()->NewFixedArray(CallSiteInfo::Fields::kCount *
+                                                  std::min(64, limit));
   }
 
   void SetPrevFrameAsConstructCall() {
     if (skipped_prev_frame_) return;
     DCHECK_GT(index_, 0);
-    Tagged<CallSiteInfo> info =
-        Tagged<CallSiteInfo>::cast(elements_->get(index_ - 1));
+    int base_index = (index_ - 1) * CallSiteInfo::Fields::kCount;
+    int flags =
+        Smi::ToInt(elements_->get(base_index + CallSiteInfo::Fields::kFlags));
 #if V8_ENABLE_WEBASSEMBLY
-    if (info->IsWasm()) return;
+    if (flags & CallSiteInfo::kIsWasm) return;
 #endif
-    info->set_flags(info->flags() | CallSiteInfo::kIsConstructor);
+    elements_->set(base_index + CallSiteInfo::Fields::kFlags,
+                   Smi::FromInt(flags | CallSiteInfo::kIsConstructor));
   }
 
   bool Visit(FrameSummary const& summary) {
@@ -1051,7 +1054,8 @@ class CallSiteBuilder {
   bool Full() { return index_ >= limit_; }
 
   Handle<FixedArray> Build() {
-    return FixedArray::RightTrimOrEmpty(isolate_, elements_, index_);
+    return FixedArray::RightTrimOrEmpty(isolate_, elements_,
+                                        CallSiteInfo::Fields::kCount * index_);
   }
 
  private:
@@ -1114,19 +1118,70 @@ class CallSiteBuilder {
     return true;
   }
 
+ public:
+  // Store a deferred entry for a baseline frame.
+  // Stores the Code + raw PC offset; bytecode offset resolution
+  // happens lazily in ExpandDeferredFrames().
+  bool AppendDeferredFrame(JavaScriptFrame* frame, int deferred_flag) {
+    if (Full()) return false;
+    DirectHandle<JSFunction> function(frame->function(), isolate_);
+    if (!IsVisibleInStackTrace(function)) {
+      skipped_prev_frame_ = true;
+      return true;
+    }
+    int flags = deferred_flag;
+    if (IsStrictFrame(function)) flags |= CallSiteInfo::kIsStrict;
+    if (frame->IsConstructor()) flags |= CallSiteInfo::kIsConstructor;
+
+    Tagged<Code> code = frame->LookupCode();
+    int pc_offset = static_cast<int>(frame->pc() - code->instruction_start());
+
+    AppendFrame(Cast<UnionOf<JSAny, Hole>>(handle(frame->receiver(), isolate_)),
+                function, handle(code, isolate_), pc_offset, flags,
+                frame->GetParameters(/*never_allocate=*/false));
+    return true;
+  }
+
   void AppendFrame(DirectHandle<UnionOf<JSAny, Hole>> receiver_or_instance,
                    DirectHandle<UnionOf<Smi, JSFunction>> function,
-                   DirectHandle<HeapObject> code, int offset, int flags,
+                   DirectHandle<HeapObject> code_obj, int offset, int flags,
                    DirectHandle<FixedArray> parameters) {
     if (IsTheHole(*receiver_or_instance, isolate_)) {
       // TODO(jgruber): Fix all cases in which frames give us a hole value
       // (e.g. the receiver in RegExp constructor frames).
       receiver_or_instance = isolate_->factory()->undefined_value();
     }
-    auto info = isolate_->factory()->NewCallSiteInfo(
-        Cast<JSAny>(receiver_or_instance), function, code, offset, flags,
-        parameters);
-    elements_ = FixedArray::SetAndGrow(isolate_, elements_, index_++, info);
+
+    int base_index = index_ * CallSiteInfo::Fields::kCount;
+
+    // Set the last field first and grow the array if needed.
+    static_assert(CallSiteInfo::Fields::kFlags ==
+                  CallSiteInfo::Fields::kCount - 1);
+    elements_ = FixedArray::SetAndGrow(
+        isolate_, elements_, base_index + CallSiteInfo::Fields::kFlags,
+        Smi::FromInt(flags));
+
+    elements_->set(base_index + CallSiteInfo::Fields::kReceiver,
+                   *receiver_or_instance);
+    elements_->set(base_index + CallSiteInfo::Fields::kFunction, *function);
+
+    if (DirectHandle<Code> code; TryCast(code_obj, &code)) {
+      elements_->set(base_index + CallSiteInfo::Fields::kCode, code->wrapper());
+    } else if (DirectHandle<BytecodeArray> bytecode;
+               TryCast(code_obj, &bytecode)) {
+      elements_->set(base_index + CallSiteInfo::Fields::kCode,
+                     bytecode->wrapper());
+    } else {
+      elements_->set(base_index + CallSiteInfo::Fields::kCode,
+                     *isolate_->factory()->undefined_value());
+    }
+
+    elements_->set(base_index + CallSiteInfo::Fields::kOffset,
+                   Smi::FromInt(offset));
+    elements_->set(base_index + CallSiteInfo::Fields::kParameters,
+                   *parameters);
+
+    index_++;
     skipped_prev_frame_ = false;
   }
 
@@ -1357,18 +1412,16 @@ void CaptureAsyncStackTrace(Isolate* isolate, CallSiteBuilder* builder) {
   }
 }
 
+// Summarize a single frame and pass each logical frame to the visitor.
 template <typename Visitor>
 void VisitStack(Isolate* isolate, Visitor* visitor,
                 StackTrace::StackTraceOptions options = StackTrace::kDetailed,
                 bool never_allocate = false) {
   DisallowJavascriptExecution no_js(isolate);
-  // Keep track if we visited a stack frame, but did not visit any summarized
-  // frames. Either because the stack frame didn't create any summarized frames
-  // or due to security origin.
-  bool skipped_last_frame = true;
   for (StackFrameIterator it(isolate); !it.done(); it.Advance()) {
     StackFrame* frame = it.frame();
     switch (frame->type()) {
+      case StackFrame::BASELINE:
       case StackFrame::API_CALLBACK_EXIT:
       case StackFrame::API_CONSTRUCT_EXIT:
       case StackFrame::BUILTIN_EXIT:
@@ -1377,7 +1430,6 @@ void VisitStack(Isolate* isolate, Visitor* visitor,
       case StackFrame::TURBOFAN_JS:
       case StackFrame::MAGLEV:
       case StackFrame::INTERPRETED:
-      case StackFrame::BASELINE:
       case StackFrame::BUILTIN:
 #if V8_ENABLE_WEBASSEMBLY
       case StackFrame::STUB:
@@ -1392,14 +1444,73 @@ void VisitStack(Isolate* isolate, Visitor* visitor,
         // inlining).
         FrameSummaries summaries =
             CommonFrame::cast(frame)->Summarize(never_allocate);
+        for (auto& summary : base::Reversed(summaries.frames)) {
+          // Skip frames from other origins when asked to do so.
+          if (!(options & StackTrace::kExposeFramesAcrossSecurityOrigins) &&
+              !summary.native_context()->HasSameSecurityTokenAs(
+                  isolate->context())) {
+            continue;
+          }
+          if (!visitor->Visit(summary)) return;
+        }
+        break;
+      }
+
+      default:
+        break;
+    }
+  }
+}
+
+// Specialized stack walk for CallSiteBuilder, handling deferred baseline
+// frames and the construct-call flag on the previous frame.
+void VisitStack_ForCallSiteBuilder(Isolate* isolate, CallSiteBuilder* visitor) {
+  DisallowJavascriptExecution no_js(isolate);
+  // Track whether the last physical frame produced any visited summarized
+  // frames. Used to correctly attribute construct-call flags.
+  bool skipped_last_frame = true;
+  for (StackFrameIterator it(isolate); !it.done(); it.Advance()) {
+    StackFrame* frame = it.frame();
+    switch (frame->type()) {
+      case StackFrame::BASELINE:
+        // Baseline frames are captured as deferred entries so they can be
+        // expanded later without blocking the stack capture path.
+        if (!visitor->AppendDeferredFrame(
+                JavaScriptFrame::cast(frame),
+                CallSiteInfo::kIsDeferredBaselineFrame)) {
+          return;
+        }
+        skipped_last_frame = true;
+        break;
+      case StackFrame::API_CALLBACK_EXIT:
+      case StackFrame::API_CONSTRUCT_EXIT:
+      case StackFrame::BUILTIN_EXIT:
+      case StackFrame::JAVASCRIPT_BUILTIN_CONTINUATION:
+      case StackFrame::JAVASCRIPT_BUILTIN_CONTINUATION_WITH_CATCH:
+      case StackFrame::TURBOFAN_JS:
+      case StackFrame::MAGLEV:
+      case StackFrame::INTERPRETED:
+      case StackFrame::BUILTIN:
+#if V8_ENABLE_WEBASSEMBLY
+      case StackFrame::STUB:
+      case StackFrame::WASM:
+      case StackFrame::WASM_SEGMENT_START:
+#if V8_ENABLE_DRUMBRAKE
+      case StackFrame::WASM_INTERPRETER_ENTRY:
+#endif  // V8_ENABLE_DRUMBRAKE
+#endif  // V8_ENABLE_WEBASSEMBLY
+      {
+        // A standard frame may include many summarized frames (due to
+        // inlining).
+        FrameSummaries summaries = CommonFrame::cast(frame)->Summarize();
         if (summaries.top_frame_is_construct_call && !skipped_last_frame) {
           visitor->SetPrevFrameAsConstructCall();
         }
         skipped_last_frame = true;
         for (auto& summary : base::Reversed(summaries.frames)) {
-          // Skip frames from other origins when asked to do so.
-          if (!(options & StackTrace::kExposeFramesAcrossSecurityOrigins) &&
-              !summary.native_context()->HasSameSecurityTokenAs(
+          // CaptureSimpleStackTrace uses kDetailed, which does not expose
+          // frames across security origins.
+          if (!summary.native_context()->HasSameSecurityTokenAs(
                   isolate->context())) {
             continue;
           }
@@ -1426,7 +1537,7 @@ Handle<FixedArray> CaptureSimpleStackTrace(Isolate* isolate, int limit,
 #endif  // V8_ENABLE_WEBASSEMBLY
 
   CallSiteBuilder builder(isolate, mode, limit, caller);
-  VisitStack(isolate, &builder);
+  VisitStack_ForCallSiteBuilder(isolate, &builder);
 
   // If --async-stack-traces are enabled and the "current microtask" is a
   // PromiseReactionJobTask, we try to enrich the stack trace with async
@@ -1442,13 +1553,21 @@ Handle<FixedArray> CaptureSimpleStackTrace(Isolate* isolate, int limit,
 }
 
 DirectHandle<StackTraceInfo> GetDetailedStackTraceFromCallSiteInfos(
-    Isolate* isolate, DirectHandle<FixedArray> call_site_infos, int limit) {
-  auto frames = isolate->factory()->NewFixedArray(
-      std::min(limit, call_site_infos->length()));
-  int index = 0;
-  for (int i = 0; i < call_site_infos->length() && index < limit; ++i) {
-    DirectHandle<CallSiteInfo> call_site_info(
-        Cast<CallSiteInfo>(call_site_infos->get(i)), isolate);
+    Isolate* isolate, DirectHandle<FixedArray> raw_data_for_call_site_infos,
+    uint32_t limit) {
+  Handle<FixedArray> expanded = CallSiteInfo::ExpandDeferredFrames(
+      isolate, handle(*raw_data_for_call_site_infos, isolate));
+  raw_data_for_call_site_infos = expanded;
+  uint32_t call_site_infos_len =
+      raw_data_for_call_site_infos->length() /
+      CallSiteInfo::Fields::kCount;
+  auto frames =
+      isolate->factory()->NewFixedArray(std::min(limit, call_site_infos_len));
+  uint32_t index = 0;
+  for (uint32_t i = 0; i < call_site_infos_len && index < limit; ++i) {
+    DirectHandle<CallSiteInfo> call_site_info =
+        CallSiteInfo::ConstructFromRawData(isolate,
+                                           raw_data_for_call_site_infos, i);
     if (call_site_info->IsAsync()) {
       break;
     }
@@ -1519,14 +1638,19 @@ MaybeDirectHandle<JSObject> Isolate::CaptureAndSetErrorStack(
           stack_trace_for_uncaught_exceptions_frame_limit_,
           stack_trace_for_uncaught_exceptions_options_);
     } else {
-      auto call_site_infos =
+      auto raw_data_for_call_site_infos =
           Cast<FixedArray>(call_site_infos_or_formatted_stack);
       stack_trace = GetDetailedStackTraceFromCallSiteInfos(
-          this, call_site_infos,
-          stack_trace_for_uncaught_exceptions_frame_limit_);
-      if (stack_trace_limit < call_site_infos->length()) {
+          this, raw_data_for_call_site_infos,
+          static_cast<uint32_t>(
+              stack_trace_for_uncaught_exceptions_frame_limit_));
+      DCHECK_GE(stack_trace_limit, 0);
+      if (static_cast<int>(stack_trace_limit) *
+              CallSiteInfo::Fields::kCount <
+          raw_data_for_call_site_infos->length()) {
         call_site_infos_or_formatted_stack = FixedArray::RightTrimOrEmpty(
-            this, call_site_infos, stack_trace_limit);
+            this, raw_data_for_call_site_infos,
+            stack_trace_limit * CallSiteInfo::Fields::kCount);
       }
       // Notify the debugger.
       OnStackTraceCaptured(stack_trace);
@@ -1556,17 +1680,29 @@ Handle<FixedArray> Isolate::GetSimpleStackTrace(
   ErrorUtils::StackPropertyLookupResult lookup =
       ErrorUtils::GetErrorStackProperty(this, maybe_error_object);
 
+  Handle<FixedArray> raw_data;
   if (IsFixedArray(*lookup.error_stack)) {
-    return Cast<FixedArray>(lookup.error_stack);
-  }
-  if (!IsErrorStackData(*lookup.error_stack)) {
+    raw_data = Cast<FixedArray>(lookup.error_stack);
+  } else if (IsErrorStackData(*lookup.error_stack)) {
+    auto error_stack_data = Cast<ErrorStackData>(lookup.error_stack);
+    if (!error_stack_data->HasRawDataForCallSiteInfos()) {
+      return factory()->empty_fixed_array();
+    }
+    raw_data = handle(error_stack_data->raw_data_for_call_site_infos(), this);
+  } else {
     return factory()->empty_fixed_array();
   }
-  auto error_stack_data = Cast<ErrorStackData>(lookup.error_stack);
-  if (!error_stack_data->HasCallSiteInfos()) {
-    return factory()->empty_fixed_array();
+
+  raw_data = CallSiteInfo::ExpandDeferredFrames(this, raw_data);
+
+  int frame_count = raw_data->length() / CallSiteInfo::Fields::kCount;
+  Handle<FixedArray> call_site_infos = factory()->NewFixedArray(frame_count);
+  for (int i = 0; i < frame_count; ++i) {
+    DirectHandle<CallSiteInfo> call_site_info =
+        CallSiteInfo::ConstructFromRawData(this, raw_data, i);
+    call_site_infos->set(i, *call_site_info);
   }
-  return handle(error_stack_data->call_site_infos(), this);
+  return call_site_infos;
 }
 
 Address Isolate::GetAbstractPC(int* line, int* column) {
@@ -1616,10 +1752,6 @@ class StackFrameBuilder {
         index_(0),
         limit_(limit) {}
 
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     // Check if we have enough capacity left.
     if (index_ >= limit_) return false;
@@ -1664,10 +1796,6 @@ class CurrentScriptNameStackVisitor {
   explicit CurrentScriptNameStackVisitor(Isolate* isolate)
       : isolate_(isolate) {}
 
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     // Skip frames that aren't subject to debugging. Keep this in sync with
     // StackFrameBuilder::Visit so both visitors visit the same frames.
@@ -1696,10 +1824,6 @@ class CurrentScriptNameStackVisitor {
 
 class CurrentScriptIdStackVisitor {
  public:
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     // Skip frames that aren't subject to debugging. Keep this in sync with
     // StackFrameBuilder::Visit so both visitors visit the same frames.
@@ -1729,10 +1853,6 @@ class CurrentScriptIdsAndContextsStackVisitor {
     DCHECK_LT(0, frame_data.size());
   }
 
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     if (!summary.is_subject_to_debugging()) return true;
 
@@ -1778,10 +1898,6 @@ class CurrentScriptIdsAndContextsStackVisitor {
 
 class CurrentScriptStackVisitor {
  public:
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     // Skip frames that aren't subject to debugging. Keep this in sync with
     // StackFrameBuilder::Visit so both visitors visit the same frames.
@@ -1919,10 +2035,6 @@ class MinimalStackPrinter {
 
   explicit MinimalStackPrinter(size_t max_length) : max_length_(max_length) {}
 
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     if (summary.IsJavaScript()) {
       const FrameSummary::JavaScriptFrameSummary& js_summary =
@@ -3164,12 +3276,16 @@ Tagged<Object> Isolate::ThrowIllegalOperation() {
 void Isolate::PrintCurrentStackTrace(
     std::ostream& out,
     PrintCurrentStackTraceFilterCallback should_include_frame_callback) {
-  DirectHandle<FixedArray> frames = CaptureSimpleStackTrace(
+  Handle<FixedArray> frames = CaptureSimpleStackTrace(
       this, FixedArray::kMaxLength, SKIP_NONE, factory()->undefined_value());
+  frames = CallSiteInfo::ExpandDeferredFrames(this, frames);
 
   IncrementalStringBuilder builder(this);
-  for (int i = 0; i < frames->length(); ++i) {
-    DirectHandle<CallSiteInfo> frame(Cast<CallSiteInfo>(frames->get(i)), this);
+  uint32_t frame_count =
+      frames->length() / CallSiteInfo::Fields::kCount;
+  for (uint32_t i = 0; i < frame_count; ++i) {
+    DirectHandle<CallSiteInfo> frame =
+        CallSiteInfo::ConstructFromRawData(this, frames, i);
 
     if (should_include_frame_callback) {
       Tagged<Object> raw_script_name = frame->GetScriptNameOrSourceURL();
@@ -3193,7 +3309,7 @@ void Isolate::PrintCurrentStackTrace(
       SerializeCallSiteInfo(this, frame, &builder);
     }
 
-    if (i != frames->length() - 1) builder.AppendCharacter('\n');
+    if (i != frame_count - 1) builder.AppendCharacter('\n');
   }
 
   DirectHandle<String> stack_trace = builder.Finish().ToHandleChecked();
diff --git a/deps/v8/src/execution/messages.cc b/deps/v8/src/execution/messages.cc
index b24aafc1be43..64800baec261 100644
--- a/deps/v8/src/execution/messages.cc
+++ b/deps/v8/src/execution/messages.cc
@@ -24,6 +24,7 @@
 #include "src/parsing/parse-info.h"
 #include "src/parsing/parsing.h"
 #include "src/roots/roots.h"
+#include "src/sandbox/indirect-pointer-inl.h"
 #include "src/strings/string-builder-inl.h"
 
 namespace v8 {
@@ -202,15 +203,16 @@ namespace {
 
 // Convert the raw frames as written by Isolate::CaptureSimpleStackTrace into
 // a JSArray of JSCallSite objects.
-MaybeDirectHandle<JSArray> GetStackFrames(Isolate* isolate,
-                                          DirectHandle<FixedArray> frames) {
-  int frame_count = frames->length();
+MaybeDirectHandle<JSArray> GetStackFrames(
+    Isolate* isolate, DirectHandle<FixedArray> raw_data_for_call_site_infos) {
+  uint32_t frame_count = raw_data_for_call_site_infos->length() /
+                         CallSiteInfo::Fields::kCount;
   DirectHandle<JSFunction> constructor = isolate->callsite_function();
   DirectHandle<FixedArray> sites =
       isolate->factory()->NewFixedArray(frame_count);
-  for (int i = 0; i < frame_count; ++i) {
-    DirectHandle<CallSiteInfo> frame(Cast<CallSiteInfo>(frames->get(i)),
-                                     isolate);
+  for (uint32_t i = 0; i < frame_count; ++i) {
+    DirectHandle<CallSiteInfo> frame = CallSiteInfo::ConstructFromRawData(
+        isolate, raw_data_for_call_site_infos, i);
     DirectHandle<JSObject> site;
     ASSIGN_RETURN_ON_EXCEPTION(isolate, site,
                                JSObject::New(constructor, constructor,
@@ -292,7 +294,7 @@ MaybeDirectHandle<Object> ErrorUtils::FormatStackTrace(
     return isolate->factory()->empty_string();
   }
   DCHECK(IsFixedArray(*raw_stack));
-  auto elems = Cast<FixedArray>(raw_stack);
+  auto raw_data_for_call_site_infos = Cast<FixedArray>(raw_stack);
 
   const bool in_recursion = isolate->formatting_stack_trace();
   const bool has_overflowed = i::StackLimitCheck{isolate}.HasOverflowed();
@@ -303,8 +305,9 @@ MaybeDirectHandle<Object> ErrorUtils::FormatStackTrace(
       PrepareStackTraceScope scope(isolate);
 
       DirectHandle<JSArray> sites;
-      ASSIGN_RETURN_ON_EXCEPTION(isolate, sites,
-                                 GetStackFrames(isolate, elems));
+      ASSIGN_RETURN_ON_EXCEPTION(
+          isolate, sites,
+          GetStackFrames(isolate, raw_data_for_call_site_infos));
 
       DirectHandle<Object> result;
       ASSIGN_RETURN_ON_EXCEPTION(
@@ -329,8 +332,9 @@ MaybeDirectHandle<Object> ErrorUtils::FormatStackTrace(
         isolate->CountUsage(v8::Isolate::kErrorPrepareStackTrace);
 
         DirectHandle<JSArray> sites;
-        ASSIGN_RETURN_ON_EXCEPTION(isolate, sites,
-                                   GetStackFrames(isolate, elems));
+        ASSIGN_RETURN_ON_EXCEPTION(
+            isolate, sites,
+            GetStackFrames(isolate, raw_data_for_call_site_infos));
 
         constexpr int argc = 2;
         std::array<DirectHandle<Object>, argc> args;
@@ -359,12 +363,16 @@ MaybeDirectHandle<Object> ErrorUtils::FormatStackTrace(
 
   RETURN_ON_EXCEPTION(isolate, AppendErrorString(isolate, error, &builder));
 
-  for (int i = 0; i < elems->length(); ++i) {
+  int elems_len = raw_data_for_call_site_infos->length() /
+                       CallSiteInfo::Fields::kCount;
+  for (int i = 0; i < elems_len; ++i) {
     builder.AppendCStringLiteral("\n    at ");
 
-    DirectHandle<CallSiteInfo> frame(Cast<CallSiteInfo>(elems->get(i)),
-                                     isolate);
+    DirectHandle<CallSiteInfo> frame = CallSiteInfo::ConstructFromRawData(
+        isolate, raw_data_for_call_site_infos, i);
 
+    // TODO(marja): Avoid CallSiteInfo creation since we serialize it right
+    // away.
     v8::TryCatch try_catch(reinterpret_cast<v8::Isolate*>(isolate));
     SerializeCallSiteInfo(isolate, frame, &builder);
 
@@ -1160,12 +1168,13 @@ MaybeDirectHandle<Object> ErrorUtils::GetFormattedStack(
 
     DirectHandle<JSObject> error_object =
         lookup.error_stack_symbol_holder.ToHandleChecked();
+    Handle<FixedArray> expanded = CallSiteInfo::ExpandDeferredFrames(
+        isolate,
+        handle(error_stack_data->raw_data_for_call_site_infos(), isolate));
     DirectHandle<Object> formatted_stack;
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, formatted_stack,
-        FormatStackTrace(
-            isolate, error_object,
-            direct_handle(error_stack_data->call_site_infos(), isolate)));
+        FormatStackTrace(isolate, error_object, expanded));
     error_stack_data->set_formatted_stack(*formatted_stack);
     return formatted_stack;
   }
@@ -1173,11 +1182,12 @@ MaybeDirectHandle<Object> ErrorUtils::GetFormattedStack(
   if (IsFixedArray(*lookup.error_stack)) {
     DirectHandle<JSObject> error_object =
         lookup.error_stack_symbol_holder.ToHandleChecked();
+    Handle<FixedArray> expanded = CallSiteInfo::ExpandDeferredFrames(
+        isolate, handle(Cast<FixedArray>(*lookup.error_stack), isolate));
     DirectHandle<Object> formatted_stack;
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, formatted_stack,
-        FormatStackTrace(isolate, error_object,
-                         Cast<FixedArray>(lookup.error_stack)));
+        FormatStackTrace(isolate, error_object, expanded));
     RETURN_ON_EXCEPTION(
         isolate, Object::SetProperty(isolate, error_object,
                                      isolate->factory()->error_stack_symbol(),
diff --git a/deps/v8/src/flags/flag-definitions.h b/deps/v8/src/flags/flag-definitions.h
index aab9435dbb53..15d4341ff84b 100644
--- a/deps/v8/src/flags/flag-definitions.h
+++ b/deps/v8/src/flags/flag-definitions.h
@@ -344,8 +344,6 @@ DEFINE_BOOL(js_shipping, true, "enable all shipped JavaScript features")
   V(js_error_iserror, "Error.isError")                                       \
   V(js_regexp_escape, "RegExp.escape")                                       \
   V(js_explicit_resource_management, "explicit resource management")         \
-  V(js_float16array,                                                         \
-    "Float16Array, Math.f16round, DataView.getFloat16, DataView.setFloat16") \
   V(js_base_64, "Uint8Array to/from base64 and hex")                         \
   V(js_esm_ns_reexport,                                                      \
     "Support diamond-importing re-expored namespaces "                       \
diff --git a/deps/v8/src/heap/factory.cc b/deps/v8/src/heap/factory.cc
index 32b47dee39ff..2fc11e822292 100644
--- a/deps/v8/src/heap/factory.cc
+++ b/deps/v8/src/heap/factory.cc
@@ -1589,13 +1589,14 @@ DirectHandle<InterceptorInfo> Factory::NewInterceptorInfo(
 }
 
 DirectHandle<ErrorStackData> Factory::NewErrorStackData(
-    DirectHandle<UnionOf<JSAny, FixedArray>> call_site_infos_or_formatted_stack,
+    DirectHandle<UnionOf<JSAny, FixedArray>>
+        raw_data_for_call_site_infos_or_formatted_stack,
     DirectHandle<StackTraceInfo> stack_trace) {
   Tagged<ErrorStackData> error_stack_data = NewStructInternal<ErrorStackData>(
       ERROR_STACK_DATA_TYPE, AllocationType::kYoung);
   DisallowGarbageCollection no_gc;
-  error_stack_data->set_call_site_infos_or_formatted_stack(
-      *call_site_infos_or_formatted_stack, SKIP_WRITE_BARRIER);
+  error_stack_data->set_raw_data_for_call_site_infos_or_formatted_stack(
+      *raw_data_for_call_site_infos_or_formatted_stack, SKIP_WRITE_BARRIER);
   error_stack_data->set_stack_trace(*stack_trace, SKIP_WRITE_BARRIER);
   return direct_handle(error_stack_data, isolate());
 }
diff --git a/deps/v8/src/heap/factory.h b/deps/v8/src/heap/factory.h
index 67abd4458664..bba53c6a5872 100644
--- a/deps/v8/src/heap/factory.h
+++ b/deps/v8/src/heap/factory.h
@@ -472,7 +472,7 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
 
   DirectHandle<ErrorStackData> NewErrorStackData(
       DirectHandle<UnionOf<JSAny, FixedArray>>
-          call_site_infos_or_formatted_stack,
+          raw_data_for_call_site_infos_or_formatted_stack,
       DirectHandle<StackTraceInfo> stack_trace);
 
   Handle<Script> CloneScript(DirectHandle<Script> script,
diff --git a/deps/v8/src/init/bootstrapper.cc b/deps/v8/src/init/bootstrapper.cc
index ba75a3a17df2..dca2648b3a93 100644
--- a/deps/v8/src/init/bootstrapper.cc
+++ b/deps/v8/src/init/bootstrapper.cc
@@ -3483,6 +3483,8 @@ void Genesis::InitializeGlobal(DirectHandle<JSGlobalObject> global_object,
     SimpleInstallFunction(isolate_, math, "exp", Builtin::kMathExp, 1, kAdapt);
     SimpleInstallFunction(isolate_, math, "floor", Builtin::kMathFloor, 1,
                           kAdapt);
+    SimpleInstallFunction(isolate_, math, "f16round", Builtin::kMathF16round, 1,
+                          kAdapt);
     SimpleInstallFunction(isolate_, math, "fround", Builtin::kMathFround, 1,
                           kAdapt);
     SimpleInstallFunction(isolate_, math, "hypot", Builtin::kMathHypot, 2,
@@ -4330,6 +4332,10 @@ void Genesis::InitializeGlobal(DirectHandle<JSGlobalObject> global_object,
                           Builtin::kDataViewPrototypeGetUint32, 1, kDontAdapt);
     SimpleInstallFunction(isolate_, prototype, "setUint32",
                           Builtin::kDataViewPrototypeSetUint32, 2, kDontAdapt);
+    SimpleInstallFunction(isolate_, prototype, "getFloat16",
+                          Builtin::kDataViewPrototypeGetFloat16, 1, kDontAdapt);
+    SimpleInstallFunction(isolate_, prototype, "setFloat16",
+                          Builtin::kDataViewPrototypeSetFloat16, 2, kDontAdapt);
     SimpleInstallFunction(isolate_, prototype, "getFloat32",
                           Builtin::kDataViewPrototypeGetFloat32, 1, kDontAdapt);
     SimpleInstallFunction(isolate_, prototype, "setFloat32",
@@ -5084,11 +5090,6 @@ DirectHandle<JSFunction> Genesis::InstallTypedArray(
           GetCorrespondingRabGsabElementsKind(elements_kind), 0);
   rab_gsab_initial_map->SetConstructor(*result);
 
-  if (rab_gsab_initial_map_index == Context::RAB_GSAB_FLOAT16_ARRAY_MAP_INDEX &&
-      v8_flags.js_float16array) {
-    LOG(isolate(), MapDetails(*rab_gsab_initial_map));
-  }
-
   native_context()->set(rab_gsab_initial_map_index, *rab_gsab_initial_map,
                         UPDATE_WRITE_BARRIER, kReleaseStore);
   Map::SetPrototype(isolate(), rab_gsab_initial_map, prototype);
@@ -5869,34 +5870,6 @@ void Genesis::InitializeGlobal_js_explicit_resource_management() {
       kAdapt);
 }
 
-void Genesis::InitializeGlobal_js_float16array() {
-  if (!v8_flags.js_float16array) return;
-
-  DirectHandle<JSGlobalObject> global(native_context()->global_object(),
-                                      isolate());
-  DirectHandle<JSObject> math = Cast<JSObject>(
-      JSReceiver::GetProperty(isolate(), global, "Math").ToHandleChecked());
-
-  SimpleInstallFunction(isolate_, math, "f16round", Builtin::kMathF16round, 1,
-                        kAdapt);
-
-  DirectHandle<JSObject> dataview_prototype(
-      Cast<JSObject>(native_context()->data_view_fun()->instance_prototype()),
-      isolate());
-
-  SimpleInstallFunction(isolate_, dataview_prototype, "getFloat16",
-                        Builtin::kDataViewPrototypeGetFloat16, 1, kDontAdapt);
-  SimpleInstallFunction(isolate_, dataview_prototype, "setFloat16",
-                        Builtin::kDataViewPrototypeSetFloat16, 2, kDontAdapt);
-
-  DirectHandle<JSFunction> fun = InstallTypedArray(
-      "Float16Array", FLOAT16_ELEMENTS, FLOAT16_TYPED_ARRAY_CONSTRUCTOR_TYPE,
-      Context::RAB_GSAB_FLOAT16_ARRAY_MAP_INDEX);
-
-  InstallWithIntrinsicDefaultProto(isolate_, fun,
-                                   Context::FLOAT16_ARRAY_FUN_INDEX);
-}
-
 void Genesis::InitializeGlobal_js_regexp_escape() {
   if (!v8_flags.js_regexp_escape) return;
 
diff --git a/deps/v8/src/objects/call-site-info.cc b/deps/v8/src/objects/call-site-info.cc
index f0a390cdf825..fa1a0f15a6b2 100644
--- a/deps/v8/src/objects/call-site-info.cc
+++ b/deps/v8/src/objects/call-site-info.cc
@@ -7,7 +7,9 @@
 #include <optional>
 
 #include "src/base/strings.h"
+#include "src/builtins/builtins.h"
 #include "src/objects/call-site-info-inl.h"
+#include "src/objects/code-inl.h"
 #include "src/objects/shared-function-info.h"
 #include "src/strings/string-builder-inl.h"
 
@@ -17,6 +19,73 @@
 
 namespace v8::internal {
 
+// static
+DirectHandle<CallSiteInfo> CallSiteInfo::ConstructFromRawData(
+    Isolate* isolate, DirectHandle<FixedArray> frames, int index) {
+  int base_index = index * Fields::kCount;
+  DirectHandle<Object> receiver(frames->get(base_index + Fields::kReceiver),
+                                isolate);
+  DirectHandle<Object> function(frames->get(base_index + Fields::kFunction),
+                                isolate);
+  DirectHandle<Object> code_obj(frames->get(base_index + Fields::kCode),
+                                isolate);
+  DirectHandle<Union<Code, BytecodeArray, Undefined>> resolved_code;
+  if (IsCodeWrapper(*code_obj)) {
+    resolved_code = handle(Cast<CodeWrapper>(code_obj)->code(isolate), isolate);
+  } else if (IsBytecodeWrapper(*code_obj)) {
+    resolved_code =
+        handle(Cast<BytecodeWrapper>(code_obj)->bytecode(isolate), isolate);
+  } else if (IsUndefined(*code_obj)) {
+    resolved_code = isolate->factory()->undefined_value();
+  } else {
+    UNREACHABLE();
+  }
+
+  int offset = Smi::ToInt(frames->get(base_index + Fields::kOffset));
+  DirectHandle<FixedArray> parameters(
+      Cast<FixedArray>(frames->get(base_index + Fields::kParameters)), isolate);
+  int flags = Smi::ToInt(frames->get(base_index + Fields::kFlags));
+
+  return isolate->factory()->NewCallSiteInfo(
+      Cast<JSAny>(receiver), Cast<UnionOf<Smi, JSFunction>>(function),
+      resolved_code, offset, flags, parameters);
+}
+
+// static
+Handle<FixedArray> CallSiteInfo::ExpandDeferredFrames(
+    Isolate* isolate, Handle<FixedArray> raw_data) {
+  int entry_count = raw_data->length() / Fields::kCount;
+
+  // Resolve deferred baseline frames in-place (PC offset → bytecode offset).
+  for (int i = 0; i < entry_count; i++) {
+    int base = i * Fields::kCount;
+    int flags = Smi::ToInt(raw_data->get(base + Fields::kFlags));
+
+    if (flags & kIsDeferredBaselineFrame) {
+      // Resolve the bytecode offset from the raw PC offset.
+      Tagged<Object> code_obj = raw_data->get(base + Fields::kCode);
+      CHECK(IsCodeWrapper(code_obj));
+      Tagged<Code> code = Cast<CodeWrapper>(code_obj)->code(isolate);
+      int pc_offset = Smi::ToInt(raw_data->get(base + Fields::kOffset));
+      Tagged<BytecodeArray> bytecode_array =
+          Cast<JSFunction>(raw_data->get(base + Fields::kFunction))
+              ->shared()
+              ->GetBytecodeArray(isolate);
+      int bytecode_offset = code->GetBytecodeOffsetForBaselinePC(
+          code->instruction_start() + pc_offset, bytecode_array);
+
+      raw_data->set(base + Fields::kCode, bytecode_array->wrapper());
+      raw_data->set(base + Fields::kOffset, Smi::FromInt(bytecode_offset));
+
+      // Strip deferred flags.
+      int clean_flags = flags & ~kDeferredFlagsMask;
+      raw_data->set(base + Fields::kFlags, Smi::FromInt(clean_flags));
+    }
+  }
+
+  return raw_data;
+}
+
 bool CallSiteInfo::IsPromiseAll() const {
   if (!IsAsync()) return false;
   Tagged<JSFunction> fun = Cast<JSFunction>(function());
diff --git a/deps/v8/src/objects/call-site-info.h b/deps/v8/src/objects/call-site-info.h
index cb4d8433f141..bea45215aeaa 100644
--- a/deps/v8/src/objects/call-site-info.h
+++ b/deps/v8/src/objects/call-site-info.h
@@ -80,6 +80,33 @@ V8_OBJECT class CallSiteInfo : public StructLayout {
   // Used to signal that the requested field is unknown.
   static constexpr int kUnknown = kNoSourcePosition;
 
+  // For delayed CallSiteInfo creation (storing the raw data for several
+  // CallSiteInfos in a FixedArray).
+  // kFlags must stay last (see CallSiteBuilder::AppendFrame).
+  enum Fields {
+    kCode = 0,
+    kReceiver,
+    kFunction,
+    kOffset,
+    kParameters,
+    kFlags,
+    kCount
+  };
+
+  // Deferred flags: defined in the Torque bitfield, but only meaningful in
+  // raw capture arrays.  Stripped before creating actual CallSiteInfo objects.
+  static constexpr int kDeferredFlagsMask = kIsDeferredBaselineFrame;
+
+  static DirectHandle<CallSiteInfo> ConstructFromRawData(
+      Isolate* isolate, DirectHandle<FixedArray> frames, int index);
+
+  // Expand a raw stack-capture array that may contain deferred entries
+  // (optimized/baseline frames that were not Summarize'd at capture time)
+  // into a fully-resolved raw array where every entry corresponds to one
+  // logical JS frame.  Non-deferred entries are copied as-is.
+  static Handle<FixedArray> ExpandDeferredFrames(Isolate* isolate,
+                                                 Handle<FixedArray> raw_data);
+
   V8_EXPORT_PRIVATE static int GetLineNumber(DirectHandle<CallSiteInfo> info);
   V8_EXPORT_PRIVATE static int GetColumnNumber(DirectHandle<CallSiteInfo> info);
 
diff --git a/deps/v8/src/objects/call-site-info.tq b/deps/v8/src/objects/call-site-info.tq
index f9585b2324a3..3df40cee3b3c 100644
--- a/deps/v8/src/objects/call-site-info.tq
+++ b/deps/v8/src/objects/call-site-info.tq
@@ -14,6 +14,11 @@ bitfield struct CallSiteInfoFlags extends uint31 {
 
   // whether offset_or_source_position contains the source position.
   is_source_position_computed: bool: 1 bit;
+
+  // Only meaningful in raw capture arrays, stripped before creating
+  // CallSiteInfo objects.  Indicates the entry stores a Code + raw PC offset
+  // that needs resolution to a BytecodeArray + bytecode offset.
+  is_deferred_baseline_frame: bool: 1 bit;
 }
 
 @cppObjectLayoutDefinition
diff --git a/deps/v8/src/objects/debug-objects-inl.h b/deps/v8/src/objects/debug-objects-inl.h
index 1b282108b96e..41a4dea1cd8a 100644
--- a/deps/v8/src/objects/debug-objects-inl.h
+++ b/deps/v8/src/objects/debug-objects-inl.h
@@ -84,18 +84,20 @@ TQ_OBJECT_CONSTRUCTORS_IMPL(StackTraceInfo)
 TQ_OBJECT_CONSTRUCTORS_IMPL(ErrorStackData)
 
 bool ErrorStackData::HasFormattedStack() const {
-  return !IsFixedArray(call_site_infos_or_formatted_stack());
+  return !IsFixedArray(raw_data_for_call_site_infos_or_formatted_stack());
 }
 
 ACCESSORS_RELAXED_CHECKED2(ErrorStackData, formatted_stack, Tagged<Object>,
-                           kCallSiteInfosOrFormattedStackOffset,
+                           kRawDataForCallSiteInfosOrFormattedStackOffset,
                            HasFormattedStack(), true)
 
-bool ErrorStackData::HasCallSiteInfos() const { return !HasFormattedStack(); }
+bool ErrorStackData::HasRawDataForCallSiteInfos() const {
+  return !HasFormattedStack();
+}
 
-DEF_GETTER(ErrorStackData, call_site_infos, Tagged<FixedArray>) {
-  DCHECK(HasCallSiteInfos());
-  return Cast<FixedArray>(call_site_infos_or_formatted_stack());
+DEF_GETTER(ErrorStackData, raw_data_for_call_site_infos, Tagged<FixedArray>) {
+  DCHECK(HasRawDataForCallSiteInfos());
+  return Cast<FixedArray>(raw_data_for_call_site_infos_or_formatted_stack());
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/debug-objects.h b/deps/v8/src/objects/debug-objects.h
index e4ffa7ecf174..2ae518dcc190 100644
--- a/deps/v8/src/objects/debug-objects.h
+++ b/deps/v8/src/objects/debug-objects.h
@@ -254,8 +254,8 @@ class ErrorStackData
  public:
   inline bool HasFormattedStack() const;
   DECL_ACCESSORS(formatted_stack, Tagged<Object>)
-  inline bool HasCallSiteInfos() const;
-  DECL_GETTER(call_site_infos, Tagged<FixedArray>)
+  inline bool HasRawDataForCallSiteInfos() const;
+  DECL_GETTER(raw_data_for_call_site_infos, Tagged<FixedArray>)
 
   DECL_VERIFIER(ErrorStackData)
 
diff --git a/deps/v8/src/objects/debug-objects.tq b/deps/v8/src/objects/debug-objects.tq
index 630a134971bb..607f2abf4418 100644
--- a/deps/v8/src/objects/debug-objects.tq
+++ b/deps/v8/src/objects/debug-objects.tq
@@ -102,10 +102,10 @@ extern class StackTraceInfo extends Struct {
 // (2) A valid JavaScript object and StackTraceInfo once
 //     error.stack was accessed.
 extern class ErrorStackData extends Struct {
-  // This holds either the FixedArray of CallSiteInfo instances or
-  // the formatted stack value (usually a string) that's returned
-  // from the error.stack property.
-  call_site_infos_or_formatted_stack: FixedArray|JSAny;
+  // This holds either the FixedArray of raw data for constructing the
+  // CallSiteInfo instances or the formatted stack value (usually a string)
+  // that's returned from the error.stack property.
+  raw_data_for_call_site_infos_or_formatted_stack: FixedArray|JSAny;
   // This holds the StackTraceInfo for inspector stack trace.
   stack_trace: StackTraceInfo;
 }
diff --git a/deps/v8/src/objects/elements-kind.h b/deps/v8/src/objects/elements-kind.h
index 7be923774f2c..2383a6a3a401 100644
--- a/deps/v8/src/objects/elements-kind.h
+++ b/deps/v8/src/objects/elements-kind.h
@@ -26,13 +26,10 @@ namespace internal {
   V(BigInt64, bigint64, BIGINT64, int64_t)               \
   V(Uint8Clamped, uint8_clamped, UINT8_CLAMPED, uint8_t) \
   V(Float32, float32, FLOAT32, float)                    \
-  V(Float64, float64, FLOAT64, double)
+  V(Float64, float64, FLOAT64, double)                   \
+  V(Float16, float16, FLOAT16, uint16_t)
 
-#define TYPED_ARRAYS_FLOAT16(V) V(Float16, float16, FLOAT16, uint16_t)
-
-#define TYPED_ARRAYS(V) \
-  TYPED_ARRAYS_BASE(V)  \
-  TYPED_ARRAYS_FLOAT16(V)
+#define TYPED_ARRAYS(V) TYPED_ARRAYS_BASE(V)
 
 #define RAB_GSAB_TYPED_ARRAYS_BASE(V)                                    \
   V(RabGsabUint8, rab_gsab_uint8, RAB_GSAB_UINT8, uint8_t)               \
@@ -46,14 +43,10 @@ namespace internal {
   V(RabGsabUint8Clamped, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED, \
     uint8_t)                                                             \
   V(RabGsabFloat32, rab_gsab_float32, RAB_GSAB_FLOAT32, float)           \
-  V(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double)
-
-#define RAB_GSAB_TYPED_ARRAYS_FLOAT16(V) \
+  V(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double)          \
   V(RabGsabFloat16, rab_gsab_float16, RAB_GSAB_FLOAT16, uint16_t)
 
-#define RAB_GSAB_TYPED_ARRAYS(V) \
-  RAB_GSAB_TYPED_ARRAYS_BASE(V)  \
-  RAB_GSAB_TYPED_ARRAYS_FLOAT16(V)
+#define RAB_GSAB_TYPED_ARRAYS(V) RAB_GSAB_TYPED_ARRAYS_BASE(V)
 
 // The TypedArrays backed by RAB / GSAB are called Uint8Array, Uint16Array etc,
 // and not RabGsabUint8Array, RabGsabUint16Array etc. This macro is used for
@@ -69,14 +62,11 @@ namespace internal {
   V(BigInt64, rab_gsab_bigint64, RAB_GSAB_BIGINT64, int64_t)               \
   V(Uint8Clamped, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED, uint8_t) \
   V(Float32, rab_gsab_float32, RAB_GSAB_FLOAT32, float)                    \
-  V(Float64, rab_gsab_float64, RAB_GSAB_FLOAT64, double)
-
-#define RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE_FLOAT16(V) \
+  V(Float64, rab_gsab_float64, RAB_GSAB_FLOAT64, double)                   \
   V(Float16, rab_gsab_float16, RAB_GSAB_FLOAT16, uint16_t)
 
 #define RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE(V) \
-  RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE_BASE(V)  \
-  RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE_FLOAT16(V)
+  RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE_BASE(V)
 
 // Like RAB_GSAB_TYPED_ARRAYS but has an additional parameter for
 // for the corresponding non-RAB/GSAB ElementsKind.
@@ -93,14 +83,11 @@ namespace internal {
   V(RabGsabUint8Clamped, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED,      \
     uint8_t, UINT8_CLAMPED)                                                   \
   V(RabGsabFloat32, rab_gsab_float32, RAB_GSAB_FLOAT32, float, FLOAT32)       \
-  V(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double, FLOAT64)
-
-#define RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND_FLOAT16(V) \
+  V(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double, FLOAT64)      \
   V(RabGsabFloat16, rab_gsab_float16, RAB_GSAB_FLOAT16, uint16_t, FLOAT16)
 
 #define RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND(V) \
-  RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND_BASE(V)  \
-  RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND_FLOAT16(V)
+  RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND_BASE(V)
 
 enum ElementsKind : uint8_t {
   // The "fast" kind for elements that only contain SMI values. Must be first
diff --git a/deps/v8/src/objects/fixed-array.cc b/deps/v8/src/objects/fixed-array.cc
index 28eebb5acec0..88bbe5655c8f 100644
--- a/deps/v8/src/objects/fixed-array.cc
+++ b/deps/v8/src/objects/fixed-array.cc
@@ -21,10 +21,9 @@ bool FixedArrayBase::IsCowArray() const {
 template <template <typename> typename HandleType>
   requires(
       std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
-HandleType<FixedArray> FixedArray::SetAndGrow(Isolate* isolate,
-                                              HandleType<FixedArray> array,
-                                              int index,
-                                              DirectHandle<Object> value) {
+HandleType<FixedArray> FixedArray::Grow(Isolate* isolate,
+                                        HandleType<FixedArray> array,
+                                        int index) {
   int len = array->length();
   if (index >= len) {
     int new_capacity = FixedArray::NewCapacityForIndex(index, len);
@@ -33,7 +32,17 @@ HandleType<FixedArray> FixedArray::SetAndGrow(Isolate* isolate,
     // use `undefined` as a filler. Make this more explicit.
     array->FillWithHoles(len, new_capacity);
   }
+  return array;
+}
 
+template <template <typename> typename HandleType>
+  requires(
+      std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
+HandleType<FixedArray> FixedArray::SetAndGrow(Isolate* isolate,
+                                              HandleType<FixedArray> array,
+                                              int index,
+                                              DirectHandle<Object> value) {
+  array = Grow(isolate, array, index);
   array->set(index, *value);
   return array;
 }
@@ -45,6 +54,25 @@ template IndirectHandle<FixedArray> FixedArray::SetAndGrow(
     Isolate* isolate, IndirectHandle<FixedArray> array, int index,
     DirectHandle<Object> value);
 
+template <template <typename> typename HandleType>
+  requires(
+      std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
+HandleType<FixedArray> FixedArray::SetAndGrow(Isolate* isolate,
+                                              HandleType<FixedArray> array,
+                                              int index,
+                                              Tagged<Smi> value) {
+  array = Grow(isolate, array, index);
+  array->set(index, value);
+  return array;
+}
+
+template DirectHandle<FixedArray> FixedArray::SetAndGrow(
+    Isolate* isolate, DirectHandle<FixedArray> array, int index,
+    Tagged<Smi> value);
+template IndirectHandle<FixedArray> FixedArray::SetAndGrow(
+    Isolate* isolate, IndirectHandle<FixedArray> array, int index,
+    Tagged<Smi> value);
+
 void FixedArray::RightTrim(Isolate* isolate, int new_capacity) {
   DCHECK_NE(map(), ReadOnlyRoots{isolate}.fixed_cow_array_map());
   Super::RightTrim(isolate, new_capacity);
diff --git a/deps/v8/src/objects/fixed-array.h b/deps/v8/src/objects/fixed-array.h
index e634550ae8f9..a0adf5e49011 100644
--- a/deps/v8/src/objects/fixed-array.h
+++ b/deps/v8/src/objects/fixed-array.h
@@ -259,6 +259,12 @@ V8_OBJECT class FixedArray
   V8_EXPORT_PRIVATE static HandleType<FixedArray> SetAndGrow(
       Isolate* isolate, HandleType<FixedArray> array, int index,
       DirectHandle<Object> value);
+  template <template <typename> typename HandleType>
+    requires(
+        std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
+  V8_EXPORT_PRIVATE static HandleType<FixedArray> SetAndGrow(
+      Isolate* isolate, HandleType<FixedArray> array, int index,
+      Tagged<Smi> value);
 
   // Right-trim the array.
   // Invariant: 0 < new_length <= length()
@@ -289,6 +295,13 @@ V8_OBJECT class FixedArray
   static constexpr int kMaxRegularLength = FixedArray::kMaxRegularCapacity;
 
  private:
+  template <template <typename> typename HandleType>
+    requires(
+        std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
+  static HandleType<FixedArray> Grow(Isolate* isolate,
+                                     HandleType<FixedArray> array,
+                                     int index);
+
   inline static Handle<FixedArray> Resize(
       Isolate* isolate, DirectHandle<FixedArray> xs, int new_capacity,
       AllocationType allocation = AllocationType::kYoung,
diff --git a/deps/v8/src/objects/value-serializer.cc b/deps/v8/src/objects/value-serializer.cc
index def468a73920..1cbe14d654bd 100644
--- a/deps/v8/src/objects/value-serializer.cc
+++ b/deps/v8/src/objects/value-serializer.cc
@@ -2301,13 +2301,6 @@ MaybeDirectHandle<JSArrayBufferView> ValueDeserializer::ReadJSArrayBufferView(
     break;
       TYPED_ARRAYS_BASE(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
-    case ArrayBufferViewTag::kFloat16Array: {
-      if (i::v8_flags.js_float16array) {
-        external_array_type = kExternalFloat16Array;
-        element_size = sizeof(uint16_t);
-      }
-      break;
-    }
   }
   if (element_size == 0 || byte_offset % element_size != 0 ||
       byte_length % element_size != 0) {
diff --git a/deps/v8/test/cctest/test-inobject-slack-tracking.cc b/deps/v8/test/cctest/test-inobject-slack-tracking.cc
index ace7c1370ad0..a74b20fa8eb1 100644
--- a/deps/v8/test/cctest/test-inobject-slack-tracking.cc
+++ b/deps/v8/test/cctest/test-inobject-slack-tracking.cc
@@ -1100,7 +1100,6 @@ TEST(SubclassArrayBuiltinNoInlineNew) {
 
 
 TEST(SubclassTypedArrayBuiltin) {
-  v8_flags.js_float16array = true;
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
 
diff --git a/deps/v8/test/cctest/test-typedarrays.cc b/deps/v8/test/cctest/test-typedarrays.cc
index ce256fec8f0b..40d3cdde0fc4 100644
--- a/deps/v8/test/cctest/test-typedarrays.cc
+++ b/deps/v8/test/cctest/test-typedarrays.cc
@@ -115,20 +115,17 @@ void TestSpeciesProtector(char* code,
 }
 
 UNINITIALIZED_TEST(SpeciesConstructor) {
-  v8_flags.js_float16array = true;
   char code[] = "x.constructor = MyTypedArray";
   TestSpeciesProtector(code);
 }
 
 UNINITIALIZED_TEST(SpeciesConstructorAccessor) {
-  v8_flags.js_float16array = true;
   char code[] =
       "Object.defineProperty(x, 'constructor',{get() {return MyTypedArray;}})";
   TestSpeciesProtector(code);
 }
 
 UNINITIALIZED_TEST(SpeciesModified) {
-  v8_flags.js_float16array = true;
   char code[] =
       "Object.defineProperty(constructor, Symbol.species, "
       "{value:MyTypedArray})";
@@ -136,7 +133,6 @@ UNINITIALIZED_TEST(SpeciesModified) {
 }
 
 UNINITIALIZED_TEST(SpeciesParentConstructor) {
-  v8_flags.js_float16array = true;
   char code[] = "constructor.prototype.constructor = MyTypedArray";
   TestSpeciesProtector(code);
 }
diff --git a/deps/v8/test/mjsunit/regress/regress-499260582.js b/deps/v8/test/mjsunit/regress/regress-499260582.js
new file mode 100644
index 000000000000..08e4a2daf9b1
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-499260582.js
@@ -0,0 +1,20 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --jit-fuzzing --single-threaded
+
+function f9(a10, a11) {
+    'use strict';
+    for (let v12 = 0; v12 < 5; v12++) {
+        const v15 = ({ maxByteLength: 1073741824 }).maxByteLength;
+        %OptimizeOsr();
+        function F16(a18, a19, a20) {
+            if (!new.target) { throw 'must be called with new'; }
+        }
+        try { F16.call(v15); } catch (e) {}
+    }
+    return f9;
+}
+%PrepareFunctionForOptimization(f9);
+f9(f9, f9);
diff --git a/deps/v8/test/test262/testcfg.py b/deps/v8/test/test262/testcfg.py
index aa93daaef0cd..07e03b07aaa9 100644
--- a/deps/v8/test/test262/testcfg.py
+++ b/deps/v8/test/test262/testcfg.py
@@ -59,7 +59,6 @@
     'import-attributes': '--harmony-import-attributes',
     'regexp-duplicate-named-groups': '--js-regexp-duplicate-named-groups',
     'regexp-modifiers': '--js-regexp-modifiers',
-    'Float16Array': '--js-float16array',
     'explicit-resource-management': '--js-explicit-resource-management',
     'decorators': '--js-decorators',
     'promise-try': '--js-promise-try',
diff --git a/deps/v8/test/unittests/objects/object-unittest.cc b/deps/v8/test/unittests/objects/object-unittest.cc
index 18032ea39fd9..d4421cd807d6 100644
--- a/deps/v8/test/unittests/objects/object-unittest.cc
+++ b/deps/v8/test/unittests/objects/object-unittest.cc
@@ -683,8 +683,6 @@ TEST_FUNCTION_KIND(IsStrictFunctionWithoutPrototype)
 #undef TEST_FUNCTION_KIND
 
 TEST_F(ObjectTest, ConstructorInstanceTypes) {
-  bool flag_was_enabled = i::v8_flags.js_float16array;
-  i::v8_flags.js_float16array = true;
   v8::HandleScope scope(isolate());
 
   DirectHandle<NativeContext> context = i_isolate()->native_context();
@@ -720,7 +718,6 @@ TEST_F(ObjectTest, ConstructorInstanceTypes) {
         break;
     }
   }
-  i::v8_flags.js_float16array = flag_was_enabled;
 }
 
 TEST_F(ObjectTest, AddDataPropertyNameCollision) {
diff --git a/deps/v8/test/unittests/objects/value-serializer-unittest.cc b/deps/v8/test/unittests/objects/value-serializer-unittest.cc
index ee7e8acf26db..a6ce6cee63cc 100644
--- a/deps/v8/test/unittests/objects/value-serializer-unittest.cc
+++ b/deps/v8/test/unittests/objects/value-serializer-unittest.cc
@@ -48,7 +48,6 @@ class ValueSerializerTest : public TestWithIsolate {
 
  protected:
   ValueSerializerTest() {
-    FLAG_SCOPE(js_float16array);
     Local<Context> serialization_context = Context::New(isolate());
     Local<Context> deserialization_context = Context::New(isolate());
     serialization_context_.Reset(isolate(), serialization_context);
@@ -2083,7 +2082,6 @@ TEST_F(ValueSerializerTestWithArrayBufferTransfer,
 }
 
 TEST_F(ValueSerializerTest, RoundTripTypedArray) {
-  FLAG_SCOPE(js_float16array);
   // Check that the right type comes out the other side for every kind of typed
   // array.
   // TODO(v8:11111): Use API functions for testing is_length_tracking and
@@ -2133,7 +2131,6 @@ TEST_F(ValueSerializerTest, RoundTripTypedArray) {
 }
 
 TEST_F(ValueSerializerTest, RoundTripRabBackedLengthTrackingTypedArray) {
-  FLAG_SCOPE(js_float16array);
   // Check that the right type comes out the other side for every kind of typed
   // array.
   // TODO(v8:11111): Use API functions for testing is_length_tracking and
@@ -2158,7 +2155,6 @@ TEST_F(ValueSerializerTest, RoundTripRabBackedLengthTrackingTypedArray) {
 }
 
 TEST_F(ValueSerializerTest, RoundTripRabBackedNonLengthTrackingTypedArray) {
-  FLAG_SCOPE(js_float16array);
   // Check that the right type comes out the other side for every kind of typed
   // array.
   // TODO(v8:11111): Use API functions for testing is_length_tracking and
diff --git a/deps/zlib/crc32_simd.c b/deps/zlib/crc32_simd.c
index 20204e322ebe..f9d52a6311e9 100644
--- a/deps/zlib/crc32_simd.c
+++ b/deps/zlib/crc32_simd.c
@@ -22,7 +22,7 @@
 #include <immintrin.h>
 
 #if defined(__GNUC__) || defined(__clang__)
-__attribute__((__target__("avx512f,avx512vl,vpclmulqdq")))
+__attribute__((__target__("avx512f,pclmul,vpclmulqdq")))
 #endif
 uint32_t ZLIB_INTERNAL crc32_avx512_simd_(  /* AVX512+PCLMUL */
     const unsigned char *buf,
diff --git a/deps/zstd/unofficial.gni b/deps/zstd/unofficial.gni
index fe6c2b425eac..733ddb965684 100644
--- a/deps/zstd/unofficial.gni
+++ b/deps/zstd/unofficial.gni
@@ -4,25 +4,38 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("zstd_gn_build") {
-  config("zstd_config") {
-    include_dirs = [ "./lib" ]
-  }
+  if (node_shared_zstd) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("zstd_config") {
+      packages = [ "libzstd" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":zstd_config" ]
+    }
+  } else {
+    config("zstd_config") {
+      include_dirs = [ "./lib" ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("zstd.gyp") ],
-                            "scope",
-                            [ "zstd.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("zstd.gyp") ],
+                              "scope",
+                              [ "zstd.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":zstd_config" ]
-    sources = gypi_values.zstd_sources
-    defines = [ "XXH_NAMESPACE=ZSTD_", "ZSTD_MULTITHREAD", "ZSTD_DISABLE_ASM" ]
-    cflags_c = [ "-Wno-unused-function" ]
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":zstd_config" ]
+      sources = gypi_values.zstd_sources
+      defines = [ "XXH_NAMESPACE=ZSTD_", "ZSTD_MULTITHREAD", "ZSTD_DISABLE_ASM" ]
+      cflags_c = [ "-Wno-unused-function" ]
 
-    if (is_posix) {
-      ldflags = [ "-pthread" ]
+      if (is_posix) {
+        ldflags = [ "-pthread" ]
+      }
     }
   }
 }
diff --git a/doc/api/bench.md b/doc/api/bench.md
new file mode 100644
index 000000000000..e06622ddf366
--- /dev/null
+++ b/doc/api/bench.md
@@ -0,0 +1,848 @@
+# Benchmark runner
+
+<!--introduced_in=v26.9.0-->
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1.0 - Early Development
+
+<!-- source_link=lib/bench.js -->
+
+The `node:bench` module supports defining and running JavaScript benchmarks in
+the current process, and running one benchmark file in a fresh child process.
+The module is only available when Node.js is started with the
+`--experimental-bench` flag and can only be imported with the `node:` scheme:
+
+```mjs
+import { bench, suite } from 'node:bench';
+```
+
+```cjs
+const { bench, suite } = require('node:bench');
+```
+
+## Example benchmark
+
+Save the following as `benchmark.mjs`:
+
+```mjs
+import { bench, suite } from 'node:bench';
+
+suite('URL', () => {
+  const input = 'https://example.com/a?b=c';
+
+  bench('construct', {
+    samples: 30,
+    params: { input: 'short' },
+  }, (b) => {
+    const operations = 10_000;
+    let totalLength = 0;
+
+    b.start();
+    for (let i = 0; i < operations; i++) {
+      totalLength += new URL(input).href.length;
+    }
+    b.end(operations);
+
+    if (totalLength !== operations * input.length) {
+      throw new Error('Unexpected URL result');
+    }
+  });
+});
+```
+
+Run the benchmark from the command line:
+
+```console
+node --experimental-bench --bench benchmark.mjs
+```
+
+Benchmarks are executed serially in declaration order. Declared benchmarks are
+scheduled automatically. Call `run()` during the same turn as the declarations
+to consume the event stream or configure filtering.
+If an automatically scheduled run fails and `run()` was not called, the process
+exit code is set to `1`.
+
+## Measurement model
+
+Each warmup and measured sample invokes the benchmark function once with a
+fresh {BenchContext}. The function must either call `context.start()` and
+`context.end(operations)` exactly once, or call `context.record(sample)` exactly
+once to provide an externally measured sample. Setup before `start()` and
+cleanup after `end()` are outside the measured region. Promise-returning
+functions are awaited.
+
+By default, an event loop turn occurs between sample invocations. An embedded
+runner can disable this using `yieldBetweenSamples`. The runner executes
+benchmarks serially, but it does not provide process isolation. Other work in
+the process, JIT compilation, garbage collection, CPU frequency changes, and
+system load can all affect results. Keep raw samples when comparing results and
+investigate noisy or skewed distributions rather than treating a confidence
+interval as a pass/fail threshold.
+
+### Measurement integrity
+
+A statistically consistent result does not prove that a benchmark measured the
+intended work. An optimizing runtime can remove work whose result is unused or
+specialize it more narrowly than the workload being modeled. Framework and loop
+overhead can also dominate operations that are too short. To reduce these risks:
+
+* Make values produced by measured work observable outside the measured
+  interval, for example by validating an aggregate derived from every result.
+  Passing them only through unused local computations is insufficient.
+* Perform enough operations in each sample to amortize fixed timer reads and
+  calls to `context.start()` and `context.end()`. If loop bookkeeping is material
+  relative to one operation, batch multiple operations per iteration and report
+  the total operation count.
+* Inspect raw `samples` for trends that indicate insufficient warmup or
+  optimization tiering, pauses consistent with garbage collection, and
+  multimodal distributions.
+* Validate surprising results with an independent benchmark shape that performs
+  the same intended work differently.
+
+`node:bench` does not force a particular optimization state or infer whether an
+engine eliminated work. Such controls and diagnostics are runtime-specific and
+heuristic, and do not replace validating the benchmark workload.
+
+### Dynamic sampling and variable batches
+
+Calling `context.done()` during a measured sample completes the benchmark after
+that sample. This allows a higher-level tool to treat `samples` as a maximum and
+implement a dynamic sampling policy.
+
+The number of operations can differ between samples. Summary statistics treat
+each sample's `rate` as one equally weighted observation. In particular,
+`summary.mean` is the arithmetic mean of the per-sample rates. It is not the
+pooled throughput calculated as:
+
+```text
+1_000_000_000 * sum(sample.operations) / sum(sample.duration_ns)
+```
+
+The two values can differ when sample durations vary because pooled throughput
+weights each per-sample rate by its duration. A higher-level tool that varies
+batch sizes should choose the aggregation that matches its analysis. It can
+calculate pooled throughput from the raw `samples`; operation counts should be
+summed as `bigint` values because their total can exceed
+`Number.MAX_SAFE_INTEGER` even though each count cannot.
+
+### Comparing benchmark results
+
+`node:bench` does not designate a benchmark as a baseline or produce a pass/fail
+comparison between runs. It exposes raw samples, stable benchmark identities,
+parameters, and tags so that comparison policy can remain in higher-level
+tools. A tool can use `benchId` to match the same declaration and parameters
+across compatible source layouts, and use a tag or its own metadata to identify
+a baseline.
+
+Comparison tools should retain the raw sample rates and verify that execution
+plans and relevant environment details are comparable. The appropriate analysis
+depends on the experimental design and distribution. For example, independent
+samples might use Welch's t-test or a rank-based test, while observations that
+were deliberately paired require paired analysis. Tools should also consider
+effect sizes, uncertainty, and correction when testing multiple benchmarks.
+The general-purpose {Histogram} statistics in `node:perf_hooks` can support such
+analysis, but the runner does not select a method or significance threshold.
+
+## Reusable runners
+
+The module-level declaration functions use a shared runner and schedule it
+automatically. Higher-level tools can create isolated, explicitly started
+runners instead:
+
+```mjs
+import { createRunner } from 'node:bench';
+
+const runner = createRunner({ yieldBetweenSamples: false });
+
+runner.bench('example', { samples: 100 }, (b) => {
+  const operations = chooseOperationCount();
+  b.start();
+  runOperations(operations);
+  const sample = b.end(operations);
+
+  if (hasEnoughData(sample)) b.done();
+});
+
+for await (const record of runner.run()) {
+  // Consume structured benchmark records.
+}
+```
+
+Each runner has independent declarations, hooks, filtering, and output. Unlike
+the module-level declarations, creating a benchmark on an explicit runner does
+not schedule execution. This allows packages to collect declarations and start
+them later. Calling the explicit runner's `run()` function prevents additional
+declarations and a second call to `run()` is an error.
+
+## Command-line runner
+
+The `--bench` flag runs one or more explicit benchmark files or glob patterns:
+
+```console
+node --experimental-bench --bench benchmark.mjs
+node --experimental-bench --bench --bench-reporter=json 'benchmarks/**/*.js'
+```
+
+Files are sorted and executed serially. The default
+`--bench-isolation=process` mode runs each file in a separate child process and
+emits one aggregate summary. Structured events are transferred to the parent
+without JSON conversion, preserving BigInt durations, errors, and parameter
+values. Child writes to stdout and stderr are emitted as diagnostic records so
+they do not corrupt reporter output.
+
+`--bench-isolation=none` imports all files into the runner process. This mode
+has lower startup overhead, but module, heap, and process state carry between
+files, and user writes share stdout and stderr with reporters.
+
+Worker-thread isolation is not a CLI mode. Each newly constructed {Worker} has a
+separate V8 isolate, JavaScript heap, and event loop, typically with lower
+startup cost than a child process. Reusing a worker preserves its module and heap
+state. Workers also share libuv's process-wide thread pool and can share
+process-global native or addon state, so they do not provide the same boundary
+as process isolation.
+
+Higher-level tools can experiment with worker isolation by loading benchmark
+code inside a worker, measuring there, transferring structured sample data, and
+passing it to [`context.record()`][]. The reported `duration_ns` can exclude
+message transport when the worker captures both timestamps. Tools should
+identify worker modules and workloads explicitly. They should not stringify
+arbitrary functions or closures to move them between isolates, because closures
+cannot be reconstructed with their original lexical environment.
+
+Benchmark files passed to `--bench` should declare benchmarks but must not call
+`run()`. The CLI supports `--bench-name-pattern`, `--bench-samples`,
+`--bench-warmup`, `--bench-reporter`, and `--bench-reporter-destination`. See
+the [command-line options documentation][] for details.
+
+Preload modules passed through `--require` or `--import` should not declare
+benchmarks. Such declarations are not associated with an entry file and have
+an `entryFile` value of `null`. Their `fileRunId` identifies the runner or child
+execution in which they occurred. With process isolation, a preload is evaluated
+and its declarations run once for every benchmark child process.
+
+## Benchmark reporters
+
+The built-in reporters are available from the scheme-only
+`node:bench/reporters` module:
+
+```mjs
+import { json, spec } from 'node:bench/reporters';
+```
+
+```cjs
+const { json, spec } = require('node:bench/reporters');
+```
+
+Reporter values can be passed directly to `stream.compose()`:
+
+```mjs
+import { bench, run } from 'node:bench';
+import { spec } from 'node:bench/reporters';
+import process from 'node:process';
+
+bench('example', (b) => {
+  b.start();
+  doWork();
+  b.end(1);
+});
+
+run().compose(spec).pipe(process.stdout);
+```
+
+The `spec` reporter buffers results and outputs a concise table containing the
+sample count, mean rate, 95% confidence interval for the mean, median rate, and
+warnings. A coefficient of variation above 5% is reported as `noisy`, and an
+absolute skewness above 1 is reported as `skewed`. The exact human-readable
+format is subject to change.
+
+The `json` reporter emits every lifecycle record as newline-delimited JSON.
+BigInt values, including `duration_ns`, are encoded as decimal strings. Errors
+are represented using their `name`, `message`, `stack`, `code`, `cause`, and
+`errors` properties. As required by JSON, non-finite numbers are encoded as
+`null`.
+
+Custom reporters use the same composition contract. They can be transforms or
+functions accepted by `stream.compose()`. The composed readable can be piped to
+any writable destination:
+
+```mjs
+import { run } from 'node:bench';
+import process from 'node:process';
+
+async function* names(source) {
+  for await (const { type, data } of source) {
+    if (type === 'bench:complete') {
+      yield `${data.name}\n`;
+    }
+  }
+}
+
+run().compose(names).pipe(process.stdout);
+```
+
+## `createRunner([options])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `options` {Object}
+  * `yieldBetweenSamples` {boolean} Schedule an event loop turn between sample
+    callbacks. Disabling this also prevents timer-based abort signals from
+    firing between synchronous callbacks. Benchmark timeouts continue to be
+    checked against a monotonic deadline. **Default:** `true`.
+* Returns: {Object} An isolated benchmark runner with bound `after`, `afterEach`,
+  `before`, `beforeEach`, `bench`, `describe`, `run`, and `suite` functions.
+
+Creates an explicitly started benchmark runner. Declarations made through one
+runner do not interact with declarations made through another runner or through
+the module-level functions. Call the returned `run()` function to start the
+runner and obtain its {BenchmarksStream}.
+
+Each runner can be started once. Its `run()` function accepts the same options
+as the module-level [`run()`][]. `run({ yieldBetweenSamples })` overrides the
+value passed to `createRunner()`.
+
+## `bench([name][, options], fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `name` {string} The benchmark name. **Default:** The `name` property of `fn`,
+  or `'<anonymous>'` when `fn` has no name.
+* `options` {Object}
+  * `diagnosticChannels` {Array} String diagnostics channel names, deduplicated
+    and inherited from containing suites by union. Symbol values in the array
+    are silently ignored. **Default:** `[]`.
+  * `only` {boolean} When any benchmark or containing suite has `only` set,
+    benchmarks without `only` in their hierarchy are skipped. **Default:**
+    `false`.
+  * `params` {Object} String, finite number, or boolean metadata identifying
+    this benchmark configuration. Parameter keys are sorted when constructing
+    the stable benchmark identity. **Default:** An empty object.
+  * `samples` {number} The maximum number of measured callback invocations.
+    Must be a positive 32-bit unsigned integer. The benchmark may finish earlier
+    by calling `context.done()`. **Default:** `30`.
+  * `signal` {AbortSignal} Allows aborting this benchmark.
+  * `skip` {boolean|string} If truthy, the benchmark is skipped. A string is
+    included in the result as the skip reason. **Default:** `false`.
+  * `tags` {string\[]} Labels associated with the benchmark. Tags are
+    lowercased, deduplicated, and inherited from containing suites by union.
+    **Default:** `[]`.
+  * `timeout` {number} The number of milliseconds after which the benchmark
+    fails. **Default:** `Infinity`.
+  * `warmup` {number} The number of unreported callback invocations before
+    measured samples. Must be a 32-bit unsigned integer. **Default:** `0`.
+* `fn` {Function|AsyncFunction} The benchmark function. It receives a
+  {BenchContext}.
+* Returns: {Promise} Fulfilled with the benchmark result after a top-level
+  benchmark finishes, or with `undefined` immediately when declared in a
+  suite.
+
+Warmup invocations use the same callback and timing contract as measured
+samples, but their samples are discarded. An exception, rejection, timeout,
+abort, missing timing call, or duplicate timing call stops the current
+benchmark. Later benchmarks continue to run.
+
+After a timeout or abort, the runner briefly waits for asynchronous benchmark
+work to settle before continuing. If it remains pending, all later benchmarks
+that were selected to run fail without running so that their measurements
+cannot overlap with that work.
+
+For each warmup and measured callback, the runner subscribes to the configured
+diagnostics channels. Each publication queues a context diagnostic whose
+`message` is `{ name, message }`, containing the string channel name and the
+published message. Subscriptions are removed when the callback settles or is
+aborted.
+
+A timeout or abort cannot interrupt synchronous JavaScript and does not forcibly
+cancel asynchronous work that ignores `context.signal`.
+
+The `benchId` is based on the declaration source file, hierarchical suite and
+benchmark names, and canonicalized parameters. It is stable for repeated runs
+from the same source location, but the embedded source value is not normalized
+across checkout roots, module formats, operating systems, or path casing.
+
+Execution scope is represented separately. A `runId` identifies one logical
+run, while `fileRunId` identifies a file runner or child execution within that
+run. The `entryFile` field records which entry-file import caused a declaration
+and is `null` for declarations made by preload modules.
+The same `benchId` can therefore occur under multiple `fileRunId` values when
+entry files use a shared declaration helper. Declaring the same `benchId` more
+than once within one file execution scope reports an error rather than merging
+the samples.
+
+### `bench.skip([name][, options], fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Shorthand for `bench(name, { ...options, skip: true }, fn)`.
+
+### `bench.only([name][, options], fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Shorthand for `bench(name, { ...options, only: true }, fn)`.
+
+## `suite([name][, options], fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `name` {string} The suite name. **Default:** The `name` property of `fn`, or
+  `'<anonymous>'` when `fn` has no name.
+* `options` {Object}
+  * `diagnosticChannels` {Array} String diagnostics channel names inherited by
+    nested suites and benchmarks. Symbol values in the array are silently
+    ignored. **Default:** `[]`.
+  * `only` {boolean} Selects all benchmarks nested in this suite. **Default:**
+    `false`.
+  * `skip` {boolean|string} Skips all benchmarks nested in this suite.
+    **Default:** `false`.
+  * `tags` {string\[]} Labels inherited by nested suites and benchmarks.
+    **Default:** `[]`.
+* `fn` {Function|AsyncFunction} A function that declares nested suites,
+  benchmarks, and hooks.
+* Returns: {Promise} Fulfilled when a top-level suite finishes, or with
+  `undefined` immediately when declared in another suite.
+
+Suite functions run while declarations are collected. Promise-returning suite
+functions are awaited before benchmark execution begins.
+
+## `describe([name][, options], fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Alias for `suite()`.
+
+## `before(fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `fn` {Function|AsyncFunction} The hook function.
+
+Registers a hook that runs once before the benchmarks in the current suite.
+
+## `after(fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `fn` {Function|AsyncFunction} The hook function.
+
+Registers a hook that runs once after the benchmarks in the current suite.
+
+## `beforeEach(fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `fn` {Function|AsyncFunction} The hook function. It receives an object with
+  the benchmark's `name`, `params`, and `signal`.
+
+Registers a hook that runs once before each complete logical benchmark in the
+current suite. It does not run before every sample. Per-sample setup belongs in
+the benchmark function before `context.start()` or `context.record()`.
+
+## `afterEach(fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `fn` {Function|AsyncFunction} The hook function. It receives an object with
+  the benchmark's `name`, `params`, and `signal`.
+
+Registers a hook that runs once after each complete logical benchmark in the
+current suite. It does not run after every sample. Per-sample cleanup belongs
+in the benchmark function after `context.end()` or `context.record()`.
+
+## `run([options])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `options` {Object}
+  * `namePattern` {string|RegExp} Only runs benchmarks whose full hierarchical
+    name matches the pattern. String values are interpreted as JavaScript
+    regular expressions.
+  * `samples` {number} Overrides the maximum number of measured callback
+    invocations for every benchmark. Must be a positive 32-bit unsigned integer.
+  * `signal` {AbortSignal} Allows aborting in-progress benchmark execution.
+  * `warmup` {number} Overrides the number of unreported warmup callback
+    invocations for every benchmark. Must be a 32-bit unsigned integer.
+  * `yieldBetweenSamples` {boolean} Schedule an event loop turn between sample
+    callbacks. **Default:** `true`, or the value passed to `createRunner()` for
+    an explicit runner.
+* Returns: {BenchmarksStream}
+
+Returns the object-mode event stream for the in-process benchmark run. Call
+`run()` during the same turn in which benchmarks are declared, before automatic
+execution begins. Calling `run()` is optional when the returned stream is not
+needed. An explicit runner created by `createRunner()` does not run
+automatically, so its `run()` function may be called later.
+
+```mjs
+import { bench, run } from 'node:bench';
+
+bench('example', { samples: 3 }, (b) => {
+  b.start();
+  doWork();
+  b.end(1);
+});
+
+for await (const { type, data } of run()) {
+  if (type === 'bench:complete' && data.error === undefined) {
+    console.log(data.name, data.summary.mean);
+  }
+}
+```
+
+## `runFile(path[, options])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `path` {string|Buffer|URL} The path of one benchmark module.
+* `options` {Object}
+  * `env` {Object} The child process environment. Property values must be
+    strings or `undefined`. This replaces, rather than extends, the parent
+    environment. **Default:** A snapshot of `process.env`.
+  * `execArgv` {string\[]} Node.js command-line options for the child process.
+    This replaces, rather than extends, inherited options. Benchmark runner
+    options, positional arguments, and options that select another execution
+    mode are not allowed. **Default:** Compatible options inherited from the
+    current process.
+  * `signal` {AbortSignal} Terminates the child process when aborted.
+* Returns: {BenchmarksStream}
+
+Runs exactly one benchmark module in a fresh child process and returns its
+object-mode event stream. A relative `path` is resolved from the current working
+directory when `runFile()` is called. `path` is not interpreted as a glob.
+Unless the signal is aborted or the stream is destroyed before startup, every
+call uses a new child. Input discovery, ordering, concurrency, retries, and
+multi-file scheduling remain the caller's responsibility.
+
+When the Permission Model is enabled, the caller must have file system read
+access to `path` and permission to create child processes.
+
+Records use advanced child process serialization, preserving supported
+structured values such as `bigint` and errors. Child writes to stdout and stderr
+become `'bench:diagnostic'` records. A permission failure, module loading error,
+abnormal child exit, or cancellation also emits an error diagnostic and produces
+a terminal `'bench:summary'` whose `success` property is `false`; these execution
+failures do not error the stream. If module evaluation fails after declaring
+benchmarks, those declarations still run before the unsuccessful summary.
+
+`env`, effective inherited options, and an explicitly provided `execArgv` are
+copied when `runFile()` is called. The runner removes `NODE_OPTIONS`, replaces
+IPC-related environment variables, and sets its private child-context, run
+identity, and file identity variables, overriding properties with those names
+in `env`. Pass child Node.js options through `execArgv`, not `NODE_OPTIONS`.
+Standard `child_process` environment propagation still applies, including
+`NODE_V8_COVERAGE`, permission-model options, and required z/OS variables.
+Aborting `signal` before the child starts produces an `AbortError` diagnostic
+without spawning it. Aborting during execution sends `SIGTERM` to the child and
+escalates to `SIGKILL` if it does not exit. Destroying the returned stream
+follows the same termination procedure.
+
+## Class: `BenchContext`
+
+An instance of `BenchContext` is passed to every benchmark invocation. A new
+instance is created for every warmup and measured sample.
+
+### `context.index`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* {number}
+
+The zero-based invocation index within the current `context.phase`. Warmup and
+measured samples have separate index sequences.
+
+### `context.name`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* {string}
+
+The benchmark name.
+
+### `context.params`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* {Object}
+
+The benchmark's canonicalized parameter metadata.
+
+### `context.phase`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* {string}
+
+The current sample phase. It is `'warmup'` for an unreported warmup invocation
+and `'measurement'` for a measured invocation.
+
+### `context.signal`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* {AbortSignal}
+
+An abort signal that is triggered when the benchmark is aborted, times out, or
+finishes.
+
+### `context.start()`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Starts the measured region using `process.hrtime.bigint()`. Calling `start()`
+more than once is an error.
+
+### `context.end(operations[, options])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `operations` {number} The number of completed operations. Must be a positive
+  safe integer.
+* `options` {Object}
+  * `detail` {any} Additional structured-cloneable sample data. With CLI process
+    isolation, it must also be supported by advanced child process
+    serialization.
+* Returns: {Object} The sample's `operations`, `duration_ns`, computed `rate`,
+  and optional cloned `detail`.
+
+Ends the measured region. The end timestamp is captured before `operations` is
+validated. Calling `end()` before `start()`, calling it more than once, or
+recording a zero-duration sample is an error. When provided, `detail` is cloned
+after the end timestamp is captured, so cloning time is outside the measured
+region.
+
+### `context.record(sample)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `sample` {Object}
+  * `operations` {number} The number of completed operations. Must be a positive
+    safe integer.
+  * `duration_ns` {bigint} An externally measured positive duration in
+    nanoseconds no greater than `Number.MAX_SAFE_INTEGER`.
+  * `detail` {any} Additional structured-cloneable sample data. With CLI process
+    isolation, it must also be supported by advanced child process
+    serialization.
+* Returns: {Object} The normalized sample, including its computed `rate` and
+  optional cloned `detail`.
+
+Records a measurement made by another clock or execution environment. This is
+useful when a higher-level tool measures work in a worker and needs to exclude
+message transport from the duration. `record()` is mutually exclusive with
+`start()` and `end()` within one callback and must be called exactly once.
+
+### `context.diagnostic(message[, options])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `message` {any} A structured-cloneable diagnostic value. With CLI process
+  isolation, it must also be supported by advanced child process serialization.
+* `options` {Object}
+  * `level` {string} Either `'info'` or `'warning'`. **Default:** `'info'`.
+  * `detail` {any} Additional structured-cloneable diagnostic data. With CLI
+    process isolation, it must also be supported by advanced child process
+    serialization.
+* Returns: {undefined}
+
+Queues a diagnostic associated with the current benchmark, phase, and sample
+index. Multiple diagnostics preserve call order. They are emitted after the
+sample callback settles and before that sample's `'bench:sample'` event. Warmup
+diagnostics are emitted even though warmup samples are not. Diagnostics queued
+before a callback failure are emitted before the failed `'bench:complete'`
+event and do not themselves cause the benchmark to fail. If a timeout or abort
+wins before the callback settles, queued diagnostics might not be emitted.
+
+The message and detail are cloned synchronously. Options are also validated
+synchronously. Calling `diagnostic()` between `context.start()` and
+`context.end()` therefore includes that work in the measured duration. Invalid
+arguments or an uncloneable message or detail violate the sample contract.
+
+### `context.done()`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Requests successful benchmark completion after the current measured sample.
+The callback must still call either `start()` and `end()`, or `record()`.
+Calling `done()` during a warmup invocation is an error. The configured
+`samples` value remains the maximum number of measured invocations if `done()`
+is not called.
+
+## Class: `BenchmarksStream`
+
+`BenchmarksStream` is an object-mode {stream.Readable}. Each lifecycle record is
+both emitted as a named event and made available on the stream as
+`{ type, data }`.
+
+The events are emitted in execution order:
+
+* `'bench:plan'`
+* `'bench:start'`
+* `'bench:sample'`
+* `'bench:complete'`
+* `'bench:diagnostic'`
+* `'bench:summary'`
+
+Named event payloads, readable records, and benchmark completion values are
+independent snapshots. Mutating a value received through one delivery mechanism
+does not change values received through the others. As with other
+{EventEmitter} events, multiple listeners for the same named event receive the
+same event payload. Memory referenced through a {SharedArrayBuffer} remains
+shared, following structured clone semantics.
+
+Once a consumer starts reading, the runner honors the stream's object-mode
+high-water mark and waits between records when the consumer is slower than the
+producer. These waits occur after sample timing has ended, and records are not
+dropped. Snapshot creation and delivery waits are excluded from benchmark
+timeout accounting. Before readable consumption starts, records accumulate in
+the standard readable buffer and are included in `readableLength`. This keeps an
+unread stream and a consumer using only named events from deadlocking, but the
+buffer can grow without bound. A named-event-only consumer that does not need
+readable records should call `stream.resume()` to discard them. Destroying the
+stream stops readable delivery but does not cancel benchmark execution, so
+benchmark completion promises still settle. Automatically scheduled
+module-level runs drain their stream internally.
+
+With process isolation, each record sent by a child is acknowledged only after
+the parent has accepted it. A child sends no additional record until it receives
+that acknowledgement, bounding the IPC relay when a reporter is slow.
+
+Every benchmark-scoped event contains `runId`, `fileRunId`, `entryFile`,
+`benchId`, `parentId`, and `namePath`. `runId` and `fileRunId` are opaque and
+change between runs. `entryFile` identifies the top-level benchmark file whose
+loading caused the declaration, while `file` identifies the source location of
+the declaration itself. `parentId` is based on the containing suite's source
+file and hierarchical name path.
+
+After asynchronous suite declarations settle, an in-process runner emits one
+`'bench:plan'` event for every benchmark it collected, in declaration order.
+All plans from that runner are emitted before its suite hooks or benchmark
+callbacks run. With process isolation, files run in separate children, so plans
+for a later file are emitted after an earlier child has completed. With no
+isolation, all files share one runner and their plans are emitted before any
+benchmark executes. Plan data contains the benchmark-scoped identity, location,
+tags, and parameters described in [benchmark result][], together with:
+
+* `diagnosticChannels` {string\[]} The inherited string channel names
+  subscribed to during each callback.
+* `samples` {number} The effective maximum number of measured callback
+  invocations after run-level overrides.
+* `warmup` {number} The effective number of unreported warmup callback
+  invocations after run-level overrides.
+* `timeout` {number|null} The timeout in milliseconds, or `null` when no timeout
+  is configured.
+* `yieldBetweenSamples` {boolean} Whether an event loop turn is scheduled between
+  sample callbacks.
+* `selected` {boolean} Whether the benchmark is eligible to run after applying
+  `skip`, `only`, and `namePattern` selection. Execution can still be prevented
+  by a duplicate declaration, suite build, hook, abort, or other runtime failure.
+* `skip` {boolean|string} When `selected` is `false`, the explicit skip value or
+  the selection reason, such as `'only'` or `'name pattern'`.
+
+The plan contains execution settings known to the runner. Runtime version,
+operating system, processor, and other environment metadata are intentionally
+left for reporters and higher-level tools to collect.
+
+`'bench:complete'` data contains a [benchmark result][]. A failed result has an
+additional `error` property and may contain samples recorded before the error.
+A skipped result has an additional `skip` property and an empty `samples`
+array. `'bench:diagnostic'` reports loading, suite, and hook errors as well as
+public context diagnostics. A context diagnostic contains the benchmark-scoped
+identity fields, `phase`, `index`, `message`, `level`, source location, and
+optional `detail`. `'bench:summary'` contains overall `runId`, `fileRunId`,
+`entryFile`, `success`, `counts`, `duration_ns`, and `file` properties.
+`fileRunId`, `entryFile`, and `file` are {string|null}; they are `null` when the
+summary aggregates multiple files.
+
+## Sample result
+
+Each measured sample has the following properties:
+
+* `operations` {number} The positive operation count passed to
+  `context.end()` or `context.record()`.
+* `duration_ns` {bigint} The measured duration in nanoseconds.
+* `rate` {number} Operations per second.
+* `detail` {any} The optional cloned sample detail.
+
+## Benchmark result
+
+A completed benchmark result contains:
+
+* `runId` {string} The opaque logical run identity.
+* `fileRunId` {string} The opaque file runner or child execution identity.
+* `entryFile` {string|null} The top-level file that caused this declaration.
+* `benchId` {string} The stable declaration identity within the same source
+  layout.
+* `parentId` {string|null} The stable containing suite identity.
+* `name` {string} The benchmark name.
+* `namePath` {string\[]} The hierarchical suite and benchmark names.
+* `file` {string} The declaration source file.
+* `line` {number} The source line.
+* `column` {number} The source column.
+* `tags` {string\[]} The inherited canonical tags.
+* `params` {Object} The canonical parameter metadata.
+* `samples` {Object\[]} The exact measured samples in measurement invocation
+  order.
+* `summary` {Object}
+  * `mean` {number} The equally weighted arithmetic mean of per-sample rates,
+    not pooled throughput across all operations and durations.
+  * `median` {number} The median per-sample rate.
+  * `min` {number} The minimum per-sample rate.
+  * `max` {number} The maximum per-sample rate.
+  * `stddev` {number} The population standard deviation of rates.
+  * `coefficientOfVariation` {number} `stddev / mean`.
+  * `confidenceInterval` {Object} The 95% Student's t confidence interval for
+    the mean rate, with `lower` and `upper` properties.
+  * `medianConfidenceInterval` {Object} The 95% nonparametric confidence
+    interval for the median rate, with `lower` and `upper` properties.
+  * `skewness` {number} The skewness of the scaled rate histogram.
+
+[`context.record()`]: #contextrecordsample
+[`run()`]: #runoptions
+[benchmark result]: #benchmark-result
+[command-line options documentation]: cli.md#--bench
diff --git a/doc/api/buffer.md b/doc/api/buffer.md
index b89a91cee78e..53b2f3a08256 100644
--- a/doc/api/buffer.md
+++ b/doc/api/buffer.md
@@ -5680,8 +5680,9 @@ since the extra bytes are not free.
 
 Because the address of a `Buffer`'s memory cannot be chosen directly, extra bytes
 have to be allocated or skipped to reach an aligned address.
-[`Buffer.allocUnsafeSlow()`][] over-allocates up to `alignment - 1` bytes and
-positions the returned `Buffer` at the first suitably aligned byte within them.
+[`Buffer.allocUnsafeSlow()`][] over-allocates `alignment` bytes, or 8 when
+`alignment` is smaller than that, and positions the returned `Buffer` at the
+first suitably aligned byte within them.
 [`Buffer.allocUnsafe()`][] instead pads its offset into the shared internal pool,
 whose start is always aligned to 64 bytes, and only falls back to an allocation
 of its own when `alignment` is larger than that. Either way,
diff --git a/doc/api/child_process.md b/doc/api/child_process.md
index e72810262a58..138fb52f8612 100644
--- a/doc/api/child_process.md
+++ b/doc/api/child_process.md
@@ -1204,7 +1204,8 @@ changes:
     `'/bin/sh'` on Unix, and `process.env.ComSpec` on Windows. A different
     shell can be specified as a string. See [Shell requirements][] and
     [Default Windows shell][]. **Default:** `false` (no shell).
-* Returns: {Buffer|string} The stdout from the command.
+* Returns: {Buffer|string|null} If `stdio` is `'pipe'`, the stdout from the
+  command, otherwise null.
 
 The `child_process.execFileSync()` method is generally identical to
 [`child_process.execFile()`][] with the exception that the method will not
@@ -1331,7 +1332,8 @@ changes:
     **Default:** `'buffer'`.
   * `windowsHide` {boolean} Hide the subprocess console window that would
     normally be created on Windows systems. **Default:** `false`.
-* Returns: {Buffer|string} The stdout from the command.
+* Returns: {Buffer|string|null} If `stdio` is `'pipe'`, the stdout from the
+  command, otherwise null.
 
 The `child_process.execSync()` method is generally identical to
 [`child_process.exec()`][] with the exception that the method will not return
@@ -1415,8 +1417,10 @@ changes:
 * Returns: {Object}
   * `pid` {number} Pid of the child process.
   * `output` {Array} Array of results from stdio output.
-  * `stdout` {Buffer|string} The contents of `output[1]`.
-  * `stderr` {Buffer|string} The contents of `output[2]`.
+  * `stdout` {Buffer|string|null} If `stdio` is `'pipe'`, the contents of
+    `output[1]`, otherwise null.
+  * `stderr` {Buffer|string|null} If `stdio` is `'pipe'`, the contents of
+    `output[2]`, otherwise null.
   * `status` {number|null} The exit code of the subprocess, or `null` if the
     subprocess terminated due to a signal.
   * `signal` {string|null} The signal used to kill the subprocess, or `null` if
diff --git a/doc/api/cli.md b/doc/api/cli.md
index 642d4256852d..f18a26d55157 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -202,8 +202,8 @@ added: v26.1.0
 When using the [Permission Model][], the process will not be able to use FFI
 APIs by default. Attempts to use FFI APIs will throw an `ERR_ACCESS_DENIED`
 exception unless the user explicitly passes the `--allow-ffi` flag when
-starting Node.js. The [`node:ffi`][] module also requires the
-`--experimental-ffi` flag and is only available in builds with FFI support.
+starting Node.js. The [`node:ffi`][] module is only available in builds with
+FFI support.
 
 Example:
 
@@ -213,7 +213,7 @@ const lib = new DynamicLibrary(`./mylib.${suffix}`);
 ```
 
 ```console
-$ node --permission --experimental-ffi index.js
+$ node --permission index.js
 Error: Access to this API has been restricted. Use --allow-ffi to manage permissions.
     at node:internal/main/run_main_module:17:47 {
   code: 'ERR_ACCESS_DENIED',
@@ -268,6 +268,26 @@ process.permission.has('fs.read', 'custom-require.js'); // true
 process.permission.has('fs.read', 'custom-require-2.js'); // true
 ```
 
+### `--allow-fs-vfs`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1.1 - Active development
+
+When using the [Permission Model][], a [virtual file system][] cannot be
+mounted by default: [`vfs.mount()`][] throws `ERR_INVALID_STATE` unless the
+user explicitly passes the `--allow-fs-vfs` flag when starting Node.js.
+
+A mounted VFS serves paths that the file system permissions do not describe,
+so mounting one is gated on its own flag rather than on `--allow-fs-read` or
+`--allow-fs-write`.
+
+```console
+$ node --experimental-vfs --permission --allow-fs-vfs app.js
+```
+
 ### `--allow-fs-write`
 
 <!-- YAML
@@ -450,6 +470,115 @@ Error: Access to this API has been restricted
 }
 ```
 
+### `--bench`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+Starts the Node.js command-line benchmark runner. At least one explicit file or
+glob pattern is required:
+
+```console
+node --experimental-bench --bench benchmark.mjs
+node --experimental-bench --bench 'benchmarks/**/*.js'
+```
+
+The `--experimental-bench` flag is required to use this flag or any other
+`--bench-*` option.
+
+Quote glob patterns to prevent expansion by the shell. Matching files are
+sorted and executed serially. By default, each file runs in a separate child
+process. Benchmark files declare benchmarks using `node:bench`; they must not
+call `run()` themselves. See the [benchmark runner][] documentation for more
+details.
+
+This flag cannot be combined with `--test`, `--watch`, `--watch-path`,
+`--check`, `--eval`, or `--interactive`.
+
+### `--bench-isolation=mode`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+Configures benchmark file isolation. When `mode` is `'process'`, each matching
+file runs in a separate child process. This is the default. Files are still run
+serially so their measured work does not overlap.
+
+When `mode` is `'none'`, all matching files and benchmarks run serially in the
+benchmark runner process. This reduces startup overhead but allows module,
+heap, and process state to carry between files. User writes to stdout or stderr
+also share destinations with benchmark reporters in this mode.
+
+The supported modes are `'process'` and `'none'`.
+
+### `--bench-name-pattern=pattern`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+Only runs benchmarks whose full hierarchical name matches the JavaScript
+regular expression `pattern`. Non-matching benchmarks are reported as skipped.
+
+### `--bench-reporter-destination=destination`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+Specifies the destination for the corresponding benchmark reporter. The value
+can be `stdout`, `stderr`, or a file path. A single reporter defaults to
+`stdout` when no destination is specified.
+
+### `--bench-reporter=reporter`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+Specifies a benchmark reporter. The built-in reporters are `spec` and `json`.
+The `json` reporter emits newline-delimited JSON. A custom reporter can be
+specified using a module specifier resolved from the current working directory.
+
+This option can be repeated. When multiple reporters are specified, each must
+have a corresponding `--bench-reporter-destination`. The default reporter is
+`spec`.
+
+### `--bench-samples=count`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+Overrides the maximum number of measured callback invocations for every
+selected benchmark. A benchmark may finish earlier by calling
+`context.done()`. `count` must be an integer between `1` and `4294967295`.
+
+### `--bench-warmup=count`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+Overrides the number of unreported warmup callback invocations for every
+selected benchmark. `count` must be an integer between `0` and `4294967295`.
+
 ### `--build-sea=config`
 
 <!-- YAML
@@ -885,6 +1014,17 @@ Enable [FIPS mode][] at startup. With OpenSSL 3, a configured provider named
 `fips` must be available and initialize successfully. With OpenSSL 1.1.1,
 Node.js must be built against a FIPS-capable OpenSSL.
 
+### `--enable-fips-indicator-events`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Publish OpenSSL FIPS indicator results to the
+[`'crypto.fips.indicator'`][] diagnostics channel. This option requires OpenSSL
+3.4 or later. It does not enable [FIPS mode][] or change whether an operation
+is permitted.
+
 ### `--enable-source-maps`
 
 <!-- YAML
@@ -1073,6 +1213,16 @@ changes:
 
 Enable experimental import support for `.node` addons.
 
+### `--experimental-bench`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+Enable the experimental `node:bench` module and command-line benchmark runner.
+
 ### `--experimental-config-file=path`, `--experimental-config-file`
 
 <!-- YAML
@@ -1244,27 +1394,26 @@ If present, Node.js will look for a
 `node.config.json` file in the current working directory and load it as a
 configuration file.
 
-### `--experimental-eventsource`
+### `--experimental-dtls`
 
 <!-- YAML
-added:
-  - v22.3.0
-  - v20.18.0
+added: v26.9.0
 -->
 
-Enable exposition of [EventSource Web API][] on the global scope.
+> Stability: 1 - Experimental
 
-### `--experimental-ffi`
+Enable experimental support for the DTLS protocol. See the
+[dtls documentation][] for details.
+
+### `--experimental-eventsource`
 
 <!-- YAML
-added: v26.1.0
+added:
+  - v22.3.0
+  - v20.18.0
 -->
 
-> Stability: 1 - Experimental
-
-Enable the experimental [`node:ffi`][] module.
-
-This flag is only available in builds with FFI support.
+Enable exposition of [EventSource Web API][] on the global scope.
 
 ### `--experimental-import-meta-resolve`
 
@@ -1542,6 +1691,14 @@ changes:
 
 Enable experimental WebAssembly System Interface (WASI) support.
 
+### `--experimental-web-worker`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Enable experimental support for the Web Worker API.
+
 ### `--experimental-worker-inspection`
 
 <!-- YAML
@@ -1562,15 +1719,32 @@ added: v12.12.0
 
 Disable loading native addons that are not [context-aware][].
 
-### `--force-fips`
+### `--force-fips[=mode]`
 
 <!-- YAML
 added: v6.0.0
+changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/65645
+    description: Added the optional `provider` and `strict` modes.
 -->
 
 Enable [FIPS mode][] at startup and prevent it from being disabled from script
 code. The same OpenSSL requirements as [`--enable-fips`][] apply.
 
+An optional mode can be specified using `--force-fips=mode`:
+
+* `provider`: Preserve the OpenSSL FIPS provider's configured handling of
+  non-approved operations. This is the current default when the mode is
+  omitted.
+* `strict`: Reject non-approved operations reported through the OpenSSL FIPS
+  indicator callback. This mode requires OpenSSL 3.4 or later.
+
+The `strict` mode only covers operations reported through the callback for
+OpenSSL's default library context. It does not cover native addons that use
+another `OSSL_LIB_CTX` or another copy of `libcrypto`, nor operation-specific
+indicators that do not invoke the callback.
+
 ### `--force-node-api-uncaught-exceptions-policy`
 
 <!-- YAML
@@ -2069,6 +2243,18 @@ changes:
 
 Disable using [syntax detection][] to determine module type.
 
+### `--no-experimental-ffi`
+
+<!-- YAML
+added: v26.1.0
+-->
+
+> Stability: 1 - Experimental
+
+Disable the experimental [`node:ffi`][] module.
+
+This flag is only available in builds with FFI support.
+
 ### `--no-experimental-global-navigator`
 
 <!-- YAML
@@ -2247,6 +2433,17 @@ added: v6.0.0
 
 Silence all process warnings (including deprecations).
 
+### `--no-worker-snapshot`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+Start worker threads by running the internal bootstrap from scratch instead of
+deserializing the bootstrapped context from the built-in startup snapshot.
+
 ### `--node-memory-debug`
 
 <!-- YAML
@@ -2661,6 +2858,9 @@ forked processes, or clustered processes.
 <!-- YAML
 added: v22.0.0
 changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/64606
+    description: Passing `--run` without a command lists the available scripts.
   - version: v22.3.0
     pr-url: https://github.com/nodejs/node/pull/53032
     description: NODE_RUN_SCRIPT_NAME environment variable is added.
@@ -2677,6 +2877,15 @@ changes:
 This runs a specified command from a package.json's `"scripts"` object.
 If a missing `"command"` is provided, it will list the available scripts.
 
+Passing `--run` without a command lists the available scripts and exits
+with a non-zero exit code:
+
+```console
+$ node --run
+Available scripts are:
+  test: node --test
+```
+
 `--run` will traverse up to the root directory and finds a `package.json`
 file to run the command from.
 
@@ -3458,19 +3667,21 @@ When both are set, `--use-env-proxy` takes precedence.
 added:
  - v13.6.0
  - v12.17.0
+changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/65389
+    description: This option is now a no-op.
 -->
 
-Re-map the Node.js static code to large memory pages at startup. If supported on
-the target system, this will cause the Node.js static code to be moved onto 2
-MiB pages instead of 4 KiB pages.
+This option is no longer supported and a no-op. It used to re-map the Node.js
+static code to large memory pages at startup.
 
-The following values are valid for `mode`:
+It still accepts the following values for compatibility:
 
 * `off`: No mapping will be attempted. This is the default.
-* `on`: If supported by the OS, mapping will be attempted. Failure to map will
-  be ignored and a message will be printed to standard error.
-* `silent`: If supported by the OS, mapping will be attempted. Failure to map
-  will be ignored and will not be reported.
+* `on`: No mapping will be attempted and a message will be printed to
+  standard error stating it's no longer supported.
+* `silent`: Same as `off`.
 
 ### `--use-system-ca`
 
@@ -3833,12 +4044,19 @@ one is included in the list below.
 * `--allow-child-process`
 * `--allow-ffi`
 * `--allow-fs-read`
+* `--allow-fs-vfs`
 * `--allow-fs-write`
 * `--allow-inspector`
 * `--allow-net`
 * `--allow-openssl-store`
 * `--allow-wasi`
 * `--allow-worker`
+* `--bench-isolation`
+* `--bench-name-pattern`
+* `--bench-reporter-destination`
+* `--bench-reporter`
+* `--bench-samples`
+* `--bench-warmup`
 * `--conditions`, `-C`
 * `--cpu-prof-dir`
 * `--cpu-prof-interval`
@@ -3850,15 +4068,17 @@ one is included in the list below.
 * `--disable-warning`
 * `--disable-wasm-trap-handler`
 * `--dns-result-order`
+* `--enable-fips-indicator-events`
 * `--enable-fips`
 * `--enable-network-family-autoselection`
 * `--enable-source-maps`
 * `--entry-url`
 * `--experimental-abortcontroller`
 * `--experimental-addon-modules`
+* `--experimental-bench`
 * `--experimental-detect-module`
+* `--experimental-dtls`
 * `--experimental-eventsource`
-* `--experimental-ffi`
 * `--experimental-import-meta-resolve`
 * `--experimental-import-text`
 * `--experimental-json-modules`
@@ -3876,6 +4096,7 @@ one is included in the list below.
 * `--experimental-vfs`
 * `--experimental-vm-modules`
 * `--experimental-wasi-unstable-preview1`
+* `--experimental-web-worker`
 * `--force-context-aware`
 * `--force-fips`
 * `--force-node-api-uncaught-exceptions-policy`
@@ -3903,6 +4124,7 @@ one is included in the list below.
 * `--no-addons`
 * `--no-async-context-frame`
 * `--no-deprecation`
+* `--no-experimental-ffi`
 * `--no-experimental-global-navigator`
 * `--no-experimental-repl-await`
 * `--no-experimental-sqlite`
@@ -3916,6 +4138,7 @@ one is included in the list below.
 * `--no-strip-types`
 * `--no-warnings`
 * `--no-webstorage`
+* `--no-worker-snapshot`
 * `--node-memory-debug`
 * `--openssl-config`
 * `--openssl-legacy-provider`
@@ -4486,6 +4709,7 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [V8 Inspector integration for Node.js]: debugger.md#v8-inspector-integration-for-nodejs
 [V8 JavaScript code coverage]: https://v8project.blogspot.com/2017/12/javascript-code-coverage.html
 [`"type"`]: packages.md#type
+[`'crypto.fips.indicator'`]: diagnostics_channel.md#event-cryptofipsindicator
 [`--allow-addons`]: #--allow-addons
 [`--allow-child-process`]: #--allow-child-process
 [`--allow-fs-read`]: #--allow-fs-read
@@ -4542,7 +4766,9 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [`v8.startupSnapshot.addDeserializeCallback()`]: v8.md#v8startupsnapshotadddeserializecallbackcallback-data
 [`v8.startupSnapshot.setDeserializeMainFunction()`]: v8.md#v8startupsnapshotsetdeserializemainfunctioncallback-data
 [`v8.startupSnapshot` API]: v8.md#startup-snapshot-api
+[`vfs.mount()`]: vfs.md#vfsmount
 [asynchronous module customization hooks]: module.md#asynchronous-customization-hooks
+[benchmark runner]: bench.md#command-line-runner
 [captured by the built-in snapshot of Node.js]: https://github.com/nodejs/node/blob/b19525a33cc84033af4addd0f80acd4dc33ce0cf/test/parallel/test-bootstrap-modules.js#L24
 [collecting code coverage from tests]: test.md#collecting-code-coverage
 [conditional exports]: packages.md#conditional-exports
@@ -4550,6 +4776,7 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [debugger]: debugger.md
 [debugging security implications]: https://nodejs.org/learn/getting-started/debugging#security-implications
 [deprecation warnings]: deprecations.md#list-of-deprecated-apis
+[dtls documentation]: dtls.md
 [emit_warning]: process.md#processemitwarningwarning-options
 [environment_variables]: #environment-variables-1
 [filtering tests by name]: test.md#filtering-tests-by-name
@@ -4572,4 +4799,5 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [test runner execution model]: test.md#test-runner-execution-model
 [timezone IDs]: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
 [tracking issue for user-land snapshots]: https://github.com/nodejs/node/issues/44014
+[virtual file system]: vfs.md
 [ways that `TZ` is handled in other environments]: https://www.gnu.org/software/libc/manual/html_node/TZ-Variable.html
diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index 5cd1d3bbd675..2c25f117005e 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -7,8 +7,8 @@
 <!-- source_link=lib/crypto.js -->
 
 The `node:crypto` module provides cryptographic functionality that includes a
-set of wrappers for OpenSSL's hash, HMAC, cipher, decipher, sign, and verify
-functions.
+set of wrappers for OpenSSL's hash, message authentication code (MAC), cipher,
+decipher, sign, verify, and key encapsulation mechanism (KEM) functions.
 
 ```mjs
 const { createHmac } = await import('node:crypto');
@@ -633,6 +633,10 @@ The [`crypto.createCipheriv()`][] method is
 used to create `Cipheriv` instances. `Cipheriv` objects are not to be created
 directly using the `new` keyword.
 
+The selected algorithm may impose additional restrictions on streaming and
+calls to [`cipher.update()`][]. See [CCM mode][], [CBC-CTS mode][], [XTS mode][],
+[AES key wrap modes][], and [SIV and GCM-SIV modes][].
+
 Example: Using `Cipheriv` objects as streams:
 
 ```mjs
@@ -905,14 +909,15 @@ added: v0.7.1
 * `autoPadding` {boolean} **Default:** `true`
 * Returns: {Cipheriv} The same `Cipheriv` instance for method chaining.
 
-When using block encryption algorithms, the `Cipheriv` class will automatically
-add padding to the input data to the appropriate block size. To disable the
-default padding call `cipher.setAutoPadding(false)`.
+When using block ciphers that use standard block padding, the `Cipheriv` class
+will automatically add padding to the input data to the appropriate block size.
+To disable the default padding call `cipher.setAutoPadding(false)`.
 
-When `autoPadding` is `false`, the length of the entire input data must be a
-multiple of the cipher's block size or [`cipher.final()`][] will throw an error.
-Disabling automatic padding is useful for non-standard padding, for instance
-using `0x0` instead of PKCS padding.
+For block ciphers that use standard block padding, when `autoPadding` is
+`false`, the length of the entire input data must be a multiple of the cipher's
+block size or [`cipher.final()`][] will throw an error. Disabling automatic
+padding is useful for non-standard padding, for instance using `0x0` instead of
+PKCS padding.
 
 The `cipher.setAutoPadding()` method must be called before
 [`cipher.final()`][].
@@ -946,9 +951,12 @@ is specified, a string using the specified encoding is returned. If no
 When `outputEncoding` is specified, it must use the same encoding as previous
 calls to `cipher.update()`.
 
-The `cipher.update()` method can be called multiple times with new data until
-[`cipher.final()`][] is called. Calling `cipher.update()` after
-[`cipher.final()`][] will result in an error being thrown.
+For most algorithms, `cipher.update()` can be called multiple times with new
+data until [`cipher.final()`][] is called. Some algorithms restrict calls to
+`cipher.update()`. For example, [CCM mode][], [CBC-CTS mode][], [XTS mode][],
+[AES key wrap modes][], and [SIV and GCM-SIV modes][] require the whole message
+in a single call. Calling `cipher.update()` after [`cipher.final()`][] will
+result in an error being thrown.
 
 ## Class: `Decipheriv`
 
@@ -970,6 +978,10 @@ The [`crypto.createDecipheriv()`][] method is
 used to create `Decipheriv` instances. `Decipheriv` objects are not to be created
 directly using the `new` keyword.
 
+The selected algorithm may impose additional restrictions on streaming and
+calls to [`decipher.update()`][]. See [CCM mode][], [CBC-CTS mode][],
+[XTS mode][], [AES key wrap modes][], and [SIV and GCM-SIV modes][].
+
 Example: Using `Decipheriv` objects as streams:
 
 ```mjs
@@ -1267,8 +1279,8 @@ When data has been encrypted without standard block padding, calling
 `decipher.setAutoPadding(false)` will disable automatic padding to prevent
 [`decipher.final()`][] from checking for and removing padding.
 
-Turning auto padding off will only work if the input data's length is a
-multiple of the ciphers block size.
+For block ciphers that use standard block padding, disabling it requires the
+input data's length to be a multiple of the cipher's block size.
 
 The `decipher.setAutoPadding()` method must be called before
 [`decipher.final()`][].
@@ -1291,19 +1303,23 @@ changes:
 Updates the decipher with `data`. If the `inputEncoding` argument is given,
 the `data`
 argument is a string using the specified encoding. If the `inputEncoding`
-argument is not given, `data` must be a [`Buffer`][]. If `data` is a
-[`Buffer`][] then `inputEncoding` is ignored.
+argument is not given, `data` must be a [`Buffer`][], `TypedArray`, or
+`DataView`. If `data` is a [`Buffer`][], `TypedArray`, or `DataView`, then
+`inputEncoding` is ignored.
 
-The `outputEncoding` specifies the output format of the enciphered
+The `outputEncoding` specifies the output format of the deciphered
 data. If the `outputEncoding`
 is specified, a string using the specified encoding is returned. If no
 `outputEncoding` is provided, a [`Buffer`][] is returned.
 When `outputEncoding` is specified, it must use the same encoding as previous
 calls to `decipher.update()`.
 
-The `decipher.update()` method can be called multiple times with new data until
-[`decipher.final()`][] is called. Calling `decipher.update()` after
-[`decipher.final()`][] will result in an error being thrown.
+For most algorithms, `decipher.update()` can be called multiple times with new
+data until [`decipher.final()`][] is called. Some algorithms restrict calls to
+`decipher.update()`. For example, [CCM mode][], [CBC-CTS mode][], [XTS mode][],
+[AES key wrap modes][], and [SIV and GCM-SIV modes][] require the whole message
+in a single call. Calling `decipher.update()` after [`decipher.final()`][] will
+result in an error being thrown.
 
 Even if the underlying cipher implements authentication, the authenticity and
 integrity of the plaintext returned from this function may be uncertain at this
@@ -2521,6 +2537,91 @@ Depending on the type of this `KeyObject`, this property is either
 `'secret'` for secret (symmetric) keys, `'public'` for public (asymmetric) keys
 or `'private'` for private (asymmetric) keys.
 
+## Class: `Mac`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Extends: {stream.Transform}
+
+The `Mac` class computes message authentication codes using MAC
+implementations supplied by OpenSSL providers. It can be used in one of two
+ways:
+
+* As a [stream][] that is both readable and writable, where data is written and
+  one authentication tag is produced on the readable side when the writable
+  side ends; or
+* By calling [`mac.update()`][] one or more times followed by [`mac.final()`][].
+
+Instances of `Mac` are created using [`crypto.createMac()`][]. The `Mac` class
+is not exported directly by the `node:crypto` module.
+
+Calling `mac.end()` without first writing data computes the authentication tag
+for an empty message. If the selected MAC produces a zero-byte tag, such as
+when a provider accepts `outputLength: 0`, the readable side ends without
+emitting a data chunk because Node.js streams do not emit zero-length chunks.
+When using `mac.final()` instead, it returns a zero-length [`Buffer`][] or an
+empty encoded string.
+
+`mac.end()` and `mac.final()` are alternative terminal operations and must not
+both be called on the same object. A `Mac` object cannot be used again after
+either operation attempts finalization or after an underlying MAC update fails.
+
+Example: Using [`mac.update()`][] and [`mac.final()`][]:
+
+```mjs
+const { createMac, randomBytes } = await import('node:crypto');
+
+const key = randomBytes(16);
+const mac = createMac('CMAC', key, {
+  cipher: 'AES-128-CBC',
+});
+
+mac.update('some data to authenticate');
+console.log(mac.final('hex'));
+```
+
+### `mac.final([outputEncoding])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `outputEncoding` {string} The [encoding][] of the return value.
+* Returns: {Buffer | string}
+
+Completes the MAC computation and returns the authentication tag. If
+`outputEncoding` is omitted or is `'buffer'`, a [`Buffer`][] is returned.
+Otherwise, a string is returned.
+
+To verify an authentication tag, compare equal-length [`Buffer`][] values using
+[`crypto.timingSafeEqual()`][].
+
+The `Mac` object cannot be used again after finalization is attempted,
+including when finalization fails. Later calls to `mac.update()` or
+`mac.final()` throw `ERR_CRYPTO_MAC_FINALIZED`.
+
+### `mac.update(data[, inputEncoding])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `data` {string|Buffer|TypedArray|DataView}
+* `inputEncoding` {string} The [encoding][] of the `data` string.
+* Returns: {Mac}
+
+Updates the MAC with `data` and returns the `Mac` object so that calls can be
+chained. When `data` is a string, `inputEncoding` defaults to `'utf8'`. When
+`data` is a [`Buffer`][], `TypedArray`, or `DataView`, `inputEncoding` is
+ignored.
+
+This method can be called multiple times before finalization. If an underlying
+MAC update fails, the `Mac` object cannot be used again. Calling this method
+after a previous underlying MAC update failure or after finalization throws
+`ERR_CRYPTO_MAC_FINALIZED`.
+
 ## Class: `Sign`
 
 <!-- YAML
@@ -3554,6 +3655,12 @@ operations. The specific constants currently defined are described in
 <!-- YAML
 added: v0.1.94
 changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/65484
+    description: Additional ciphers available through OpenSSL providers (e.g.
+                 SM4-GCM, SM4-CCM, SM4-XTS, CBC-CTS, and AES key-wrap variants)
+                 are now supported. The `ctsMode` and `xtsStandard` options
+                 were added.
   - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/63411
     description: Ciphers in SIV and GCM-SIV modes are now supported.
@@ -3595,47 +3702,74 @@ changes:
 * `algorithm` {string}
 * `key` {string|ArrayBuffer|Buffer|TypedArray|DataView|KeyObject|CryptoKey}
 * `iv` {string|ArrayBuffer|Buffer|TypedArray|DataView|null}
-* `options` {Object} [`stream.transform` options][]
+* `options` {Object} [`stream.transform` options][] with these additional
+  properties:
+  * `authTagLength` {number} The authentication tag length in bytes. Its
+    requirements and default depend on the authenticated cipher, as described
+    below.
+  * `ctsMode` {string} The [CBC-CTS mode][] variant. One of `'CS1'`, `'CS2'`,
+    or `'CS3'`. The values are case-sensitive. **Default:** `'CS1'`.
+  * `encoding` {string} The [encoding][] to use when `key` is a string. This
+    option does not affect a string `iv`, which is always interpreted as UTF-8.
+    **Default:** `'utf8'`.
+  * `xtsStandard` {string} The standard used by `sm4-xts`. One of `'GB'` or
+    `'IEEE'`. The values are case-sensitive. **Default:** `'GB'`.
 * Returns: {Cipheriv}
 
 Creates and returns a `Cipheriv` object, with the given `algorithm`, `key` and
 initialization vector (`iv`).
 
-The `options` argument controls stream behavior and is optional except when a
-cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the
-`authTagLength` option is required and specifies the length of the
-authentication tag in bytes, see [CCM mode][]. In GCM mode, the `authTagLength`
-option is not required but can be used to set the length of the authentication
-tag that will be returned by `getAuthTag()` and defaults to 16 bytes.
+The `options` argument controls cipher-specific settings and stream behavior.
+It is optional except when a cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`)
+is used. In that case, the `authTagLength` option is required and specifies the
+length of the authentication tag in bytes, see [CCM mode][]. In GCM mode, the
+`authTagLength` option is not required but can be used to set the length of the
+authentication tag that will be returned by `getAuthTag()` and defaults to 16
+bytes.
 For `SIV`, `GCM-SIV`, and `chacha20-poly1305`, the `authTagLength` option
 defaults to 16 bytes. `SIV` and `GCM-SIV` only support 16-byte authentication
 tags.
 
-The `algorithm` is dependent on OpenSSL, examples are `'aes192'`, etc. On
-recent OpenSSL releases, `openssl list -cipher-algorithms` will
-display the available cipher algorithms.
+The `ctsMode` and `xtsStandard` options configure parameters exposed by OpenSSL
+providers. They are available only with OpenSSL 3.0 or later and a provider
+that supports the corresponding parameter. `ctsMode` applies only to CBC-CTS
+ciphers, and `xtsStandard` applies only to `sm4-xts`. Supplying either option
+for an available cipher implementation that does not support it throws an
+`ERR_CRYPTO_UNSUPPORTED_OPERATION` error. See [CBC-CTS mode][] and [XTS mode][]
+for details.
+
+The available algorithms depend on OpenSSL. [`crypto.getCiphers()`][] lists the
+algorithms exposed by Node.js. On recent OpenSSL releases,
+`openssl list -cipher-algorithms` displays the algorithms available to OpenSSL,
+which can include algorithms that Node.js does not expose.
 
 The `key` is the raw key used by the `algorithm` and `iv` is an
-[initialization vector][]. Both arguments must be `'utf8'` encoded strings,
-[Buffers][`Buffer`], `TypedArray`, or `DataView`s. The `key` may optionally be
-a [`KeyObject`][] of type `secret`. If the cipher does not need
-an initialization vector, `iv` may be `null`.
+[initialization vector][]. Each may be a string, `ArrayBuffer`, [`Buffer`][],
+`TypedArray`, or `DataView`. A string `key` is decoded using `options.encoding`,
+which defaults to `'utf8'`; a string `iv` is always decoded as UTF-8. The `key`
+may optionally be a [`KeyObject`][] of type `secret`. If the cipher does not
+need an initialization vector, `iv` may be `null`.
 
 When passing strings for `key` or `iv`, please consider
 [caveats when using strings as inputs to cryptographic APIs][].
 
-Initialization vectors should be unpredictable and unique; ideally, they will be
-cryptographically random. They do not have to be secret: IVs are typically just
-added to ciphertext messages unencrypted. It may sound contradictory that
-something has to be unpredictable and unique, but does not have to be secret;
-remember that an attacker must not be able to predict ahead of time what a
-given IV will be.
+Initialization vector requirements depend on the algorithm. For some
+algorithms, an IV must be unpredictable and unique; for others, uniqueness
+alone is sufficient, a fixed value is required, or no IV is used. Follow the
+requirements for the selected algorithm. IVs typically do not have to be secret
+and can be transmitted with the ciphertext.
 
 ### `crypto.createDecipheriv(algorithm, key, iv[, options])`
 
 <!-- YAML
 added: v0.1.94
 changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/65484
+    description: Additional ciphers available through OpenSSL providers (e.g.
+                 SM4-GCM, SM4-CCM, SM4-XTS, CBC-CTS, and AES key-wrap variants)
+                 are now supported. The `ctsMode` and `xtsStandard` options
+                 were added.
   - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/63411
     description: Ciphers in SIV and GCM-SIV modes are now supported.
@@ -3673,40 +3807,59 @@ changes:
 * `algorithm` {string}
 * `key` {string|ArrayBuffer|Buffer|TypedArray|DataView|KeyObject|CryptoKey}
 * `iv` {string|ArrayBuffer|Buffer|TypedArray|DataView|null}
-* `options` {Object} [`stream.transform` options][]
+* `options` {Object} [`stream.transform` options][] with these additional
+  properties:
+  * `authTagLength` {number} The authentication tag length in bytes. Its
+    requirements and default depend on the authenticated cipher, as described
+    below.
+  * `ctsMode` {string} The [CBC-CTS mode][] variant. One of `'CS1'`, `'CS2'`,
+    or `'CS3'`. The values are case-sensitive. **Default:** `'CS1'`.
+  * `encoding` {string} The [encoding][] to use when `key` is a string. This
+    option does not affect a string `iv`, which is always interpreted as UTF-8.
+    **Default:** `'utf8'`.
+  * `xtsStandard` {string} The standard used by `sm4-xts`. One of `'GB'` or
+    `'IEEE'`. The values are case-sensitive. **Default:** `'GB'`.
 * Returns: {Decipheriv}
 
 Creates and returns a `Decipheriv` object that uses the given `algorithm`, `key`
 and initialization vector (`iv`).
 
-The `options` argument controls stream behavior and is optional except when a
-cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the
-`authTagLength` option is required and specifies the length of the
-authentication tag in bytes, see [CCM mode][].
-For AES-GCM and `chacha20-poly1305`, the `authTagLength` option defaults to 16
-bytes and must be set to a different value if a different length is used. For
-`SIV` and `GCM-SIV`, the `authTagLength` option defaults to 16 bytes and only
-16-byte authentication tags are supported.
-
-The `algorithm` is dependent on OpenSSL, examples are `'aes192'`, etc. On
-recent OpenSSL releases, `openssl list -cipher-algorithms` will
-display the available cipher algorithms.
+The `options` argument controls cipher-specific settings and stream behavior.
+It is optional except when a cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`)
+is used. In that case, the `authTagLength` option is required and specifies the
+length of the authentication tag in bytes, see [CCM mode][]. For GCM and
+`chacha20-poly1305`, the `authTagLength` option defaults to 16 bytes and must be
+set if a different length is used. For `SIV` and `GCM-SIV`, the `authTagLength`
+option defaults to 16 bytes and only 16-byte authentication tags are supported.
+
+The `ctsMode` and `xtsStandard` options configure parameters exposed by OpenSSL
+providers. They are available only with OpenSSL 3.0 or later and a provider
+that supports the corresponding parameter. `ctsMode` applies only to CBC-CTS
+ciphers, and `xtsStandard` applies only to `sm4-xts`. Supplying either option
+for an available cipher implementation that does not support it throws an
+`ERR_CRYPTO_UNSUPPORTED_OPERATION` error. See [CBC-CTS mode][] and [XTS mode][]
+for details.
+
+The available algorithms depend on OpenSSL. [`crypto.getCiphers()`][] lists the
+algorithms exposed by Node.js. On recent OpenSSL releases,
+`openssl list -cipher-algorithms` displays the algorithms available to OpenSSL,
+which can include algorithms that Node.js does not expose.
 
 The `key` is the raw key used by the `algorithm` and `iv` is an
-[initialization vector][]. Both arguments must be `'utf8'` encoded strings,
-[Buffers][`Buffer`], `TypedArray`, or `DataView`s. The `key` may optionally be
-a [`KeyObject`][] of type `secret`. If the cipher does not need
-an initialization vector, `iv` may be `null`.
+[initialization vector][]. Each may be a string, `ArrayBuffer`, [`Buffer`][],
+`TypedArray`, or `DataView`. A string `key` is decoded using `options.encoding`,
+which defaults to `'utf8'`; a string `iv` is always decoded as UTF-8. The `key`
+may optionally be a [`KeyObject`][] of type `secret`. If the cipher does not
+need an initialization vector, `iv` may be `null`.
 
 When passing strings for `key` or `iv`, please consider
 [caveats when using strings as inputs to cryptographic APIs][].
 
-Initialization vectors should be unpredictable and unique; ideally, they will be
-cryptographically random. They do not have to be secret: IVs are typically just
-added to ciphertext messages unencrypted. It may sound contradictory that
-something has to be unpredictable and unique, but does not have to be secret;
-remember that an attacker must not be able to predict ahead of time what a given
-IV will be.
+Initialization vector requirements depend on the algorithm. For some
+algorithms, an IV must be unpredictable and unique; for others, uniqueness
+alone is sufficient, a fixed value is required, or no IV is used. Follow the
+requirements for the selected algorithm. IVs typically do not have to be secret
+and can be transmitted with the ciphertext.
 
 ### `crypto.createDiffieHellman(prime[, primeEncoding][, generator][, generatorEncoding])`
 
@@ -3789,6 +3942,11 @@ and description of each available elliptic curve.
 <!-- YAML
 added: v0.1.92
 changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/65484
+    description: Hash algorithms exposed by OpenSSL providers are now
+                 supported. The `functionName` and `customization` options
+                 were added for cSHAKE hash functions.
   - version: v12.8.0
     pr-url: https://github.com/nodejs/node/pull/28805
     description: The `outputLength` option was added for XOF hash functions.
@@ -3796,6 +3954,14 @@ changes:
 
 * `algorithm` {string}
 * `options` {Object} [`stream.transform` options][]
+  * `customization` {string|ArrayBuffer|Buffer|TypedArray|DataView} For cSHAKE
+    hash functions, specifies the customization byte string. **Default:** an
+    empty byte string.
+  * `functionName` {string|ArrayBuffer|Buffer|TypedArray|DataView} For cSHAKE
+    hash functions, specifies the NIST function-name byte string. **Default:**
+    an empty byte string.
+  * `outputLength` {number} For XOF hash functions, specifies the desired
+    output length in bytes.
 * Returns: {Hash}
 
 Creates and returns a `Hash` object that can be used to generate hash digests
@@ -3803,12 +3969,23 @@ using the given `algorithm`. Optional `options` argument controls stream
 behavior. For XOF hash functions such as `'shake256'`, the `outputLength` option
 can be used to specify the desired output length in bytes.
 
+The `functionName` and `customization` options apply only to cSHAKE-128 and
+cSHAKE-256. They are supported only when Node.js is built with OpenSSL 4.0 or
+later and the selected provider supports the corresponding digest parameters.
+Strings are encoded as UTF-8, and neither strings nor byte values may contain
+NUL bytes. Both options default to an empty byte string. For OpenSSL's built-in
+providers, `functionName` is case-sensitive and must be `''`, `'TupleHash'`,
+`'ParallelHash'`, or `'KMAC'`. Other providers can impose different
+restrictions. With both options empty, cSHAKE produces the same output as the
+corresponding SHAKE function for the same output length. `cshake-128` and
+`cshake-256` default to output lengths of 32 and 64 bytes, respectively.
+
 When the data is small (< 5MB) and readily available, [`crypto.hash()`][] is usually faster.
 
-The `algorithm` is dependent on the available algorithms supported by the
-version of OpenSSL on the platform. Examples are `'sha256'`, `'sha512'`, etc.
-On recent releases of OpenSSL, `openssl list -digest-algorithms` will
-display the available digest algorithms.
+The available algorithms depend on the version and configuration of OpenSSL on
+the platform. Examples are `'sha256'` and `'sha512'`. Use
+[`crypto.getHashes()`][] to obtain the list of hash algorithms available to the
+Node.js process.
 
 Example: generating the sha256 sum of a file
 
@@ -3891,10 +4068,11 @@ changes:
 Creates and returns an `Hmac` object that uses the given `algorithm` and `key`.
 Optional `options` argument controls stream behavior.
 
-The `algorithm` is dependent on the available algorithms supported by the
-version of OpenSSL on the platform. Examples are `'sha256'`, `'sha512'`, etc.
-On recent releases of OpenSSL, `openssl list -digest-algorithms` will
-display the available digest algorithms.
+The available algorithms depend on the version and configuration of OpenSSL on
+the platform. Examples are `'sha256'` and `'sha512'`.
+[`crypto.getHashes()`][] lists algorithms available to the hashing APIs, but
+HMAC imposes additional restrictions, so not every listed algorithm is
+suitable.
 
 The `key` is the HMAC key used to generate the cryptographic HMAC hash. If it is
 a [`KeyObject`][], its type must be `secret`. If it is a string, please consider
@@ -3957,6 +4135,65 @@ input.on('readable', () => {
 });
 ```
 
+### `crypto.createMac(algorithm, key[, options])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1.2 - Release candidate
+
+* `algorithm` {string} The name of the MAC algorithm.
+* `key` {ArrayBuffer|Buffer|TypedArray|DataView|KeyObject}
+* `options` {Object} [`stream.transform` options][]
+  * `digest` {string} The digest used by a MAC such as HMAC.
+  * `cipher` {string} The cipher used by a MAC such as CMAC or GMAC.
+  * `iv` {ArrayBuffer|Buffer|TypedArray|DataView} The initialization vector for
+    a MAC such as GMAC.
+  * `customization` {ArrayBuffer|Buffer|TypedArray|DataView} A customization
+    byte string for MACs that support it, such as KMAC.
+  * `salt` {ArrayBuffer|Buffer|TypedArray|DataView} A salt byte string for MACs
+    that support it, such as BLAKE2 MACs.
+  * `outputLength` {number} The requested provider output size in bytes. Must be
+    an unsigned 32-bit integer. Provider-specific restrictions also apply.
+* Returns: {Mac}
+
+`algorithm` must be a non-empty provider MAC name. The MAC-specific properties
+listed above are extensions to the standard [`stream.transform` options][] and
+are passed only when the selected provider implementation advertises the
+corresponding parameter with the expected type. A supplied MAC-specific option
+that the selected implementation does not support causes an error.
+
+The following table summarizes the MAC-specific options accepted by MAC
+implementations in OpenSSL's built-in providers. The `key` argument is required
+for every MAC. The table lists only MAC-specific options; standard
+[`stream.transform` options][] remain available for every family.
+
+| MAC family | Required options                        | Optional options                        | Notes                                                                  |
+| ---------- | --------------------------------------- | --------------------------------------- | ---------------------------------------------------------------------- |
+| HMAC       | `digest`                                | None                                    |                                                                        |
+| CMAC       | `cipher` using CBC mode                 | None                                    |                                                                        |
+| GMAC       | `cipher` using GCM mode, non-empty `iv` | None                                    | Requires a unique IV for every message authenticated with a given key. |
+| KMAC       | None                                    | `customization`, `outputLength`         |                                                                        |
+| BLAKE2 MAC | None                                    | `customization`, `salt`, `outputLength` |                                                                        |
+| Poly1305   | None                                    | None                                    | Each key must be used for only one message.                            |
+| SipHash    | None                                    | `outputLength`                          |                                                                        |
+
+`outputLength` configures the output size of the provider MAC. It is never
+implemented by computing a longer tag and truncating it. A value of `0` is
+passed to the provider and is accepted only when that provider can initialize
+and finalize the MAC with a zero-byte output. When `outputLength` is omitted,
+the provider's default output size is used and must be nonzero.
+
+The `key` must contain bytes or be a [`KeyObject`][] of type `secret`. Key
+length and other key requirements are determined by the selected provider
+implementation.
+
+Available algorithms and their accepted parameters depend on the OpenSSL
+version, loaded providers, and active default property query. Use
+[`crypto.getMacs()`][] to list fetchable MAC names. A listed name can still
+require options or a key with provider-specific properties.
+
 ### `crypto.createPrivateKey(key)`
 
 <!-- YAML
@@ -4171,8 +4408,10 @@ added: v0.1.92
 * Returns: {Sign}
 
 Creates and returns a `Sign` object that uses the given `algorithm`. Use
-[`crypto.getHashes()`][] to obtain the names of the available digest algorithms.
-Optional `options` argument controls the `stream.Writable` behavior.
+[`crypto.getHashes()`][] to obtain the names available to the hashing APIs. The
+key type and signature scheme can impose additional restrictions on which
+digests can be used. Optional `options` argument controls the
+`stream.Writable` behavior.
 
 In some cases, a `Sign` instance can be created using the name of a signature
 algorithm, such as `'RSA-SHA256'`, instead of a digest algorithm. This will use
@@ -4191,8 +4430,9 @@ added: v0.1.92
 * Returns: {Verify}
 
 Creates and returns a `Verify` object that uses the given algorithm.
-Use [`crypto.getHashes()`][] to obtain an array of names of the available
-signing algorithms. Optional `options` argument controls the
+Use [`crypto.getHashes()`][] to obtain the names available to the hashing APIs.
+The key type and signature scheme can impose additional restrictions on which
+digests can be used. Optional `options` argument controls the
 `stream.Writable` behavior.
 
 In some cases, a `Verify` instance can be created using the name of a signature
@@ -4439,6 +4679,10 @@ changes:
 Generates a new asymmetric key pair of the given `type`. See the
 supported [asymmetric key types][].
 
+For RSA-PSS keys, [`crypto.getHashes()`][] lists algorithms available to the
+hashing APIs, but not every listed digest can be encoded in RSA-PSS parameters
+or is supported by the active RSA implementation.
+
 If a `publicKeyEncoding` or `privateKeyEncoding` was specified, this function
 behaves as if [`keyObject.export()`][] had been called on its result. Otherwise,
 the respective part of the key is returned as a [`KeyObject`][].
@@ -4561,6 +4805,10 @@ changes:
 Generates a new asymmetric key pair of the given `type`. See the
 supported [asymmetric key types][].
 
+For RSA-PSS keys, [`crypto.getHashes()`][] lists algorithms available to the
+hashing APIs, but not every listed digest can be encoded in RSA-PSS parameters
+or is supported by the active RSA implementation.
+
 If a `publicKeyEncoding` or `privateKeyEncoding` was specified, this function
 behaves as if [`keyObject.export()`][] had been called on its result. Otherwise,
 the respective part of the key is returned as a [`KeyObject`][].
@@ -4919,11 +5167,27 @@ mode][].
 
 <!-- YAML
 added: v0.9.3
+changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/65484
+    description: Names and aliases exposed by loaded OpenSSL providers that
+                 match the default property query are now included.
 -->
 
 * Returns: {string\[]} An array of the names of the supported hash algorithms,
   such as `'RSA-SHA256'`. Hash algorithms are also called "digest" algorithms.
 
+This is the authoritative Node.js list of hash algorithms available to
+[`crypto.createHash()`][] and [`crypto.hash()`][] in the current process. With
+OpenSSL 3 or later, the list depends on the loaded providers and the default
+property query in effect when the list is first generated. Some listed
+algorithms can require API-specific options, such as `outputLength` for XOF
+hash functions.
+
+A listed hash algorithm is not necessarily supported by APIs that combine a
+digest with another cryptographic operation, such as HMAC, key derivation, or
+signing. Those operations can apply additional restrictions.
+
 ```mjs
 const {
   getHashes,
@@ -4940,6 +5204,40 @@ const {
 console.log(getHashes()); // ['DSA', 'DSA-SHA', 'DSA-SHA1', ...]
 ```
 
+### `crypto.getMacs()`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1.2 - Release candidate
+
+* Returns: {string\[]} A fresh array containing the sorted, lowercase names
+  and aliases of fetchable MAC implementations.
+
+Returns MAC names exposed by loaded OpenSSL providers that match the active
+default property query. Duplicate names and numeric OID aliases are omitted.
+On builds without OpenSSL `EVP_MAC` support, this function returns an empty
+array.
+
+The returned names describe implementations that OpenSSL can fetch. They do not
+guarantee that [`crypto.createMac()`][] can initialize the MAC without
+additional options. A provider can require additional parameters or a key with
+algorithm-specific properties, and it can expose parameters that this API does
+not support.
+
+After a successful FIPS mode change made with [`crypto.setFips()`][], subsequent
+calls reflect the new mode, and newly created `Mac` objects use it. Existing
+`Mac` objects continue using the provider implementation selected when they
+were created.
+
+```mjs
+const { getMacs } = await import('node:crypto');
+
+console.log(getMacs());
+// ['blake2bmac', 'blake2smac', 'cmac', 'gmac', 'hmac', ...]
+```
+
 ### `crypto.getRandomValues(typedArray)`
 
 <!-- YAML
@@ -4960,6 +5258,11 @@ added:
  - v21.7.0
  - v20.12.0
 changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/65484
+    description: Hash algorithms exposed by OpenSSL providers are now
+                 supported. The `functionName` and `customization` options
+                 were added for cSHAKE hash functions.
   - version:
      - v25.5.0
      - v24.13.1
@@ -4977,6 +5280,12 @@ changes:
   into a `TypedArray` using either `TextEncoder` or `Buffer.from()` and passing
   the encoded `TypedArray` into this API instead.
 * `options` {Object|string}
+  * `customization` {string|ArrayBuffer|Buffer|TypedArray|DataView} For cSHAKE
+    hash functions, specifies the customization byte string. **Default:** an
+    empty byte string.
+  * `functionName` {string|ArrayBuffer|Buffer|TypedArray|DataView} For cSHAKE
+    hash functions, specifies the NIST function-name byte string. **Default:**
+    an empty byte string.
   * `outputEncoding` {string} [Encoding][encoding] used to encode the
     returned digest. **Default:** `'hex'`.
   * `outputLength` {number} For XOF hash functions such as 'shake256',
@@ -4988,10 +5297,21 @@ the object-based `crypto.createHash()` when hashing a smaller amount of data
 (<= 5MB) that's readily available. If the data can be big or if it is streamed,
 it's still recommended to use `crypto.createHash()` instead.
 
-The `algorithm` is dependent on the available algorithms supported by the
-version of OpenSSL on the platform. Examples are `'sha256'`, `'sha512'`, etc.
-On recent releases of OpenSSL, `openssl list -digest-algorithms` will
-display the available digest algorithms.
+The available algorithms depend on the version and configuration of OpenSSL on
+the platform. Examples are `'sha256'` and `'sha512'`. Use
+[`crypto.getHashes()`][] to obtain the list of hash algorithms available to the
+Node.js process.
+
+The `functionName` and `customization` options apply only to cSHAKE-128 and
+cSHAKE-256. They are supported only when Node.js is built with OpenSSL 4.0 or
+later and the selected provider supports the corresponding digest parameters.
+Strings are encoded as UTF-8, and neither strings nor byte values may contain
+NUL bytes. Both options default to an empty byte string. For OpenSSL's built-in
+providers, `functionName` is case-sensitive and must be `''`, `'TupleHash'`,
+`'ParallelHash'`, or `'KMAC'`. Other providers can impose different
+restrictions. With both options empty, cSHAKE produces the same output as the
+corresponding SHAKE function for the same output length. `cshake-128` and
+`cshake-256` default to output lengths of 32 and 64 bytes, respectively.
 
 If `options` is a string, then it specifies the `outputEncoding`.
 
@@ -5063,6 +5383,10 @@ changes:
 
 HKDF is a simple key derivation function defined in RFC 5869. The given `ikm`,
 `salt` and `info` are used with the `digest` to derive a key of `keylen` bytes.
+The available digest algorithms depend on the version and configuration of
+OpenSSL. HKDF uses HMAC internally. [`crypto.getHashes()`][] lists algorithms
+available to the hashing APIs, but not every listed algorithm is necessarily
+suitable for HMAC or HKDF.
 
 The supplied `callback` function is called with two arguments: `err` and
 `derivedKey`. If an error occurs while deriving the key, `err` will be set;
@@ -5122,6 +5446,10 @@ changes:
 Provides a synchronous HKDF key derivation function as defined in RFC 5869. The
 given `ikm`, `salt` and `info` are used with the `digest` to derive a key of
 `keylen` bytes.
+The available digest algorithms depend on the version and configuration of
+OpenSSL. HKDF uses HMAC internally. [`crypto.getHashes()`][] lists algorithms
+available to the hashing APIs, but not every listed algorithm is necessarily
+suitable for HMAC or HKDF.
 
 The successfully generated `derivedKey` will be returned as an {ArrayBuffer}.
 
@@ -5231,8 +5559,10 @@ pbkdf2('secret', 'salt', 100000, 64, 'sha512', (err, derivedKey) => {
 });
 ```
 
-An array of supported digest functions can be retrieved using
-[`crypto.getHashes()`][].
+The available digest algorithms depend on the version and configuration of
+OpenSSL. PBKDF2 uses HMAC internally. [`crypto.getHashes()`][] lists algorithms
+available to the hashing APIs, but not every listed algorithm is necessarily
+suitable for HMAC or PBKDF2.
 
 This API uses libuv's threadpool, which can have surprising and
 negative performance implications for some applications; see the
@@ -5304,8 +5634,10 @@ const key = pbkdf2Sync('secret', 'salt', 100000, 64, 'sha512');
 console.log(key.toString('hex'));  // '3745e48...08d59ae'
 ```
 
-An array of supported digest functions can be retrieved using
-[`crypto.getHashes()`][].
+The available digest algorithms depend on the version and configuration of
+OpenSSL. PBKDF2 uses HMAC internally. [`crypto.getHashes()`][] lists algorithms
+available to the hashing APIs, but not every listed algorithm is necessarily
+suitable for HMAC or PBKDF2.
 
 ### `crypto.privateDecrypt(privateKey, buffer)`
 
@@ -5361,6 +5693,10 @@ changes:
 Decrypts `buffer` with `privateKey`. `buffer` was previously encrypted using
 the corresponding public key, for example using [`crypto.publicEncrypt()`][].
 
+[`crypto.getHashes()`][] lists algorithms available to the hashing APIs, but
+the active RSA implementation can impose additional restrictions on digests
+used for OAEP or MGF1.
+
 If `privateKey` is not a [`KeyObject`][], this function behaves as if
 `privateKey` had been passed to [`crypto.createPrivateKey()`][]. If it is an
 object, the `padding` property can be passed. Otherwise, this function uses
@@ -5509,6 +5845,10 @@ Encrypts the content of `buffer` with `key` and returns a new
 [`Buffer`][] with encrypted content. The returned data can be decrypted using
 the corresponding private key, for example using [`crypto.privateDecrypt()`][].
 
+[`crypto.getHashes()`][] lists algorithms available to the hashing APIs, but
+the active RSA implementation can impose additional restrictions on digests
+used for OAEP or MGF1.
+
 If `key` is not a [`KeyObject`][], this function behaves as if
 `key` had been passed to [`crypto.createPublicKey()`][]. If it is an
 object, the `padding` property can be passed. Otherwise, this function uses
@@ -6285,6 +6625,10 @@ dependent upon the key type.
 `algorithm` is required to be `null` or `undefined` for Ed25519, Ed448, and
 ML-DSA.
 
+[`crypto.getHashes()`][] lists algorithms available to the hashing APIs, but
+the key type and signature scheme determine whether a listed digest can be
+used for signing.
+
 If `key` is not a [`KeyObject`][], this function behaves as if `key` had been
 passed to [`crypto.createPrivateKey()`][]. When `key` is a string, `ArrayBuffer`,
 [`Buffer`][], `TypedArray`, or `DataView`, it must contain PEM-encoded key
@@ -6422,6 +6766,10 @@ key type.
 `algorithm` is required to be `null` or `undefined` for Ed25519, Ed448, and
 ML-DSA.
 
+[`crypto.getHashes()`][] lists algorithms available to the hashing APIs, but
+the key type and signature scheme determine whether a listed digest can be
+used for verification.
+
 If `key` is not a [`KeyObject`][], this function behaves as if `key` had been
 passed to [`crypto.createPublicKey()`][]. When `key` is a string, `ArrayBuffer`,
 [`Buffer`][], `TypedArray`, or `DataView`, it must contain PEM-encoded key
@@ -6665,6 +7013,79 @@ try {
 console.log(receivedPlaintext);
 ```
 
+### CBC-CTS mode
+
+For CBC ciphertext stealing (CBC-CTS) ciphers, the `ctsMode` option to
+[`crypto.createCipheriv()`][] or [`crypto.createDecipheriv()`][] selects the
+variant:
+
+* `'CS1'` is the default. For block-aligned input, its output is the same as CBC
+  mode.
+* `'CS2'` is also the same as CBC for block-aligned input. For input with a
+  partial final block, it swaps the final full and partial ciphertext blocks
+  relative to CS1.
+* `'CS3'` is the Kerberos 5 variant. It uses the CS2 ordering for a partial
+  final block and swaps the final two ciphertext blocks even for block-aligned
+  input.
+
+Encryption and decryption must use the same variant. The option is available
+only with CBC-CTS provider ciphers on OpenSSL 3.0 or later.
+
+Applications which use this mode must adhere to these restrictions:
+
+* The plaintext or ciphertext must be at least one block long.
+* The ciphertext has the same length as the plaintext.
+* `cipher.update()` or `decipher.update()` must be called exactly once with all
+  input data. Stream methods such as `write(data)`, `end(data)`, or `pipe()` may
+  fail because CBC-CTS does not accept multiple data updates.
+* `cipher.final()` or `decipher.final()` must still be called to complete the
+  operation.
+* `crypto.getCipherInfo()` reports the base mode as `'cbc'`.
+
+### XTS mode
+
+XTS ciphers operate on independently tweakable data units. A `Cipheriv` or
+`Decipheriv` instance represents one complete data unit, and its `iv` argument
+provides the 16-byte tweak. Use a new instance with the appropriate positional
+tweak for each different logical data unit.
+
+Applications which use XTS mode must adhere to these restrictions:
+
+* The plaintext or ciphertext must be at least one 16-byte block. Its length
+  does not have to be a multiple of 16 bytes because XTS uses ciphertext
+  stealing for a final partial block.
+* The ciphertext has the same length as the plaintext.
+* `cipher.update()` or `decipher.update()` must be called exactly once with all
+  input data. Stream methods such as `write(data)`, `end(data)`, or `pipe()` may
+  fail because XTS does not accept multiple data updates.
+* `cipher.final()` or `decipher.final()` must still be called to complete the
+  operation.
+
+For `sm4-xts`, the `xtsStandard` option to [`crypto.createCipheriv()`][] or
+[`crypto.createDecipheriv()`][] selects either the default `'GB'` variant from
+GB/T 17964-2021 or the `'IEEE'` variant from IEEE Std 1619-2007. Encryption and
+decryption must use the same variant. The option is available only for
+`sm4-xts`; it does not apply to AES-XTS ciphers. OpenSSL's default provider
+supports `sm4-xts` in OpenSSL 3.2 or later.
+
+### AES key wrap modes
+
+AES key wrap (`AES-WRAP`) and AES key wrap with padding (`AES-WRAP-PAD`)
+ciphers operate on a complete key-data value rather than on an incremental byte
+stream. The inverse-transform variants have the same processing restrictions.
+
+Applications which use an AES key wrap cipher must adhere to these
+restrictions:
+
+* `cipher.update()` or `decipher.update()` must be called exactly once with the
+  complete, non-empty input value.
+* Do not use AES key wrap ciphers as generic [`stream.Transform`][] streams.
+  Methods such as `write(data)`, `end(data)`, and `pipe()` can split one value
+  across multiple updates, with each update being treated as a separate wrap or
+  unwrap operation.
+* `cipher.final()` or `decipher.final()` must still be called to complete the
+  operation.
+
 ### SIV and GCM-SIV modes
 
 `SIV`[^openssl30] and `GCM-SIV`[^openssl32] are supported [AEAD algorithms][]
@@ -6790,12 +7211,18 @@ startup. The following controls are also available:
 * [`--enable-fips`][] and [`--force-fips`][] enable the property query and
   additionally require the configured provider named `fips` to initialize and
   pass its self-test. Node.js exits if that check fails. `--force-fips` also
-  prevents FIPS mode from being disabled from script code.
+  prevents FIPS mode from being disabled from script code. With
+  `--force-fips=strict`, Node.js also rejects non-approved operations reported
+  through the OpenSSL FIPS indicator callback.
 * [`crypto.setFips()`][] changes the FIPS/property-query state. On OpenSSL 3, it
   does not install, load, initialize, or validate a provider. Implementations
   fetched before the call are not changed.
 * [`crypto.getFips()`][] reports the FIPS/property-query state. On OpenSSL 3, a
   return value of `1` does not prove that a FIPS provider is loaded or validated.
+* With [`--enable-fips-indicator-events`][], the
+  [`'crypto.fips.indicator'`][] diagnostics channel reports non-approved
+  operations permitted by an OpenSSL 3.4 or later FIPS provider configured for
+  backwards compatibility.
 
 With OpenSSL 1.1.1, these controls use the library's FIPS mode support and
 require a FIPS-capable OpenSSL build.
@@ -7090,6 +7517,8 @@ See the [list of SSL OP Flags][] for details.
 [^openssl35]: Requires OpenSSL >= 3.5
 
 [AEAD algorithms]: https://en.wikipedia.org/wiki/Authenticated_encryption
+[AES key wrap modes]: #aes-key-wrap-modes
+[CBC-CTS mode]: #cbc-cts-mode
 [CCM mode]: #ccm-mode
 [CVE-2021-44532]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44532
 [Caveats]: #support-for-weak-or-compromised-algorithms
@@ -7119,8 +7548,12 @@ See the [list of SSL OP Flags][] for details.
 [RFC 7517]: https://www.rfc-editor.org/rfc/rfc7517.txt
 [RFC 8032]: https://www.rfc-editor.org/rfc/rfc8032.txt
 [RFC 9562]: https://www.rfc-editor.org/rfc/rfc9562.txt
+[SIV and GCM-SIV modes]: #siv-and-gcm-siv-modes
 [Web Crypto API documentation]: webcrypto.md
+[XTS mode]: #xts-mode
+[`'crypto.fips.indicator'`]: diagnostics_channel.md#event-cryptofipsindicator
 [`--allow-openssl-store`]: cli.md#--allow-openssl-store
+[`--enable-fips-indicator-events`]: cli.md#--enable-fips-indicator-events
 [`--enable-fips`]: cli.md#--enable-fips
 [`--force-fips`]: cli.md#--force-fips
 [`--openssl-config`]: cli.md#--openssl-configfile
@@ -7142,6 +7575,7 @@ See the [list of SSL OP Flags][] for details.
 [`crypto.createECDH()`]: #cryptocreateecdhcurvename
 [`crypto.createHash()`]: #cryptocreatehashalgorithm-options
 [`crypto.createHmac()`]: #cryptocreatehmacalgorithm-key-options
+[`crypto.createMac()`]: #cryptocreatemacalgorithm-key-options
 [`crypto.createPrivateKey()`]: #cryptocreateprivatekeykey
 [`crypto.createPublicKey()`]: #cryptocreatepublickeykey
 [`crypto.createSecretKey()`]: #cryptocreatesecretkeykey-encoding
@@ -7149,10 +7583,12 @@ See the [list of SSL OP Flags][] for details.
 [`crypto.createVerify()`]: #cryptocreateverifyalgorithm-options
 [`crypto.generateKey()`]: #cryptogeneratekeytype-options-callback
 [`crypto.generateKeyPair()`]: #cryptogeneratekeypairtype-options-callback
+[`crypto.getCiphers()`]: #cryptogetciphers
 [`crypto.getCurves()`]: #cryptogetcurves
 [`crypto.getDiffieHellman()`]: #cryptogetdiffiehellmangroupname
 [`crypto.getFips()`]: #cryptogetfips
 [`crypto.getHashes()`]: #cryptogethashes
+[`crypto.getMacs()`]: #cryptogetmacs
 [`crypto.hash()`]: #cryptohashalgorithm-data-options
 [`crypto.privateDecrypt()`]: #cryptoprivatedecryptprivatekey-buffer
 [`crypto.privateEncrypt()`]: #cryptoprivateencryptprivatekey-buffer
@@ -7162,6 +7598,7 @@ See the [list of SSL OP Flags][] for details.
 [`crypto.randomFill()`]: #cryptorandomfillbuffer-offset-size-callback
 [`crypto.setFips()`]: #cryptosetfipsbool
 [`crypto.sign()`]: #cryptosignalgorithm-data-key-callback
+[`crypto.timingSafeEqual()`]: #cryptotimingsafeequala-b
 [`crypto.verify()`]: #cryptoverifyalgorithm-data-key-signature-callback
 [`crypto.webcrypto.getRandomValues()`]: webcrypto.md#cryptogetrandomvaluestypedarray
 [`crypto.webcrypto.subtle`]: webcrypto.md#class-subtlecrypto
@@ -7178,9 +7615,12 @@ See the [list of SSL OP Flags][] for details.
 [`hmac.update()`]: #hmacupdatedata-inputencoding
 [`import()`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/import
 [`keyObject.export()`]: #keyobjectexportoptions
+[`mac.final()`]: #macfinaloutputencoding
+[`mac.update()`]: #macupdatedata-inputencoding
 [`postMessage()`]: worker_threads.md#portpostmessagevalue-transferlist
 [`sign.sign()`]: #signsignprivatekey-outputencoding
 [`sign.update()`]: #signupdatedata-inputencoding
+[`stream.Transform`]: stream.md#class-streamtransform
 [`stream.Writable` options]: stream.md#new-streamwritableoptions
 [`stream.transform` options]: stream.md#new-streamtransformoptions
 [`util.promisify()`]: util.md#utilpromisifyoriginal
diff --git a/doc/api/diagnostics_channel.md b/doc/api/diagnostics_channel.md
index 0971e04609b5..2dff06e2d92d 100644
--- a/doc/api/diagnostics_channel.md
+++ b/doc/api/diagnostics_channel.md
@@ -1570,6 +1570,72 @@ passed to `console.warn()`.
 Emitted when `console.error()` is called. Receives and array of the arguments
 passed to `console.error()`.
 
+#### Crypto
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+##### Event: `'crypto.fips.indicator'`
+
+* `operation` {string} The provider-defined operation type.
+* `reason` {string} The provider-defined description of why the operation is
+  not approved.
+* `blocked` {boolean} Whether an indicator callback blocked the operation.
+* `count` {number} The number of matching pending indicator invocations
+  represented by this message.
+* `dropped` {number} The number of additional indicator invocations dropped
+  before this message was delivered.
+
+Emitted when the OpenSSL FIPS provider used by Node.js detects an operation that
+is not FIPS approved after the corresponding provider check was relaxed. Such
+operations are possible when the provider is configured for backwards
+compatibility. The `operation` and `reason` values come from the provider and
+should be treated as opaque strings rather than stable enumerations.
+
+Start Node.js with [`--enable-fips-indicator-events`][] to enable this channel.
+Without the option, subscribing does not install the OpenSSL callback and no
+messages are published.
+
+Subscribing to the channel is observation-only and never changes the result of
+an operation. Node.js preserves the result from any native indicator callback
+installed before Node.js initializes its crypto support. When
+[`--force-fips=strict`][] is used, Node.js rejects callback-indicated
+non-approved operations whether or not indicator events are enabled or the
+channel has subscribers.
+
+Messages are published asynchronously on the main thread because OpenSSL
+indicators can originate from Workers or other threads. Only subscriptions on
+the main thread receive messages. Delivery order relative to the originating
+operation is not defined, and a message cannot be correlated with a particular
+call or Worker.
+
+One cryptographic operation can invoke the OpenSSL indicator more than once.
+Matching pending invocations are coalesced and reflected in `count`, which does
+not necessarily represent a number of cryptographic operations. At most 256
+distinct messages are queued. Additional invocations are reported in `dropped`
+on the first queued message. Queued messages do not keep the event loop active,
+so this channel is best-effort diagnostics rather than an authoritative audit
+log.
+
+This channel observes the default OpenSSL library context used by Node.js. It
+does not observe native addons or other code that uses another `OSSL_LIB_CTX`
+or another copy of `libcrypto`. It is active with OpenSSL 3.4 and later and is
+not available with BoringSSL. A provider configured to reject a check directly,
+including a pedantic OpenSSL FIPS provider, can reject an operation without
+emitting an indicator. Receiving or not receiving a message does not establish
+that Node.js or a cryptographic operation is FIPS validated.
+
+```mjs
+import diagnosticsChannel from 'node:diagnostics_channel';
+
+diagnosticsChannel.subscribe('crypto.fips.indicator', (message) => {
+  console.error('Non-approved cryptographic operation', message);
+});
+```
+
 #### HTTP
 
 > Stability: 1 - Experimental
@@ -1961,6 +2027,8 @@ statement, since both are still in use while the event is being delivered; see
 [BoundedChannel Channels]: #boundedchannel-channels
 [TracingChannel Channels]: #tracingchannel-channels
 [`'uncaughtException'`]: process.md#event-uncaughtexception
+[`--enable-fips-indicator-events`]: cli.md#--enable-fips-indicator-events
+[`--force-fips=strict`]: cli.md#--force-fips
 [`BoundedChannel`]: #class-boundedchannel
 [`DatabaseSync`]: sqlite.md#class-databasesync
 [`TracingChannel`]: #class-tracingchannel
diff --git a/doc/api/dtls.md b/doc/api/dtls.md
new file mode 100644
index 000000000000..33ea7445c82c
--- /dev/null
+++ b/doc/api/dtls.md
@@ -0,0 +1,584 @@
+# DTLS
+
+<!-- YAML
+added: v26.9.0
+-->
+
+<!-- introduced_in=v26.9.0 -->
+
+> Stability: 1 - Experimental
+
+<!-- source_link=lib/dtls.js -->
+
+The `node:dtls` module provides an implementation of the Datagram Transport
+Layer Security (DTLS) protocol over UDP. DTLS provides TLS-equivalent
+security guarantees for datagram-based communication, including
+confidentiality, integrity, and authentication.
+
+To use this module, it must be enabled at build time with the
+`--experimental-dtls` configure flag and at runtime with the
+`--experimental-dtls` CLI flag.
+
+```bash
+node --experimental-dtls app.mjs
+```
+
+```mjs
+import { listen, connect } from 'node:dtls';
+```
+
+```cjs
+const { listen, connect } = require('node:dtls');
+```
+
+## Permission model
+
+When using the [Permission Model][], the `--allow-net` flag must be passed to
+allow DTLS network operations. Without it, calling [`dtls.connect()`][] or
+[`dtls.listen()`][] will throw an `ERR_ACCESS_DENIED` error.
+
+```console
+node --permission --allow-fs-read=* --experimental-dtls index.mjs
+Error: Access to this API has been restricted. Use --allow-net to manage permissions.
+  code: 'ERR_ACCESS_DENIED',
+  permission: 'Net',
+}
+```
+
+Creating a [`DTLSEndpoint`][] instance without connecting or listening
+is permitted even without `--allow-net`, since no network I/O occurs until
+[`dtls.connect()`][] or [`dtls.listen()`][] is called.
+
+## DTLS vs TLS
+
+DTLS is designed for UDP transport and differs from TLS in several key ways:
+
+* No stream guarantees: Messages may arrive out of order or be lost.
+  DTLS preserves datagram semantics.
+* One socket, many peers: A single UDP socket can serve multiple DTLS
+  sessions. The `DTLSEndpoint` manages this multiplexing.
+* Cookie exchange: DTLS servers use a stateless cookie mechanism
+  (HelloVerifyRequest) to prevent denial-of-service amplification attacks.
+* Retransmission: DTLS handles handshake retransmission internally since
+  UDP does not guarantee delivery.
+
+## `dtls.listen(callback, options)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `callback` {Function} Called for each new DTLS session accepted by the
+  server.
+  * `session` {DTLSSession} The new session.
+* `options` {Object}
+  * `cert` {string|Buffer} Server certificate in PEM format. **Required.**
+  * `key` {string|Buffer} Server private key in PEM format. **Required.**
+  * `port` {number} Port to bind to. **Required.**
+  * `host` {string} Address to bind to. **Default:** `'0.0.0.0'`.
+  * `ca` {string|Buffer|string\[]|Buffer\[]} CA certificates in PEM format.
+  * `ciphers` {string} OpenSSL cipher list string.
+  * `alpn` {string\[]|Buffer} ALPN protocol names.
+  * `srtp` {string} Colon-separated SRTP protection profile names
+    (e.g., `'SRTP_AES128_CM_SHA1_80:SRTP_AEAD_AES_128_GCM'`).
+  * `requestCert` {boolean} Request client certificate. **Default:** `false`.
+  * `mtu` {number} Maximum transmission unit for DTLS records.
+    **Default:** `1200`.
+* Returns: {DTLSEndpoint}
+
+Creates a DTLS server bound to the specified address and port. The server
+uses automatic HMAC-based cookie exchange for DoS protection.
+
+```mjs
+import { listen } from 'node:dtls';
+import { readFileSync } from 'node:fs';
+
+const endpoint = listen((session) => {
+  session.onmessage = (data) => {
+    console.log('Received:', data.toString());
+    session.send('pong');
+  };
+
+  session.onhandshake = (protocol) => {
+    console.log('Handshake complete:', protocol);
+  };
+}, {
+  cert: readFileSync('server-cert.pem'),
+  key: readFileSync('server-key.pem'),
+  port: 4433,
+});
+
+console.log('DTLS server listening on', endpoint.address);
+```
+
+## `dtls.connect(host, port[, options])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `host` {string} Remote host to connect to.
+* `port` {number} Remote port to connect to.
+* `options` {Object}
+  * `ca` {string|Buffer|string\[]|Buffer\[]} CA certificates in PEM format.
+  * `cert` {string|Buffer} Client certificate in PEM format.
+  * `key` {string|Buffer} Client private key in PEM format.
+  * `rejectUnauthorized` {boolean} When `true`, the server's certificate must
+    both chain to a trusted CA and match the expected identity (`servername`,
+    or `host` when `servername` is not set); otherwise the handshake is
+    aborted and `session.opened` rejects. When `false`, the certificate is not
+    verified. **Default:** `true`.
+  * `servername` {string} Server name used for the SNI (Server Name
+    Indication) extension and as the identity checked during certificate
+    verification. **Default:** the `host` argument. Set to `''` to disable SNI.
+    SNI is never sent for IP address literals.
+  * `bindHost` {string} Local bind address. **Default:** `'0.0.0.0'`.
+  * `bindPort` {number} Local bind port. **Default:** `0` (ephemeral).
+  * `alpn` {string\[]|Buffer} ALPN protocol names.
+  * `srtp` {string} SRTP protection profile names.
+  * `mtu` {number} Maximum transmission unit. **Default:** `1200`.
+* Returns: {DTLSSession}
+
+Connects to a DTLS server. Returns a `DTLSSession` whose `opened` property
+is a `Promise` that resolves when the handshake completes.
+
+```mjs
+import { connect } from 'node:dtls';
+import { readFileSync } from 'node:fs';
+
+const session = connect('localhost', 4433, {
+  ca: [readFileSync('ca-cert.pem')],
+});
+
+await session.opened;
+session.send('hello');
+
+session.onmessage = (data) => {
+  console.log('Received:', data.toString());
+};
+```
+
+## Class: `DTLSEndpoint`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Manages a UDP socket and multiplexes DTLS sessions.
+
+### `endpoint.address`
+
+* Returns: {Object} `{ address, family, port }`
+
+The local address the endpoint is bound to.
+
+### `endpoint.state`
+
+* Returns: {DTLSEndpointState}
+
+Shared state object with properties:
+
+* `bound` {boolean}
+* `listening` {boolean}
+* `closing` {boolean}
+* `destroyed` {boolean}
+* `sessionCount` {number}
+* `busy` {boolean}
+
+### `endpoint.stats`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {DTLSEndpoint.Stats}
+
+The statistics collected for this endpoint. Read only. The stats object is
+live and updated by the C++ internals as data flows through the endpoint.
+
+### `endpoint.busy`
+
+* {boolean}
+
+When `true`, the endpoint rejects new incoming connections. Can be set
+to implement backpressure.
+
+### `endpoint.close()`
+
+* Returns: {Promise} Resolves when the endpoint is fully closed.
+
+Gracefully closes the endpoint. All active sessions are closed with
+`close_notify` alerts before the UDP socket is released.
+
+### `endpoint.destroy([error])`
+
+Immediately destroys the endpoint without sending `close_notify` alerts.
+
+### `endpoint.closed`
+
+* {Promise} Resolves when the endpoint has fully closed.
+
+### `endpoint[Symbol.asyncDispose]()`
+
+Equivalent to calling `endpoint.close()`.
+
+## Class: `DTLSEndpoint.Stats`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+A view of the collected statistics for an endpoint.
+
+### `endpointStats.createdAt`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} A timestamp indicating when the endpoint was created. Read only.
+
+### `endpointStats.destroyedAt`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} A timestamp indicating when the endpoint was destroyed. Read only.
+
+### `endpointStats.bytesReceived`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of bytes received by this endpoint. Read only.
+
+### `endpointStats.bytesSent`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of bytes sent by this endpoint. Read only.
+
+### `endpointStats.packetsReceived`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of UDP packets received by this endpoint. Read only.
+
+### `endpointStats.packetsSent`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of UDP packets sent by this endpoint. Read only.
+
+### `endpointStats.serverSessions`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of peer-initiated sessions accepted by this
+  endpoint. Read only.
+
+### `endpointStats.clientSessions`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of sessions initiated by this endpoint. Read only.
+
+### `endpointStats.serverBusyCount`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of incoming connections rejected because the
+  endpoint was marked busy. Read only.
+
+### `endpointStats.isConnected`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {boolean}
+
+`true` if the stats object is still connected to the underlying endpoint.
+Once the endpoint is destroyed, the stats become a stale snapshot.
+
+## Class: `DTLSSession`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Represents a DTLS association with a single remote peer.
+
+### `session.send(data)`
+
+* `data` {string|Buffer} The data to send.
+* Returns: {number} The number of bytes written to the DTLS layer.
+
+Send application data to the peer. The data is encrypted by DTLS before
+being sent over UDP. Can only be called after the handshake completes
+(`session.opened` has resolved).
+
+### `session.close()`
+
+* Returns: {Promise} Resolves when the session is closed.
+
+Initiates a graceful DTLS shutdown by sending a `close_notify` alert.
+
+### `session.destroy([error])`
+
+Immediately destroys the session without sending `close_notify`.
+
+### `session.opened`
+
+* {Promise} Resolves with `{ protocol }` when the DTLS handshake completes.
+
+### `session.closed`
+
+* {Promise} Resolves when the session is fully closed.
+
+### `session.remoteAddress`
+
+* Returns: {Object} `{ address, family, port }`
+
+### `session.protocol`
+
+* Returns: {string} The negotiated DTLS protocol version
+  (e.g., `'DTLSv1.2'`).
+
+### `session.cipher`
+
+* Returns: {Object} `{ name, standardName, version }`
+
+### `session.peerCertificate`
+
+* Returns: {string|undefined} The peer's certificate in PEM format.
+
+### `session.alpnProtocol`
+
+* Returns: {string|undefined} The negotiated ALPN protocol.
+
+### `session.srtpProfile`
+
+* Returns: {string|undefined} The negotiated SRTP protection profile name.
+
+### `session.stats`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {DTLSSession.Stats}
+
+The statistics collected for this session. Read only. The stats object is
+live and updated as data flows through the session.
+
+### `session.exportKeyingMaterial(length, label[, context])`
+
+* `length` {number} Number of bytes to export.
+* `label` {string} The label for the exported keying material.
+* `context` {Buffer} Optional context value.
+* Returns: {Buffer}
+
+Exports keying material from the DTLS session, as defined in
+[RFC 5705][]. This is commonly used with DTLS-SRTP to derive
+encryption keys for media streams.
+
+## Class: `DTLSSession.Stats`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+A view of the collected statistics for a session.
+
+### `sessionStats.createdAt`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} A timestamp indicating when the session was created. Read only.
+
+### `sessionStats.destroyedAt`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} A timestamp indicating when the session was destroyed. Read only.
+
+### `sessionStats.closingAt`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} A timestamp indicating when `close()` was called. Read only.
+
+### `sessionStats.handshakeCompletedAt`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} A timestamp indicating when the DTLS handshake completed. Read only.
+
+### `sessionStats.bytesReceived`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of application data bytes received. Read only.
+
+### `sessionStats.bytesSent`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of application data bytes sent. Read only.
+
+### `sessionStats.messagesReceived`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of application messages received. Read only.
+
+### `sessionStats.messagesSent`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of application messages sent. Read only.
+
+### `sessionStats.retransmitCount`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of DTLS handshake retransmissions. Read only.
+
+### `sessionStats.isConnected`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {boolean}
+
+`true` if the stats object is still connected to the underlying session.
+Once the session is destroyed, the stats become a stale snapshot.
+
+### Callback properties
+
+#### `session.onmessage`
+
+* {Function}
+  * `data` {Buffer}
+
+Set to receive application data from the peer.
+
+#### `session.onerror`
+
+* {Function}
+  * `error` {Error}
+
+Set to receive error notifications.
+
+#### `session.onhandshake`
+
+* {Function}
+  * `protocol` {string}
+
+Set to receive handshake completion notifications.
+
+#### `session.onkeylog`
+
+* {Function}
+  * `line` {string}
+
+Set to receive TLS key log lines (for debugging with Wireshark).
+
+### `session[Symbol.asyncDispose]()`
+
+Equivalent to calling `session.close()`.
+
+## DTLS-SRTP example
+
+DTLS-SRTP is used by WebRTC for media encryption. The DTLS handshake
+negotiates the SRTP protection profile and provides keying material.
+
+```mjs
+import { listen, connect } from 'node:dtls';
+import { readFileSync } from 'node:fs';
+
+// Server with SRTP
+const server = listen((session) => {
+  session.onhandshake = () => {
+    console.log('SRTP profile:', session.srtpProfile);
+    const keys = session.exportKeyingMaterial(
+      60,
+      'EXTRACTOR-dtls_srtp',
+    );
+    console.log('SRTP keying material:', keys);
+  };
+}, {
+  cert: readFileSync('server-cert.pem'),
+  key: readFileSync('server-key.pem'),
+  port: 5004,
+  srtp: 'SRTP_AES128_CM_SHA1_80:SRTP_AEAD_AES_128_GCM',
+});
+
+// Client with SRTP
+const session = connect('localhost', 5004, {
+  rejectUnauthorized: false,
+  srtp: 'SRTP_AEAD_AES_128_GCM:SRTP_AES128_CM_SHA1_80',
+});
+
+await session.opened;
+console.log('Negotiated SRTP:', session.srtpProfile);
+const keys = session.exportKeyingMaterial(60, 'EXTRACTOR-dtls_srtp');
+```
+
+## MTU considerations
+
+Since libuv does not currently support path MTU discovery, the DTLS module
+uses a conservative default MTU of 1200 bytes. This value works across
+virtually all network paths but may be suboptimal for local networks.
+
+The MTU can be configured via the `mtu` option:
+
+```mjs
+// For a local network where you know the path MTU
+const endpoint = listen(callback, {
+  // ...
+  mtu: 1400,
+});
+```
+
+The minimum allowed MTU is 256 bytes. The maximum is 65535.
+
+[Permission Model]: permissions.md#permission-model
+[RFC 5705]: https://www.rfc-editor.org/rfc/rfc5705
+[`DTLSEndpoint`]: #class-dtlsendpoint
+[`dtls.connect()`]: #dtlsconnecthost-port-options
+[`dtls.listen()`]: #dtlslistencallback-options
diff --git a/doc/api/errors.md b/doc/api/errors.md
index 9084e2998f06..c1b2add02a60 100644
--- a/doc/api/errors.md
+++ b/doc/api/errors.md
@@ -934,7 +934,7 @@ be called no more than one time per instance of a `Hash` object.
 
 ### `ERR_CRYPTO_HASH_UPDATE_FAILED`
 
-[`hash.update()`][] failed for any reason. This should rarely, if ever, happen.
+[`hash.update()`][] failed for an unspecified reason.
 
 <a id="ERR_CRYPTO_INCOMPATIBLE_KEY"></a>
 
@@ -1050,6 +1050,16 @@ An invalid key type was provided.
 
 The given crypto key object's type is invalid for the attempted operation.
 
+<a id="ERR_CRYPTO_INVALID_MAC"></a>
+
+### `ERR_CRYPTO_INVALID_MAC`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+An invalid MAC algorithm was specified.
+
 <a id="ERR_CRYPTO_INVALID_MESSAGELEN"></a>
 
 ### `ERR_CRYPTO_INVALID_MESSAGELEN`
@@ -1123,6 +1133,37 @@ added: v24.7.0
 Attempted to use KEM operations while Node.js was not compiled with
 OpenSSL with KEM support.
 
+<a id="ERR_CRYPTO_MAC_FINALIZED"></a>
+
+### `ERR_CRYPTO_MAC_FINALIZED`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+An operation was attempted on a `Mac` object after finalization was attempted
+or an underlying MAC update failed.
+
+<a id="ERR_CRYPTO_MAC_NOT_SUPPORTED"></a>
+
+### `ERR_CRYPTO_MAC_NOT_SUPPORTED`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Node.js was built without support for the OpenSSL `EVP_MAC` API.
+
+<a id="ERR_CRYPTO_MAC_UPDATE_FAILED"></a>
+
+### `ERR_CRYPTO_MAC_UPDATE_FAILED`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+[`mac.update()`][] failed for an unspecified reason.
+
 <a id="ERR_CRYPTO_OPERATION_FAILED"></a>
 
 ### `ERR_CRYPTO_OPERATION_FAILED`
@@ -4684,6 +4725,7 @@ An error occurred trying to allocate memory. This should never happen.
 [`http`]: http.md
 [`https`]: https.md
 [`libuv Error handling`]: https://docs.libuv.org/en/v1.x/errors.html
+[`mac.update()`]: crypto.md#macupdatedata-inputencoding
 [`net.Server`]: net.md#class-netserver
 [`net.Socket.write()`]: net.md#socketwritedata-encoding-callback
 [`net.Socket`]: net.md#class-netsocket
diff --git a/doc/api/ffi.md b/doc/api/ffi.md
index 19972747a985..ba7f866cebff 100644
--- a/doc/api/ffi.md
+++ b/doc/api/ffi.md
@@ -28,7 +28,7 @@ const ffi = require('node:ffi');
 ```
 
 This module is only available under the `node:` scheme in builds with FFI
-support and is gated by the `--experimental-ffi` flag.
+support. It can be disabled with the `--no-experimental-ffi` flag.
 
 Building Node.js with `node:ffi` support is available via the bundled `libffi` on
 platforms where `libffi` provides a compatible static backend, or via a
diff --git a/doc/api/fs.md b/doc/api/fs.md
index c5a50b8af13b..315ecdb97c43 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -1414,6 +1414,9 @@ behavior is similar to `cp dir1/ dir2/`.
 <!-- YAML
 added: v22.0.0
 changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/64003
+    description: Add support for the `maxDepth` option.
   - version: v26.1.0
     pr-url: https://github.com/nodejs/node/pull/62695
     description: Add support for the `followSymlinks` option.
@@ -1448,6 +1451,8 @@ changes:
     not supported.
   * `followSymlinks` {boolean} When `true`, symbolic links to directories are
     followed while expanding `**` patterns. **Default:** `false`.
+  * `maxDepth` {integer} Maximum number of directory levels to traverse.
+    The `cwd` directory has a depth of `0`. **Default:** `Infinity`.
   * `withFileTypes` {boolean} `true` if the glob should return paths as Dirents,
     `false` otherwise. **Default:** `false`.
 * Returns: {AsyncIterator} An AsyncIterator that yields the paths of files
@@ -3621,6 +3626,9 @@ descriptor. See [`fs.utimes()`][].
 <!-- YAML
 added: v22.0.0
 changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/64003
+    description: Add support for the `maxDepth` option.
   - version: v26.1.0
     pr-url: https://github.com/nodejs/node/pull/62695
     description: Add support for the `followSymlinks` option.
@@ -3653,6 +3661,8 @@ changes:
     `true` to exclude the item, `false` to include it. **Default:** `undefined`.
   * `followSymlinks` {boolean} When `true`, symbolic links to directories are
     followed while expanding `**` patterns. **Default:** `false`.
+  * `maxDepth` {integer} Maximum number of directory levels to traverse.
+    The `cwd` directory has a depth of `0`. **Default:** `Infinity`.
   * `withFileTypes` {boolean} `true` if the glob should return paths as Dirents,
     `false` otherwise. **Default:** `false`.
 
@@ -6261,6 +6271,9 @@ Synchronous version of [`fs.futimes()`][]. Returns `undefined`.
 <!-- YAML
 added: v22.0.0
 changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/64003
+    description: Add support for the `maxDepth` option.
   - version: v26.1.0
     pr-url: https://github.com/nodejs/node/pull/62695
     description: Add support for the `followSymlinks` option.
@@ -6292,6 +6305,8 @@ changes:
     `true` to exclude the item, `false` to include it. **Default:** `undefined`.
   * `followSymlinks` {boolean} When `true`, symbolic links to directories are
     followed while expanding `**` patterns. **Default:** `false`.
+  * `maxDepth` {integer} Maximum number of directory levels to traverse.
+    The `cwd` directory has a depth of `0`. **Default:** `Infinity`.
   * `withFileTypes` {boolean} `true` if the glob should return paths as Dirents,
     `false` otherwise. **Default:** `false`.
 * Returns: {string\[]} paths of files that match the pattern.
diff --git a/doc/api/globals.md b/doc/api/globals.md
index 73d34250ac06..aee77dab6b44 100644
--- a/doc/api/globals.md
+++ b/doc/api/globals.md
@@ -1310,6 +1310,109 @@ changes:
 A browser-compatible implementation of {WebSocket}. Disable this API
 with the [`--no-experimental-websocket`][] CLI flag.
 
+## Class: `Worker`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental. Enable this API with the
+> [`--experimental-web-worker`][] CLI flag.
+
+A mostly browser-compatible implementation of Web Workers of the [HTML Standard][],
+implemented on top of [`node:worker_threads`][]. Threads created with it
+are given the {DedicatedWorkerGlobalScope} API (`self`,
+`name`, `location`, `navigator`, `postMessage()`, `close()`, and
+`importScripts()`), in addition to the usual Node.js globals, such as `process`.
+
+```js
+// worker.js
+addEventListener('message', (event) => {
+  postMessage(`${event.data} from ${name}!`);
+});
+```
+
+```js
+// main.js
+const worker = new Worker('./worker.js', { name: 'greeter' });
+
+worker.addEventListener('message', (event) => {
+  console.log(event.data); // Prints: Hello from greeter!
+  worker.terminate();
+});
+
+worker.postMessage('Hello');
+```
+
+Because their lifetime and sharing model depend on origins and
+browsing contexts, Node.js does not currently implement `SharedWorker`.
+
+### Loading worker scripts
+
+Worker scripts are read synchronously from the local file system or from
+memory rather than fetched over the network, which changes which URLs are
+accepted and how failures are reported:
+
+* `new Worker()` and `importScripts()` accept only `file:`, `data:`, and
+  `blob:` URLs. Any other scheme makes `new Worker()` throw a
+  `NotSupportedError` and `importScripts()` throw a `NetworkError`.
+* A script that cannot be read makes `importScripts()` throw a `NetworkError`;
+  for `new Worker()` it fires an `error` event at the `Worker` object.
+* Redirects, the `nosniff` check, and HTTP MIME type validation do not apply.
+  MIME types are validated only for `data:` and `blob:` URLs. The
+  `credentials` option is validated for API compatibility but has no effect,
+  since no network request is made.
+* On the main thread, relative script URLs are resolved against the current
+  working directory, because there is no document base URL. Within a worker
+  they are resolved against the worker's own URL (as is done in the spec).
+* For `blob:` URLs, the script must be held in memory, so blobs backed by a file,
+  such as those returned by [`fs.openAsBlob()`][], cannot be used.
+
+### Differences from the HTML Standard
+
+Besides script loading, mentioned above:
+
+* Node.js has no origin model, so same-origin and cross-origin distinctions do
+  not exist and `location.origin` is `'null'` for every supported scheme.
+* `close()` terminates the worker immediately instead of following the
+  specification's "closing flag" algorithm, so code remaining in the current
+  task after `close()` is not executed.
+* The worker global is the normal Node.js global object with
+  `DedicatedWorkerGlobalScope` inserted into its prototype chain, rather than
+  a fresh global created from the interface. Node.js globals such as
+  `process`, `Buffer`, and `require()` remain available to worker scripts.
+* `ErrorEvent`s dispatched at `Worker` instances include `message` and
+  `error`, but `filename`, `lineno`, and `colno` are always `''`, `0`, and
+  `0`. An uncaught exception terminates the worker thread, and an unhandled
+  `error` event is not propagated further: it neither reaches the parent's
+  global scope nor affects the exit code of the process.
+* The following {WorkerGlobalScope} events are never dispatched, although
+  their handler properties exist: `languagechange`, `online`, and `offline`,
+  since these concepts do not exist in Node.js; `rejectionhandled` and
+  `unhandledrejection`, since Node.js exposes the equivalent does not
+  implement the `PromiseRejectionEvent` interface or the per-rejection
+  `preventDefault()` behavior required by the HTML Standard.
+
+### Web Workers and `node:worker_threads`
+
+Every Web Worker is backed by a [`node:worker_threads`][] {Worker}, so the
+two APIs share their threading, structured clone, and transfer semantics.
+Inside a worker, \[`worker_threads.parentPort`]\[] is the port behind
+`self.postMessage()` and the worker's `message` events, `isMainThread` is
+`false`, and `workerData` is `undefined`.
+
+Web Workers, like `node:worker_threads` workers, keep the event loop alive by
+default. In Node.js, Web Workers implement the [Refable protocol][], and can be
+ref'd and unref'd using `process.ref(worker)` and `process.unref(worker)`.
+
+As a rule of thumb, use [`node:worker_threads`][] directly when a program
+needs `workerData`, a custom `env` or `execArgv`, resource limits, stdio
+redirection, the `'online'` and `'exit'` events, or `worker.threadId`;
+`Worker` accepts only the `name`, `type`, and `credentials` options and,
+per the specification, its `terminate()` returns `undefined`, rather than
+a promise. Threads started through [`node:worker_threads`][] are ordinary
+Node.js threads and do not get the worker global scope APIs.
+
 ## Class: `WritableStream`
 
 <!-- YAML
@@ -1355,10 +1458,13 @@ A browser-compatible implementation of [`WritableStreamDefaultWriter`][].
 [CommonJS module]: modules.md
 [CommonJS modules]: modules.md
 [ECMAScript module]: esm.md
+[HTML Standard]: https://html.spec.whatwg.org/multipage/workers.html
 [Navigator API]: https://html.spec.whatwg.org/multipage/system-state.html#the-navigator-object
 [RFC 5646]: https://www.rfc-editor.org/rfc/rfc5646.txt
+[Refable protocol]: process.md#processrefmayberefable
 [Web Crypto API]: webcrypto.md
 [`--experimental-eventsource`]: cli.md#--experimental-eventsource
+[`--experimental-web-worker`]: cli.md#--experimental-web-worker
 [`--localstorage-file`]: cli.md#--localstorage-filefile
 [`--no-experimental-global-navigator`]: cli.md#--no-experimental-global-navigator
 [`--no-experimental-websocket`]: cli.md#--no-experimental-websocket
@@ -1410,9 +1516,11 @@ A browser-compatible implementation of [`WritableStreamDefaultWriter`][].
 [`console`]: console.md
 [`exports`]: modules.md#exports
 [`fetch()`]: https://developer.mozilla.org/en-US/docs/Web/API/Window/fetch
+[`fs.openAsBlob()`]: fs.md#fsopenasblobpath-options
 [`globalThis`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/globalThis
 [`localStorage`]: https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage
 [`module`]: modules.md#module
+[`node:worker_threads`]: worker_threads.md
 [`perf_hooks.performance`]: perf_hooks.md#perf_hooksperformance
 [`process.nextTick()`]: process.md#processnexttickcallback-args
 [`process` object]: process.md#process
diff --git a/doc/api/http.md b/doc/api/http.md
index 1f6d9541134d..c0dcfc3f7b8b 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -1127,7 +1127,7 @@ const hasContentType = request.hasHeader('content-type');
 
 ### `request.maxHeadersCount`
 
-* Type: {number} **Default:** `2000`
+* Type: {number} **Default:** `1000`
 
 Limits maximum response headers count. If set to 0, no limit will be applied.
 
@@ -1914,7 +1914,7 @@ added: v5.7.0
 added: v0.7.0
 -->
 
-* Type: {number} **Default:** `2000`
+* Type: {number} **Default:** `1000`
 
 Limits maximum incoming headers count. If set to 0, no limit will be applied.
 
diff --git a/doc/api/https.md b/doc/api/https.md
index 97501abf186b..74b759556c43 100644
--- a/doc/api/https.md
+++ b/doc/api/https.md
@@ -199,7 +199,7 @@ This method is identical to [`server.listen()`][] from [`net.Server`][].
 
 ### `server.maxHeadersCount`
 
-* Type: {number} **Default:** `2000`
+* Type: {number} **Default:** `1000`
 
 See [`server.maxHeadersCount`][] in the `node:http` module.
 
diff --git a/doc/api/index.md b/doc/api/index.md
index 24c38d0f3a70..700814fa98a0 100644
--- a/doc/api/index.md
+++ b/doc/api/index.md
@@ -10,6 +10,7 @@
 * [Assertion testing](assert.md)
 * [Asynchronous context tracking](async_context.md)
 * [Async hooks](async_hooks.md)
+* [Benchmark runner](bench.md)
 * [Buffer](buffer.md)
 * [C++ addons](addons.md)
 * [C/C++ addons with Node-API](n-api.md)
diff --git a/doc/api/perf_hooks.md b/doc/api/perf_hooks.md
index 2d409517010f..9d48c45e65bb 100644
--- a/doc/api/perf_hooks.md
+++ b/doc/api/perf_hooks.md
@@ -1091,6 +1091,54 @@ changes:
 The high resolution millisecond timestamp representing the time immediately
 before Node.js receives the first byte of the response from the server.
 
+### `performanceResourceTiming.finalResponseHeadersStart`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {number}
+
+The high resolution millisecond timestamp representing the time immediately
+after Node.js receives the first byte of the final response,
+as opposed to an interim response.
+
+### `performanceResourceTiming.firstInterimResponseStart`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {number}
+
+The high resolution millisecond timestamp representing the time immediately
+after Node.js receives the first byte of the first interim response, such as
+a `103 Early Hints` response.
+
+### `performanceResourceTiming.responseStart`
+
+<!-- YAML
+added:
+  - v18.2.0
+  - v16.17.0
+changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/65017
+    description: This property now returns `firstInterimResponseStart`
+                 when it is non-zero.
+  - version: v19.0.0
+    pr-url: https://github.com/nodejs/node/pull/44483
+    description: This property getter must be called with the
+                 `PerformanceResourceTiming` object as the receiver.
+-->
+
+* Type: {number}
+
+The high resolution millisecond timestamp representing the time immediately
+after Node.js receives the first byte of the response from the server. This
+is `firstInterimResponseStart` when it is non-zero, and
+`finalResponseHeadersStart` otherwise.
+
 ### `performanceResourceTiming.responseEnd`
 
 <!-- YAML
@@ -1166,6 +1214,37 @@ A number representing the size (in octets) received from the fetch
 (HTTP or cache), of the message body, after removing any applied
 content-codings.
 
+### `performanceResourceTiming.renderBlockingStatus`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {string}
+
+The render blocking status of the resource. It is either `'blocking'` or `'non-blocking'`.
+
+### `performanceResourceTiming.contentType`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {string}
+
+The minimized MIME type of the content of the fetched resource, or an empty
+string if it cannot be determined.
+
+### `performanceResourceTiming.contentEncoding`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {string}
+
+The content encoding of the fetched resource, such as `'gzip'` or `'br'`.
+
 ### `performanceResourceTiming.toJSON()`
 
 <!-- YAML
@@ -1639,6 +1718,34 @@ added:
 
 Returns a {RecordableHistogram}.
 
+## `perf_hooks.importHistogram(data)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `data` {Uint8Array} A CBOR-encoded histogram previously produced by
+  [`histogram.export()`][].
+* Returns: {RecordableHistogram}
+
+Reconstructs a histogram from a CBOR-encoded `Uint8Array`. The returned
+histogram is a full {RecordableHistogram} with all bucket data, configuration,
+and EWMA state restored. New values can be recorded into it.
+
+```js
+const { createHistogram, importHistogram } = require('node:perf_hooks');
+
+const h = createHistogram();
+for (let i = 1; i <= 1000; i++) h.record(i);
+
+// Serialize and reconstruct
+const data = h.export();
+const h2 = importHistogram(data);
+
+console.log(h2.count);          // 1000
+console.log(h2.percentile(99)); // Same as h.percentile(99)
+```
+
 ## `perf_hooks.eventLoopUtilization([utilization1[, utilization2]])`
 
 <!-- YAML
@@ -1852,6 +1959,37 @@ invoked.
 added: v11.10.0
 -->
 
+### `histogram.burnRate(sloTarget)`
+
+<!-- YAML
+added: v26.8.0
+-->
+
+* `sloTarget` {number} The SLO target as a fraction between 0 and 1
+  (exclusive). For example, `0.999` for a 99.9% SLO.
+* Returns: {number}
+
+Returns the SLO burn rate: `ewmaErrorRate / (1 - sloTarget)`. A burn rate
+of 1 means the error budget will be exactly exhausted over the SLO window.
+A burn rate greater than 1 means it is being consumed faster than allowed.
+Requires the histogram to have been created with both `halfLife` and
+`threshold` options.
+
+```js
+const { createHistogram } = require('node:perf_hooks');
+
+// Track latency with a 200ms SLO threshold, half-life of 100 samples
+const h = createHistogram({ halfLife: 100, threshold: 200_000_000 });
+
+// ... record latency values ...
+
+// Check burn rate against a 99.9% SLO
+const rate = h.burnRate(0.999);
+if (rate > 1) {
+  console.log(`SLO burn rate: ${rate.toFixed(2)}x — error budget depleting`);
+}
+```
+
 ### `histogram.count`
 
 <!-- YAML
@@ -1969,6 +2107,43 @@ added:
 The number of times the event loop delay exceeded the maximum 1 hour event
 loop delay threshold.
 
+### `histogram.export()`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Returns: {Uint8Array}
+
+Serializes the histogram to a [CBOR][]-encoded (RFC 8949) `Uint8Array`
+suitable for transmission or persistent storage. The encoding uses a
+delta-encoded sparse representation of the bucket counts, so the output size
+scales with the number of distinct recorded values rather than the total
+bucket count.
+
+The output includes all histogram configuration, bucket data, and EWMA
+state (when enabled). It can be reconstructed into a new histogram using
+[`perf_hooks.importHistogram()`][].
+
+The CBOR payload is a map with integer keys:
+
+| Key | Type    | Field                                         |
+| --- | ------- | --------------------------------------------- |
+| 0   | uint    | Format version (currently 1)                  |
+| 1   | uint    | Lowest discernible value                      |
+| 2   | uint    | Highest trackable value                       |
+| 3   | uint    | Significant figures                           |
+| 4   | uint    | Total count                                   |
+| 5   | uint    | Min value                                     |
+| 6   | uint    | Max value                                     |
+| 7   | uint    | Normalizing index offset                      |
+| 8   | float64 | Conversion ratio                              |
+| 9   | uint    | Counts array length                           |
+| 10  | array   | Delta-encoded sparse counts `[delta, c, ...]` |
+| 11  | map     | EWMA state (omitted when disabled)            |
+
+Any standard CBOR decoder can parse the output.
+
 ### `histogram.ewmaMean`
 
 <!-- YAML
@@ -2006,37 +2181,6 @@ The EWMA-smoothed probability of a recorded value exceeding the configured
 and `threshold` options. Returns `0` when not enabled or no values have been
 recorded.
 
-### `histogram.burnRate(sloTarget)`
-
-<!-- YAML
-added: v26.8.0
--->
-
-* `sloTarget` {number} The SLO target as a fraction between 0 and 1
-  (exclusive). For example, `0.999` for a 99.9% SLO.
-* Returns: {number}
-
-Returns the SLO burn rate: `ewmaErrorRate / (1 - sloTarget)`. A burn rate
-of 1 means the error budget will be exactly exhausted over the SLO window.
-A burn rate greater than 1 means it is being consumed faster than allowed.
-Requires the histogram to have been created with both `halfLife` and
-`threshold` options.
-
-```js
-const { createHistogram } = require('node:perf_hooks');
-
-// Track latency with a 200ms SLO threshold, half-life of 100 samples
-const h = createHistogram({ halfLife: 100, threshold: 200_000_000 });
-
-// ... record latency values ...
-
-// Check burn rate against a 99.9% SLO
-const rate = h.burnRate(0.999);
-if (rate > 1) {
-  console.log(`SLO burn rate: ${rate.toFixed(2)}x — error budget depleting`);
-}
-```
-
 ### `histogram.ksTest(other)`
 
 <!-- YAML
@@ -2140,6 +2284,41 @@ added: v11.10.0
 
 The mean of the recorded event loop delays.
 
+### `histogram.meanCI([options])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `options` {Object}
+  * `confidence` {number} The confidence level for the interval, between
+    0 and 1 (exclusive). **Default:** `0.95`.
+* Returns: {Object}
+  * `mean` {number} The mean estimate, equivalent to `histogram.mean`.
+  * `lower` {number} The lower bound of the confidence interval.
+  * `upper` {number} The upper bound of the confidence interval.
+
+Returns a two-sided confidence interval for the mean using Student's
+t-distribution and the sample standard error. A higher confidence level
+produces a wider interval. This interval assumes that samples are independent
+and approximately normally distributed, although the approximation is robust
+for sufficiently large samples.
+
+The result reflects the histogram's configured precision and is calculated
+from the values represented by its buckets. With fewer than two recorded
+values, `lower` and `upper` are `NaN`. When all recorded values are equal,
+`lower` and `upper` equal `mean`.
+
+```js
+const { createHistogram } = require('node:perf_hooks');
+
+const h = createHistogram();
+for (let i = 1; i <= 100; i++) h.record(i);
+
+const { mean, lower, upper } = h.meanCI();
+console.log(`mean=${mean}, 95% CI=[${lower}, ${upper}]`);
+```
+
 ### `histogram.min`
 
 <!-- YAML
@@ -2844,6 +3023,7 @@ dns.promises.resolve('localhost');
 ```
 
 [Async Hooks]: async_hooks.md
+[CBOR]: https://www.rfc-editor.org/rfc/rfc8949
 [Cliff's delta]: https://en.wikipedia.org/wiki/Effect_size#Cliff's_delta
 [Cohen's d]: https://en.wikipedia.org/wiki/Effect_size#Cohen's_d
 [Fetch Response Body Info]: https://fetch.spec.whatwg.org/#response-body-info
@@ -2858,7 +3038,9 @@ dns.promises.resolve('localhost');
 [Worker threads]: worker_threads.md#worker-threads
 [`'exit'`]: process.md#event-exit
 [`child_process.spawnSync()`]: child_process.md#child_processspawnsynccommand-args-options
+[`histogram.export()`]: #histogramexport
 [`perf_hooks.eventLoopUtilization()`]: #perf_hookseventlooputilizationutilization1-utilization2
+[`perf_hooks.importHistogram()`]: #perf_hooksimporthistogramdata
 [`perf_hooks.monitorEventLoopDelay()`]: #perf_hooksmonitoreventloopdelayoptions
 [`perf_hooks.timerify()`]: #perf_hookstimerifyfn-options
 [`process.hrtime()`]: process.md#processhrtimetime
diff --git a/doc/api/permissions.md b/doc/api/permissions.md
index 0b46f42d982a..b677013d7978 100644
--- a/doc/api/permissions.md
+++ b/doc/api/permissions.md
@@ -82,8 +82,8 @@ using the [`--allow-child-process`][] and [`--allow-worker`][] respectively.
 To allow network access, use [`--allow-net`][] and for allowing native addons
 when using permission model, use the [`--allow-addons`][]
 flag. For WASI, use the [`--allow-wasi`][] flag. For FFI, use the
-[`--allow-ffi`][] flag. The [`node:ffi`](ffi.md) module also requires the
-`--experimental-ffi` flag and is only available in builds with FFI support.
+[`--allow-ffi`][] flag. The [`node:ffi`](ffi.md) module is only available in
+builds with FFI support.
 
 To allow use of OpenSSL STORE loaders, for example to load a private key
 from a {URL} passed to [`crypto.createPrivateKey()`][], use the
@@ -258,6 +258,14 @@ does not exist, the wildcard will not be added, and access will be limited to
 yet, make sure to explicitly include the wildcard:
 `/my-path/folder-do-not-exist/*`.
 
+Some `node:fs` operations act on an already-open file descriptor rather than a
+path, so they cannot be tied to a `--allow-fs-read` or `--allow-fs-write` grant.
+When the permission model is enabled these operations are disabled and throw
+`ERR_ACCESS_DENIED`, regardless of how the descriptor was obtained. This applies
+both to the top-level `node:fs` functions and to the equivalent
+`FileHandle` methods, and currently includes `fsync`/`fdatasync`,
+`fchmod`, and `fchown` (and their synchronous variants).
+
 #### Configuration file support
 
 In addition to passing permission flags on the command line, they can also be
diff --git a/doc/api/quic.md b/doc/api/quic.md
index 74e4644f8112..c99cd5d9314c 100644
--- a/doc/api/quic.md
+++ b/doc/api/quic.md
@@ -2948,10 +2948,10 @@ The ALPN (Application-Layer Protocol Negotiation) identifier(s).
 For **client** sessions, this is a single string specifying the protocol
 the client wants to use (e.g. `'h3'`).
 
-For **server** sessions, this is an array of protocol names in preference
-order that the server supports (e.g. `['h3', 'h3-29']`). During the TLS
-handshake, the server selects the first protocol from its list that the
-client also supports.
+For **server** sessions, this is a non-empty array of protocol names in
+preference order that the server supports (e.g. `['h3', 'h3-29']`).
+During the TLS handshake, the server selects the first protocol from its
+list that the client also supports.
 
 The negotiated ALPN determines which Application implementation is used
 for the session. `'h3'` and `'h3-*'` variants select the HTTP/3
diff --git a/doc/api/repl.md b/doc/api/repl.md
index 3c61adb450fd..c7c6a80af767 100644
--- a/doc/api/repl.md
+++ b/doc/api/repl.md
@@ -276,6 +276,15 @@ Uncaught SyntaxError: Identifier 'm' has already been declared
 
 [`--no-experimental-repl-await`][] shall disable top-level await in REPL.
 
+### Error handling
+
+By default, uncaught exceptions in the REPL are printed to the output stream
+(as with `Uncaught Error: REPL await` above). `uncaughtException` listeners
+can be added freely in both standalone and nested REPLs. The `handleError`
+option of [`repl.start()`][] can customize this behavior, including
+forwarding exceptions to [`'uncaughtException'`][] by returning
+`'unhandled'`.
+
 ### Reverse-i-search
 
 <!-- YAML
@@ -469,6 +478,9 @@ const firstInstance = repl.start(options);
 const secondInstance = new repl.REPLServer(options);
 ```
 
+Calling `repl.REPLServer()` without the `new` keyword throws a `TypeError`
+(see [DEP0185][]).
+
 ### Event: `'exit'`
 
 <!-- YAML
@@ -1170,6 +1182,7 @@ avoiding open network interfaces.
 
 Original code from <https://gist.github.com/TooTallNate/2053342>.
 
+[DEP0185]: deprecations.md#dep0185-instantiating-noderepl-classes-without-new
 [TTY keybindings]: readline.md#tty-keybindings
 [ZSH]: https://en.wikipedia.org/wiki/Z_shell
 [`'uncaughtException'`]: process.md#event-uncaughtexception
diff --git a/doc/api/single-executable-applications.md b/doc/api/single-executable-applications.md
index be5667cbd499..1032a14be6db 100644
--- a/doc/api/single-executable-applications.md
+++ b/doc/api/single-executable-applications.md
@@ -116,6 +116,7 @@ The configuration currently reads the following top-level fields:
   "disableExperimentalSEAWarning": true, // Default: false
   "useSnapshot": false,  // Default: false
   "useCodeCache": true, // Default: false
+  "useVfs": true, // Default: false
   "execArgv": ["--no-warnings", "--max-old-space-size=4096"], // Optional
   "execArgvExtension": "env", // Default: "env", options: "none", "env", "cli"
   "assets": {  // Optional
@@ -175,6 +176,105 @@ const raw = getRawAsset('a.jpg');
 See documentation of the [`sea.getAsset()`][], [`sea.getAssetAsBlob()`][],
 [`sea.getRawAsset()`][] and [`sea.getAssetKeys()`][] APIs for more information.
 
+### Virtual file system (VFS) for assets
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1.0 - Early development
+
+In addition to using the `node:sea` API to access individual assets, the
+bundled assets can be exposed as a read-only [virtual file system][] and
+accessed through standard `node:fs` APIs. To enable this, set
+`"useVfs": true` in the SEA configuration.
+
+A virtual file system never shadows the real file system: it is mounted at a
+reserved mount point that cannot exist on the real file system, and the mount
+point is chosen at runtime rather than being a fixed path. When `useVfs` is
+enabled, the injected main script itself is placed at the root of the mount
+and executed from there, so `__filename` and `__dirname` point inside the
+virtual file system instead of reflecting [`process.execPath`][]. Bundled
+code therefore reaches the assets through `__dirname`-relative paths and
+relative [`require()`][] calls, without having to know the mount point:
+
+```cjs
+const fs = require('node:fs');
+const path = require('node:path');
+
+// __dirname is the root of the virtual file system holding the assets.
+const rawConfig = fs.readFileSync(path.join(__dirname, 'config.json'), 'utf8');
+const data = fs.readFileSync(path.join(__dirname, 'data/file.txt'));
+
+// Directory operations work too.
+const files = fs.readdirSync(path.join(__dirname, 'assets'));
+
+// Check if a bundled file exists.
+if (fs.existsSync(path.join(__dirname, 'optional.json'))) {
+  // ...
+}
+```
+
+The VFS supports the `node:fs` operations for reading files and directories.
+Since the SEA VFS is read-only, write operations fail with `EROFS`. See the
+[VFS documentation][] for the full list of supported operations.
+
+#### Loading modules from the VFS in a SEA
+
+When `useVfs` is enabled, the main script is executed from inside the
+virtual file system, and `require()` uses the [module loader
+integration][] of the VFS to load modules from the bundled assets. This
+supports relative requires (e.g. `require('./helper.js')`) as well as
+`node_modules` package lookups, which are confined to the mount:
+
+```cjs
+// Require bundled modules using relative paths.
+const myModule = require('./lib/mymodule.js');
+
+// Packages bundled under the node_modules asset prefix also resolve.
+const dep = require('some-package');
+```
+
+#### ESM entry points
+
+`"useVfs": true` also supports `"mainFormat": "module"`. The ESM main
+script is loaded from inside the mount through the ESM loader, so
+`import.meta.url`, `import.meta.filename`, and `import.meta.dirname`
+reflect the location of the main script in the virtual file system, and
+static and dynamic imports resolve against the bundled assets:
+
+```mjs
+import fs from 'node:fs';
+import path from 'node:path';
+
+// import.meta.dirname is the root of the virtual file system.
+const data = fs.readFileSync(
+  path.join(import.meta.dirname, 'data/file.txt'));
+
+// Relative and bare specifier imports resolve inside the mount.
+import myModule from './lib/mymodule.mjs';
+const lazy = await import('./lib/lazy.mjs');
+```
+
+Module format detection works the same way as on the real file
+system: name bundled ES modules with the `.mjs` extension (or provide the
+relevant `package.json` files as assets) so they are interpreted as ESM.
+
+#### Snapshot and code caching limitations
+
+`"useVfs": true` cannot be used together with `"useSnapshot": true` or
+`"useCodeCache": true`. The code cache limitation is due to incomplete
+implementation, not a technical impossibility. Consider bundling the
+application if startup performance matters and do not rely on module loading
+from the VFS in that case.
+
+#### Native addon limitations
+
+Native addons (`.node` files) cannot be loaded directly from the VFS because
+`process.dlopen()` requires files on the real file system. To use native
+addons in a SEA with VFS, write the asset to a temporary file first. See
+[Using native addons in the injected main script][] for an example.
+
 ### Startup snapshot support
 
 The `useSnapshot` field can be used to enable startup snapshot support. In this
@@ -648,6 +748,8 @@ to help us document them.
 [Generating single executable preparation blobs]: #1-generating-single-executable-preparation-blobs
 [Mach-O]: https://en.wikipedia.org/wiki/Mach-O
 [PE]: https://en.wikipedia.org/wiki/Portable_Executable
+[Using native addons in the injected main script]: #using-native-addons-in-the-injected-main-script
+[VFS documentation]: vfs.md
 [Windows SDK]: https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/
 [`process.execPath`]: process.md#processexecpath
 [`require()`]: modules.md#requireid
@@ -660,8 +762,10 @@ to help us document them.
 [`v8.startupSnapshot` API]: v8.md#startup-snapshot-api
 [documentation about startup snapshot support in Node.js]: cli.md#--build-snapshot
 [fuse]: https://www.electronjs.org/docs/latest/tutorial/fuses
+[module loader integration]: vfs.md#module-loader-integration
 [postject]: https://github.com/nodejs/postject
 [postject-linux-arm64-issue]: https://github.com/nodejs/postject/issues/105
 [signtool]: https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool
 [single executable applications]: https://github.com/nodejs/single-executable
 [supported by Node.js]: https://github.com/nodejs/node/blob/main/BUILDING.md#platform-list
+[virtual file system]: vfs.md
diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index bc41da391d4c..10e8df348678 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -241,7 +241,8 @@ Registers a new aggregate function with the SQLite database. This method is a wr
     JavaScript numbers. **Default:** `false`.
   * `varargs` {boolean} If `true`, `options.step` and `options.inverse` may be invoked with any number of
     arguments (between zero and [`SQLITE_MAX_FUNCTION_ARG`][]). If `false`,
-    `inverse` and `step` must be invoked with exactly `length` arguments.
+    `inverse` and `step` must be invoked with exactly `length` arguments, and
+    their `length` properties must be integers.
     **Default:** `false`.
   * `start` {number | string | null | Array | Object | Function} The identity
     value for the aggregation function. This value is used when the aggregation
@@ -428,7 +429,8 @@ added:
     JavaScript numbers. **Default:** `false`.
   * `varargs` {boolean} If `true`, `function` may be invoked with any number of
     arguments (between zero and [`SQLITE_MAX_FUNCTION_ARG`][]). If `false`,
-    `function` must be invoked with exactly `function.length` arguments.
+    `function` must be invoked with exactly `function.length` arguments, which
+    must be an integer.
     **Default:** `false`.
 * `fn` {Function} The JavaScript function to call when the SQLite function is
   invoked. The return value of this function should be a valid SQLite data type:
@@ -1006,8 +1008,11 @@ wrapper around [`sqlite3session_patchset()`][].
 ### `session.close()`
 
 Closes the session. An exception is thrown if the database or the session is not open,
-or if the session is currently generating a changeset or patchset. This method is a
-wrapper around [`sqlite3session_delete()`][].
+or if the session is currently generating a changeset or patchset. An
+[`ERR_INVALID_STATE`][] error is thrown if the method is called from a callback that
+SQLite invoked, such as an authorizer callback, a user-defined function, or a
+[`'sqlite.db.query'`][] subscriber, because SQLite may still be using the session.
+This method is a wrapper around [`sqlite3session_delete()`][].
 
 ### `session[Symbol.dispose]()`
 
@@ -1015,7 +1020,10 @@ wrapper around [`sqlite3session_delete()`][].
 added: v24.9.0
 -->
 
-Closes the session. If the session is already closed, does nothing.
+Closes the session. If the session is already closed, then this is a no-op. An
+[`ERR_INVALID_STATE`][] error is thrown if the session is currently generating
+a changeset or patchset, or if the method is called from a callback that SQLite
+invoked, under the same conditions as [`session.close()`][].
 
 ## Class: `StatementSync`
 
@@ -1907,6 +1915,7 @@ callback function to indicate what type of operation is being authorized.
 [`database.serialize()`]: #databaseserializedbname
 [`database.setAuthorizer()`]: #databasesetauthorizercallback
 [`diagnostics_channel`]: diagnostics_channel.md
+[`session.close()`]: #sessionclose
 [`sqlite3_backup_finish()`]: https://www.sqlite.org/c3ref/backup_finish.html#sqlite3backupfinish
 [`sqlite3_backup_init()`]: https://www.sqlite.org/c3ref/backup_finish.html#sqlite3backupinit
 [`sqlite3_backup_step()`]: https://www.sqlite.org/c3ref/backup_finish.html#sqlite3backupstep
diff --git a/doc/api/stream_iter.md b/doc/api/stream_iter.md
index 899f19b38672..ab91bfdbb1dc 100644
--- a/doc/api/stream_iter.md
+++ b/doc/api/stream_iter.md
@@ -401,6 +401,12 @@ const { writer, readable } = push({
 A writer is any object conforming to the Writer interface. Only `write()` is
 required; all other methods are optional.
 
+Writer arguments use Web IDL conversion semantics. A non-`Uint8Array` chunk is
+converted to a `USVString` and then UTF-8 encoded. `writev()` and
+`writevSync()` accept any iterable object whose values can be converted to
+chunks. Writer option dictionaries treat `null` as an empty dictionary and
+ignore unknown members.
+
 Each async method has a synchronous `*Sync` counterpart designed for a
 try-fallback pattern: attempt the fast synchronous path first, and fall back
 to the async version only when the synchronous call indicates it could not
@@ -417,9 +423,13 @@ writer.fail(err);  // Always synchronous, no fallback needed
 
 * {boolean|null}
 
-Returns `true` if the next write is likely to be accepted (buffered data is
-below capacity), `false` if backpressure is active, or `null` if the writer
-is closed or the consumer has disconnected.
+Returns `true` if the slots buffer has physical capacity (buffered data is
+below the configured byte budget), `false` if the budget is exhausted, or
+`null` if the writer is closed or the consumer has disconnected.
+
+This reports physical capacity independently of the backpressure policy. With
+`'drop-oldest'` or `'drop-newest'`, writes still complete when this is `false`
+by evicting buffered data or discarding the incoming data, respectively.
 
 This is a hint, not a guarantee: the state can change between the check and
 the write. Use [`ondrain()`][] to wait for capacity rather than polling.
@@ -431,7 +441,11 @@ the write. Use [`ondrain()`][] to wait for capacity rather than polling.
     the pending `end()` call; it does not fail the writer itself.
 * Returns: {Promise} Fulfills with the total number of bytes written.
 
-Signals that no more data will be written and waits for buffered data to drain.
+Signals that no more data will be written. Writes already waiting for buffer
+space remain ordered before the end of the stream, while later writes fail. If
+data is outstanding, the returned promise fulfills after the consumer pulls
+`done: true` beyond the final batch. If no data is buffered or pending, the
+writer closes immediately.
 
 #### `writer.endSync()`
 
@@ -458,6 +472,12 @@ or errored, this is a no-op. Unlike `write()` and `end()`, `fail()` is
 unconditionally synchronous because failing a writer is a pure state
 transition with no async work to perform.
 
+#### `writer[Symbol.asyncDispose]()`
+
+If the writer is open, calls `writer.fail()`. If the writer is closing after
+`end()` or `endSync()`, waits for buffered data to drain. If the writer is
+already closed or errored, resolves immediately.
+
 #### `writer.write(chunk[, options])`
 
 * `chunk` {Uint8Array|string}
@@ -478,7 +498,7 @@ Synchronous write. Does not block; returns `false` if backpressure is active.
 
 #### `writer.writev(chunks[, options])`
 
-* `chunks` {Uint8Array\[]|string\[]}
+* `chunks` {Iterable} of {Uint8Array|string} values
 * `options` {Object}
   * `signal` {AbortSignal} Cancel just this write operation. The signal cancels
     only the pending `writev()` call; it does not fail the writer itself.
@@ -488,7 +508,7 @@ Write multiple chunks as a single batch.
 
 #### `writer.writevSync(chunks)`
 
-* `chunks` {Uint8Array\[]|string\[]}
+* `chunks` {Iterable} of {Uint8Array|string} values
 * Returns: {boolean} `true` if the write was accepted, `false` if the
   buffer is full.
 
@@ -507,6 +527,12 @@ import { from, pull, bytes, Stream } from 'node:stream/iter';
 Stream.from('hello');
 ```
 
+Options dictionaries defined by the Iterable Streams API use Web IDL
+conversion semantics. `null` is treated as an empty dictionary, unknown
+members are ignored, and known members are converted to their declared types
+before the operation runs. Conversion failures use Node.js error codes such as
+`ERR_INVALID_ARG_TYPE`, `ERR_INVALID_ARG_VALUE`, and `ERR_OUT_OF_RANGE`.
+
 ```cjs
 // Named exports
 const { from, pull, bytes, Stream } = require('node:stream/iter');
@@ -531,7 +557,8 @@ added: v25.9.0
 
 Create an async byte stream from the given input. Strings are UTF-8 encoded.
 `ArrayBuffer` and `ArrayBufferView` values are wrapped as `Uint8Array`. Arrays
-and iterables in `input` are recursively flattened and normalized.
+and iterables in `input` are recursively flattened and normalized. Flattened
+values may be split across implementation-defined bounded batches.
 
 Objects implementing `Symbol.for('Stream.toAsyncStreamable')` or
 `Symbol.for('Stream.toStreamable')` are converted via those protocols. The
@@ -599,7 +626,8 @@ added: v25.9.0
 * `...transforms` {Function|Object} Zero or more transforms to apply.
 * `writer` {Object} Destination with `write(chunk)` method.
 * `options` {Object}
-  * `signal` {AbortSignal} Abort the pipeline.
+  * `signal` {AbortSignal} Abort the pipeline. Aborting fails the destination
+    writer unless `preventFail` is `true`.
   * `preventClose` {boolean} If `true`, do not call `writer.end()` when
     the source ends. **Default:** `false`.
   * `preventFail` {boolean} If `true`, do not call `writer.fail()` on
@@ -678,8 +706,10 @@ added: v25.9.0
   * `signal` {AbortSignal} Abort the pipeline.
 * Returns: {AsyncIterable} whose chunks fulfill with {Uint8Array\[]}
 
-Create a lazy async pipeline. Data is not read from `source` until the
-returned iterable is consumed. Transforms are applied in order.
+Create a lazy async pipeline. Source conversion and streamable protocol
+dispatch occur when `pull()` is called, but data is not read from `source`
+until the returned iterable is consumed. A signal that is already aborted is
+thrown synchronously after source conversion. Transforms are applied in order.
 
 ```mjs
 import { from, pull, text } from 'node:stream/iter';
@@ -747,7 +777,8 @@ added: v25.9.0
 * `...transforms` {Function|Object} Zero or more sync transforms.
 * Returns: {Iterable} whose chunks return {Uint8Array\[]}
 
-Synchronous version of [`pull()`][]. All transforms must be synchronous.
+Synchronous version of [`pull()`][]. Source conversion and streamable protocol
+dispatch occur when `pullSync()` is called. All transforms must be synchronous.
 
 ## Push streams
 
@@ -765,7 +796,9 @@ added: v25.9.0
     **Default:** `16384`.
   * `backpressure` {string} Backpressure policy: `'strict'`, `'unbounded'`,
     `'drop-oldest'`, or `'drop-newest'`. **Default:** `'strict'`.
-  * `signal` {AbortSignal} Abort the stream.
+  * `signal` {AbortSignal} Abort the stream. The signal remains active while
+    buffered data drains after `writer.end()`; aborting during that time fails
+    the writer and rejects the pending `end()` promise.
 * Returns: {Object}
   * `writer` {Writable} The writer side.
   * `readable` {AsyncIterable} whose chunks fulfill with {Uint8Array\[]}
@@ -823,7 +856,7 @@ added: v25.9.0
 
 * `options` {Object}
   * `budget` {number} Buffer size in bytes for both directions.
-    **Default:** `16384`.
+    Must be >= 16384. **Default:** `16384`.
   * `backpressure` {string} Policy for both directions.
     **Default:** `'strict'`.
   * `signal` {AbortSignal} Cancellation signal for both channels.
@@ -1055,9 +1088,13 @@ added: v25.9.0
 * `drainable` {Object} An object implementing the drainable protocol.
 * Returns: {Promise|null}
 
-Wait for a drainable writer's backpressure to clear. Returns `null` if
-the object does not implement the drainable protocol, or a promise that
-fulfills with `true` when the writer can accept more data.
+Wait for a drainable writer to regain physical buffer capacity. Returns `null`
+if the object does not implement the drainable protocol, or a promise that
+fulfills with `true` when buffered data falls below the byte budget.
+
+For writers using `'drop-oldest'` or `'drop-newest'`, this waits for physical
+capacity even though writes do not block. This allows producers to avoid data
+loss by waiting before writing.
 
 ```mjs
 import { push, ondrain, text } from 'node:stream/iter';
@@ -1308,6 +1345,7 @@ added: v25.9.0
     **Default:** `65536`.
   * `backpressure` {string} `'strict'`, `'unbounded'`, `'drop-oldest'`, or
     `'drop-newest'`. **Default:** `'strict'`.
+  * `signal` {AbortSignal}
 * Returns: {Share}
 
 Create a pull-model multi-consumer shared stream. Unlike `broadcast()`, the
diff --git a/doc/api/v8.md b/doc/api/v8.md
index cf8777db9734..45603fac1f6e 100644
--- a/doc/api/v8.md
+++ b/doc/api/v8.md
@@ -1853,6 +1853,39 @@ const profile = handle.stop();
 console.log(profile);
 ```
 
+## `v8.setHeapProfileNearHeapLimit(limit)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+* `limit` {integer}
+
+Writes the active sampling heap profile as a `.heapprofile` file when V8 is
+near the heap limit, up to `limit` times. Files are written to the directory
+configured by `--diagnostic-dir` (or to the current working directory if the
+option is unset), using the
+`Heap.${yyyymmdd}.${hhmmss}.${pid}.${tid}.${seq}.heapprofile` naming
+convention.
+
+[`v8.startHeapProfile()`][] must be called before this API can capture a
+profile. If no sampling heap profile is active when V8 reaches the heap
+limit, the callback is uninstalled and V8 continues its normal
+out-of-memory behavior.
+
+This API can be used together with [`v8.setHeapSnapshotNearHeapLimit()`][].
+Each API maintains its own `limit`.
+
+Writing is best-effort. Materializing the sampled call tree can allocate V8
+and native memory, so the profile might not be completed if the process has
+insufficient memory available. The serialized profile is written by native code
+and is not exposed to JavaScript.
+
+Calling `setHeapProfileNearHeapLimit()` more than once is a no-op. `limit`
+must be a positive integer.
+
 [CppHeap]: https://v8docs.nodesource.com/node-22.4/d9/dc4/classv8_1_1_cpp_heap.html
 [HTML structured clone algorithm]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm
 [Hook Callbacks]: #hook-callbacks
@@ -1887,6 +1920,8 @@ console.log(profile);
 [`serializer.transferArrayBuffer()`]: #serializertransferarraybufferid-arraybuffer
 [`serializer.writeRawBytes()`]: #serializerwriterawbytesbuffer
 [`settled` callback]: #settledpromise
+[`v8.setHeapSnapshotNearHeapLimit()`]: #v8setheapsnapshotnearheaplimitlimit
+[`v8.startHeapProfile()`]: #v8startheapprofileoptions
 [`v8.stopCoverage()`]: #v8stopcoverage
 [`v8.takeCoverage()`]: #v8takecoverage
 [`vm.Script`]: vm.md#new-vmscriptcode-options
diff --git a/doc/api/vfs.md b/doc/api/vfs.md
index 1551a18feac7..9be346439af5 100644
--- a/doc/api/vfs.md
+++ b/doc/api/vfs.md
@@ -38,10 +38,12 @@ Mounting a VFS only redirects supported [`node:fs`][] calls whose resolved paths
 are under the mount point. It does not prevent code from using other paths or
 other Node.js APIs to access resources available to the process.
 [`RealFSProvider`][] maps VFS paths under its configured root and rejects paths
-that resolve outside that root, but that check is not a security boundary. Do
-not rely on VFS to run untrusted code; use operating-system-level isolation,
-such as separate users, containers, or platform sandboxes, when a security
-boundary is required.
+that resolve outside that root, but that check is not a security boundary.
+[`ZipProvider`][] has no real file-system paths of its own to escape; its
+entries only ever exist within the archive's own namespace. Do not rely on VFS
+to run untrusted code; use operating-system-level isolation, such as separate
+users, containers, or platform sandboxes, when a security boundary is
+required.
 
 ## Basic usage
 
@@ -61,6 +63,11 @@ callback-based, and promise-based file system methods that mirror the
 shape of the [`node:fs`][] API. All paths are POSIX-style and absolute
 (starting with `/`).
 
+By default, the file tree is private to the VFS instance. To expose
+it through the global `node:fs` module, `require()`, and `import`,
+call [`vfs.mount()`][]; call [`vfs.unmount()`][] (or rely on a
+`using` declaration) to detach again.
+
 ## `vfs.create([provider][, options])`
 
 <!-- YAML
@@ -107,6 +114,124 @@ added: v26.4.0
   * `emitExperimentalWarning` {boolean} Whether to emit the experimental
     warning. **Default:** `true`.
 
+### `vfs.mount()`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Returns: {string} The absolute mount point.
+
+Mounts the virtual file system and returns the resulting mount point.
+After mounting, files in the VFS can be accessed through the
+`node:fs` module and resolved through `require()` and `import`
+using paths under the returned mount point.
+
+Mount points always live inside a reserved namespace that cannot have child file system entries,
+so virtual paths never conflate with (or shadow) real paths. The virtual path scheme is subject to
+change and users should not manually construct them based on assumptions. Instead, obtain
+them from what `vfs.mount()` returns or `vfs.mountPoint`.
+
+```cjs
+const vfs = require('node:vfs');
+const fs = require('node:fs');
+
+const myVfs = vfs.create();
+myVfs.writeFileSync('/data.txt', 'Hello');
+const mountPoint = myVfs.mount();
+// e.g. '/dev/null/vfs/0'
+
+fs.readFileSync(`${mountPoint}/data.txt`, 'utf8'); // 'Hello'
+```
+
+Each `VirtualFileSystem` instance may be mounted at most once at a
+time. Attempting to mount an already-mounted instance throws
+`ERR_INVALID_STATE`. Because each instance mounts inside its own
+per-layer namespace, mounts from different instances can never
+overlap.
+
+The VFS supports the [Explicit Resource Management][] proposal. Use
+a `using` declaration to unmount automatically when leaving scope:
+
+```cjs
+const vfs = require('node:vfs');
+const fs = require('node:fs');
+
+let mountPoint;
+{
+  using myVfs = vfs.create();
+  myVfs.writeFileSync('/data.txt', 'Hello');
+  mountPoint = myVfs.mount();
+
+  fs.readFileSync(`${mountPoint}/data.txt`, 'utf8'); // 'Hello'
+} // VFS is automatically unmounted here
+
+fs.existsSync(`${mountPoint}/data.txt`); // false
+```
+
+### `vfs.unmount()`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Unmounts the virtual file system. After unmounting, virtual files
+are no longer reachable through `node:fs`, `require()`, or `import`.
+The same instance may be mounted again by calling `mount()`.
+
+This method is idempotent: calling `unmount()` on a VFS that is not
+currently mounted has no effect.
+
+### `vfs.mounted`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* {boolean}
+
+`true` while the VFS is mounted; `false` otherwise.
+
+### `vfs.mountPoint`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* {string | null}
+
+The current mount point as an absolute string (the value returned by
+the last [`vfs.mount()`][] call), or `null` when the VFS is not
+mounted.
+
+### `vfs.mountPointURL`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* {string | null}
+
+The current mount point as a `file:` URL string (the [`vfs.mountPoint`][]
+path converted with [`url.pathToFileURL()`][]), or `null` when the VFS
+is not mounted.
+
+This is a convenience for addressing mounted files with URL-based
+APIs such as dynamic `import()`:
+
+```mjs
+import vfs from 'node:vfs';
+
+const myVfs = vfs.create();
+myVfs.writeFileSync('/mod.mjs', 'export const value = 42;');
+myVfs.mount();
+
+const { value } = await import(`${myVfs.mountPointURL}/mod.mjs`);
+console.log(value); // 42
+
+myVfs.unmount();
+```
+
 ### `vfs.provider`
 
 <!-- YAML
@@ -196,6 +321,141 @@ The promise namespace mirrors `fs.promises` and includes `readFile`,
 `access`, `rm`, `truncate`, `link`, `mkdtemp`, `chmod`, `chown`, `lchown`,
 `utimes`, `lutimes`, `open`, `lchmod`, and `watch`.
 
+## Module loader integration
+
+Once a `VirtualFileSystem` is mounted, paths under the mount point
+participate in module resolution and loading. The [CommonJS
+resolution algorithm][] used by [`require()`][] and
+[`require.resolve()`][] and the [ES modules resolution algorithm][]
+used by `import` and [`import.meta.resolve()`][] are unchanged;
+instead, every file system operation those algorithms perform is
+dispatched on the path being probed: paths under a mount point are
+served by the owning VFS, and all other paths are served by the real
+file system. Files served from the VFS therefore behave as
+first-class modules.
+
+Because mounted paths live in a reserved namespace that cannot exist
+on disk, any given path is served either by exactly one VFS or by
+the real file system, never both. There is no search order or
+fallback between the two: if a path under a mount point does not
+exist in the VFS, resolution fails with `ENOENT` without consulting
+the disk, and a mounted layer never shadows a real directory.
+
+For resolution purposes the mount point behaves as a file system
+root: `package.json` scope lookups and [loading from `node_modules`
+folders][] stop at the mount point. For example, when
+`${mountPoint}/foo/bar/main.cjs` calls `require('baz')`, the lookup
+goes through:
+
+* `${mountPoint}/foo/bar/node_modules/baz`
+* `${mountPoint}/foo/node_modules/baz`
+* `${mountPoint}/node_modules/baz`
+* If `$NODE_PATH` is set, the folders listed in `$NODE_PATH`
+* `$HOME/.node_modules/baz`
+* `$HOME/.node_libraries/baz`
+* `$PREFIX/lib/node/baz`
+
+The last four entries are [the global folders][], which are legacy
+CommonJS behavior and do not apply to `import`. Absolute specifiers
+may cross the boundary in either direction: a module on the real
+file system can `require()` a mounted path, and a virtual module can
+`require()` a real one.
+
+```cjs
+const vfs = require('node:vfs');
+
+const myVfs = vfs.create();
+myVfs.mkdirSync('/lib');
+myVfs.writeFileSync('/lib/greet.js', 'module.exports = () => "hi";');
+myVfs.writeFileSync(
+  '/lib/package.json', '{"main": "./greet.js"}');
+const mountPoint = myVfs.mount();
+
+const greet = require(`${mountPoint}/lib`);
+console.log(greet()); // 'hi'
+
+myVfs.unmount();
+```
+
+For ECMAScript modules, use `file:` URLs when passing mounted paths
+to dynamic `import()`. [`vfs.mountPointURL`][] provides the mount
+point in that form; this keeps VFS imports portable on Windows,
+where mounted paths use Windows path syntax.
+
+```mjs
+import vfs from 'node:vfs';
+
+const myVfs = vfs.create();
+myVfs.writeFileSync('/mod.mjs', 'export const value = 42;');
+myVfs.mount();
+
+const { value } = await import(`${myVfs.mountPointURL}/mod.mjs`);
+console.log(value); // 42
+
+myVfs.unmount();
+```
+
+CommonJS modules loaded from a mounted VFS are identified by their VFS paths
+that start with the mount point. This is reflected in, for example, `__filename` and
+`__dirname` in the module, or the errors stack traces involving functions from
+the VFS modules. ES modules in the VFS are similarly identified by the `file:` URL of
+their VFS paths and this is reflected in e.g. `import.meta.url`.
+
+Like modules loaded from the real file system, modules loaded from the VFS are
+cached on the first load. When `require()` or `import()` is used to load an absolute
+path or URL that falls under the mounted VFS multiple times, the module is only loaded
+once and subsequent calls return the same instance.
+
+Calling [`vfs.unmount()`][] invalidates the modules that were loaded
+from the mount point: a subsequent `require()` or `import` of a path
+under a re-created mount re-reads the file from the newly mounted
+VFS rather than returning a stale module. Modules loaded from other
+VFS instances or from the real file system are unaffected.
+
+Mounting and unmounting do not stop any module execution that is
+already started, or invalidate any objects materialized from VFS
+modules that are already executed. As with modules in the real file
+system, the callers are responsible for avoiding removal or
+invalidation of modules in the virtual file system while they are
+being loaded.
+
+Native addons (`.node` files) stored in a mounted VFS can be `require()`d as
+well. The operating system's dynamic loader cannot open a virtual path, so the
+addon's bytes are read from the VFS and loaded from a private, self-cleaning
+temporary image instead. Addons on the real file system are unaffected and
+load directly.
+
+## Use with Single Executable Applications
+
+When running as a [Single Executable Application][] built with
+`"useVfs": true` in the SEA configuration, the bundled assets are
+automatically mounted as a read-only virtual file system and the injected
+main script is executed from the root of the mount. No additional setup is
+required. Since the mount point is reserved and chosen at runtime, bundled
+code accesses the assets through `__dirname`-relative paths and relative
+`require()` calls rather than through a fixed path:
+
+```cjs
+// In the SEA main script, __dirname is the root of the mounted assets.
+const fs = require('node:fs');
+const path = require('node:path');
+
+const config = JSON.parse(
+  fs.readFileSync(path.join(__dirname, 'config.json'), 'utf8'));
+const template = fs.readFileSync(
+  path.join(__dirname, 'templates/index.html'), 'utf8');
+```
+
+ESM entry points (`"mainFormat": "module"`) are supported: the main module
+is loaded from inside the mount through the ESM loader, and
+`import.meta.dirname` points at the mount root.
+
+`"useVfs"` cannot be used together with `"useSnapshot"` or `"useCodeCache"`.
+The SEA configuration parser will error if either combination is detected.
+
+See the [Single Executable Application][] documentation for more information
+on creating SEA builds with assets.
+
 ## Class: `VirtualProvider`
 
 <!-- YAML
@@ -302,6 +562,55 @@ added: v26.4.0
 
 The resolved absolute path used as the root.
 
+## Class: `ZipProvider`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+A provider that exposes the entries of a ZIP archive - either a
+[`zlib.ZipBuffer`][] (in memory) or a [`zlib.ZipFile`][] (on disk) - through
+the VFS API. `provider.readonly` reflects the archive's own
+[`zipFile.writable`][] flag: a `ZipBuffer` is always writable, and a
+`ZipFile` is writable only when opened with `{ writable: true }`.
+
+Directories are recognized both explicitly (an entry whose name ends in `/`)
+and implicitly (any entry name starting with `"<dir>/"`). `readdir()` does
+not support `{ recursive: true }`. Because a ZIP member cannot be edited or
+read in place - only fully written or fully decompressed - a file opened for
+writing only commits its content (as a new archive entry) when the handle is
+closed.
+
+Every method has a synchronous counterpart (`openSync()`, `statSync()`,
+`readdirSync()`, and so on), backed by the equally complete synchronous
+surface [`zlib.ZipBuffer`][]/[`zlib.ZipFile`][] expose. As with those, the
+synchronous methods here block the Node.js event loop and further JavaScript
+execution until the operation - including any deflate/inflate pass -
+completes.
+
+```cjs
+const vfs = require('node:vfs');
+const zlib = require('node:zlib');
+const { readFileSync } = require('node:fs');
+
+async function main() {
+  const zip = new zlib.ZipBuffer(readFileSync('archive.zip'));
+  const archiveVfs = vfs.create(new vfs.ZipProvider(zip));
+
+  console.log(await archiveVfs.promises.readdir('/'));
+  await archiveVfs.promises.writeFile('/new.txt', 'hello');
+}
+main();
+```
+
+### `new ZipProvider(source)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `source` {zlib.ZipBuffer|zlib.ZipFile} An already-open archive.
+
 ## Implementation details
 
 ### `Stats` objects
@@ -316,10 +625,28 @@ fields use synthetic but stable values:
 * `blocks` is `Math.ceil(size / 512)`.
 * Times default to the moment the entry was created/last modified.
 
+[CommonJS resolution algorithm]: modules.md#all-together
+[ES modules resolution algorithm]: esm.md#resolution-algorithm
+[Explicit Resource Management]: https://github.com/tc39/proposal-explicit-resource-management
+[Single Executable Application]: single-executable-applications.md
 [`MemoryProvider`]: #class-memoryprovider
 [`RealFSProvider`]: #class-realfsprovider
 [`VirtualFileSystem`]: #class-virtualfilesystem
 [`VirtualProvider`]: #class-virtualprovider
+[`ZipProvider`]: #class-zipprovider
 [`fs.BigIntStats`]: fs.md#class-fsstats
 [`fs.Stats`]: fs.md#class-fsstats
+[`import.meta.resolve()`]: esm.md#importmetaresolvespecifier
 [`node:fs`]: fs.md
+[`require()`]: modules.md#requireid
+[`require.resolve()`]: modules.md#requireresolverequest-options
+[`url.pathToFileURL()`]: url.md#urlpathtofileurlpath-options
+[`vfs.mount()`]: #vfsmount
+[`vfs.mountPointURL`]: #vfsmountpointurl
+[`vfs.mountPoint`]: #vfsmountpoint
+[`vfs.unmount()`]: #vfsunmount
+[`zipFile.writable`]: zlib.md#zipfilewritable
+[`zlib.ZipBuffer`]: zlib.md#class-zlibzipbuffer
+[`zlib.ZipFile`]: zlib.md#class-zlibzipfile
+[loading from `node_modules` folders]: modules.md#loading-from-node_modules-folders
+[the global folders]: modules.md#loading-from-the-global-folders
diff --git a/doc/changelogs/CHANGELOG_V26.md b/doc/changelogs/CHANGELOG_V26.md
index 11c30aeef58b..825c6d1e9aff 100644
--- a/doc/changelogs/CHANGELOG_V26.md
+++ b/doc/changelogs/CHANGELOG_V26.md
@@ -8,6 +8,7 @@
 </tr>
 <tr>
 <td>
+<a href="#26.9.0">26.9.0</a><br/>
 <a href="#26.8.2">26.8.2</a><br/>
 <a href="#26.8.1">26.8.1</a><br/>
 <a href="#26.8.0">26.8.0</a><br/>
@@ -53,6 +54,235 @@
   * [io.js](CHANGELOG_IOJS.md)
   * [Archive](CHANGELOG_ARCHIVE.md)
 
+<a id="26.9.0"></a>
+
+## 2026-09-16, Version 26.9.0 (Current), @aduh95
+
+### Notable Changes
+
+* \[[`d414624dce`](https://github.com/nodejs/node/commit/d414624dce)] - **(SEMVER-MINOR)** **crypto**: add a generic MAC API (Filip Skokan) [#65553](https://github.com/nodejs/node/pull/65553)
+* \[[`7ac458f802`](https://github.com/nodejs/node/commit/7ac458f802)] - **(SEMVER-MINOR)** **crypto**: discover ciphers from OpenSSL providers (Filip Skokan) [#65484](https://github.com/nodejs/node/pull/65484)
+* \[[`7c7e95a3bd`](https://github.com/nodejs/node/commit/7c7e95a3bd)] - **(SEMVER-MINOR)** **crypto**: discover hashes from OpenSSL providers (Filip Skokan) [#65484](https://github.com/nodejs/node/pull/65484)
+* \[[`2d2f4f6d1a`](https://github.com/nodejs/node/commit/2d2f4f6d1a)] - **(SEMVER-MINOR)** **ffi**: enable module by default (Matteo Collina) [#65475](https://github.com/nodejs/node/pull/65475)
+* \[[`657415c6df`](https://github.com/nodejs/node/commit/657415c6df)] - **(SEMVER-MINOR)** **lib**: implement `node:bench` (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`ebcfec2f0c`](https://github.com/nodejs/node/commit/ebcfec2f0c)] - **(SEMVER-MINOR)** **perf\_hooks**: implement Histogram `meanCI` API (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`e1913630c3`](https://github.com/nodejs/node/commit/e1913630c3)] - **(SEMVER-MINOR)** **perf\_hooks**: add CBOR export/import for histogram exchange (James M Snell) [#65434](https://github.com/nodejs/node/pull/65434)
+* \[[`8e9151c9f2`](https://github.com/nodejs/node/commit/8e9151c9f2)] - **(SEMVER-MINOR)** **src**: let embedders supply a builtin code cache without a snapshot (Shelley Vohr) [#65352](https://github.com/nodejs/node/pull/65352)
+* \[[`889854f18b`](https://github.com/nodejs/node/commit/889854f18b)] - **(SEMVER-MINOR)** **src,lib**: implement experimental DTLS API (James M Snell) [#63182](https://github.com/nodejs/node/pull/63182)
+* \[[`5198142c59`](https://github.com/nodejs/node/commit/5198142c59)] - **(SEMVER-MINOR)** **vfs**: integrate with CJS and ESM module loaders (Matteo Collina) [#63653](https://github.com/nodejs/node/pull/63653)
+* \[[`5af9d72e7f`](https://github.com/nodejs/node/commit/5af9d72e7f)] - **(SEMVER-MINOR)** **worker**: add support for Web Workers (Aviv Keller) [#64894](https://github.com/nodejs/node/pull/64894)
+
+### Commits
+
+* \[[`59dcad3f44`](https://github.com/nodejs/node/commit/59dcad3f44)] - **(SEMVER-MINOR)** **benchmark**: implement node:bench version of bench tools (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`6bdb6dd8fa`](https://github.com/nodejs/node/commit/6bdb6dd8fa)] - **benchmark**: fix max-regressions detection in compare.js (James M Snell) [#65587](https://github.com/nodejs/node/pull/65587)
+* \[[`49d40091ba`](https://github.com/nodejs/node/commit/49d40091ba)] - **benchmark**: add --analyze option to benchmark/scatter.js (James M Snell) [#65594](https://github.com/nodejs/node/pull/65594)
+* \[[`bd40a9a19a`](https://github.com/nodejs/node/commit/bd40a9a19a)] - **benchmark**: add crypto class benchmarks (Filip Skokan) [#65518](https://github.com/nodejs/node/pull/65518)
+* \[[`6bff2238f5`](https://github.com/nodejs/node/commit/6bff2238f5)] - **buffer**: pad aligned allocations by a multiple of 8 (Lazizbek Ergashev) [#65605](https://github.com/nodejs/node/pull/65605)
+* \[[`37d12946dd`](https://github.com/nodejs/node/commit/37d12946dd)] - **buffer**: prevent abort on indexOf with lone surrogate needle (Rafael Gonzaga) [#65430](https://github.com/nodejs/node/pull/65430)
+* \[[`02f8eb3b2d`](https://github.com/nodejs/node/commit/02f8eb3b2d)] - **build**: add `--shared-perfetto` flag (Antoine du Hamel) [#65614](https://github.com/nodejs/node/pull/65614)
+* \[[`fe7032ec41`](https://github.com/nodejs/node/commit/fe7032ec41)] - **build**: enable V8 gdb/lldb plugin support (Chengzhong Wu) [#65786](https://github.com/nodejs/node/pull/65786)
+* \[[`109f2caf80`](https://github.com/nodejs/node/commit/109f2caf80)] - **build**: allow linking shared dependencies in the GN build (Shelley Vohr) [#65797](https://github.com/nodejs/node/pull/65797)
+* \[[`55213fd8a8`](https://github.com/nodejs/node/commit/55213fd8a8)] - **build**: enable the V8 sandbox in shared-cage builds (Shelley Vohr) [#62237](https://github.com/nodejs/node/pull/62237)
+* \[[`120929a1b3`](https://github.com/nodejs/node/commit/120929a1b3)] - **build**: add `--shared-highway` configure flag (Antoine du Hamel) [#65686](https://github.com/nodejs/node/pull/65686)
+* \[[`c99af0942b`](https://github.com/nodejs/node/commit/c99af0942b)] - **build**: add `--shared-abseil` configure flag (Antoine du Hamel) [#65682](https://github.com/nodejs/node/pull/65682)
+* \[[`431c2bf0eb`](https://github.com/nodejs/node/commit/431c2bf0eb)] - **build**: define V8\_CONTIGUOUS\_COMPRESSED\_RO\_SPACE for shared cage (Shelley Vohr) [#65464](https://github.com/nodejs/node/pull/65464)
+* \[[`b6b5764c6e`](https://github.com/nodejs/node/commit/b6b5764c6e)] - **build**: remove obsolete configure flags (Chengzhong Wu) [#65456](https://github.com/nodejs/node/pull/65456)
+* \[[`a623ee29d9`](https://github.com/nodejs/node/commit/a623ee29d9)] - **build,src**: make --use-largepages a no-op (Joyee Cheung) [#65389](https://github.com/nodejs/node/pull/65389)
+* \[[`2f494cb7aa`](https://github.com/nodejs/node/commit/2f494cb7aa)] - **crypto**: fix multi-prime RSA JWKs (Filip Skokan) [#65649](https://github.com/nodejs/node/pull/65649)
+* \[[`501d8ac815`](https://github.com/nodejs/node/commit/501d8ac815)] - **crypto**: cache valid ECDH key pairs (Filip Skokan) [#65615](https://github.com/nodejs/node/pull/65615)
+* \[[`3fd905ea8f`](https://github.com/nodejs/node/commit/3fd905ea8f)] - **crypto**: add strict mode to --force-fips (Filip Skokan) [#65645](https://github.com/nodejs/node/pull/65645)
+* \[[`54b3cdb805`](https://github.com/nodejs/node/commit/54b3cdb805)] - **crypto**: add FIPS indicator diagnostics channel (Filip Skokan) [#65645](https://github.com/nodejs/node/pull/65645)
+* \[[`3e6e931fc9`](https://github.com/nodejs/node/commit/3e6e931fc9)] - **crypto**: fix public PKCS8 export error (한국) [#65609](https://github.com/nodejs/node/pull/65609)
+* \[[`d414624dce`](https://github.com/nodejs/node/commit/d414624dce)] - **(SEMVER-MINOR)** **crypto**: add a generic MAC API (Filip Skokan) [#65553](https://github.com/nodejs/node/pull/65553)
+* \[[`eef579047c`](https://github.com/nodejs/node/commit/eef579047c)] - **crypto**: validate JWK usages before key\_ops (Filip Skokan) [#65550](https://github.com/nodejs/node/pull/65550)
+* \[[`9a9b137a24`](https://github.com/nodejs/node/commit/9a9b137a24)] - **crypto**: fix private SPKI export error (Filip Skokan) [#65550](https://github.com/nodejs/node/pull/65550)
+* \[[`9941fb5dab`](https://github.com/nodejs/node/commit/9941fb5dab)] - **crypto**: fix RSA-PSS oversized salt handling (Filip Skokan) [#65550](https://github.com/nodejs/node/pull/65550)
+* \[[`09b431596a`](https://github.com/nodejs/node/commit/09b431596a)] - **crypto**: correct CCM decryption FIPS error message (kyungrae) [#65450](https://github.com/nodejs/node/pull/65450)
+* \[[`e6b34e6f7a`](https://github.com/nodejs/node/commit/e6b34e6f7a)] - **crypto**: harden X509Certificate state (Filip Skokan) [#65518](https://github.com/nodejs/node/pull/65518)
+* \[[`a884b6ccbc`](https://github.com/nodejs/node/commit/a884b6ccbc)] - **crypto**: optimize key slot caching (Filip Skokan) [#65518](https://github.com/nodejs/node/pull/65518)
+* \[[`fb512086d3`](https://github.com/nodejs/node/commit/fb512086d3)] - **crypto**: add null checks for OPENSSL\_INIT\_new() (Nora Dossche) [#63457](https://github.com/nodejs/node/pull/63457)
+* \[[`656504ffc0`](https://github.com/nodejs/node/commit/656504ffc0)] - **crypto**: prevent Hmac.digest() from returning uninitialized memory (Matteo Collina) [#65112](https://github.com/nodejs/node/pull/65112)
+* \[[`15e7884732`](https://github.com/nodejs/node/commit/15e7884732)] - **crypto**: avoid throwing CryptoKey brand checks (Filip Skokan) [#65503](https://github.com/nodejs/node/pull/65503)
+* \[[`3302bec74a`](https://github.com/nodejs/node/commit/3302bec74a)] - **crypto**: avoid throwing KeyObject brand checks (Filip Skokan) [#65503](https://github.com/nodejs/node/pull/65503)
+* \[[`7ac458f802`](https://github.com/nodejs/node/commit/7ac458f802)] - **(SEMVER-MINOR)** **crypto**: discover ciphers from OpenSSL providers (Filip Skokan) [#65484](https://github.com/nodejs/node/pull/65484)
+* \[[`7c7e95a3bd`](https://github.com/nodejs/node/commit/7c7e95a3bd)] - **(SEMVER-MINOR)** **crypto**: discover hashes from OpenSSL providers (Filip Skokan) [#65484](https://github.com/nodejs/node/pull/65484)
+* \[[`0539e90110`](https://github.com/nodejs/node/commit/0539e90110)] - **deps**: update googletest to 283c17563fe7a1111cd7f581aa5d541e8baeff2f (Node.js GitHub Bot) [#65833](https://github.com/nodejs/node/pull/65833)
+* \[[`e34af820da`](https://github.com/nodejs/node/commit/e34af820da)] - **deps**: update simdjson to 4.6.11 (Node.js GitHub Bot) [#65834](https://github.com/nodejs/node/pull/65834)
+* \[[`5fb7ffebc2`](https://github.com/nodejs/node/commit/5fb7ffebc2)] - **deps**: update zlib to 1.3.2.1-motley-285e94b (Node.js GitHub Bot) [#65835](https://github.com/nodejs/node/pull/65835)
+* \[[`05cdf1db62`](https://github.com/nodejs/node/commit/05cdf1db62)] - **deps**: V8: backport 1a0089053443 (Jakob Linke) [#65764](https://github.com/nodejs/node/pull/65764)
+* \[[`8910f7914a`](https://github.com/nodejs/node/commit/8910f7914a)] - **deps**: V8: backport c9c0abfa51f0 (Jakob Linke) [#65764](https://github.com/nodejs/node/pull/65764)
+* \[[`e7fd388424`](https://github.com/nodejs/node/commit/e7fd388424)] - **deps**: V8: backport ebd15783b7ba (Marja Hölttä) [#65764](https://github.com/nodejs/node/pull/65764)
+* \[[`82715158b8`](https://github.com/nodejs/node/commit/82715158b8)] - **deps**: V8: backport f3d4d458fe59 (Olivier Flückiger) [#65702](https://github.com/nodejs/node/pull/65702)
+* \[[`7003159885`](https://github.com/nodejs/node/commit/7003159885)] - **diagnostics\_channel**: lazily create tracing context (Romain Lanz) [#65513](https://github.com/nodejs/node/pull/65513)
+* \[[`a97def782f`](https://github.com/nodejs/node/commit/a97def782f)] - **doc**: clarify node:bench significance policy (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`c74091647d`](https://github.com/nodejs/node/commit/c74091647d)] - **doc**: clarify isolation modes for node:bench (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`3ef81a676c`](https://github.com/nodejs/node/commit/3ef81a676c)] - **doc**: clarify measurement integrity details of node:bench (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`6b565d7b2c`](https://github.com/nodejs/node/commit/6b565d7b2c)] - **doc**: clarify security triage dispositions and permission boundaries (Rafael Gonzaga) [#65436](https://github.com/nodejs/node/pull/65436)
+* \[[`724981287c`](https://github.com/nodejs/node/commit/724981287c)] - **(SEMVER-MINOR)** **doc**: move histogram.burnRate to correct location in doc (James M Snell) [#65434](https://github.com/nodejs/node/pull/65434)
+* \[[`f8b627c09b`](https://github.com/nodejs/node/commit/f8b627c09b)] - **doc**: fix default limit of maxHeadersCount (Aryn H) [#65472](https://github.com/nodejs/node/pull/65472)
+* \[[`aa3d94fc1d`](https://github.com/nodejs/node/commit/aa3d94fc1d)] - **doc**: fix return types for sync methods (Chiang Fong Lee) [#58575](https://github.com/nodejs/node/pull/58575)
+* \[[`fe9f452ddd`](https://github.com/nodejs/node/commit/fe9f452ddd)] - **doc**: document REPL DEP0185 throws and uncaught-exception behavior (Adrián Estrada) [#64993](https://github.com/nodejs/node/pull/64993)
+* \[[`6b84ee66fa`](https://github.com/nodejs/node/commit/6b84ee66fa)] - **errors**: validate constructor name (Christian Aurich) [#65607](https://github.com/nodejs/node/pull/65607)
+* \[[`ed1b629901`](https://github.com/nodejs/node/commit/ed1b629901)] - **events**: fix weak listener retention overwrite (Aryan) [#64024](https://github.com/nodejs/node/pull/64024)
+* \[[`7b4c17f723`](https://github.com/nodejs/node/commit/7b4c17f723)] - **ffi**: throw on missing memory helper arguments (Soul Lee) [#65500](https://github.com/nodejs/node/pull/65500)
+* \[[`cf78d4260e`](https://github.com/nodejs/node/commit/cf78d4260e)] - **ffi**: include SharedArrayBuffer in error message (Donghoon Kang) [#65735](https://github.com/nodejs/node/pull/65735)
+* \[[`2d2f4f6d1a`](https://github.com/nodejs/node/commit/2d2f4f6d1a)] - **(SEMVER-MINOR)** **ffi**: enable module by default (Matteo Collina) [#65475](https://github.com/nodejs/node/pull/65475)
+* \[[`bdcb6def4e`](https://github.com/nodejs/node/commit/bdcb6def4e)] - **ffi**: validate DynamicLibrary getter receivers (Trivikram Kamat) [#65415](https://github.com/nodejs/node/pull/65415)
+* \[[`5d24a8fe37`](https://github.com/nodejs/node/commit/5d24a8fe37)] - **fs**: copy directory trees for fs.cp() on the thread pool (Shelley Vohr) [#65488](https://github.com/nodejs/node/pull/65488)
+* \[[`40bdf32d91`](https://github.com/nodejs/node/commit/40bdf32d91)] - **fs**: give directories created by cpSync the source directory's mode (Shelley Vohr) [#65488](https://github.com/nodejs/node/pull/65488)
+* \[[`6ac1bc040f`](https://github.com/nodejs/node/commit/6ac1bc040f)] - **fs**: write files in one thread pool round trip (Shelley Vohr) [#65489](https://github.com/nodejs/node/pull/65489)
+* \[[`b4b89c08c1`](https://github.com/nodejs/node/commit/b4b89c08c1)] - **fs**: handle recursive watch setup races (Filip Skokan) [#65699](https://github.com/nodejs/node/pull/65699)
+* \[[`54a1311d9e`](https://github.com/nodejs/node/commit/54a1311d9e)] - **fs**: apply nocase to literal glob exclude patterns (Yusuke Hayashi) [#64817](https://github.com/nodejs/node/pull/64817)
+* \[[`2130460831`](https://github.com/nodejs/node/commit/2130460831)] - **fs**: improve performance of recursive directory read (Aviv Keller) [#65524](https://github.com/nodejs/node/pull/65524)
+* \[[`ab7f4c88b7`](https://github.com/nodejs/node/commit/ab7f4c88b7)] - **fs**: do not descend into symlinks for \*\* unless following symlinks (RafaelGSS) [#65435](https://github.com/nodejs/node/pull/65435)
+* \[[`e990324e7a`](https://github.com/nodejs/node/commit/e990324e7a)] - **fs**: watch directories, not files, in recursive fs.watch fallback (Shelley Vohr) [#65486](https://github.com/nodejs/node/pull/65486)
+* \[[`b6db21972a`](https://github.com/nodejs/node/commit/b6db21972a)] - **fs**: preserve directory timestamps in cp (Abhinandan Kumar) [#65540](https://github.com/nodejs/node/pull/65540)
+* \[[`d418ca140e`](https://github.com/nodejs/node/commit/d418ca140e)] - **fs**: fix recursive watch error handling (Filip Skokan) [#65635](https://github.com/nodejs/node/pull/65635)
+* \[[`ea372bf9c9`](https://github.com/nodejs/node/commit/ea372bf9c9)] - **fs**: cancel in-flight stat on abort (Mert Can Altin) [#63142](https://github.com/nodejs/node/pull/63142)
+* \[[`458664073e`](https://github.com/nodejs/node/commit/458664073e)] - **fs**: fix rmSync error messages for non-ASCII paths (Yeaseen) [#61233](https://github.com/nodejs/node/pull/61233)
+* \[[`34b38235c3`](https://github.com/nodejs/node/commit/34b38235c3)] - **fs**: add maxDepth option to glob (Alexander Lichter) [#64003](https://github.com/nodejs/node/pull/64003)
+* \[[`e3cc0d9313`](https://github.com/nodejs/node/commit/e3cc0d9313)] - **http**: fast-forward teardown of unread messages (Matteo Collina) [#65732](https://github.com/nodejs/node/pull/65732)
+* \[[`f9175a212c`](https://github.com/nodejs/node/commit/f9175a212c)] - **http**: coalesce chunked writes during auto-corking (GetThatCookie) [#64987](https://github.com/nodejs/node/pull/64987)
+* \[[`b4a7cd3efb`](https://github.com/nodejs/node/commit/b4a7cd3efb)] - **http2**: fix write deadlock exposed by larger window sizes (Tim Perry) [#65440](https://github.com/nodejs/node/pull/65440)
+* \[[`b7e97f6cfd`](https://github.com/nodejs/node/commit/b7e97f6cfd)] - **http2**: error for incomplete reads on RST, auto-drain, deprecate aborted (Tim Perry) [#63249](https://github.com/nodejs/node/pull/63249)
+* \[[`d62989dbdf`](https://github.com/nodejs/node/commit/d62989dbdf)] - **http2**: fix async context loss when trailers carry END\_STREAM (Orgad Shaneh) [#63814](https://github.com/nodejs/node/pull/63814)
+* \[[`8aba314f87`](https://github.com/nodejs/node/commit/8aba314f87)] - **https**: limit proxy CONNECT response headers (Matteo Collina) [#64545](https://github.com/nodejs/node/pull/64545)
+* \[[`bea74e1cb5`](https://github.com/nodejs/node/commit/bea74e1cb5)] - **lib**: put node:bench behind an --experimental-bench flag (James M Snell) [#65920](https://github.com/nodejs/node/pull/65920)
+* \[[`2835523960`](https://github.com/nodejs/node/commit/2835523960)] - **lib**: fixup node:bench handling of --require option (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`aae83d87a4`](https://github.com/nodejs/node/commit/aae83d87a4)] - **lib**: improve diagnostic message support (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`ba7baed423`](https://github.com/nodejs/node/commit/ba7baed423)] - **lib**: have runFile honor permissions and accept URL/Buffer paths (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`55103db988`](https://github.com/nodejs/node/commit/55103db988)] - **lib**: add runFile api to node:bench (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`0a4c50eb76`](https://github.com/nodejs/node/commit/0a4c50eb76)] - **lib**: add context.diagnostic api to node:bench (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`476e25e864`](https://github.com/nodejs/node/commit/476e25e864)] - **lib**: add `bench:plan` event to `node:bench` (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`67cf0e556f`](https://github.com/nodejs/node/commit/67cf0e556f)] - **lib**: clarify mean in node:bench docs (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`f85f72ad42`](https://github.com/nodejs/node/commit/f85f72ad42)] - **lib**: improve node:bench stream handling (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`b32b09f56b`](https://github.com/nodejs/node/commit/b32b09f56b)] - **lib**: add runId, fileRunId, entryFile, namePath to node:bench (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`4b9b53f958`](https://github.com/nodejs/node/commit/4b9b53f958)] - **(SEMVER-MINOR)** **lib**: add `node:bench` explicit createRunner (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`d9f18171f0`](https://github.com/nodejs/node/commit/d9f18171f0)] - **(SEMVER-MINOR)** **lib**: complete the implementation of node:bench and cli (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`c39e20e9ca`](https://github.com/nodejs/node/commit/c39e20e9ca)] - **(SEMVER-MINOR)** **lib**: implement bench/reporters (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`657415c6df`](https://github.com/nodejs/node/commit/657415c6df)] - **(SEMVER-MINOR)** **lib**: implement node:bench (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`46863a7f9c`](https://github.com/nodejs/node/commit/46863a7f9c)] - **lib**: use `Float16Array` from primordials (Antoine du Hamel) [#65702](https://github.com/nodejs/node/pull/65702)
+* \[[`cbd0948138`](https://github.com/nodejs/node/commit/cbd0948138)] - **lib**: defer source map payload decoding until first use (Shelley Vohr) [#65490](https://github.com/nodejs/node/pull/65490)
+* \[[`1ddb1c8934`](https://github.com/nodejs/node/commit/1ddb1c8934)] - **lib**: optimize async context frame activation (Tim Perry) [#65519](https://github.com/nodejs/node/pull/65519)
+* \[[`02f6feef7e`](https://github.com/nodejs/node/commit/02f6feef7e)] - **lib**: use validateArray for array arguments (JunHwan Choi) [#65344](https://github.com/nodejs/node/pull/65344)
+* \[[`962795ab8c`](https://github.com/nodejs/node/commit/962795ab8c)] - **lib**: apply minor dtls cleanups (James M Snell) [#63539](https://github.com/nodejs/node/pull/63539)
+* \[[`c07b2ab8a9`](https://github.com/nodejs/node/commit/c07b2ab8a9)] - **lib,benchmark**: address multiple review issues (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`54a5e25f72`](https://github.com/nodejs/node/commit/54a5e25f72)] - **module**: derive builtinModules from enabled builtin set (Jungwon Sohn) [#65418](https://github.com/nodejs/node/pull/65418)
+* \[[`c93a90cf12`](https://github.com/nodejs/node/commit/c93a90cf12)] - **net**: fix BlockList.fromJSON for IPv4-mapped IPv6 rules (Daijiro Wachi) [#64125](https://github.com/nodejs/node/pull/64125)
+* \[[`506d23b76f`](https://github.com/nodejs/node/commit/506d23b76f)] - **net**: recognize bare IPv6 loopback addresses in isLoopback (Daijiro Wachi) [#63619](https://github.com/nodejs/node/pull/63619)
+* \[[`81cd6d7b78`](https://github.com/nodejs/node/commit/81cd6d7b78)] - **net**: improve dtls cert verification (James M Snell) [#64314](https://github.com/nodejs/node/pull/64314)
+* \[[`51d094e26b`](https://github.com/nodejs/node/commit/51d094e26b)] - **node-api**: make object property arrays const (Yilong Li) [#65621](https://github.com/nodejs/node/pull/65621)
+* \[[`875c7ecee2`](https://github.com/nodejs/node/commit/875c7ecee2)] - **node-api**: enter env context for async callbacks (Shelley Vohr) [#65406](https://github.com/nodejs/node/pull/65406)
+* \[[`ebcfec2f0c`](https://github.com/nodejs/node/commit/ebcfec2f0c)] - **(SEMVER-MINOR)** **perf\_hooks**: implement Histogram meanCI API (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`09b333bcc5`](https://github.com/nodejs/node/commit/09b333bcc5)] - **perf\_hooks**: add missing resource timing attributes (greenhead) [#65017](https://github.com/nodejs/node/pull/65017)
+* \[[`e1913630c3`](https://github.com/nodejs/node/commit/e1913630c3)] - **(SEMVER-MINOR)** **perf\_hooks**: add CBOR export/import for histogram exchange (James M Snell) [#65434](https://github.com/nodejs/node/pull/65434)
+* \[[`67a78317dd`](https://github.com/nodejs/node/commit/67a78317dd)] - **permission**: do not enforce fs and addons in audit mode (Issac) [#65659](https://github.com/nodejs/node/pull/65659)
+* \[[`19e69e5f72`](https://github.com/nodejs/node/commit/19e69e5f72)] - **permission**: support URL and Uint8Array as has()/drop() reference (Seungmin Nam) [#65492](https://github.com/nodejs/node/pull/65492)
+* \[[`168af4d8d7`](https://github.com/nodejs/node/commit/168af4d8d7)] - **permission**: block FileHandle fsync and fdatasync (Rafael Gonzaga) [#65431](https://github.com/nodejs/node/pull/65431)
+* \[[`855fff682f`](https://github.com/nodejs/node/commit/855fff682f)] - **quic**: stop guarding ngtcp2\_recv\_stop\_sending callback field (René) [#65688](https://github.com/nodejs/node/pull/65688)
+* \[[`d30df2a3e1`](https://github.com/nodejs/node/commit/d30df2a3e1)] - **quic**: reuse TLS pause machinery to drop event deferral & improve 0RTT (Tim Perry) [#65522](https://github.com/nodejs/node/pull/65522)
+* \[[`fce1b6a482`](https://github.com/nodejs/node/commit/fce1b6a482)] - **quic**: remove unused fin flag from blob reader wakeup (trivenay) [#65315](https://github.com/nodejs/node/pull/65315)
+* \[[`c721aabfb7`](https://github.com/nodejs/node/commit/c721aabfb7)] - **quic**: apply multiple fixes to flow control signaling (James M Snell) [#65309](https://github.com/nodejs/node/pull/65309)
+* \[[`2c552cd32c`](https://github.com/nodejs/node/commit/2c552cd32c)] - **quic**: release stream arenas before cleanup (Trivikram Kamat) [#65410](https://github.com/nodejs/node/pull/65410)
+* \[[`487662717b`](https://github.com/nodejs/node/commit/487662717b)] - **sea**: mount bundled assets as a virtual file system (Matteo Collina) [#65675](https://github.com/nodejs/node/pull/65675)
+* \[[`0ec15a2a54`](https://github.com/nodejs/node/commit/0ec15a2a54)] - **sea**: keep ELF segments on separate pages in --build-sea output (Shelley Vohr) [#65564](https://github.com/nodejs/node/pull/65564)
+* \[[`1627fd6561`](https://github.com/nodejs/node/commit/1627fd6561)] - **sqlite**: re-validate database state after reading options (Trevor Burnham) [#65595](https://github.com/nodejs/node/pull/65595)
+* \[[`18c3867d19`](https://github.com/nodejs/node/commit/18c3867d19)] - **sqlite**: run backup completion in callback scope (Filip Skokan) [#65666](https://github.com/nodejs/node/pull/65666)
+* \[[`a77d738683`](https://github.com/nodejs/node/commit/a77d738683)] - **sqlite**: copy changeset before applying it (Matteo Collina) [#65286](https://github.com/nodejs/node/pull/65286)
+* \[[`b5f0558c84`](https://github.com/nodejs/node/commit/b5f0558c84)] - **sqlite**: reject closing a session from a callback (Trevor Burnham) [#65454](https://github.com/nodejs/node/pull/65454)
+* \[[`5f95032859`](https://github.com/nodejs/node/commit/5f95032859)] - **sqlite**: keep sessions alive across SQLite callbacks (Trevor Burnham) [#65465](https://github.com/nodejs/node/pull/65465)
+* \[[`2ce0e2eb10`](https://github.com/nodejs/node/commit/2ce0e2eb10)] - **sqlite**: throw on disposal of an in-use session (Guilherme Araújo) [#65449](https://github.com/nodejs/node/pull/65449)
+* \[[`f66ed89136`](https://github.com/nodejs/node/commit/f66ed89136)] - **src**: fix use-after-free in CleanupHookThunkRun (Caleb Everett) [#65630](https://github.com/nodejs/node/pull/65630)
+* \[[`14613fdc3e`](https://github.com/nodejs/node/commit/14613fdc3e)] - **(SEMVER-MINOR)** **src**: fixup histogram and options linting issues (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`6db3f662cf`](https://github.com/nodejs/node/commit/6db3f662cf)] - **src**: fix startup snapshot reproducibility of InternalFieldInfo (Chengzhong Wu) [#65684](https://github.com/nodejs/node/pull/65684)
+* \[[`8e9151c9f2`](https://github.com/nodejs/node/commit/8e9151c9f2)] - **(SEMVER-MINOR)** **src**: let embedders supply a builtin code cache without a snapshot (Shelley Vohr) [#65352](https://github.com/nodejs/node/pull/65352)
+* \[[`760337aa5b`](https://github.com/nodejs/node/commit/760337aa5b)] - **src**: fix live lock between environments with blocked requests (Ilyas Shabi) [#65520](https://github.com/nodejs/node/pull/65520)
+* \[[`f2a588c385`](https://github.com/nodejs/node/commit/f2a588c385)] - **src**: apply IsolateSettings when using a snapshot (Shelley Vohr) [#65407](https://github.com/nodejs/node/pull/65407)
+* \[[`2fd50ae915`](https://github.com/nodejs/node/commit/2fd50ae915)] - **src**: add re-entrancy guard to TriggerUncaughtException (Temuulen Undrakhbayar) [#64327](https://github.com/nodejs/node/pull/64327)
+* \[[`e260fd146c`](https://github.com/nodejs/node/commit/e260fd146c)] - **src**: reuse cached strings in CompileSerializeMain (agape1225) [#65453](https://github.com/nodejs/node/pull/65453)
+* \[[`0650dca863`](https://github.com/nodejs/node/commit/0650dca863)] - **src**: add missing vector include (Filip Skokan) [#65622](https://github.com/nodejs/node/pull/65622)
+* \[[`6e9d44d1fe`](https://github.com/nodejs/node/commit/6e9d44d1fe)] - **src**: disable V8 external memory reasonable size check (Paul Bouchon) [#65589](https://github.com/nodejs/node/pull/65589)
+* \[[`9c46e56303`](https://github.com/nodejs/node/commit/9c46e56303)] - **src**: report libuv error when openAsBlob cannot stat (Paul Bouchon) [#65517](https://github.com/nodejs/node/pull/65517)
+* \[[`a0aaff6b07`](https://github.com/nodejs/node/commit/a0aaff6b07)] - **src**: list scripts when `--run` has no command (James Ross) [#64606](https://github.com/nodejs/node/pull/64606)
+* \[[`469590c155`](https://github.com/nodejs/node/commit/469590c155)] - **src**: fixup manual new/delete usages (James M Snell) [#65348](https://github.com/nodejs/node/pull/65348)
+* \[[`5902acf031`](https://github.com/nodejs/node/commit/5902acf031)] - **src**: make the options structs smaller with packed bits (James M Snell) [#65145](https://github.com/nodejs/node/pull/65145)
+* \[[`0c24639a5a`](https://github.com/nodejs/node/commit/0c24639a5a)] - **(SEMVER-MINOR)** **src, lib**: add stats to dtls (James M Snell) [#63182](https://github.com/nodejs/node/pull/63182)
+* \[[`652fbc286e`](https://github.com/nodejs/node/commit/652fbc286e)] - **(SEMVER-MINOR)** **src,lib**: add dtls interop tests (James M Snell) [#63182](https://github.com/nodejs/node/pull/63182)
+* \[[`889854f18b`](https://github.com/nodejs/node/commit/889854f18b)] - **(SEMVER-MINOR)** **src,lib**: implement experimental DTLS API (James M Snell) [#63182](https://github.com/nodejs/node/pull/63182)
+* \[[`76538d519c`](https://github.com/nodejs/node/commit/76538d519c)] - **stream**: use webidl validation semantics for args (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`649a4aba93`](https://github.com/nodejs/node/commit/649a4aba93)] - **stream**: ensure that stateful transforms preserve this (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`23220992c0`](https://github.com/nodejs/node/commit/23220992c0)] - **stream**: fix nested async flushing with infinite sources (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`3ad1338139`](https://github.com/nodejs/node/commit/3ad1338139)] - **stream**: ensure from() observes returned rejecting promise correctly (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`cafdee6369`](https://github.com/nodejs/node/commit/cafdee6369)] - **stream**: apply source normalization once at call time (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`edb83cb620`](https://github.com/nodejs/node/commit/edb83cb620)] - **stream**: make consumer signals on longer alter source precedence (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`56bdd765df`](https://github.com/nodejs/node/commit/56bdd765df)] - **stream**: make pipeTo source normalization independent of Writer (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`037c07af2b`](https://github.com/nodejs/node/commit/037c07af2b)] - **stream**: pre-aborted pipeTo now applies dest failure handling (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`7308492d48`](https://github.com/nodejs/node/commit/7308492d48)] - **stream**: ensure pre-existing writes drain before EOF and end() waits (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`756773477b`](https://github.com/nodejs/node/commit/756773477b)] - **stream**: ensure async dispoal after endSync awaits for drain (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`042b951312`](https://github.com/nodejs/node/commit/042b951312)] - **stream**: ensure factory signals remain active through closing (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`2dc09ca9ca`](https://github.com/nodejs/node/commit/2dc09ca9ca)] - **stream**: canWrite and ondrain now reflect physical capacity (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`9192fbb6dd`](https://github.com/nodejs/node/commit/9192fbb6dd)] - **stream**: skip unobserved 'readable' emission at EOF (Matteo Collina) [#65749](https://github.com/nodejs/node/pull/65749)
+* \[[`dc25a61e7a`](https://github.com/nodejs/node/commit/dc25a61e7a)] - **stream**: avoid per-chunk promises in webstream adapters (Matteo Collina) [#65548](https://github.com/nodejs/node/pull/65548)
+* \[[`82ae196af6`](https://github.com/nodejs/node/commit/82ae196af6)] - **stream**: address stream/iter review feedback (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`3b37b48592`](https://github.com/nodejs/node/commit/3b37b48592)] - **stream**: replace object sentinel with symbol (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`b6424b6612`](https://github.com/nodejs/node/commit/b6424b6612)] - **stream**: ensure pipeToSync requires synchronous close (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`830fc81acf`](https://github.com/nodejs/node/commit/830fc81acf)] - **stream**: cancel active stream/iter pulls (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`30606908de`](https://github.com/nodejs/node/commit/30606908de)] - **stream**: fix merge settlement tagging and falsy error tracking (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`7319198755`](https://github.com/nodejs/node/commit/7319198755)] - **stream**: ensure full-close semantics when closed (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`bf5acb783f`](https://github.com/nodejs/node/commit/bf5acb783f)] - **stream**: defend against re-entrancy in writev (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`b01594f93a`](https://github.com/nodejs/node/commit/b01594f93a)] - **stream**: ensure stability of stored metadata (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`7bfd81ab09`](https://github.com/nodejs/node/commit/7bfd81ab09)] - **stream**: fixup writer to terminate on consumer return/throw (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`dc2483c38d`](https://github.com/nodejs/node/commit/dc2483c38d)] - **stream**: ensure iterator cleanup on done, reject, etc (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`f6fac6f7f0`](https://github.com/nodejs/node/commit/f6fac6f7f0)] - **stream**: fixup cancelation handling in pull() (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`dfe0617e71`](https://github.com/nodejs/node/commit/dfe0617e71)] - **stream**: fix early drain after Utf8Stream reopen (Matteo Collina) [#65633](https://github.com/nodejs/node/pull/65633)
+* \[[`900fae0a24`](https://github.com/nodejs/node/commit/900fae0a24)] - **test**: split test-bench-cli to try deflaking it (James M Snell) [#65919](https://github.com/nodejs/node/pull/65919)
+* \[[`31f4bd73b2`](https://github.com/nodejs/node/commit/31f4bd73b2)] - **test**: make node:bench test samples survive a coarse clock (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`e0fa1893c3`](https://github.com/nodejs/node/commit/e0fa1893c3)] - **test**: do not dump core in external memory limit test (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`00ad283b8d`](https://github.com/nodejs/node/commit/00ad283b8d)] - **test**: zero-fill buffers before the string length limit check (Christian Aurich) [#65755](https://github.com/nodejs/node/pull/65755)
+* \[[`70763fcc46`](https://github.com/nodejs/node/commit/70763fcc46)] - **test**: expand test coverage of node:bench (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`5a38e6b115`](https://github.com/nodejs/node/commit/5a38e6b115)] - **(SEMVER-MINOR)** **test**: fix node:bench test timing (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`536ae0e24b`](https://github.com/nodejs/node/commit/536ae0e24b)] - **(SEMVER-MINOR)** **test**: improve node:bench test coverage (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`eec66d529c`](https://github.com/nodejs/node/commit/eec66d529c)] - **(SEMVER-MINOR)** **test**: update bench tests to not fail on no-crypto (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`ce7b349de5`](https://github.com/nodejs/node/commit/ce7b349de5)] - **test**: bump WPT webidl and interfaces (Filip Skokan) [#65679](https://github.com/nodejs/node/pull/65679)
+* \[[`ec96f8dc23`](https://github.com/nodejs/node/commit/ec96f8dc23)] - **test**: update WPT for url to c23755a144 (Node.js GitHub Bot) [#65651](https://github.com/nodejs/node/pull/65651)
+* \[[`ebe2ac248b`](https://github.com/nodejs/node/commit/ebe2ac248b)] - **test**: fix recursive fs.watch error fixture (Filip Skokan) [#65683](https://github.com/nodejs/node/pull/65683)
+* \[[`a19912ee8f`](https://github.com/nodejs/node/commit/a19912ee8f)] - **test**: update streams WPT (Jeong SeokChan) [#65638](https://github.com/nodejs/node/pull/65638)
+* \[[`14b5dfc63d`](https://github.com/nodejs/node/commit/14b5dfc63d)] - **test**: remove `console.log` call in `node_run_list` (Antoine du Hamel) [#65572](https://github.com/nodejs/node/pull/65572)
+* \[[`3f67df139c`](https://github.com/nodejs/node/commit/3f67df139c)] - **test**: expect node:ffi to be enabled by default (Matteo Collina) [#65636](https://github.com/nodejs/node/pull/65636)
+* \[[`b9ee2e67bf`](https://github.com/nodejs/node/commit/b9ee2e67bf)] - **(SEMVER-MINOR)** **test**: use native builder for legacy SEA tests (Filip Skokan) [#65553](https://github.com/nodejs/node/pull/65553)
+* \[[`53a29d0894`](https://github.com/nodejs/node/commit/53a29d0894)] - **test**: use common spawnSync helpers in more tests (greenhead) [#65552](https://github.com/nodejs/node/pull/65552)
+* \[[`5c680a50f4`](https://github.com/nodejs/node/commit/5c680a50f4)] - **test**: add coverage for removeEventListener boolean capture (Lazizbek Ergashev) [#65245](https://github.com/nodejs/node/pull/65245)
+* \[[`6f99474912`](https://github.com/nodejs/node/commit/6f99474912)] - **test**: deflake fastutf8stream destroy and reopen tests (Christian Aurich) [#65554](https://github.com/nodejs/node/pull/65554)
+* \[[`2342b2bf30`](https://github.com/nodejs/node/commit/2342b2bf30)] - **test**: cover Readable.from() sync iterator errors (jakecastelli) [#65515](https://github.com/nodejs/node/pull/65515)
+* \[[`1e455a4ffe`](https://github.com/nodejs/node/commit/1e455a4ffe)] - **test**: support inspecting WPTs in child processes (Filip Skokan) [#65510](https://github.com/nodejs/node/pull/65510)
+* \[[`1f7cab588e`](https://github.com/nodejs/node/commit/1f7cab588e)] - **test**: document WPT runner workflows (Filip Skokan) [#65510](https://github.com/nodejs/node/pull/65510)
+* \[[`d39a902cec`](https://github.com/nodejs/node/commit/d39a902cec)] - **test**: simplify test-worker-heap-profile.js (Donghoon Kang) [#65372](https://github.com/nodejs/node/pull/65372)
+* \[[`90d1b863f7`](https://github.com/nodejs/node/commit/90d1b863f7)] - **test**: keep WPT backend checks alive (Filip Skokan) [#65320](https://github.com/nodejs/node/pull/65320)
+* \[[`be60c34b52`](https://github.com/nodejs/node/commit/be60c34b52)] - **(SEMVER-MINOR)** **test**: enable multi-global WPTs (Filip Skokan) [#64894](https://github.com/nodejs/node/pull/64894)
+* \[[`d04cfcda8e`](https://github.com/nodejs/node/commit/d04cfcda8e)] - **(SEMVER-MINOR)** **test**: add opt-in process WPT runner (Filip Skokan) [#64894](https://github.com/nodejs/node/pull/64894)
+* \[[`715c21f805`](https://github.com/nodejs/node/commit/715c21f805)] - **(SEMVER-MINOR)** **test**: accomodate multi-global tests in WPT{Runner,TestSpec,Report} (Filip Skokan) [#64894](https://github.com/nodejs/node/pull/64894)
+* \[[`9aa8489a01`](https://github.com/nodejs/node/commit/9aa8489a01)] - **test**: fix lint in dtls tests (Matteo Collina) [#64902](https://github.com/nodejs/node/pull/64902)
+* \[[`6a3d8a6d9f`](https://github.com/nodejs/node/commit/6a3d8a6d9f)] - **tls**: read the peer certificate chain without consuming it (Tony Gies) [#65602](https://github.com/nodejs/node/pull/65602)
+* \[[`2e519f8fef`](https://github.com/nodejs/node/commit/2e519f8fef)] - **tls,quic**: commonize TLS cert handling between tls, dtls & quic (Tim Perry) [#64711](https://github.com/nodejs/node/pull/64711)
+* \[[`2266c14051`](https://github.com/nodejs/node/commit/2266c14051)] - **tools**: add GHA workflow to test vendored Perfetto (Antoine du Hamel) [#65614](https://github.com/nodejs/node/pull/65614)
+* \[[`19779f121f`](https://github.com/nodejs/node/commit/19779f121f)] - **tools**: fix the list of globals in ESLint config files (Antoine du Hamel) [#65281](https://github.com/nodejs/node/pull/65281)
+* \[[`b57db8dfd3`](https://github.com/nodejs/node/commit/b57db8dfd3)] - **typings**: add types for performance binding (Jungwon Sohn) [#65574](https://github.com/nodejs/node/pull/65574)
+* \[[`371e2260f4`](https://github.com/nodejs/node/commit/371e2260f4)] - **typings**: add encodeIntoResults to EncodingBinding (greenhead) [#65350](https://github.com/nodejs/node/pull/65350)
+* \[[`417cdd8a77`](https://github.com/nodejs/node/commit/417cdd8a77)] - **typings**: add typing for permission binding (Seungmin Nam) [#65385](https://github.com/nodejs/node/pull/65385)
+* \[[`a82cc7097f`](https://github.com/nodejs/node/commit/a82cc7097f)] - **url**: align URLPatternInit dictionary conversion with WebIDL (Piyush Yadav) [#65498](https://github.com/nodejs/node/pull/65498)
+* \[[`0e8f7b96b0`](https://github.com/nodejs/node/commit/0e8f7b96b0)] - **util**: canonicalize namespaced tags in inspect() (René) [#63257](https://github.com/nodejs/node/pull/63257)
+* \[[`acd2bb10ce`](https://github.com/nodejs/node/commit/acd2bb10ce)] - **v8**: add setHeapProfileNearHeapLimit (Ilyas Shabi) [#64676](https://github.com/nodejs/node/pull/64676)
+* \[[`d0535b1041`](https://github.com/nodejs/node/commit/d0535b1041)] - **vfs**: load native addons from a mounted file system (Philipp Dunkel) [#65680](https://github.com/nodejs/node/pull/65680)
+* \[[`ea6f70ba41`](https://github.com/nodejs/node/commit/ea6f70ba41)] - **vfs**: fix rename over non-empty directory (Christian Aurich) [#65613](https://github.com/nodejs/node/pull/65613)
+* \[[`b4f6b3798a`](https://github.com/nodejs/node/commit/b4f6b3798a)] - **vfs**: add ZipProvider (Philipp Dunkel) [#64915](https://github.com/nodejs/node/pull/64915)
+* \[[`5198142c59`](https://github.com/nodejs/node/commit/5198142c59)] - **(SEMVER-MINOR)** **vfs**: integrate with CJS and ESM module loaders (Matteo Collina) [#63653](https://github.com/nodejs/node/pull/63653)
+* \[[`38192126e2`](https://github.com/nodejs/node/commit/38192126e2)] - **worker**: start worker threads from the built-in snapshot (Shelley Vohr) [#65336](https://github.com/nodejs/node/pull/65336)
+* \[[`56144ea80a`](https://github.com/nodejs/node/commit/56144ea80a)] - **worker**: add ref/unref to web workers (Aviv Keller) [#65507](https://github.com/nodejs/node/pull/65507)
+* \[[`7231c13b8a`](https://github.com/nodejs/node/commit/7231c13b8a)] - **(SEMVER-MINOR)** **worker**: add wpt tests for Web Workers (Aviv Keller) [#64894](https://github.com/nodejs/node/pull/64894)
+* \[[`5af9d72e7f`](https://github.com/nodejs/node/commit/5af9d72e7f)] - **(SEMVER-MINOR)** **worker**: add support for Web Workers (Aviv Keller) [#64894](https://github.com/nodejs/node/pull/64894)
+* \[[`069a1b1200`](https://github.com/nodejs/node/commit/069a1b1200)] - **zlib**: avoid waiting for paused ZIP iterators (Trivikram Kamat) [#65278](https://github.com/nodejs/node/pull/65278)
+
 <a id="26.8.2"></a>
 
 ## 2026-09-09, Version 26.8.2 (Current), @aduh95
diff --git a/doc/contributing/writing-and-running-benchmarks.md b/doc/contributing/writing-and-running-benchmarks.md
index a31e0e82aabc..a4c8e20244cd 100644
--- a/doc/contributing/writing-and-running-benchmarks.md
+++ b/doc/contributing/writing-and-running-benchmarks.md
@@ -17,6 +17,7 @@
     * [Using `--analyze` (no external tools needed)](#using---analyze-no-external-tools-needed)
     * [Using R scripts or node-benchmark-compare](#using-r-scripts-or-node-benchmark-compare)
   * [Comparing parameters](#comparing-parameters)
+  * [Evaluating `node:bench` ports](#evaluating-nodebench-ports)
   * [Running benchmarks on the CI](#running-benchmarks-on-the-ci)
 * [Creating a benchmark](#creating-a-benchmark)
   * [Basics of a benchmark](#basics-of-a-benchmark)
@@ -521,6 +522,124 @@ run `node benchmark/scatter.js`.
 node benchmark/scatter.js benchmark/string_decoder/string-decoder.js > scatter.csv
 ```
 
+#### Analyzing the results without R
+
+Pass `--analyze` to summarize the results directly, without generating a csv
+or installing R. It needs `--xaxis` to know which benchmark variable to
+summarize against, and takes an optional `--category` to break each point
+down by a second variable. Any remaining variable that is not constant is
+averaged over, and reported as an aggregated variable.
+
+```bash
+node benchmark/scatter.js --analyze --xaxis chunkLen --category encoding \
+    benchmark/string_decoder/string-decoder.js
+```
+
+```console
+chunkLen  encoding   samples          rate  confidence.interval        median    median.interval
+      16  'ascii'          6   2,248,111.0    61,570.3 (±2.74%)   2,241,996.7   [-3.75%, +4.47%]
+      16  'utf16le'        6   2,004,145.9    33,363.7 (±1.66%)   1,990,015.9   [-1.03%, +3.44%]
+      16  'utf8'           6   1,156,990.9    84,288.2 (±7.29%)   1,186,284.7  [-16.23%, +1.15%]  (!)
+     256  'ascii'          6  11,271,912.4   398,786.9 (±3.54%)  10,991,001.5   [-0.47%, +7.61%]
+     256  'utf16le'        6  10,243,336.8   792,495.2 (±7.74%)   9,908,838.3  [-4.73%, +17.25%]  (!)
+     256  'utf8'           6   8,247,482.7   316,510.5 (±3.84%)   8,282,009.5   [-5.80%, +3.19%]
+    1024  'ascii'          6  11,130,650.9   438,019.6 (±3.94%)  10,838,937.5   [-1.34%, +7.10%]
+    1024  'utf16le'        6   9,786,274.4   186,207.1 (±1.90%)   9,690,675.1   [-0.77%, +4.20%]
+    1024  'utf8'           6   8,479,690.1   405,762.8 (±4.79%)   8,525,516.7   [-9.01%, +4.06%]  (!)
+
+Rate in operations/second; longer is faster. │ marks the mean and the
+shaded band (░) is its 95% confidence interval, so bars whose bands
+overlap are not clearly different.
+
+                                  0                           11,670,699.3
+                                  +--------------------------------------+
+chunkLen=16 encoding='ascii'      ███████│                                   2,248,111.0
+chunkLen=16 encoding='utf16le'    ██████│                                    2,004,145.9
+chunkLen=16 encoding='utf8'       ███│                                       1,156,990.9
+
+chunkLen=256 encoding='ascii'     █████████████████████████████████████░│░  11,271,912.4
+chunkLen=256 encoding='utf16le'   ████████████████████████████████░░░│░░    10,243,336.8
+chunkLen=256 encoding='utf8'      ███████████████████████████░│              8,247,482.7
+
+chunkLen=1024 encoding='ascii'    █████████████████████████████████████░│░  11,130,650.9
+chunkLen=1024 encoding='utf16le'  █████████████████████████████████│         9,786,274.4
+chunkLen=1024 encoding='utf8'     ████████████████████████████░│             8,479,690.1
+
+Change between consecutive chunkLen values (Mann-Whitney U, Cliff's delta):
+
+  encoding='ascii'
+    16 -> 256    +401.39%  16.0x  exponent=+0.58  p=0.0039  delta=+1.000 (large)
+    256 -> 1024    -1.25%   4.0x  exponent=-0.01  p=0.3367  delta=-0.333 (medium)
+
+  encoding='utf16le'
+    16 -> 256    +411.11%  16.0x  exponent=+0.59  p=0.0039  delta=+1.000 (large)
+    256 -> 1024    -4.46%   4.0x  exponent=-0.03  p=0.1495  delta=-0.500 (large)
+
+  encoding='utf8'
+    16 -> 256    +612.84%  16.0x  exponent=+0.71  p=0.0039  delta=+1.000 (large)
+    256 -> 1024    +2.82%   4.0x  exponent=+0.02  p=0.2002  delta=+0.444 (medium)
+```
+
+The table gives, for each group, the mean rate with the 95% confidence
+interval of the mean, and the median with the 95% confidence interval of the
+median. The median interval is computed with the exact binomial method, which
+assumes nothing about the shape of the distribution, so it is the more
+trustworthy of the two when a benchmark is noisy.
+
+Rows marked `(!)` are exactly those cases: the median falls outside the mean's
+confidence interval, or the sample is strongly skewed. The mean is then being
+pulled by a few unusually slow or fast runs — commonly GC or JIT tiering — and
+more `--runs` will not necessarily fix it.
+
+The final section answers the question the sweep is usually asked to settle:
+whether the parameter changes the rate at all. It compares each x-axis value
+with the previous one using a [Mann-Whitney U test][] and [Cliff's delta][],
+holding the category fixed. Both are non-parametric, because a parameter sweep
+routinely changes the shape and spread of the distribution and not just its
+centre. Above, going from `chunkLen=16` to `256` is a large, unambiguous win
+for every encoding, while `256` to `1024` is negligible — the benchmark has
+already plateaued.
+
+When the x-axis is numeric, each comparison also reports how far the parameter
+moved and the resulting scaling exponent, which is the complexity question
+these sweeps are usually run to answer. Above, a 16× larger chunk yields an
+exponent near `+0.6` (strongly sublinear), and the next 4× yields `-0.01`
+(saturated). The exponent is reported per step rather than as a single fit
+across the whole sweep, because one exponent spanning a curve that changes
+regime describes neither part of it.
+
+A p-value has to be read against what the test was capable of producing. Below
+roughly six runs per group, the smallest p-value the Mann-Whitney test can
+return rises above the usual thresholds — at `--runs 2` the floor is `0.1213`,
+so no comparison can reach significance no matter how large the real effect
+is. `scatter.js` computes that floor and warns when a non-significant result
+therefore carries no information.
+
+Aggregated variables are reported with the share of within-group variance they
+account for. This matters more than it sounds: running the example above
+without `--set inLen=128` reports
+
+```console
+aggregating variable: inLen (explains >99% of within-group variance)
+
+Note: inLen explains most of the spread within each group, so the intervals
+below describe that variable rather than the benchmark's own noise, and more
+--runs will not narrow them. Pin it with --set inLen=<value>, or pass as
+--category, for intervals that can be acted on.
+```
+
+and the confidence intervals widen from around ±3% to over ±50%. That spread
+is a genuine effect of the averaged-over variable, not sampling noise, so
+increasing `--runs` cannot reduce it.
+
+Long or non-printable variable values are abbreviated in the output and listed
+in full under `Abbreviated values:` at the end.
+
+Pass `--no-chart` to omit the bar chart, and `--no-progress` to suppress the
+progress indicator.
+
+#### Analyzing the results with R
+
 After generating the csv, a comparison table can be created using the
 `scatter.R` tool. Even more useful it creates an actual scatter plot when using
 the `--plot filename` option.
@@ -561,7 +680,7 @@ afterwards using tools such as `sed` or `grep`. In the `sed` case be
 sure to keep the first line since that contains the header information.
 
 ```console
-$ cat scatter.csv | sed -E '1p;/([^,]+, ){3}128,/!d' | Rscript benchmark/scatter.R --xaxis chunkLen --category encoding --plot scatter-plot.png --log
+$ cat scatter.csv | sed -E '1p;/([^,]+,){3}128,/!d' | Rscript benchmark/scatter.R --xaxis chunkLen --category encoding --plot scatter-plot.png --log
 
 chunkLen     encoding      rate confidence.interval
       16        ascii 1302078.5            71692.27
@@ -588,6 +707,42 @@ chunkLen     encoding      rate confidence.interval
 
 ![compare tool boxplot](doc_img/scatter-plot.png)
 
+### Evaluating `node:bench` ports
+
+The experimental `compare-node-bench.js` and `scatter-node-bench.js` tools are
+parallel versions of the existing tools for explicit `node:bench` files. They
+do not modify or replace the legacy benchmark framework. Each repeated
+observation for a benchmark identity uses one measured sample from a separate
+process invocation. Configurations declared in the same file still execute
+serially in that process, unlike the legacy framework's configuration-level
+process isolation, and can share runtime state.
+
+Both parallel tools support inline analysis. `scatter-node-bench.js --analyze`
+uses the same `--xaxis`, `--category`, and `--no-chart` interface described for
+`scatter.js`. `compare-node-bench.js --analyze` performs Welch's t-test, while
+`--max-regression N` adds a corrected regression gate. The gate requires both a
+Holm-Bonferroni-adjusted one-sided p-value against the `N%` threshold below 0.05
+and a 95% confidence interval lying entirely beyond `-N%`; the point estimate
+alone cannot fail the command.
+Scatter analysis reduces aggregated configurations to one value per outer
+process and uses disjoint process sets for consecutive Mann-Whitney comparisons
+so configurations sharing a process are not treated as independent samples.
+
+Underscore-prefixed ports are kept beside selected legacy benchmarks and are
+excluded from legacy discovery. For example:
+
+```console
+./node benchmark/scatter.js --runs 30 \
+  benchmark/crypto/create-hash.js > legacy.csv
+./node benchmark/scatter-node-bench.js --runs 30 -- \
+  benchmark/crypto/_create-hash.node-bench.js > node-bench.csv
+```
+
+The port uses the legacy relative filename as its benchmark name and preserves
+the same parameter names. The two CSV files can therefore be analyzed with the
+same scripts to check whether their rate distributions and measurement units
+agree. See [`benchmark/README.md`][] for compare and scatter examples.
+
 ### Running benchmarks on the CI
 
 To see the performance impact of a pull request by running benchmarks on
@@ -769,6 +924,9 @@ Supported options keys are:
 * `benchmarker` - benchmarker to use, defaults to the first available http
   benchmarker
 
+[Cliff's delta]: https://en.wikipedia.org/wiki/Effect_size#Effect_size_for_ordinal_data
+[Mann-Whitney U test]: https://en.wikipedia.org/wiki/Mann%E2%80%93Whitney_U_test
+[`benchmark/README.md`]: ../../benchmark/README.md#nodebench-evaluation-tools
 [autocannon]: https://github.com/mcollina/autocannon
 [benchmark-ci]: https://github.com/nodejs/benchmarking/blob/HEAD/docs/core_benchmarks.md
 [git-for-windows]: https://git-scm.com/download/win
diff --git a/doc/node-config-schema.json b/doc/node-config-schema.json
index bacf0fba64ad..ef46b6e59432 100644
--- a/doc/node-config-schema.json
+++ b/doc/node-config-schema.json
@@ -45,6 +45,63 @@
         "$schema": {
           "type": "string"
         },
+        "bench": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [],
+          "properties": {
+            "bench": {
+              "type": "boolean",
+              "description": "launch benchmark runner on startup"
+            },
+            "bench-isolation": {
+              "type": "string",
+              "description": "configures the type of benchmark isolation used in the benchmark runner"
+            },
+            "bench-name-pattern": {
+              "type": "string",
+              "description": "run benchmarks whose name matches this regular expression"
+            },
+            "bench-reporter": {
+              "oneOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              ],
+              "description": "report benchmark output using the given reporter"
+            },
+            "bench-reporter-destination": {
+              "oneOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              ],
+              "description": "report the given benchmark reporter to the given destination"
+            },
+            "bench-samples": {
+              "type": "number",
+              "description": "specify the number of measured benchmark samples"
+            },
+            "bench-warmup": {
+              "type": "number",
+              "description": "specify the number of unreported benchmark warmup samples"
+            }
+          }
+        },
         "nodeOptions": {
           "additionalProperties": false,
           "required": [],
@@ -119,6 +176,52 @@
               "type": "boolean",
               "description": "Improve AsyncLocalStorage performance with AsyncContextFrame"
             },
+            "bench-isolation": {
+              "type": "string",
+              "description": "configures the type of benchmark isolation used in the benchmark runner"
+            },
+            "bench-name-pattern": {
+              "type": "string",
+              "description": "run benchmarks whose name matches this regular expression"
+            },
+            "bench-reporter": {
+              "oneOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              ],
+              "description": "report benchmark output using the given reporter"
+            },
+            "bench-reporter-destination": {
+              "oneOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              ],
+              "description": "report the given benchmark reporter to the given destination"
+            },
+            "bench-samples": {
+              "type": "number",
+              "description": "specify the number of measured benchmark samples"
+            },
+            "bench-warmup": {
+              "type": "number",
+              "description": "specify the number of unreported benchmark warmup samples"
+            },
             "conditions": {
               "oneOf": [
                 {
@@ -209,6 +312,10 @@
               "type": "boolean",
               "description": "experimental import support for addons"
             },
+            "experimental-bench": {
+              "type": "boolean",
+              "description": "experimental node:bench module and benchmark runner"
+            },
             "experimental-detect-module": {
               "type": "boolean",
               "description": "when ambiguous modules fail to evaluate because they contain ES module syntax, try again to evaluate them as ES modules"
@@ -758,7 +865,7 @@
             },
             "use-largepages": {
               "type": "string",
-              "description": "Map the Node.js static code to large pages. Options are 'off' (the default value, meaning do not map), 'on' (map and ignore failure, reporting it to stderr), or 'silent' (map and silently ignore failure)"
+              "description": "This option is no longer supported and a no-op. Options are 'off' (default), 'on' (report a warning to stderr), or 'silent' (same as 'off')."
             },
             "use-openssl-ca": {
               "type": "boolean",
diff --git a/doc/node.1 b/doc/node.1
index 96532ee48376..f91caee0d6a8 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -122,15 +122,15 @@ directly through the process arguments.
 When using the Permission Model, the process will not be able to use FFI
 APIs by default. Attempts to use FFI APIs will throw an \fBERR_ACCESS_DENIED\fR
 exception unless the user explicitly passes the \fB--allow-ffi\fR flag when
-starting Node.js. The \fBnode:ffi\fR module also requires the
-\fB--experimental-ffi\fR flag and is only available in builds with FFI support.
+starting Node.js. The \fBnode:ffi\fR module is only available in builds with
+FFI support.
 Example:
 .Bd -literal
 const { DynamicLibrary, suffix } = require('node:ffi');
 const lib = new DynamicLibrary(`./mylib.${suffix}`);
 .Ed
 .Bd -literal
-$ node --permission --experimental-ffi index.js
+$ node --permission index.js
 Error: Access to this API has been restricted. Use --allow-ffi to manage permissions.
     at node:internal/main/run_main_module:17:47 {
   code: 'ERR_ACCESS_DENIED',
@@ -166,6 +166,17 @@ process.permission.has('fs.read', 'custom-require.js'); // true
 process.permission.has('fs.read', 'custom-require-2.js'); // true
 .Ed
 .
+.It Fl -allow-fs-vfs
+When using the Permission Model, a virtual file system cannot be
+mounted by default: \fBvfs.mount()\fR throws \fBERR_INVALID_STATE\fR unless the
+user explicitly passes the \fB--allow-fs-vfs\fR flag when starting Node.js.
+A mounted VFS serves paths that the file system permissions do not describe,
+so mounting one is gated on its own flag rather than on \fB--allow-fs-read\fR or
+\fB--allow-fs-write\fR.
+.Bd -literal
+$ node --experimental-vfs --permission --allow-fs-vfs app.js
+.Ed
+.
 .It Fl -allow-fs-write
 This flag configures file system write permissions using
 the Permission Model.
@@ -281,6 +292,59 @@ Error: Access to this API has been restricted
 }
 .Ed
 .
+.It Fl -bench
+Starts the Node.js command-line benchmark runner. At least one explicit file or
+glob pattern is required:
+.Bd -literal
+node --experimental-bench --bench benchmark.mjs
+node --experimental-bench --bench 'benchmarks/**/*.js'
+.Ed
+The \fB--experimental-bench\fR flag is required to use this flag or any other
+\fB--bench-*\fR option.
+Quote glob patterns to prevent expansion by the shell. Matching files are
+sorted and executed serially. By default, each file runs in a separate child
+process. Benchmark files declare benchmarks using \fBnode:bench\fR; they must not
+call \fBrun()\fR themselves. See the benchmark runner documentation for more
+details.
+This flag cannot be combined with \fB--test\fR, \fB--watch\fR, \fB--watch-path\fR,
+\fB--check\fR, \fB--eval\fR, or \fB--interactive\fR.
+.
+.It Fl -bench-isolation Ns = Ns Ar mode
+Configures benchmark file isolation. When \fBmode\fR is \fB'process'\fR, each matching
+file runs in a separate child process. This is the default. Files are still run
+serially so their measured work does not overlap.
+When \fBmode\fR is \fB'none'\fR, all matching files and benchmarks run serially in the
+benchmark runner process. This reduces startup overhead but allows module,
+heap, and process state to carry between files. User writes to stdout or stderr
+also share destinations with benchmark reporters in this mode.
+The supported modes are \fB'process'\fR and \fB'none'\fR.
+.
+.It Fl -bench-name-pattern Ns = Ns Ar pattern
+Only runs benchmarks whose full hierarchical name matches the JavaScript
+regular expression \fBpattern\fR. Non-matching benchmarks are reported as skipped.
+.
+.It Fl -bench-reporter-destination Ns = Ns Ar destination
+Specifies the destination for the corresponding benchmark reporter. The value
+can be \fBstdout\fR, \fBstderr\fR, or a file path. A single reporter defaults to
+\fBstdout\fR when no destination is specified.
+.
+.It Fl -bench-reporter Ns = Ns Ar reporter
+Specifies a benchmark reporter. The built-in reporters are \fBspec\fR and \fBjson\fR.
+The \fBjson\fR reporter emits newline-delimited JSON. A custom reporter can be
+specified using a module specifier resolved from the current working directory.
+This option can be repeated. When multiple reporters are specified, each must
+have a corresponding \fB--bench-reporter-destination\fR. The default reporter is
+\fBspec\fR.
+.
+.It Fl -bench-samples Ns = Ns Ar count
+Overrides the maximum number of measured callback invocations for every
+selected benchmark. A benchmark may finish earlier by calling
+\fBcontext.done()\fR. \fBcount\fR must be an integer between \fB1\fR and \fB4294967295\fR.
+.
+.It Fl -bench-warmup Ns = Ns Ar count
+Overrides the number of unreported warmup callback invocations for every
+selected benchmark. \fBcount\fR must be an integer between \fB0\fR and \fB4294967295\fR.
+.
 .It Fl -build-sea Ns = Ns Ar config
 Generates a single executable application from a JSON
 configuration file. The argument must be a path to the configuration file. If
@@ -517,6 +581,12 @@ Enable FIPS mode at startup. With OpenSSL 3, a configured provider named
 \fBfips\fR must be available and initialize successfully. With OpenSSL 1.1.1,
 Node.js must be built against a FIPS-capable OpenSSL.
 .
+.It Fl -enable-fips-indicator-events
+Publish OpenSSL FIPS indicator results to the
+\fB'crypto.fips.indicator'\fR diagnostics channel. This option requires OpenSSL
+3.4 or later. It does not enable FIPS mode or change whether an operation
+is permitted.
+.
 .It Fl -enable-source-maps
 Enable Source Map support for stack traces.
 When using a transpiler, such as TypeScript, stack traces thrown by an
@@ -609,6 +679,9 @@ It is possible to run code containing inline types unless the
 .It Fl -experimental-addon-modules
 Enable experimental import support for \fB.node\fR addons.
 .
+.It Fl -experimental-bench
+Enable the experimental \fBnode:bench\fR module and command-line benchmark runner.
+.
 .It Fl -experimental-config-file Ns = Ns Ar path , Fl -experimental-config-file
 If present, Node.js will look for a configuration file at the specified path.
 If the path is not specified, Node.js will look for a \fBnode.config.json\fR file
@@ -741,13 +814,13 @@ If present, Node.js will look for a
 \fBnode.config.json\fR file in the current working directory and load it as a
 configuration file.
 .
+.It Fl -experimental-dtls
+Enable experimental support for the DTLS protocol. See the
+dtls documentation for details.
+.
 .It Fl -experimental-eventsource
 Enable exposition of EventSource Web API on the global scope.
 .
-.It Fl -experimental-ffi
-Enable the experimental \fBnode:ffi\fR module.
-This flag is only available in builds with FFI support.
-.
 .It Fl -experimental-import-meta-resolve
 Enable experimental \fBimport.meta.resolve()\fR parent URL support, which allows
 passing a second \fBparentURL\fR argument for contextual resolution.
@@ -832,15 +905,32 @@ Enable experimental ES Module support in the \fBnode:vm\fR module.
 .It Fl -experimental-wasi-unstable-preview1
 Enable experimental WebAssembly System Interface (WASI) support.
 .
+.It Fl -experimental-web-worker
+Enable experimental support for the Web Worker API.
+.
 .It Fl -experimental-worker-inspection
 Enable experimental support for the worker inspection with Chrome DevTools.
 .
 .It Fl -force-context-aware
 Disable loading native addons that are not context-aware.
 .
-.It Fl -force-fips
+.It Fl -force-fips Ns = Ns Ar [mode]
 Enable FIPS mode at startup and prevent it from being disabled from script
 code. The same OpenSSL requirements as \fB--enable-fips\fR apply.
+An optional mode can be specified using \fB--force-fips=mode\fR:
+.Bl -bullet
+.It
+\fBprovider\fR: Preserve the OpenSSL FIPS provider's configured handling of
+non-approved operations. This is the current default when the mode is
+omitted.
+.It
+\fBstrict\fR: Reject non-approved operations reported through the OpenSSL FIPS
+indicator callback. This mode requires OpenSSL 3.4 or later.
+.El
+The \fBstrict\fR mode only covers operations reported through the callback for
+OpenSSL's default library context. It does not cover native addons that use
+another \fBOSSL_LIB_CTX\fR or another copy of \fBlibcrypto\fR, nor operation-specific
+indicators that do not invoke the callback.
 .
 .It Fl -force-node-api-uncaught-exceptions-policy
 Enforces \fBuncaughtException\fR event on Node-API asynchronous callbacks.
@@ -1094,6 +1184,10 @@ Silence deprecation warnings.
 .It Fl -no-experimental-detect-module
 Disable using syntax detection to determine module type.
 .
+.It Fl -no-experimental-ffi
+Disable the experimental \fBnode:ffi\fR module.
+This flag is only available in builds with FFI support.
+.
 .It Fl -no-experimental-global-navigator
 Disable exposition of Navigator API on the global scope.
 .
@@ -1138,6 +1232,10 @@ For more information, see the TypeScript type-stripping documentation.
 .It Fl -no-warnings
 Silence all process warnings (including deprecations).
 .
+.It Fl -no-worker-snapshot
+Start worker threads by running the internal bootstrap from scratch instead of
+deserializing the bootstrapped context from the built-in startup snapshot.
+.
 .It Fl -node-memory-debug
 Enable extra debug checks for memory leaks in Node.js internals. This is
 usually only useful for developers debugging Node.js itself.
@@ -1328,6 +1426,13 @@ forked processes, or clustered processes.
 .It Fl -run
 This runs a specified command from a package.json's \fB"scripts"\fR object.
 If a missing \fB"command"\fR is provided, it will list the available scripts.
+Passing \fB--run\fR without a command lists the available scripts and exits
+with a non-zero exit code:
+.Bd -literal
+$ node --run
+Available scripts are:
+  test: node --test
+.Ed
 \fB--run\fR will traverse up to the root directory and finds a \fBpackage.json\fR
 file to run the command from.
 \fB--run\fR prepends \fB./node_modules/.bin\fR for each ancestor of
@@ -1687,19 +1792,17 @@ This is equivalent to setting the \fBNODE_USE_ENV_PROXY=1\fR environment variabl
 When both are set, \fB--use-env-proxy\fR takes precedence.
 .
 .It Fl -use-largepages Ns = Ns Ar mode
-Re-map the Node.js static code to large memory pages at startup. If supported on
-the target system, this will cause the Node.js static code to be moved onto 2
-MiB pages instead of 4 KiB pages.
-The following values are valid for \fBmode\fR:
+This option is no longer supported and a no-op. It used to re-map the Node.js
+static code to large memory pages at startup.
+It still accepts the following values for compatibility:
 .Bl -bullet
 .It
 \fBoff\fR: No mapping will be attempted. This is the default.
 .It
-\fBon\fR: If supported by the OS, mapping will be attempted. Failure to map will
-be ignored and a message will be printed to standard error.
+\fBon\fR: No mapping will be attempted and a message will be printed to
+standard error stating it's no longer supported.
 .It
-\fBsilent\fR: If supported by the OS, mapping will be attempted. Failure to map
-will be ignored and will not be reported.
+\fBsilent\fR: Same as \fBoff\fR.
 .El
 .
 .It Fl -use-system-ca
@@ -1938,6 +2041,8 @@ one is included in the list below.
 .It
 \fB--allow-fs-read\fR
 .It
+\fB--allow-fs-vfs\fR
+.It
 \fB--allow-fs-write\fR
 .It
 \fB--allow-inspector\fR
@@ -1950,6 +2055,18 @@ one is included in the list below.
 .It
 \fB--allow-worker\fR
 .It
+\fB--bench-isolation\fR
+.It
+\fB--bench-name-pattern\fR
+.It
+\fB--bench-reporter-destination\fR
+.It
+\fB--bench-reporter\fR
+.It
+\fB--bench-samples\fR
+.It
+\fB--bench-warmup\fR
+.It
 \fB--conditions\fR, \fB-C\fR
 .It
 \fB--cpu-prof-dir\fR
@@ -1972,6 +2089,8 @@ one is included in the list below.
 .It
 \fB--dns-result-order\fR
 .It
+\fB--enable-fips-indicator-events\fR
+.It
 \fB--enable-fips\fR
 .It
 \fB--enable-network-family-autoselection\fR
@@ -1984,11 +2103,13 @@ one is included in the list below.
 .It
 \fB--experimental-addon-modules\fR
 .It
+\fB--experimental-bench\fR
+.It
 \fB--experimental-detect-module\fR
 .It
-\fB--experimental-eventsource\fR
+\fB--experimental-dtls\fR
 .It
-\fB--experimental-ffi\fR
+\fB--experimental-eventsource\fR
 .It
 \fB--experimental-import-meta-resolve\fR
 .It
@@ -2024,6 +2145,8 @@ one is included in the list below.
 .It
 \fB--experimental-wasi-unstable-preview1\fR
 .It
+\fB--experimental-web-worker\fR
+.It
 \fB--force-context-aware\fR
 .It
 \fB--force-fips\fR
@@ -2078,6 +2201,8 @@ one is included in the list below.
 .It
 \fB--no-deprecation\fR
 .It
+\fB--no-experimental-ffi\fR
+.It
 \fB--no-experimental-global-navigator\fR
 .It
 \fB--no-experimental-repl-await\fR
@@ -2104,6 +2229,8 @@ one is included in the list below.
 .It
 \fB--no-webstorage\fR
 .It
+\fB--no-worker-snapshot\fR
+.It
 \fB--node-memory-debug\fR
 .It
 \fB--openssl-config\fR
diff --git a/eslint.config.mjs b/eslint.config.mjs
index 5248a5fbb616..c19e8f3cf46e 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -122,35 +122,39 @@ export default [
         ByteLengthQueuingStrategy: 'readonly',
         CompressionStream: 'readonly',
         CountQueuingStrategy: 'readonly',
-        CustomEvent: 'readonly',
         crypto: 'readonly',
         Crypto: 'readonly',
         CryptoKey: 'readonly',
+        CustomEvent: 'readonly',
         DecompressionStream: 'readonly',
         DisposableStack: 'readonly',
         EventSource: 'readonly',
         fetch: 'readonly',
         Float16Array: 'readonly',
         FormData: 'readonly',
+        localStorage: 'readonly',
         navigator: 'readonly',
         QuotaExceededError: 'readonly',
+        ReadableByteStreamController: 'readonly',
         ReadableStream: 'readonly',
-        ReadableStreamDefaultReader: 'readonly',
         ReadableStreamBYOBReader: 'readonly',
         ReadableStreamBYOBRequest: 'readonly',
-        ReadableByteStreamController: 'readonly',
         ReadableStreamDefaultController: 'readonly',
+        ReadableStreamDefaultReader: 'readonly',
         Response: 'readonly',
+        sessionStorage: 'readonly',
+        ShadowRealm: 'readonly',
+        Storage: 'readonly',
+        SubtleCrypto: 'readonly',
         TextDecoderStream: 'readonly',
         TextEncoderStream: 'readonly',
         TransformStream: 'readonly',
         TransformStreamDefaultController: 'readonly',
-        ShadowRealm: 'readonly',
-        SubtleCrypto: 'readonly',
+        WebSocket: 'readonly',
+        Worker: 'readonly',
         WritableStream: 'readonly',
-        WritableStreamDefaultWriter: 'readonly',
         WritableStreamDefaultController: 'readonly',
-        WebSocket: 'readonly',
+        WritableStreamDefaultWriter: 'readonly',
       },
     },
   },
diff --git a/lib/_http_incoming.js b/lib/_http_incoming.js
index ef149e3d4a61..13ff5b6b30fc 100644
--- a/lib/_http_incoming.js
+++ b/lib/_http_incoming.js
@@ -292,6 +292,13 @@ IncomingMessage.prototype._destroy = function _destroy(err, cb) {
       cleanup();
       process.nextTick(onError, this, e || err, cb);
     });
+  } else if (err == null && !this.aborted) {
+    // The message was received completely and is being destroyed cleanly:
+    // complete the destroy synchronously. 'close' is still emitted on a
+    // later tick by the stream machinery. The deferral below only exists
+    // so that 'error' listeners attached right after destroy(err) still
+    // receive the error, which cannot matter when there is no error.
+    cb();
   } else {
     process.nextTick(onError, this, err, cb);
   }
@@ -505,7 +512,14 @@ IncomingMessage.prototype._dump = function _dump() {
     // If there is buffered data, it may trigger 'data' events.
     // Remove 'data' event listeners explicitly.
     this.removeAllListeners('data');
-    this.resume();
+    if (this.complete && !this.destroyed && this.readableLength === 0) {
+      // The message was fully received and never read: there is nothing to
+      // pull off the wire. Go straight to the 'end' emission instead of
+      // paying for the resume() and flow() scheduling machinery.
+      this.read(0);
+    } else {
+      this.resume();
+    }
   }
 };
 
diff --git a/lib/_http_outgoing.js b/lib/_http_outgoing.js
index 23e2856e0b99..4edfc8d7af3d 100644
--- a/lib/_http_outgoing.js
+++ b/lib/_http_outgoing.js
@@ -67,6 +67,7 @@ const {
     ERR_STREAM_DESTROYED,
     ERR_STREAM_NULL_VALUES,
     ERR_STREAM_WRITE_AFTER_END,
+    ERR_UNKNOWN_ENCODING,
   },
   hideStackFrames,
 } = require('internal/errors');
@@ -223,7 +224,12 @@ ObjectDefineProperty(OutgoingMessage.prototype, 'writableObjectMode', {
 ObjectDefineProperty(OutgoingMessage.prototype, 'writableLength', {
   __proto__: null,
   get() {
-    return this.outputSize + this[kChunkedLength] + (this[kSocket] ? this[kSocket].writableLength : 0);
+    let bufferedLength = this[kChunkedLength];
+    if (bufferedLength !== 0) {
+      bufferedLength += bufferedLength.toString(16).length + 4 +
+        (!this._headerSent && this._header !== null ? this._header.length : 0);
+    }
+    return this.outputSize + bufferedLength + (this[kSocket] ? this[kSocket].writableLength : 0);
   },
 });
 
@@ -294,37 +300,45 @@ OutgoingMessage.prototype.cork = function cork() {
 
 OutgoingMessage.prototype.uncork = function uncork() {
   this[kCorked]--;
-  if (this[kSocket]) {
-    this[kSocket].uncork();
-  }
-
-  if (this[kCorked] || this[kChunkedBuffer].length === 0) {
-    return;
-  }
-
-  const len = this[kChunkedLength];
-  const buf = this[kChunkedBuffer];
+  const socket = this[kSocket];
+  try {
+    if (this[kCorked] || this[kChunkedBuffer].length === 0) {
+      return;
+    }
 
-  assert(this.chunkedEncoding);
+    const len = this[kChunkedLength];
+    const buf = this[kChunkedBuffer];
+    if (this.destroyed || socket?.destroyed) {
+      const error = this[kErrored] || socket?._writableState?.errored || new ERR_STREAM_DESTROYED('write');
+      for (let n = 2; n < buf.length; n += 3) {
+        if (buf[n] !== nop) {
+          process.nextTick(buf[n], error);
+        }
+      }
+      buf.length = 0;
+      this[kChunkedLength] = 0;
+      return;
+    }
+    assert(this.chunkedEncoding);
 
-  let callbacks;
-  this._send(len.toString(16), 'latin1', null);
-  this._send(crlf_buf, null, null);
-  for (let n = 0; n < buf.length; n += 3) {
-    this._send(buf[n + 0], buf[n + 1], null);
-    if (buf[n + 2]) {
-      callbacks ??= [];
+    const callbacks = [];
+    this._send(len.toString(16), 'latin1', null);
+    this._send(crlf_buf, null, null);
+    for (let n = 0; n < buf.length; n += 3) {
+      this._send(buf[n + 0], buf[n + 1], null);
       callbacks.push(buf[n + 2]);
     }
-  }
-  this._send(crlf_buf, null, callbacks.length ? (err) => {
-    for (const callback of callbacks) {
-      callback(err);
-    }
-  } : null);
+    this._send(crlf_buf, null, (err) => {
+      for (const callback of callbacks) {
+        callback(err);
+      }
+    });
 
-  this[kChunkedBuffer].length = 0;
-  this[kChunkedLength] = 0;
+    this[kChunkedBuffer].length = 0;
+    this[kChunkedLength] = 0;
+  } finally {
+    socket?.uncork();
+  }
 
   // If we had a pending drain and flushed all data, emit the drain event.
   if (this[kNeedDrain] && this.writableLength === 0) {
@@ -360,6 +374,10 @@ OutgoingMessage.prototype.destroy = function destroy(error) {
   this.destroyed = true;
 
   this[kErrored] = error;
+  if (this[kChunkedBuffer].length !== 0) {
+    this[kCorked] = 1;
+    this.uncork();
+  }
 
   if (this[kSocket]) {
     this[kSocket].destroy(error);
@@ -999,24 +1017,34 @@ function write_(msg, chunk, encoding, callback, fromEnd) {
     }
   }
 
+  if (msg.chunkedEncoding && typeof chunk === 'string' && encoding && !Buffer.isEncoding(encoding)) {
+    throw new ERR_UNKNOWN_ENCODING(encoding);
+  }
+
   if (!fromEnd && msg.socket && !msg.socket.writableCorked) {
-    msg.socket.cork();
-    process.nextTick(connectionCorkNT, msg.socket);
+    msg.cork();
+    process.nextTick(connectionCorkNT, msg);
   }
 
   let ret;
   if (msg.chunkedEncoding && chunk.length !== 0) {
     len ??= typeof chunk === 'string' ? Buffer.byteLength(chunk, encoding) : chunk.byteLength;
-    if (msg[kCorked] && msg._headerSent) {
+    if (msg[kCorked]) {
+      if (typeof chunk !== 'string' && !(chunk instanceof Buffer)) {
+        chunk = Stream._uint8ArrayToBuffer(chunk);
+      }
       msg[kChunkedBuffer].push(chunk, encoding, callback);
       msg[kChunkedLength] += len;
-      ret = msg[kChunkedLength] < msg[kHighWaterMark];
+      ret = msg.writableLength < msg.writableHighWaterMark;
     } else {
       msg._send(len.toString(16), 'latin1', null);
       msg._send(crlf_buf, null, null);
       msg._send(chunk, encoding, null, len);
       ret = msg._send(crlf_buf, null, callback);
     }
+  } else if (msg.chunkedEncoding && msg[kCorked] && msg[kChunkedBuffer].length !== 0) {
+    msg[kChunkedBuffer].push(chunk, encoding, callback);
+    ret = msg.writableLength < msg.writableHighWaterMark;
   } else {
     ret = msg._send(chunk, encoding, callback, len);
   }
@@ -1045,8 +1073,10 @@ function maybePrepareFinalChunk(msg, chunk, encoding) {
   return !!msg._header && msg._hasBody && !msg.chunkedEncoding;
 }
 
-function connectionCorkNT(conn) {
-  conn.uncork();
+function connectionCorkNT(msg) {
+  if (msg[kCorked]) {
+    msg.uncork();
+  }
 }
 
 OutgoingMessage.prototype.addTrailers = function addTrailers(headers) {
@@ -1197,6 +1227,13 @@ OutgoingMessage.prototype.end = function end(chunk, encoding, callback) {
     throw new ERR_HTTP_CONTENT_LENGTH_MISMATCH(this[kBytesWritten], this._contentLength);
   }
 
+  // Flush buffered chunks before terminating the response.
+  if (this[kChunkedBuffer].length !== 0) {
+    this[kSocket]?.cork();
+    this[kCorked] = 1;
+    this.uncork();
+  }
+
   if (finishCallback === null) {
     // If we didn't early finish, send the last data and schedule 'finish' now:
     finishCallback = onFinish.bind(undefined, this);
diff --git a/lib/bench.js b/lib/bench.js
new file mode 100644
index 000000000000..96e199773d90
--- /dev/null
+++ b/lib/bench.js
@@ -0,0 +1,39 @@
+'use strict';
+
+const {
+  ObjectAssign,
+} = primordials;
+
+const { emitExperimentalWarning } = require('internal/util');
+const {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  suite,
+} = require('internal/bench_runner/harness');
+const {
+  createRunner,
+  run,
+  runFile,
+} = require('internal/bench_runner/runner');
+
+if (process.env.NODE_BENCH_CONTEXT !== 'child' ||
+    typeof process.send !== 'function') {
+  emitExperimentalWarning('Benchmarks');
+}
+
+module.exports = bench;
+ObjectAssign(module.exports, {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  createRunner,
+  describe: suite,
+  run,
+  runFile,
+  suite,
+});
diff --git a/lib/bench/reporters.js b/lib/bench/reporters.js
new file mode 100644
index 000000000000..8f33b423c9ad
--- /dev/null
+++ b/lib/bench/reporters.js
@@ -0,0 +1,34 @@
+'use strict';
+
+const {
+  ObjectDefineProperties,
+  ReflectConstruct,
+} = primordials;
+const { emitExperimentalWarning } = require('internal/util');
+
+let json;
+let specFn;
+
+emitExperimentalWarning('Benchmarks');
+
+ObjectDefineProperties(module.exports, {
+  __proto__: null,
+  json: {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    get() {
+      json ??= require('internal/bench_runner/reporter/json');
+      return json;
+    },
+  },
+  spec: {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    value: function spec() {
+      specFn ??= require('internal/bench_runner/reporter/spec');
+      return ReflectConstruct(specFn, arguments);
+    },
+  },
+});
diff --git a/lib/buffer.js b/lib/buffer.js
index 19574064ad12..7b0e37239abb 100644
--- a/lib/buffer.js
+++ b/lib/buffer.js
@@ -141,6 +141,7 @@ const {
   addBufferPrototypeMethods,
   createUnsafeBuffer,
   createUnsafeAlignedBuffer,
+  alignmentPadding,
   asciiWrite,
   latin1Write,
   utf8Write,
@@ -482,9 +483,9 @@ Buffer.allocUnsafe = function allocUnsafe(size, alignment) {
  *
  * If `alignment` is given, the memory backing the returned buffer starts at an
  * address that is a multiple of `alignment`, which is required by e.g. reads
- * and writes on file descriptors opened with `O_DIRECT`. Note that up to
- * `alignment - 1` extra bytes are allocated to satisfy the request, and that
- * the returned buffer's `byteOffset` is therefore usually non-zero.
+ * and writes on file descriptors opened with `O_DIRECT`. Note that at least
+ * `alignment` extra bytes are allocated to satisfy the request, and that the
+ * returned buffer's `byteOffset` is therefore usually non-zero.
  * @param {number} size
  * @param {number} [alignment] A power of two, at most 2 ** 30
  * @returns {FastBuffer}
@@ -504,10 +505,10 @@ function validateAlignment(size, alignment) {
     throw new ERR_INVALID_ARG_VALUE(
       'alignment', alignment, 'must be a power of two');
   }
-  // Satisfying the alignment costs up to `alignment - 1` extra bytes.
-  if (size > kMaxLength - (alignment - 1)) {
+  const padding = alignmentPadding(alignment);
+  if (size > kMaxLength - padding) {
     throw new ERR_OUT_OF_RANGE(
-      'size', `<= ${kMaxLength - (alignment - 1)}`, size);
+      'size', `<= ${kMaxLength - padding}`, size);
   }
 }
 
diff --git a/lib/child_process.js b/lib/child_process.js
index 0e3e04af0d6e..887f5668e37a 100644
--- a/lib/child_process.js
+++ b/lib/child_process.js
@@ -873,8 +873,8 @@ function spawn(file, args, options) {
  * @returns {{
  *   pid: number;
  *   output: Array;
- *   stdout: Buffer | string;
- *   stderr: Buffer | string;
+ *   stdout: Buffer | string | null;
+ *   stderr: Buffer | string | null;
  *   status: number | null;
  *   signal: string | null;
  *   error: Error;
@@ -962,7 +962,7 @@ function checkExecSyncError(ret, args, cmd) {
  *   windowsHide?: boolean;
  *   shell?: boolean | string;
  *   }} [options]
- * @returns {Buffer | string}
+ * @returns {Buffer | string | null}
  */
 function execFileSync(file, args, options) {
   ({ file, args, options } = normalizeExecFileArgs(file, args, options));
@@ -1000,7 +1000,7 @@ function execFileSync(file, args, options) {
  *   encoding?: string;
  *   windowsHide?: boolean;
  *   }} [options]
- * @returns {Buffer | string}
+ * @returns {Buffer | string | null}
  */
 function execSync(command, options) {
   const opts = normalizeExecArgs(command, options, null);
diff --git a/lib/crypto.js b/lib/crypto.js
index ac4b0a33efb8..b44ae9de4e5d 100644
--- a/lib/crypto.js
+++ b/lib/crypto.js
@@ -112,6 +112,9 @@ const {
   Hmac,
   hash,
 } = require('internal/crypto/hash');
+const {
+  Mac,
+} = require('internal/crypto/provider_mac');
 const {
   X509Certificate,
 } = require('internal/crypto/x509');
@@ -119,6 +122,7 @@ const {
   getCiphers,
   getCurves,
   getHashes,
+  getMacs,
   setEngine,
   secureHeapUsed,
 } = require('internal/crypto/util');
@@ -170,6 +174,10 @@ function createHmac(hmac, key, options) {
   return new Hmac(hmac, key, options);
 }
 
+function createMac(algorithm, key, options) {
+  return new Mac(algorithm, key, options);
+}
+
 function createSign(algorithm, options) {
   return new Sign(algorithm, options);
 }
@@ -191,6 +199,7 @@ module.exports = {
   createECDH,
   createHash,
   createHmac,
+  createMac,
   createPrivateKey,
   createPublicKey,
   createSecretKey,
@@ -204,6 +213,7 @@ module.exports = {
   getCurves,
   getDiffieHellman: createDiffieHellmanGroup,
   getHashes,
+  getMacs,
   hkdf,
   hkdfSync,
   pbkdf2,
diff --git a/lib/diagnostics_channel.js b/lib/diagnostics_channel.js
index 7c1f4fa845ed..54c25839e611 100644
--- a/lib/diagnostics_channel.js
+++ b/lib/diagnostics_channel.js
@@ -522,11 +522,15 @@ class TracingChannel {
     return done;
   }
 
-  traceSync(fn, context = { __proto__: null }, thisArg, ...args) {
+  traceSync(fn, context = undefined, thisArg, ...args) {
     if (!this.hasSubscribers) {
       return ReflectApply(fn, thisArg, args);
     }
 
+    if (context === undefined) {
+      context = { __proto__: null };
+    }
+
     const { error } = this;
 
     // eslint-disable-next-line no-unused-vars
@@ -542,7 +546,7 @@ class TracingChannel {
     }
   }
 
-  tracePromise(fn, context = { __proto__: null }, thisArg, ...args) {
+  tracePromise(fn, context = undefined, thisArg, ...args) {
     if (!this.hasSubscribers) {
       const result = ReflectApply(fn, thisArg, args);
       if (typeof result?.then !== 'function') {
@@ -551,6 +555,10 @@ class TracingChannel {
       return result;
     }
 
+    if (context === undefined) {
+      context = { __proto__: null };
+    }
+
     const { error } = this;
     const continuationWindow = this.#continuationWindow;
 
diff --git a/lib/dtls.js b/lib/dtls.js
new file mode 100644
index 000000000000..5749ee028334
--- /dev/null
+++ b/lib/dtls.js
@@ -0,0 +1,20 @@
+'use strict';
+
+const {
+  emitExperimentalWarning,
+} = require('internal/util');
+emitExperimentalWarning('dtls');
+
+const {
+  connect,
+  listen,
+  DTLSEndpoint,
+  DTLSSession,
+} = require('internal/dtls/dtls');
+
+module.exports = {
+  connect,
+  listen,
+  DTLSEndpoint,
+  DTLSSession,
+};
diff --git a/lib/eslint.config_partial.mjs b/lib/eslint.config_partial.mjs
index 335692e2cf4a..58a2cda0296f 100644
--- a/lib/eslint.config_partial.mjs
+++ b/lib/eslint.config_partial.mjs
@@ -252,6 +252,10 @@ export default [
           name: 'SharedArrayBuffer',
           message: "Use `const { constructSharedArrayBuffer } = require('internal/util');` instead of the global.",
         },
+        {
+          name: 'Storage',
+          message: "Use `const { Storage } = require('internal/webstorage');` instead of the global.",
+        },
         // Temporal is not available in primordials because it can be
         // disabled with --no-harmony-temporal CLI flag.
         {
@@ -286,6 +290,10 @@ export default [
           name: 'URL',
           message: "Use `const { URL } = require('internal/url');` instead of the global.",
         },
+        {
+          name: 'URLPattern',
+          message: "Use `const { URLPattern } = require('internal/url');` instead of the global.",
+        },
         {
           name: 'URLSearchParams',
           message: "Use `const { URLSearchParams } = require('internal/url');` instead of the global.",
@@ -296,6 +304,14 @@ export default [
           name: 'WebAssembly',
           message: 'Use `const { WebAssembly } = globalThis;` instead of the global.',
         },
+        {
+          name: 'WebSocket',
+          message: 'Use `const { WebSocket } = require("internal/deps/undici/src/lib/web/websocket/websocket.js");` instead of the global.',
+        },
+        {
+          name: 'Worker',
+          message: "Use `const { Worker } = require('internal/webworker');` instead of the global.",
+        },
         {
           name: 'WritableStream',
           message: "Use `const { WritableStream } = require('internal/webstreams/writablestream')` instead of the global.",
@@ -360,6 +376,10 @@ export default [
           name: 'globalThis',
           message: 'Use `const { globalThis } = primordials;` instead of the global.',
         },
+        {
+          name: 'localStorage',
+          message: "Use `const { localStorage } = require('internal/webstorage');` instead of the global.",
+        },
         {
           name: 'performance',
           message: "Use `const { performance } = require('perf_hooks');` instead of the global.",
@@ -368,6 +388,10 @@ export default [
           name: 'queueMicrotask',
           message: "Use `const { queueMicrotask } = require('internal/process/task_queues');` instead of the global.",
         },
+        {
+          name: 'sessionStorage',
+          message: "Use `const { sessionStorage } = require('internal/webstorage');` instead of the global.",
+        },
         {
           name: 'setImmediate',
           message: "Use `const { setImmediate } = require('timers');` instead of the global.",
@@ -388,12 +412,6 @@ export default [
           name: 'SubtleCrypto',
           message: "Use `const { SubtleCrypto } = require('internal/crypto/webcrypto');` instead of the global.",
         },
-        // Float16Array is not available in primordials because it can be
-        // disabled with --no-js-float16array CLI flag.
-        {
-          name: 'Float16Array',
-          message: 'Use `const { Float16Array } = globalThis;` instead of the global.',
-        },
         // DisposableStack and AsyncDisposableStack are not available in primordials because they can be
         // disabled with --no-js-explicit-resource-management CLI flag.
         {
@@ -421,8 +439,8 @@ export default [
       'node-core/lowercase-name-for-primitive': 'error',
       'node-core/non-ascii-character': 'error',
       'node-core/no-array-destructuring': 'error',
+      'node-core/no-crypto-class-instanceof': 'error',
       'node-core/no-cryptokey-public-accessors': 'error',
-      'node-core/no-keyobject-cryptokey-instanceof': 'error',
       'node-core/no-keyobject-public-accessors': 'error',
       'node-core/prefer-primordials': [
         'error',
@@ -454,6 +472,7 @@ export default [
           name: 'FinalizationRegistry',
           into: 'Safe',
         },
+        { name: 'Float16Array' },
         { name: 'Float32Array' },
         { name: 'Float64Array' },
         { name: 'Function' },
diff --git a/lib/fs.js b/lib/fs.js
index d1823ce97298..b858902cf44a 100644
--- a/lib/fs.js
+++ b/lib/fs.js
@@ -28,7 +28,6 @@ const {
   ArrayFromAsync,
   ArrayPrototypePush,
   BigIntPrototypeToString,
-  Boolean,
   FunctionPrototypeCall,
   MathMax,
   Number,
@@ -57,9 +56,6 @@ const {
   F_OK,
   O_WRONLY,
   O_SYMLINK,
-  UV_DIRENT_DIR,
-  UV_DIRENT_LINK,
-  UV_DIRENT_UNKNOWN,
 } = constants;
 
 const pathModule = require('path');
@@ -83,6 +79,7 @@ const {
 const {
   FSReqCallback,
   ReadFileJob,
+  WriteFileJob,
 } = binding;
 const { toPathIfFileURL } = require('internal/url');
 const {
@@ -103,10 +100,11 @@ const {
     kReadFileBufferLength,
     kMaxUserId,
   },
+  collectRecursiveReaddirResult,
   copyObject,
   Dirent,
-  getDirent,
   getDirents,
+  getRecursiveDirents,
   getOptions,
   getValidatedFd,
   getValidatedPath,
@@ -395,6 +393,7 @@ function bindSignalToReq(req, signal, callback) {
   let aborted = false;
   const onAbort = () => {
     aborted = true;
+    req.cancel();
     callback(new AbortError(undefined, { cause: signal.reason }));
   };
   kResistStopPropagation ??= require('internal/event_target').kResistStopPropagation;
@@ -1743,57 +1742,40 @@ function mkdirSync(path, options) {
 }
 
 /**
- * Appends one directory's entries to `context.results` and the subdirectories
- * still to visit to `context.dirs` (with the prefix their entries get in
- * string results in `context.prefixes`). `result` is a `binding.readdir()`
- * result with file types, so only symbolic links and entries of unknown type
- * need a stat() to find out whether they lead to a directory.
- * @param {string} dir
- * @param {string} prefix
- * @param {[string[], number[]]} result
- * @param {{ withFileTypes: boolean, results: (string | Dirent)[], dirs: string[], prefixes: string[] }} context
- */
-function collectRecursiveReaddirResult(dir, prefix, { 0: names, 1: types }, context) {
-  const { length } = names;
-  for (let i = 0; i < length; i++) {
-    const name = names[i];
-    const relative = prefix === '' ? name : `${prefix}${pathModule.sep}${name}`;
-    let isDirectory;
-    if (context.withFileTypes) {
-      const dirent = getDirent(dir, name, types[i]);
-      ArrayPrototypePush(context.results, dirent);
-      // Follow symbolic links to directories, see https://github.com/nodejs/node/issues/52663
-      isDirectory = dirent.isDirectory() ||
-        (dirent.isSymbolicLink() && binding.internalModuleStat(pathModule.join(dir, name)) === 1);
-    } else {
-      ArrayPrototypePush(context.results, relative);
-      const type = types[i];
-      isDirectory = type === UV_DIRENT_DIR ||
-        ((type === UV_DIRENT_LINK || type === UV_DIRENT_UNKNOWN) &&
-         binding.internalModuleStat(pathModule.join(dir, name)) === 1);
-    }
-    if (isDirectory) {
-      ArrayPrototypePush(context.dirs, pathModule.join(dir, name));
-      ArrayPrototypePush(context.prefixes, relative);
-    }
-  }
-}
-
-/*
- * An recursive algorithm for reading the entire contents of the `basePath` directory.
- * This function does not validate `basePath` as a directory. It is passed directly to
- * `binding.readdir`.
- * @param {string} basePath
+ * Reads the entire contents of the `basePath` directory. This function does
+ * not validate `basePath` as a directory. It is passed directly to
+ * `binding.readdirRecursive`, or to `binding.readdir` for each directory when
+ * the permission model is enabled, since that checks every directory on the
+ * main thread where the native walk can not.
+ * @param {string | Buffer} basePath
  * @param {{ encoding: string, withFileTypes: boolean }} options
  * @param {(
  *   err?: Error,
  *   files?: string[] | Buffer[] | Dirent[]
  * ) => any} callback
  * @returns {void}
-*/
+ */
 function readdirRecursive(basePath, options, callback) {
+  if (permission.isEnabled()) {
+    readdirRecursiveWithPermissionModel(basePath, options, callback);
+    return;
+  }
+  const withFileTypes = !!options.withFileTypes;
+  const req = new FSReqCallback();
+  req.oncomplete = (err, result) => {
+    if (err) {
+      callback(err);
+      return;
+    }
+    callback(null, withFileTypes ? getRecursiveDirents(basePath, result) : result);
+  };
+  binding.readdirRecursive(basePath, options.encoding, withFileTypes, req);
+}
+
+function readdirRecursiveWithPermissionModel(basePath, options, callback) {
+  const { encoding } = options;
   const context = {
-    withFileTypes: Boolean(options.withFileTypes),
+    withFileTypes: !!options.withFileTypes,
     results: [],
     dirs: [basePath],
     prefixes: [''],
@@ -1815,11 +1797,6 @@ function readdirRecursive(basePath, options, callback) {
         return;
       }
 
-      if (result === undefined) {
-        callback(null, context.results);
-        return;
-      }
-
       try {
         collectRecursiveReaddirResult(path, prefix, result, context);
       } catch (err) {
@@ -1834,37 +1811,37 @@ function readdirRecursive(basePath, options, callback) {
       }
     };
 
-    binding.readdir(path, options.encoding, true, req);
+    binding.readdir(path, encoding, true, req);
   }
 
   read(context.dirs[i], context.prefixes[i++]);
 }
 
 /**
- * An iterative algorithm for reading the entire contents of the `basePath` directory.
- * This function does not validate `basePath` as a directory. It is passed directly to
- * `binding.readdir`.
- * @param {string} basePath
+ * Synchronously reads the entire contents of the `basePath` directory, see
+ * `readdirRecursive`.
+ * @param {string | Buffer} basePath
  * @param {{ encoding: string, withFileTypes: boolean }} options
- * @returns {string[] | Dirent[]}
+ * @returns {string[] | Buffer[] | Dirent[]}
  */
 function readdirSyncRecursive(basePath, options) {
-  const context = {
-    withFileTypes: Boolean(options.withFileTypes),
-    results: [],
-    dirs: [basePath],
-    prefixes: [''],
-  };
-
-  for (let i = 0; i < context.dirs.length; i++) {
-    const dir = context.dirs[i];
-    const result = binding.readdir(dir, options.encoding, true);
-    if (result !== undefined) {
+  const withFileTypes = !!options.withFileTypes;
+  if (permission.isEnabled()) {
+    const context = {
+      withFileTypes,
+      results: [],
+      dirs: [basePath],
+      prefixes: [''],
+    };
+    for (let i = 0; i < context.dirs.length; i++) {
+      const dir = context.dirs[i];
+      const result = binding.readdir(dir, options.encoding, true);
       collectRecursiveReaddirResult(dir, context.prefixes[i], result, context);
     }
+    return context.results;
   }
-
-  return context.results;
+  const result = binding.readdirRecursive(basePath, options.encoding, withFileTypes);
+  return result !== undefined && withFileTypes ? getRecursiveDirents(basePath, result) : result;
 }
 
 /**
@@ -1898,9 +1875,6 @@ function readdir(path, options, callback) {
   }
 
   if (options.recursive) {
-    // Make shallow copy to prevent mutating options from affecting results
-    options = copyObject(options);
-
     readdirRecursive(path, options, callback);
     return;
   }
@@ -2018,7 +1992,8 @@ function lstat(path, options = { __proto__: null, bigint: false }, callback) {
 
   callback = makeStatsCallback(callback);
   path = getValidatedPath(path);
-  if (permission.isEnabled() && !permission.has('fs.read', path)) {
+  if (permission.isEnabled() && !permission.has('fs.read', path) &&
+      !permission.isAuditMode()) {
     const resource = BufferIsBuffer(path) ? BufferToString(path) : path;
     callback(new ERR_ACCESS_DENIED('Access to this API has been restricted', 'FileSystemRead', resource));
     return;
@@ -2127,11 +2102,17 @@ function fstatSync(fd, options = { __proto__: null, bigint: false }) {
 function lstatSync(path, options = { __proto__: null, bigint: false, throwIfNoEntry: true }) {
   const h = vfsState.handlers;
   if (h !== null) {
-    const result = h.lstatSync(path, options);
-    if (result !== undefined) return result;
+    try {
+      const result = h.lstatSync(path, options);
+      if (result !== undefined) return result;
+    } catch (err) {
+      if (err?.code === 'ENOENT' && options?.throwIfNoEntry === false) return;
+      throw err;
+    }
   }
   path = getValidatedPath(path);
-  if (permission.isEnabled() && !permission.has('fs.read', path)) {
+  if (permission.isEnabled() && !permission.has('fs.read', path) &&
+      !permission.isAuditMode()) {
     const resource = BufferIsBuffer(path) ? BufferToString(path) : path;
     throw new ERR_ACCESS_DENIED('Access to this API has been restricted', 'FileSystemRead', resource);
   }
@@ -2161,8 +2142,13 @@ function lstatSync(path, options = { __proto__: null, bigint: false, throwIfNoEn
 function statSync(path, options = { __proto__: null, bigint: false, throwIfNoEntry: true }) {
   const h = vfsState.handlers;
   if (h !== null) {
-    const result = h.statSync(path, options);
-    if (result !== undefined) return result;
+    try {
+      const result = h.statSync(path, options);
+      if (result !== undefined) return result;
+    } catch (err) {
+      if (err?.code === 'ENOENT' && options?.throwIfNoEntry === false) return undefined;
+      throw err;
+    }
   }
   const stats = binding.stat(
     getValidatedPath(path),
@@ -2253,7 +2239,8 @@ function symlink(target, path, type, callback) {
   // Due to the nature of Node.js runtime, symlinks has different edge cases that can bypass
   // the permission model security guarantees. Thus, this API is disabled unless fs.read
   // and fs.write permission has been given.
-  if (permission.isEnabled() && !permission.has('fs')) {
+  if (permission.isEnabled() && !permission.has('fs') &&
+      !permission.isAuditMode()) {
     callback(new ERR_ACCESS_DENIED('fs.symlink API requires full fs.read and fs.write permissions.'));
     return;
   }
@@ -2327,7 +2314,8 @@ function symlinkSync(target, path, type) {
   // Due to the nature of Node.js runtime, symlinks has different edge cases that can bypass
   // the permission model security guarantees. Thus, this API is disabled unless fs.read
   // and fs.write permission has been given.
-  if (permission.isEnabled() && !permission.has('fs')) {
+  if (permission.isEnabled() && !permission.has('fs') &&
+      !permission.isAuditMode()) {
     throw new ERR_ACCESS_DENIED('fs.symlink API requires full fs.read and fs.write permissions.');
   }
 
@@ -2946,6 +2934,23 @@ function writeFile(path, data, options, callback) {
   if (checkAborted(options.signal, callback))
     return;
 
+  if (!flush) {
+    // Open + write + close in one thread pool round trip.
+    const signal = options.signal;
+    path = getValidatedPath(path);
+    const job = new WriteFileJob(path, stringToFlags(flag, 'options.flag'),
+                                 parseFileMode(options.mode, 'mode', 0o666), data);
+    job.ondone = signal == null ? callback : (err) => {
+      // An abort that arrived while the write was in flight still wins.
+      callback(signal.aborted && !err ? new AbortError(undefined, { cause: signal.reason }) : err);
+    };
+    const accessError = job.run(path);
+    if (accessError !== undefined) {
+      callback(accessError);
+    }
+    return;
+  }
+
   fs.open(path, flag, options.mode, (openErr, fd) => {
     if (openErr) {
       callback(openErr);
diff --git a/lib/https.js b/lib/https.js
index 6ae2e5d8a213..75ec8bb3f895 100644
--- a/lib/https.js
+++ b/lib/https.js
@@ -70,6 +70,7 @@ let debug = require('internal/util/debuglog').debuglog('https', (fn) => {
   debug = fn;
 });
 const net = require('net');
+const { Buffer } = require('buffer');
 const { URL, urlToHttpOptions, isURL } = require('internal/url');
 const { validateObject } = require('internal/validators');
 const { isIP } = require('internal/net');
@@ -204,6 +205,7 @@ function getTunnelConfigForProxiedHttps(agent, reqOptions) {
   const result = {
     __proto__: null,
     proxyTunnelPayload: payload,
+    maxHeaderSize: reqOptions.maxHeaderSize || getOptionValue('--max-http-header-size'),
     requestOptions: {  // Options used for the request sent after the tunnel is established.
       __proto__: null,
       servername: reqOptions.servername || ipType ? undefined : reqOptions.host,
@@ -215,17 +217,17 @@ function getTunnelConfigForProxiedHttps(agent, reqOptions) {
 };
 
 function establishTunnel(agent, socket, options, tunnelConfig, afterSocket) {
-  const { proxyTunnelPayload } = tunnelConfig;
+  const { proxyTunnelPayload, maxHeaderSize } = tunnelConfig;
   // By default, the socket is in paused mode. Read to look for the 200
   // connection established response.
   function read() {
     let chunk;
     while ((chunk = socket.read()) !== null) {
-      if (onProxyData(chunk) !== -1) {
-        break;
+      if (onProxyData(chunk)) {
+        return;
       }
     }
-    socket.on('readable', read);
+    socket.once('readable', read);
   }
 
   function cleanup() {
@@ -243,14 +245,25 @@ function establishTunnel(agent, socket, options, tunnelConfig, afterSocket) {
 
   // Read the headers from the chunks and check for the status code. If it fails we
   // clean up the socket and return an error. Otherwise we establish the tunnel.
-  let buffer = '';
+  let buffer;
   function onProxyData(chunk) {
-    const str = chunk.toString();
-    debug('onProxyData', str);
-    buffer += str;
+    debug('onProxyData', chunk.length);
+    buffer = buffer === undefined ? chunk :
+      Buffer.concat([buffer, chunk], buffer.length + chunk.length);
     const headerEndIndex = buffer.indexOf('\r\n\r\n');
-    if (headerEndIndex === -1) return headerEndIndex;
-    const statusLine = buffer.substring(0, buffer.indexOf('\r\n'));
+    const headerLength = headerEndIndex === -1 ?
+      buffer.length : headerEndIndex + 4;
+    if (headerLength > maxHeaderSize) {
+      debug(`Proxy response headers exceed ${maxHeaderSize} bytes, cleaning up`);
+      cleanup();
+      const err = new ERR_PROXY_TUNNEL(
+        `Proxy response headers exceeded ${maxHeaderSize} bytes`);
+      afterSocket(err, socket);
+      return true;
+    }
+    if (headerEndIndex === -1) return false;
+    const statusLineEndIndex = buffer.indexOf('\r\n');
+    const statusLine = buffer.subarray(0, statusLineEndIndex).toString();
     const statusCode = statusLine.split(' ')[1];
     if (statusCode !== '200') {
       debug(`onProxyData receives ${statusCode}, cleaning up`);
@@ -292,7 +305,7 @@ function establishTunnel(agent, socket, options, tunnelConfig, afterSocket) {
       });
       tunneldSocket.on('error', onTLSHandshakeError);
     }
-    return headerEndIndex;
+    return true;
   }
 
   function onProxyEnd() {
diff --git a/lib/internal/async_context_frame.js b/lib/internal/async_context_frame.js
index cac193e33188..cd03eafe6fa6 100644
--- a/lib/internal/async_context_frame.js
+++ b/lib/internal/async_context_frame.js
@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  ObjectSetPrototypeOf,
   SafeMap,
 } = primordials;
 
@@ -10,45 +9,22 @@ const {
   setContinuationPreservedEmbedderData,
 } = internalBinding('async_context_frame');
 
-let enabled_;
-
-class ActiveAsyncContextFrame extends SafeMap {
-  static get enabled() {
-    return true;
-  }
-
-  static current() {
-    return getContinuationPreservedEmbedderData();
-  }
-
-  static set(frame) {
-    setContinuationPreservedEmbedderData(frame);
-  }
-
-  static exchange(frame) {
-    const prior = this.current();
-    this.set(frame);
-    return prior;
-  }
-
-  static disable(store) {
-    const frame = this.current();
-    frame?.disable(store);
-  }
+function activeCurrent() {
+  return getContinuationPreservedEmbedderData();
 }
 
-function checkEnabled() {
-  const enabled = require('internal/options')
-    .getOptionValue('--async-context-frame');
+function activeSet(frame) {
+  setContinuationPreservedEmbedderData(frame);
+}
 
-  // If enabled, swap to active prototype so we don't need to check status
-  // on every interaction with the async context frame.
-  if (enabled) {
-    // eslint-disable-next-line no-use-before-define
-    ObjectSetPrototypeOf(AsyncContextFrame, ActiveAsyncContextFrame);
-  }
+function activeExchange(frame) {
+  const prior = getContinuationPreservedEmbedderData();
+  setContinuationPreservedEmbedderData(frame);
+  return prior;
+}
 
-  return enabled;
+function activeDisable(store) {
+  getContinuationPreservedEmbedderData()?.disable(store);
 }
 
 class InactiveAsyncContextFrame extends SafeMap {
@@ -74,4 +50,22 @@ class AsyncContextFrame extends InactiveAsyncContextFrame {
   }
 }
 
+let enabled_;
+
+function checkEnabled() {
+  const enabled = require('internal/options')
+    .getOptionValue('--async-context-frame');
+
+  // If enabled, install the active implementations directly. We use props
+  // rather than a prototype replacement to preserve V8 optimizations.
+  if (enabled) {
+    AsyncContextFrame.current = activeCurrent;
+    AsyncContextFrame.set = activeSet;
+    AsyncContextFrame.exchange = activeExchange;
+    AsyncContextFrame.disable = activeDisable;
+  }
+
+  return enabled;
+}
+
 module.exports = AsyncContextFrame;
diff --git a/lib/internal/bench_runner/benchmark.js b/lib/internal/bench_runner/benchmark.js
new file mode 100644
index 000000000000..375f8e6b635f
--- /dev/null
+++ b/lib/internal/bench_runner/benchmark.js
@@ -0,0 +1,591 @@
+'use strict';
+
+const {
+  ArrayIsArray,
+  ArrayPrototypeJoin,
+  ArrayPrototypePush,
+  ArrayPrototypeReverse,
+  ArrayPrototypeSlice,
+  ArrayPrototypeSort,
+  JSONStringify,
+  MathFloor,
+  MathMax,
+  MathMin,
+  MathRound,
+  MathSqrt,
+  Number,
+  NumberIsFinite,
+  NumberMAX_SAFE_INTEGER,
+  ObjectFreeze,
+  ObjectKeys,
+  PromiseWithResolvers,
+  SafeSet,
+  StringPrototypeToLowerCase,
+} = primordials;
+const { AsyncResource } = require('async_hooks');
+const {
+  codes: {
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_ARG_VALUE,
+    ERR_INVALID_STATE,
+    ERR_OUT_OF_RANGE,
+  },
+} = require('internal/errors');
+const { createHistogram } = require('internal/histogram');
+const { TIMEOUT_MAX } = require('internal/timers');
+const { kEmptyObject } = require('internal/util');
+const {
+  validateAbortSignal,
+  validateFunction,
+  validateInteger,
+  validateNumber,
+  validateObject,
+  validateString,
+  validateUint32,
+} = require('internal/validators');
+const { structuredClone } = require('internal/worker/js_transferable');
+
+const { bigint: hrtime } = process.hrtime;
+const kDefaultSamples = 30;
+const kDefaultWarmup = 0;
+const kEmptyDiagnosticChannels = ObjectFreeze([]);
+const kEmptyNamePath = ObjectFreeze([]);
+const kEmptyParams = ObjectFreeze({ __proto__: null });
+const kEmptyTags = ObjectFreeze([]);
+
+function validateSkip(skip) {
+  if (skip !== undefined && typeof skip !== 'boolean' &&
+      typeof skip !== 'string') {
+    throw new ERR_INVALID_ARG_TYPE('options.skip', ['boolean', 'string'], skip);
+  }
+}
+
+function canonicalizeTags(tags, parentTags = kEmptyTags) {
+  if (tags === undefined) return parentTags;
+  if (!ArrayIsArray(tags)) {
+    throw new ERR_INVALID_ARG_TYPE('options.tags', 'Array', tags);
+  }
+
+  const result = ArrayPrototypeSlice(parentTags);
+  const seen = new SafeSet(parentTags);
+  for (let i = 0; i < tags.length; i++) {
+    validateString(tags[i], `options.tags[${i}]`);
+    if (tags[i].length === 0) {
+      throw new ERR_INVALID_ARG_VALUE(
+        `options.tags[${i}]`, tags[i], 'must not be empty');
+    }
+    const tag = StringPrototypeToLowerCase(tags[i]);
+    if (!seen.has(tag)) {
+      seen.add(tag);
+      ArrayPrototypePush(result, tag);
+    }
+  }
+  return ObjectFreeze(result);
+}
+
+function canonicalizeDiagnosticChannels(
+  diagnosticChannels,
+  parentDiagnosticChannels = kEmptyDiagnosticChannels,
+) {
+  if (diagnosticChannels === undefined) return parentDiagnosticChannels;
+  if (!ArrayIsArray(diagnosticChannels)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'options.diagnosticChannels', 'Array', diagnosticChannels);
+  }
+
+  const result = ArrayPrototypeSlice(parentDiagnosticChannels);
+  const seen = new SafeSet(parentDiagnosticChannels);
+  for (let i = 0; i < diagnosticChannels.length; i++) {
+    const name = diagnosticChannels[i];
+    if (typeof name === 'symbol') continue;
+    if (typeof name !== 'string') {
+      throw new ERR_INVALID_ARG_TYPE(
+        `options.diagnosticChannels[${i}]`, ['string', 'symbol'], name);
+    }
+    if (!seen.has(name)) {
+      seen.add(name);
+      ArrayPrototypePush(result, name);
+    }
+  }
+  return ObjectFreeze(result);
+}
+
+function canonicalizeParams(params) {
+  if (params === undefined) return kEmptyParams;
+  validateObject(params, 'options.params');
+
+  const result = { __proto__: null };
+  const keys = ObjectKeys(params);
+  ArrayPrototypeSort(keys);
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    const value = params[key];
+    if (typeof value !== 'string' && typeof value !== 'boolean' &&
+        (typeof value !== 'number' || !NumberIsFinite(value))) {
+      if (typeof value === 'number') {
+        throw new ERR_OUT_OF_RANGE(
+          `options.params.${key}`, 'a finite number', value);
+      }
+      throw new ERR_INVALID_ARG_TYPE(
+        `options.params.${key}`, ['string', 'number', 'boolean'], value);
+    }
+    result[key] = value;
+  }
+  return ObjectFreeze(result);
+}
+
+function validateNodeOptions(options, parentTags, parentDiagnosticChannels) {
+  validateObject(options, 'options');
+  const { diagnosticChannels, only = false, skip, tags } = options;
+  if (typeof only !== 'boolean') {
+    throw new ERR_INVALID_ARG_TYPE('options.only', 'boolean', only);
+  }
+  validateSkip(skip);
+  return {
+    __proto__: null,
+    diagnosticChannels: canonicalizeDiagnosticChannels(
+      diagnosticChannels, parentDiagnosticChannels),
+    only,
+    skip,
+    tags: canonicalizeTags(tags, parentTags),
+  };
+}
+
+function createLocation(loc, fallbackFile) {
+  return {
+    __proto__: null,
+    file: loc?.[2] ?? fallbackFile,
+    line: loc?.[0],
+    column: loc?.[1],
+  };
+}
+
+function getNamePath(parent, name) {
+  const path = [];
+  for (let current = parent; current?.parent !== null; current = current.parent) {
+    ArrayPrototypePush(path, current.name);
+  }
+  ArrayPrototypeReverse(path);
+  ArrayPrototypePush(path, name);
+  return path;
+}
+
+function cloneSample(sample) {
+  const result = {
+    __proto__: null,
+    operations: sample.operations,
+    duration_ns: sample.duration_ns,
+    rate: sample.rate,
+  };
+  if (sample.detail !== undefined) {
+    result.detail = structuredClone(sample.detail);
+  }
+  return result;
+}
+
+class Suite extends AsyncResource {
+  constructor(harness, parent, name, options, fn, loc, isRoot = false) {
+    super('BenchSuite');
+    const validated = validateNodeOptions(
+      options,
+      parent?.tags ?? kEmptyTags,
+      parent?.diagnosticChannels ?? kEmptyDiagnosticChannels,
+    );
+
+    this.harness = harness;
+    this.parent = parent;
+    this.name = name;
+    this.fn = fn;
+    this.loc = createLocation(loc, harness.entryFile);
+    this.isRoot = isRoot;
+    this.fileScope = isRoot ? null :
+      (parent.isRoot ? harness.getFileScope() : parent.fileScope);
+    this.namePath = isRoot ? kEmptyNamePath :
+      ObjectFreeze(getNamePath(parent, name));
+    this.suiteId = isRoot ? null : JSONStringify([
+      this.loc.file,
+      this.namePath,
+    ]);
+    this.parentId = isRoot || parent.isRoot ? null : parent.suiteId;
+    this.diagnosticChannels = validated.diagnosticChannels;
+    this.only = validated.only;
+    this.skip = validated.skip;
+    this.tags = validated.tags;
+    this.children = [];
+    this.hooks = {
+      __proto__: null,
+      after: [],
+      afterEach: [],
+      before: [],
+      beforeEach: [],
+    };
+    this.buildError = null;
+    this.buildPromise = null;
+    this.finished = false;
+    this.completion = PromiseWithResolvers();
+  }
+}
+
+class Bench extends AsyncResource {
+  constructor(harness, parent, name, options, fn, loc) {
+    super('Benchmark');
+    const validated = validateNodeOptions(
+      options, parent.tags, parent.diagnosticChannels);
+    const {
+      params,
+      samples = kDefaultSamples,
+      signal,
+      timeout = Infinity,
+      warmup = kDefaultWarmup,
+    } = options;
+
+    validateUint32(samples, 'options.samples', true);
+    validateUint32(warmup, 'options.warmup');
+    validateAbortSignal(signal, 'options.signal');
+    if (timeout !== Infinity) {
+      validateNumber(timeout, 'options.timeout', 0, TIMEOUT_MAX);
+    }
+
+    this.harness = harness;
+    this.parent = parent;
+    this.name = name;
+    this.fn = fn;
+    this.loc = createLocation(loc, harness.entryFile);
+    this.diagnosticChannels = validated.diagnosticChannels;
+    this.only = validated.only;
+    this.skip = validated.skip;
+    this.tags = validated.tags;
+    this.params = canonicalizeParams(params);
+    this.samples = samples;
+    this.warmup = warmup;
+    this.timeout = timeout;
+    this.outerSignal = signal;
+    this.fileScope = parent.isRoot ? harness.getFileScope() : parent.fileScope;
+    this.namePath = ObjectFreeze(getNamePath(parent, name));
+    this.fullName = ArrayPrototypeJoin(this.namePath, ' ');
+    this.benchId = JSONStringify([
+      this.loc.file,
+      this.namePath,
+      this.params,
+    ]);
+    this.parentId = parent.suiteId;
+    this.finished = false;
+    this.result = null;
+    this.completion = PromiseWithResolvers();
+  }
+}
+
+class BenchContext {
+  #closed = false;
+  #done = false;
+  #endCalled = false;
+  #index;
+  #invalid = false;
+  #onDiagnostic;
+  #phase;
+  #recordCalled = false;
+  #sample = null;
+  #startCalled = false;
+  #startTime;
+
+  constructor(bench, signal, phase, index, onDiagnostic) {
+    this.name = bench.name;
+    this.params = bench.params;
+    this.signal = signal;
+    this.#phase = phase;
+    this.#index = index;
+    this.#onDiagnostic = onDiagnostic;
+  }
+
+  get index() {
+    return this.#index;
+  }
+
+  get phase() {
+    return this.#phase;
+  }
+
+  diagnostic(message, options = kEmptyObject) {
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    try {
+      const clonedMessage = structuredClone(message);
+      validateObject(options, 'options');
+      const { detail, level = 'info' } = options;
+      validateString(level, 'options.level');
+      if (level !== 'info' && level !== 'warning') {
+        throw new ERR_INVALID_ARG_VALUE(
+          'options.level', level, "must be 'info' or 'warning'");
+      }
+      const diagnostic = { __proto__: null, level, message: clonedMessage };
+      if (detail !== undefined) diagnostic.detail = structuredClone(detail);
+      this.#onDiagnostic(diagnostic);
+    } catch (error) {
+      this.#invalid = true;
+      throw error;
+    }
+  }
+
+  start() {
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    if (this.#recordCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'start() cannot be combined with record()');
+    }
+    if (this.#startCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'start() must be called exactly once per benchmark sample');
+    }
+    this.#startCalled = true;
+    this.#startTime = hrtime();
+  }
+
+  end(operations, options = kEmptyObject) {
+    const endTime = hrtime();
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    if (this.#recordCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'end() cannot be combined with record()');
+    }
+    if (this.#endCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'end() must be called exactly once per benchmark sample');
+    }
+    this.#endCalled = true;
+    if (!this.#startCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('end() cannot be called before start()');
+    }
+
+    try {
+      validateObject(options, 'options');
+      const { detail } = options;
+      validateInteger(operations, 'operations', 1, NumberMAX_SAFE_INTEGER);
+      const duration = endTime - this.#startTime;
+      if (duration === 0n) {
+        throw new ERR_INVALID_STATE(
+          'insufficient clock precision for benchmark sample');
+      }
+      this.#sample = {
+        __proto__: null,
+        operations,
+        duration_ns: duration,
+        rate: operations / (Number(duration) / 1e9),
+      };
+      if (detail !== undefined) {
+        this.#sample.detail = structuredClone(detail);
+      }
+    } catch (error) {
+      this.#invalid = true;
+      throw error;
+    }
+    return cloneSample(this.#sample);
+  }
+
+  record(sample) {
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    if (this.#recordCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'record() must be called exactly once per benchmark sample');
+    }
+    if (this.#startCalled || this.#endCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'record() cannot be combined with start() or end()');
+    }
+    this.#recordCalled = true;
+
+    try {
+      validateObject(sample, 'sample');
+      const { detail, duration_ns, operations } = sample;
+      validateInteger(
+        operations, 'sample.operations', 1, NumberMAX_SAFE_INTEGER);
+      if (typeof duration_ns !== 'bigint') {
+        throw new ERR_INVALID_ARG_TYPE(
+          'sample.duration_ns', 'bigint', duration_ns);
+      }
+      if (duration_ns <= 0n) {
+        throw new ERR_OUT_OF_RANGE(
+          'sample.duration_ns', 'a positive bigint', duration_ns);
+      }
+      if (duration_ns > 9_007_199_254_740_991n) {
+        throw new ERR_OUT_OF_RANGE(
+          'sample.duration_ns',
+          'less than or equal to Number.MAX_SAFE_INTEGER',
+          duration_ns);
+      }
+      this.#sample = {
+        __proto__: null,
+        operations,
+        duration_ns,
+        rate: operations / (Number(duration_ns) / 1e9),
+      };
+      if (detail !== undefined) {
+        this.#sample.detail = structuredClone(detail);
+      }
+    } catch (error) {
+      this.#invalid = true;
+      throw error;
+    }
+    return cloneSample(this.#sample);
+  }
+
+  done() {
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    if (this.#phase !== 'measurement') {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'done() can only be called during a measured sample');
+    }
+    this.#done = true;
+  }
+
+  finish() {
+    this.#closed = true;
+    if (this.#invalid) {
+      throw new ERR_INVALID_STATE(
+        'benchmark sample violated the context method contract');
+    }
+    if (!this.#recordCalled && !this.#startCalled) {
+      throw new ERR_INVALID_STATE(
+        'benchmark callback did not call start() or record()');
+    }
+    if (!this.#recordCalled && (!this.#endCalled || this.#sample === null)) {
+      throw new ERR_INVALID_STATE(
+        'benchmark callback did not call end()');
+    }
+    return {
+      __proto__: null,
+      done: this.#done,
+      sample: this.#sample,
+    };
+  }
+
+  close() {
+    this.#closed = true;
+  }
+}
+
+function arithmeticMean(values) {
+  let sum = 0;
+  let compensation = 0;
+  for (let i = 0; i < values.length; i++) {
+    const adjusted = values[i] - compensation;
+    const next = sum + adjusted;
+    compensation = (next - sum) - adjusted;
+    sum = next;
+  }
+  return sum / values.length;
+}
+
+function summarizeSamples(samples) {
+  const rates = [];
+  let min = Infinity;
+  let max = -Infinity;
+  for (let i = 0; i < samples.length; i++) {
+    const rate = samples[i].rate;
+    ArrayPrototypePush(rates, rate);
+    min = MathMin(min, rate);
+    max = MathMax(max, rate);
+  }
+
+  const mean = arithmeticMean(rates);
+  let variance = 0;
+  for (let i = 0; i < rates.length; i++) {
+    const difference = rates[i] - mean;
+    variance += difference * difference;
+  }
+  variance /= rates.length;
+  const stddev = MathSqrt(variance);
+
+  const sorted = ArrayPrototypeSlice(rates);
+  ArrayPrototypeSort(sorted, (a, b) => a - b);
+  const middle = MathFloor(sorted.length / 2);
+  const median = sorted.length % 2 === 0 ?
+    (sorted[middle - 1] + sorted[middle]) / 2 : sorted[middle];
+
+  const scale = MathMin(1_000_000, NumberMAX_SAFE_INTEGER / max);
+  const histogram = createHistogram({ __proto__: null, figures: 5 });
+  for (let i = 0; i < rates.length; i++) {
+    const value = MathMax(
+      1,
+      MathMin(NumberMAX_SAFE_INTEGER, MathRound(rates[i] * scale)),
+    );
+    histogram.record(value);
+  }
+
+  const meanCI = histogram.meanCI();
+  const histogramMean = meanCI.mean / scale;
+  const medianCI = histogram.percentileCI(50);
+
+  return {
+    __proto__: null,
+    mean,
+    median,
+    min,
+    max,
+    stddev,
+    coefficientOfVariation: stddev / mean,
+    confidenceInterval: {
+      __proto__: null,
+      lower: mean + meanCI.lower / scale - histogramMean,
+      upper: mean + meanCI.upper / scale - histogramMean,
+    },
+    medianConfidenceInterval: {
+      __proto__: null,
+      lower: medianCI.lower / scale,
+      upper: medianCI.upper / scale,
+    },
+    skewness: histogram.skewness,
+  };
+}
+
+function normalizeArgs(type, name, options, fn) {
+  if (typeof name === 'function') {
+    fn = name;
+    name = fn.name || '<anonymous>';
+    options = kEmptyObject;
+  } else if (name !== null && typeof name === 'object') {
+    fn = options;
+    options = name;
+    name = fn?.name || '<anonymous>';
+  } else if (typeof options === 'function') {
+    fn = options;
+    options = kEmptyObject;
+  }
+
+  validateFunction(fn, `${type} function`);
+  validateString(name, `${type} name`);
+  if (name.length === 0) {
+    throw new ERR_INVALID_ARG_VALUE(`${type} name`, name, 'must not be empty');
+  }
+  validateObject(options, 'options');
+  return { __proto__: null, fn, name, options };
+}
+
+module.exports = {
+  Bench,
+  BenchContext,
+  Suite,
+  normalizeArgs,
+  summarizeSamples,
+};
diff --git a/lib/internal/bench_runner/benchmarks_stream.js b/lib/internal/bench_runner/benchmarks_stream.js
new file mode 100644
index 000000000000..295aa20483ce
--- /dev/null
+++ b/lib/internal/bench_runner/benchmarks_stream.js
@@ -0,0 +1,291 @@
+'use strict';
+
+const {
+  ArrayFrom,
+  ArrayIsArray,
+  ArrayPrototypePush,
+  MapPrototypeClear,
+  MapPrototypeEntries,
+  MapPrototypeSet,
+  ObjectDefineProperty,
+  ObjectGetOwnPropertyDescriptor,
+  ObjectGetOwnPropertyNames,
+  ObjectGetPrototypeOf,
+  ObjectKeys,
+  ObjectPrototype,
+  ObjectPrototypeHasOwnProperty,
+  ObjectSetPrototypeOf,
+  PromiseReject,
+  PromiseResolve,
+  PromiseWithResolvers,
+  SafeMap,
+  SetPrototypeAdd,
+  SetPrototypeClear,
+  SetPrototypeValues,
+  Symbol,
+} = primordials;
+const Readable = require('internal/streams/readable');
+const { deserializeError, serializeError } = require('internal/error_serdes');
+const {
+  codes: {
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+const { isError } = require('internal/util');
+const { isMap, isSet } = require('internal/util/types');
+const { structuredClone } = require('internal/worker/js_transferable');
+
+const kEmitMessage = Symbol('kEmitMessage');
+
+function repairError(source, clone, seen) {
+  const serialized = deserializeError(serializeError(source));
+  let sourceName;
+  try {
+    sourceName = source.name;
+  } catch {
+    // The serialized form already omits properties whose getters throw.
+  }
+  let repaired = clone;
+  if (!isError(repaired) ||
+      (sourceName !== undefined && repaired.name !== sourceName)) {
+    repaired = serialized;
+  }
+  if (repaired === null || typeof repaired !== 'object') return repaired;
+  seen.set(source, repaired);
+
+  if (serialized !== null && typeof serialized === 'object') {
+    const serializedKeys = ObjectGetOwnPropertyNames(serialized);
+    for (let i = 0; i < serializedKeys.length; i++) {
+      const key = serializedKeys[i];
+      if (ObjectPrototypeHasOwnProperty(repaired, key)) continue;
+      const descriptor = ObjectGetOwnPropertyDescriptor(serialized, key);
+      ObjectSetPrototypeOf(descriptor, null);
+      ObjectDefineProperty(repaired, key, descriptor);
+    }
+  }
+
+  const keys = ObjectGetOwnPropertyNames(source);
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    const descriptor = ObjectGetOwnPropertyDescriptor(source, key);
+    if (!ObjectPrototypeHasOwnProperty(descriptor, 'value') ||
+        typeof descriptor.value === 'function' ||
+        typeof descriptor.value === 'symbol') {
+      continue;
+    }
+    const existing = ObjectGetOwnPropertyDescriptor(repaired, key);
+    const value = descriptor.value !== null &&
+      typeof descriptor.value === 'object' ?
+      repairClone(descriptor.value, existing?.value, seen) : descriptor.value;
+    if ((existing !== undefined && existing.value === value) ||
+        existing?.configurable === false) {
+      continue;
+    }
+    ObjectDefineProperty(repaired, key, {
+      __proto__: null,
+      configurable: descriptor.configurable,
+      enumerable: descriptor.enumerable,
+      value,
+      writable: descriptor.writable,
+    });
+  }
+  return repaired;
+}
+
+function repairClone(source, clone, seen) {
+  if (source === null || (typeof source !== 'object' &&
+                          typeof source !== 'function')) {
+    return clone === undefined ? source : clone;
+  }
+  if (typeof source === 'function') return clone;
+  if (seen.has(source)) return seen.get(source);
+  if (isError(source)) return repairError(source, clone, seen);
+  if (clone === null || typeof clone !== 'object') {
+    try {
+      clone = structuredClone(source);
+    } catch {
+      const prototype = ObjectGetPrototypeOf(source);
+      if (!ArrayIsArray(source) && prototype !== null &&
+          prototype !== ObjectPrototype) {
+        return clone;
+      }
+      clone = ArrayIsArray(source) ? [] : { __proto__: prototype };
+    }
+  }
+  seen.set(source, clone);
+  if (isMap(source) && isMap(clone)) {
+    const sourceEntries = ArrayFrom(MapPrototypeEntries(source));
+    const cloneEntries = ArrayFrom(MapPrototypeEntries(clone));
+    const repairedEntries = [];
+    for (let i = 0; i < sourceEntries.length; i++) {
+      ArrayPrototypePush(repairedEntries, [
+        repairClone(sourceEntries[i][0], cloneEntries[i][0], seen),
+        repairClone(sourceEntries[i][1], cloneEntries[i][1], seen),
+      ]);
+    }
+    MapPrototypeClear(clone);
+    for (let i = 0; i < repairedEntries.length; i++) {
+      MapPrototypeSet(clone, repairedEntries[i][0], repairedEntries[i][1]);
+    }
+    return clone;
+  }
+  if (isSet(source) && isSet(clone)) {
+    const sourceValues = ArrayFrom(SetPrototypeValues(source));
+    const cloneValues = ArrayFrom(SetPrototypeValues(clone));
+    const repairedValues = [];
+    for (let i = 0; i < sourceValues.length; i++) {
+      ArrayPrototypePush(
+        repairedValues, repairClone(sourceValues[i], cloneValues[i], seen));
+    }
+    SetPrototypeClear(clone);
+    for (let i = 0; i < repairedValues.length; i++) {
+      SetPrototypeAdd(clone, repairedValues[i]);
+    }
+    return clone;
+  }
+  const prototype = ObjectGetPrototypeOf(source);
+  if (prototype === null) ObjectSetPrototypeOf(clone, null);
+  if (prototype !== null && prototype !== ObjectPrototype &&
+      !ArrayIsArray(source)) {
+    return clone;
+  }
+  const keys = ObjectKeys(source);
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    const descriptor = ObjectGetOwnPropertyDescriptor(source, key);
+    if (!ObjectPrototypeHasOwnProperty(descriptor, 'value')) continue;
+    const existing = ObjectGetOwnPropertyDescriptor(clone, key);
+    const value = repairClone(descriptor.value, existing?.value, seen);
+    if ((existing !== undefined && existing.value === value) ||
+        existing?.configurable === false) {
+      continue;
+    }
+    ObjectDefineProperty(clone, key, {
+      __proto__: null,
+      configurable: descriptor.configurable,
+      enumerable: descriptor.enumerable,
+      value,
+      writable: descriptor.writable,
+    });
+  }
+  if (ArrayIsArray(source)) {
+    const descriptor = ObjectGetOwnPropertyDescriptor(source, 'length');
+    ObjectSetPrototypeOf(descriptor, null);
+    ObjectDefineProperty(clone, 'length', descriptor);
+  }
+  return clone;
+}
+
+function cloneRecordData(data) {
+  let clone;
+  try {
+    clone = structuredClone(data);
+  } catch (error) {
+    if (data.error === undefined) throw error;
+    clone = structuredClone({ __proto__: null, ...data, error: undefined });
+    clone.error = deserializeError(serializeError(data.error));
+  }
+  try {
+    return repairClone(data, clone, new SafeMap());
+  } catch {
+    return clone;
+  }
+}
+
+class BenchmarksStream extends Readable {
+  #blocked = false;
+  #drainWaiters = [];
+  #hasReader = false;
+
+  constructor() {
+    super({
+      __proto__: null,
+      objectMode: true,
+    });
+  }
+
+  _read() {
+    if (this.#blocked) {
+      this.#blocked = false;
+      const waiters = this.#drainWaiters;
+      this.#drainWaiters = [];
+      for (let i = 0; i < waiters.length; i++) waiters[i].resolve();
+    }
+  }
+
+  read(size) {
+    if (size !== 0) this.#hasReader = true;
+    return super.read(size);
+  }
+
+  _destroy(error, callback) {
+    const failure = error ??
+      new ERR_INVALID_STATE('benchmark stream is closed');
+    const waiters = this.#drainWaiters;
+    this.#drainWaiters = [];
+    for (let i = 0; i < waiters.length; i++) waiters[i].reject(failure);
+    callback(error);
+  }
+
+  waitForDrain() {
+    if (this.destroyed) {
+      return PromiseReject(this.errored ??
+        new ERR_INVALID_STATE('benchmark stream is closed'));
+    }
+    if (!this.#blocked) return PromiseResolve();
+    const waiter = PromiseWithResolvers();
+    ArrayPrototypePush(this.#drainWaiters, waiter);
+    return waiter.promise;
+  }
+
+  plan(data) {
+    return this[kEmitMessage]('bench:plan', data);
+  }
+
+  start(data) {
+    return this[kEmitMessage]('bench:start', data);
+  }
+
+  sample(data) {
+    return this[kEmitMessage]('bench:sample', data);
+  }
+
+  complete(data) {
+    return this[kEmitMessage]('bench:complete', data);
+  }
+
+  diagnostic(data) {
+    return this[kEmitMessage]('bench:diagnostic', data);
+  }
+
+  summary(data) {
+    return this[kEmitMessage]('bench:summary', data);
+  }
+
+  end() {
+    return this.#tryPush(null);
+  }
+
+  [kEmitMessage](type, data) {
+    const recordData = cloneRecordData(data);
+    const record = { __proto__: null, type, data: recordData };
+    if (this.listenerCount(type) > 0) {
+      this.emit(type, cloneRecordData(recordData));
+    }
+    return this.#tryPush(record);
+  }
+
+  #tryPush(record) {
+    if (this.destroyed) return false;
+    const canPush = this.push(record);
+    if (record !== null && !canPush && this.#hasReader) {
+      this.#blocked = true;
+      return false;
+    }
+    return true;
+  }
+}
+
+module.exports = {
+  BenchmarksStream,
+};
diff --git a/lib/internal/bench_runner/cli.js b/lib/internal/bench_runner/cli.js
new file mode 100644
index 000000000000..96930ca56878
--- /dev/null
+++ b/lib/internal/bench_runner/cli.js
@@ -0,0 +1,1316 @@
+'use strict';
+
+const {
+  ArrayFrom,
+  ArrayIsArray,
+  ArrayPrototypeFilter,
+  ArrayPrototypeIncludes,
+  ArrayPrototypeJoin,
+  ArrayPrototypePush,
+  ArrayPrototypePushApply,
+  ArrayPrototypeSlice,
+  ArrayPrototypeSome,
+  ArrayPrototypeSort,
+  MathMax,
+  NumberIsFinite,
+  NumberIsSafeInteger,
+  ObjectGetOwnPropertyDescriptor,
+  ObjectGetPrototypeOf,
+  ObjectKeys,
+  ObjectPrototype,
+  ObjectPrototypeHasOwnProperty,
+  ObjectValues,
+  Promise,
+  PromisePrototypeThen,
+  PromiseReject,
+  PromiseResolve,
+  PromiseWithResolvers,
+  RegExp,
+  SafeMap,
+  SafePromiseAllReturnVoid,
+  SafeSet,
+  String,
+  StringPrototypeIndexOf,
+  StringPrototypeReplaceAll,
+  StringPrototypeSlice,
+  StringPrototypeStartsWith,
+  StringPrototypeToUpperCase,
+  SymbolDispose,
+  uncurryThis,
+} = primordials;
+const { Buffer } = require('buffer');
+const BufferToString = uncurryThis(Buffer.prototype.toString);
+const { spawn } = require('child_process');
+const { createWriteStream, statSync } = require('fs');
+const { Glob } = require('internal/fs/glob');
+const { getValidatedPath } = require('internal/fs/utils');
+const {
+  BenchmarksStream,
+} = require('internal/bench_runner/benchmarks_stream');
+const {
+  configureRunScope,
+  createRunId,
+  runInFileScope,
+  runBenchmarks,
+} = require('internal/bench_runner/harness');
+const { deserializeError, serializeError } = require('internal/error_serdes');
+const {
+  AbortError,
+  codes: {
+    ERR_ACCESS_DENIED,
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_ARG_VALUE,
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+const { addAbortListener } = require('internal/events/abort_listener');
+const {
+  getCLIOptionsInfo,
+  getOptionValue,
+  getOptionsAsFlagsFromBinding,
+} = require('internal/options');
+const permission = require('internal/process/permission');
+const { TIMEOUT_MAX } = require('internal/timers');
+const { kEmptyObject } = require('internal/util');
+const {
+  validateAbortSignal,
+  validateArray,
+  validateObject,
+  validateStringWithoutNullBytes,
+  validateUint32,
+} = require('internal/validators');
+const { pathToFileURL } = require('internal/url');
+const { pipeline } = require('stream/promises');
+const { resolve, sep } = require('path');
+const { clearTimeout, setTimeout } = require('timers');
+
+const console = require('internal/console/global');
+const esmLoader = require('internal/modules/esm/loader');
+const { bigint: hrtime } = process.hrtime;
+
+const kBuiltinDestinations = new SafeMap([
+  ['stdout', process.stdout],
+  ['stderr', process.stderr],
+]);
+const kBuiltinReporters = new SafeMap([
+  ['json', 'internal/bench_runner/reporter/json'],
+  ['spec', 'internal/bench_runner/reporter/spec'],
+]);
+const kChildAckMessageType = 'node:bench:ack';
+const kChildMessageType = 'node:bench:record';
+const kEventTypes = new SafeSet([
+  'bench:plan',
+  'bench:start',
+  'bench:sample',
+  'bench:complete',
+  'bench:diagnostic',
+  'bench:summary',
+]);
+const kFilterArgs = [
+  '--bench',
+  '--experimental-bench',
+  '--experimental-default-config-file',
+];
+const kFilterArgValues = [
+  '--bench-isolation',
+  '--bench-name-pattern',
+  '--bench-reporter',
+  '--bench-reporter-destination',
+  '--bench-samples',
+  '--bench-warmup',
+  '--experimental-config-file',
+];
+const kIncompatibleExecArgv = new SafeSet([
+  '--build-sea',
+  '--build-snapshot',
+  '--build-snapshot-config',
+  '--check',
+  '--completion-bash',
+  '--eval',
+  '--experimental-sea-config',
+  '--help',
+  '--help-all',
+  '--input-type',
+  '--interactive',
+  '--print',
+  '--prof-process',
+  '--run',
+  '--test',
+  '--version',
+  '--v8-options',
+  '--watch',
+  '--watch-path',
+  '-c',
+  '-e',
+  '-h',
+  '-i',
+  '-p',
+  '-v',
+]);
+const kExecArgvWithValue = new SafeSet([
+  '--eval',
+  '--input-type',
+  '--print',
+  '--run',
+  '--watch-path',
+  '-e',
+  '-p',
+]);
+const kIPCEnvironmentVariables = new SafeSet([
+  'NODE_CHANNEL_FD',
+  'NODE_CHANNEL_SERIALIZATION_MODE',
+  'NODE_BENCH_CONTEXT',
+  'NODE_BENCH_FILE_RUN_ID',
+  'NODE_BENCH_RUN_ID',
+  'NODE_OPTIONS',
+]);
+const kForceKillDelay = 1_000;
+
+function createBenchmarkFileList(patterns, cwd) {
+  if (patterns.length === 0) {
+    console.error('--bench requires at least one file or glob pattern');
+    return null;
+  }
+
+  const glob = new Glob(patterns, { __proto__: null, cwd });
+  const files = ArrayPrototypeFilter(glob.globSync(), (path) => {
+    try {
+      return statSync(resolve(cwd, path)).isFile();
+    } catch {
+      return false;
+    }
+  });
+  if (files.length === 0) {
+    console.error(`Could not find '${ArrayPrototypeJoin(patterns, ', ')}'`);
+    return null;
+  }
+  return ArrayPrototypeSort(files);
+}
+
+function createChildFileList(patterns, cwd) {
+  if (patterns.length !== 1) {
+    console.error('benchmark child process requires exactly one file');
+    return null;
+  }
+  const path = resolve(cwd, patterns[0]);
+  try {
+    if (statSync(path).isFile()) return [path];
+  } catch {
+    // Fall through to the standard not-found diagnostic.
+  }
+  console.error(`Could not find '${patterns[0]}'`);
+  return null;
+}
+
+function createFileScopes(files, options) {
+  const scopes = [];
+  for (let i = 0; i < files.length; i++) {
+    ArrayPrototypePush(scopes, {
+      __proto__: null,
+      entryFile: resolve(options.cwd, files[i]),
+      fileRunId: options.isChild && i === 0 &&
+        options.fileRunId !== undefined ? options.fileRunId : createRunId(),
+    });
+  }
+  return scopes;
+}
+
+function parseNamePattern(value) {
+  if (value.length === 0) return undefined;
+  try {
+    return new RegExp(value);
+  } catch (error) {
+    throw new ERR_INVALID_ARG_VALUE(
+      '--bench-name-pattern', value,
+      `is an invalid regular expression. ${error.message}`);
+  }
+}
+
+function parseCommandLine() {
+  const reporters = getOptionValue('--bench-reporter');
+  const destinations = getOptionValue('--bench-reporter-destination');
+  const isChild = process.env.NODE_BENCH_CONTEXT === 'child' &&
+    typeof process.send === 'function';
+
+  if (!isChild) {
+    if (reporters.length === 0 && destinations.length === 0) {
+      ArrayPrototypePush(reporters, 'spec');
+    }
+    if (reporters.length === 1 && destinations.length === 0) {
+      ArrayPrototypePush(destinations, 'stdout');
+    }
+    if (reporters.length !== destinations.length) {
+      throw new ERR_INVALID_ARG_VALUE(
+        '--bench-reporter', reporters,
+        'must match the number of specified ' +
+        "'--bench-reporter-destination'");
+    }
+  }
+
+  const samples = getOptionValue('[has_bench_samples]') ?
+    getOptionValue('--bench-samples') : undefined;
+  const warmup = getOptionValue('[has_bench_warmup]') ?
+    getOptionValue('--bench-warmup') : undefined;
+  if (samples !== undefined) {
+    validateUint32(samples, '--bench-samples', true);
+  }
+  if (warmup !== undefined) {
+    validateUint32(warmup, '--bench-warmup');
+  }
+
+  return {
+    __proto__: null,
+    cwd: process.cwd(),
+    destinations,
+    fileRunId: isChild && process.env.NODE_BENCH_FILE_RUN_ID ?
+      process.env.NODE_BENCH_FILE_RUN_ID : undefined,
+    isChild,
+    isolation: getOptionValue('--bench-isolation'),
+    namePattern: parseNamePattern(getOptionValue('--bench-name-pattern')),
+    namePatternSource: getOptionValue('--bench-name-pattern'),
+    reporters,
+    runId: isChild && process.env.NODE_BENCH_RUN_ID ?
+      process.env.NODE_BENCH_RUN_ID : undefined,
+    samples,
+    warmup,
+  };
+}
+
+async function loadReporter(name) {
+  const builtin = kBuiltinReporters.get(name);
+  let reporter;
+  if (builtin !== undefined) {
+    reporter = require(builtin);
+  } else {
+    let parentURL;
+    try {
+      parentURL = pathToFileURL(`${process.cwd()}${sep}`).href;
+    } catch {
+      parentURL = 'file:///';
+    }
+    const loader = esmLoader.getOrInitializeCascadedLoader();
+    reporter = await loader.import(name, parentURL, kEmptyObject);
+  }
+
+  reporter = reporter?.default ?? reporter;
+  if (reporter?.prototype &&
+      ObjectGetOwnPropertyDescriptor(reporter.prototype, 'constructor')) {
+    reporter = new reporter();
+  }
+  if (!reporter) {
+    throw new ERR_INVALID_ARG_VALUE(
+      '--bench-reporter', name, 'is not a valid reporter');
+  }
+  return reporter;
+}
+
+async function setupReporters(stream, reporters, destinations) {
+  const state = { __proto__: null, error: undefined, pending: [] };
+  try {
+    for (let i = 0; i < reporters.length; i++) {
+      const reporter = await loadReporter(reporters[i]);
+      const builtinDestination = kBuiltinDestinations.get(destinations[i]);
+      const destination = builtinDestination ??
+        createWriteStream(destinations[i], { __proto__: null, flush: true });
+      const pending = PromisePrototypeThen(pipeline(
+        stream,
+        reporter,
+        destination,
+        { __proto__: null, end: builtinDestination === undefined },
+      ), undefined, (error) => {
+        state.error ??= error;
+      });
+      ArrayPrototypePush(state.pending, pending);
+    }
+  } catch (error) {
+    stream.destroy();
+    await SafePromiseAllReturnVoid(state.pending);
+    throw error;
+  }
+  return state;
+}
+
+async function finishReporters(state) {
+  await SafePromiseAllReturnVoid(state.pending);
+  if (state.error !== undefined) throw state.error;
+}
+
+function emitRecord(stream, record) {
+  switch (record.type) {
+    case 'bench:plan':
+      return stream.plan(record.data);
+    case 'bench:start':
+      return stream.start(record.data);
+    case 'bench:sample':
+      return stream.sample(record.data);
+    case 'bench:complete':
+      return stream.complete(record.data);
+    case 'bench:diagnostic':
+      return stream.diagnostic(record.data);
+    case 'bench:summary':
+      return stream.summary(record.data);
+    default:
+      throw new ERR_INVALID_ARG_VALUE(
+        'benchmark event type', record.type, 'is not recognized');
+  }
+}
+
+function emitRecordAndWait(stream, record) {
+  if (stream.destroyed) {
+    return PromiseReject(stream.errored ??
+      new ERR_INVALID_STATE('benchmark output stream is closed'));
+  }
+  if (emitRecord(stream, record)) return undefined;
+  if (stream.destroyed) {
+    return PromiseReject(stream.errored ??
+      new ERR_INVALID_STATE('benchmark output stream is closed'));
+  }
+  return stream.waitForDrain();
+}
+
+function serializeRecord(record) {
+  if (record.data.error === undefined) return record;
+  return {
+    __proto__: null,
+    type: record.type,
+    data: {
+      __proto__: null,
+      ...record.data,
+      error: serializeError(record.data.error),
+    },
+  };
+}
+
+function deserializeRecord(record) {
+  if (record.data.error === undefined) return record;
+  return {
+    __proto__: null,
+    type: record.type,
+    data: {
+      __proto__: null,
+      ...record.data,
+      error: deserializeError(record.data.error),
+    },
+  };
+}
+
+function isStringArray(value) {
+  if (!ArrayIsArray(value)) return false;
+  for (let i = 0; i < value.length; i++) {
+    if (typeof value[i] !== 'string') return false;
+  }
+  return true;
+}
+
+function isContextDiagnostic(record) {
+  return record.type === 'bench:diagnostic' &&
+    (record.data.benchId !== undefined ||
+     record.data.phase !== undefined ||
+     record.data.index !== undefined ||
+     record.data.detail !== undefined);
+}
+
+function validateRecord(record) {
+  if (record === null || typeof record !== 'object' ||
+      !kEventTypes.has(record.type) || record.data === null ||
+      typeof record.data !== 'object' ||
+      typeof record.data.runId !== 'string' ||
+      (record.data.fileRunId !== null &&
+       typeof record.data.fileRunId !== 'string') ||
+      (record.data.entryFile !== null &&
+       typeof record.data.entryFile !== 'string')) {
+    throw new ERR_INVALID_ARG_VALUE(
+      'benchmark child message', record, 'is not a valid benchmark record');
+  }
+  const contextDiagnostic = isContextDiagnostic(record);
+  if ((record.type === 'bench:plan' || record.type === 'bench:start' ||
+       record.type === 'bench:sample' || record.type === 'bench:complete' ||
+       contextDiagnostic) &&
+      (typeof record.data.fileRunId !== 'string' ||
+       typeof record.data.benchId !== 'string' ||
+       (record.data.parentId !== null &&
+         typeof record.data.parentId !== 'string') ||
+        typeof record.data.name !== 'string' ||
+        !isStringArray(record.data.namePath))) {
+    throw new ERR_INVALID_ARG_VALUE(
+      'benchmark child message', record, 'is not a valid benchmark record');
+  }
+  if (record.type === 'bench:plan') {
+    const {
+      samples,
+      selected,
+      skip,
+      timeout,
+      warmup,
+      yieldBetweenSamples,
+    } = record.data;
+    if (!isStringArray(record.data.diagnosticChannels) ||
+        typeof record.data.file !== 'string' ||
+        !NumberIsSafeInteger(record.data.line) || record.data.line < 0 ||
+        !NumberIsSafeInteger(record.data.column) || record.data.column < 0 ||
+        !isStringArray(record.data.tags) ||
+        record.data.params === null ||
+        typeof record.data.params !== 'object' ||
+        ArrayIsArray(record.data.params) ||
+        (ObjectGetPrototypeOf(record.data.params) !== null &&
+         ObjectGetPrototypeOf(record.data.params) !== ObjectPrototype) ||
+        ArrayPrototypeSome(ObjectValues(record.data.params), (value) =>
+          typeof value !== 'string' && typeof value !== 'boolean' &&
+          (typeof value !== 'number' || !NumberIsFinite(value))) ||
+        !NumberIsSafeInteger(samples) || samples <= 0 ||
+        samples > 0xFFFFFFFF ||
+        !NumberIsSafeInteger(warmup) || warmup < 0 || warmup > 0xFFFFFFFF ||
+        (timeout !== null &&
+         (!NumberIsFinite(timeout) || timeout < 0 || timeout > TIMEOUT_MAX)) ||
+        typeof yieldBetweenSamples !== 'boolean' ||
+        typeof selected !== 'boolean' ||
+        (selected && skip !== undefined) ||
+        (!selected && skip !== true && typeof skip !== 'string')) {
+      throw new ERR_INVALID_ARG_VALUE(
+        'benchmark child plan', record.data,
+        'is not a valid benchmark plan');
+    }
+  }
+  if (contextDiagnostic &&
+      ((record.data.phase !== 'warmup' &&
+        record.data.phase !== 'measurement') ||
+       !NumberIsSafeInteger(record.data.index) || record.data.index < 0 ||
+       record.data.index > 0xFFFFFFFF ||
+       !ObjectPrototypeHasOwnProperty(record.data, 'message') ||
+       (record.data.level !== 'info' && record.data.level !== 'warning') ||
+       typeof record.data.file !== 'string' ||
+       !NumberIsSafeInteger(record.data.line) || record.data.line < 0 ||
+       !NumberIsSafeInteger(record.data.column) || record.data.column < 0 ||
+       record.data.error !== undefined)) {
+    throw new ERR_INVALID_ARG_VALUE(
+      'benchmark child diagnostic', record.data,
+      'is not a valid benchmark diagnostic');
+  }
+  if (record.type === 'bench:summary') {
+    const { counts, duration_ns, success } = record.data;
+    if (typeof success !== 'boolean' || typeof duration_ns !== 'bigint' ||
+        counts === null || typeof counts !== 'object' ||
+        !NumberIsSafeInteger(counts.completed) || counts.completed < 0 ||
+        !NumberIsSafeInteger(counts.failed) || counts.failed < 0 ||
+        !NumberIsSafeInteger(counts.skipped) || counts.skipped < 0 ||
+        !NumberIsSafeInteger(counts.total) || counts.total < 0) {
+      throw new ERR_INVALID_ARG_VALUE(
+        'benchmark child summary', record.data,
+        'is not a valid benchmark summary');
+    }
+  }
+  return record;
+}
+
+let nextChildRecordId = 0;
+let listeningForAcks = false;
+const pendingChildRecordAcks = new SafeMap();
+
+function listenForAcks() {
+  if (listeningForAcks) return;
+  listeningForAcks = true;
+  process.on('message', (message) => {
+    if (message?.type !== kChildAckMessageType) return;
+    const pending = pendingChildRecordAcks.get(message.id);
+    if (pending === undefined) return;
+    pendingChildRecordAcks.delete(message.id);
+    pending.resolve();
+  });
+  process.once('disconnect', () => {
+    const error = new ERR_INVALID_STATE(
+      'benchmark IPC channel closed before acknowledging records');
+    for (const pending of pendingChildRecordAcks.values()) {
+      pending.reject(error);
+    }
+    pendingChildRecordAcks.clear();
+  });
+}
+
+function sendRecord(record) {
+  listenForAcks();
+  const id = nextChildRecordId++;
+  const acknowledged = PromiseWithResolvers();
+  pendingChildRecordAcks.set(id, acknowledged);
+  try {
+    process.send({
+      __proto__: null,
+      id,
+      type: kChildMessageType,
+      record: serializeRecord(record),
+    }, undefined, undefined, (error) => {
+      if (error) {
+        pendingChildRecordAcks.delete(id);
+        acknowledged.reject(error);
+      }
+    });
+  } catch (error) {
+    pendingChildRecordAcks.delete(id);
+    acknowledged.reject(error);
+  }
+  return acknowledged.promise;
+}
+
+function sendAck(child, id) {
+  return new Promise((resolve, reject) => {
+    if (!child.connected) {
+      reject(new ERR_INVALID_STATE(
+        'benchmark child disconnected before acknowledgement'));
+      return;
+    }
+    child.send({ __proto__: null, id, type: kChildAckMessageType },
+               undefined, undefined, (error) => {
+                 if (error) reject(error);
+                 else resolve();
+               });
+  });
+}
+
+async function loadUserImports(options) {
+  const parentURL = pathToFileURL(`${options.cwd}${sep}`).href;
+  const loader = esmLoader.getOrInitializeCascadedLoader();
+  const userImports = getOptionValue('--import');
+  for (let i = 0; i < userImports.length; i++) {
+    await loader.import(userImports[i], parentURL, kEmptyObject);
+  }
+  return { __proto__: null, loader, parentURL };
+}
+
+async function loadBenchmarkFiles(files, options, modules, onRecord) {
+  const { loader, parentURL } = modules;
+  let loadFailed = false;
+  for (let i = 0; i < files.length; i++) {
+    const file = resolve(options.cwd, files[i]);
+    try {
+      await runInFileScope(options.fileScopes[i], () =>
+        loader.import(pathToFileURL(file), parentURL, kEmptyObject));
+    } catch (error) {
+      loadFailed = true;
+      await onRecord({
+        __proto__: null,
+        type: 'bench:diagnostic',
+        data: {
+          __proto__: null,
+          runId: options.runId,
+          ...options.fileScopes[i],
+          message: error?.message ?? String(error),
+          error,
+          level: 'error',
+          file,
+        },
+      });
+    }
+  }
+
+  const stream = runBenchmarks({
+    __proto__: null,
+    namePattern: options.namePattern,
+    samples: options.samples,
+    warmup: options.warmup,
+  }, true);
+  let summary;
+  for await (const record of stream) {
+    if (record.type === 'bench:summary' && (process.exitCode ?? 0) !== 0) {
+      const scope = files.length === 1 ? options.fileScopes[0] : {
+        __proto__: null,
+        entryFile: null,
+        fileRunId: null,
+      };
+      await onRecord({
+        __proto__: null,
+        type: 'bench:diagnostic',
+        data: {
+          __proto__: null,
+          runId: options.runId,
+          ...scope,
+          message: `Benchmark process set exit code ${process.exitCode}`,
+          level: 'error',
+          file: files.length === 1 ?
+            resolve(options.cwd, files[0]) : null,
+        },
+      });
+    }
+    if (record.type === 'bench:summary' &&
+        (loadFailed || (process.exitCode ?? 0) !== 0)) {
+      record.data.success = false;
+    }
+    if (record.type === 'bench:summary') {
+      record.data.file = files.length === 1 ?
+        resolve(options.cwd, files[0]) : null;
+      record.data.fileRunId = files.length === 1 ?
+        options.fileScopes[0].fileRunId : null;
+      record.data.entryFile = files.length === 1 ?
+        options.fileScopes[0].entryFile : null;
+      summary = record.data;
+    }
+    await onRecord(record);
+  }
+  return summary;
+}
+
+function filterExecArgv(arg, index, args) {
+  const name = getOptionName(arg);
+  return !ArrayPrototypeIncludes(kFilterArgs, name) &&
+    !ArrayPrototypeSome(kFilterArgValues, (option) => {
+      return name === option ||
+        (option !== '--experimental-config-file' &&
+         index > 0 &&
+         StringPrototypeIndexOf(args[index - 1], '=') === -1 &&
+         getOptionName(args[index - 1]) === option);
+    });
+}
+
+function getOptionName(arg) {
+  const equals = StringPrototypeIndexOf(arg, '=');
+  const name = equals === -1 ? arg : StringPrototypeSlice(arg, 0, equals);
+  return StringPrototypeReplaceAll(name, '_', '-');
+}
+
+function getRunFileOptionName(arg) {
+  if (StringPrototypeStartsWith(arg, '-') &&
+      !StringPrototypeStartsWith(arg, '--') && arg.length > 2) {
+    const shortName = StringPrototypeSlice(arg, 0, 2);
+    if (kIncompatibleExecArgv.has(shortName)) return shortName;
+  }
+  return getOptionName(arg);
+}
+
+function filterRunFileExecArgv(arg, index, args) {
+  if (!filterExecArgv(arg, index, args)) return false;
+  if (!StringPrototypeStartsWith(arg, '-') || arg === '-' || arg === '--') {
+    return false;
+  }
+  const name = getRunFileOptionName(arg);
+  if (kIncompatibleExecArgv.has(name)) return false;
+  if (index > 0) {
+    const previous = getRunFileOptionName(args[index - 1]);
+    if (kExecArgvWithValue.has(previous) &&
+        StringPrototypeIndexOf(args[index - 1], '=') === -1) {
+      return false;
+    }
+  }
+  return true;
+}
+
+function runFileOptionRequiresValue(arg) {
+  const equals = StringPrototypeIndexOf(arg, '=');
+  let name = getRunFileOptionName(arg);
+  const { aliases, options } = getCLIOptionsInfo();
+  let info = options.get(name);
+  if (info === undefined) {
+    const alias = aliases.get(name);
+    if (alias !== undefined) info = options.get(alias[0]);
+  }
+  if (info === undefined && StringPrototypeStartsWith(name, '--no-')) {
+    name = `--${StringPrototypeSlice(name, 5)}`;
+    info = options.get(name);
+  }
+  return info !== undefined && info.type >= 3 &&
+    (equals === -1 || equals === arg.length - 1);
+}
+
+const kOptionAliases = new SafeMap([
+  ['--loader', '--experimental-loader'],
+  ['-C', '--conditions'],
+  ['-r', '--require'],
+]);
+
+function getInheritedChildArgs() {
+  const nodeOptions = getOptionsAsFlagsFromBinding();
+  const args = ArrayPrototypeFilter(nodeOptions, filterExecArgv);
+  const nodeOptionNames = new SafeSet();
+  for (let i = 0; i < nodeOptions.length; i++) {
+    nodeOptionNames.add(getOptionName(nodeOptions[i]));
+  }
+  const unknownExecArgv = ArrayPrototypeFilter(
+    process.execArgv,
+    (arg, index, values) => {
+      if (!filterExecArgv(arg, index, values)) return false;
+      const optionName = getOptionName(arg);
+      const name = kOptionAliases.get(optionName) ?? optionName;
+      if (nodeOptionNames.has(name)) return false;
+      if (!StringPrototypeStartsWith(arg, '-') && index > 0) {
+        const previousName = getOptionName(values[index - 1]);
+        const previous = kOptionAliases.get(previousName) ?? previousName;
+        if (nodeOptionNames.has(previous)) return false;
+      }
+      return true;
+    },
+  );
+  ArrayPrototypePushApply(args, unknownExecArgv);
+  // Option serialization omits port 0, which would otherwise become 9229.
+  if (process.debugPort === 0) ArrayPrototypePush(args, '--inspect-port=0');
+  return args;
+}
+
+function getChildArgs(path, options) {
+  const args = options.execArgv === undefined ?
+    getInheritedChildArgs() : ArrayPrototypeSlice(options.execArgv);
+  ArrayPrototypePush(
+    args, '--experimental-bench', '--bench', '--bench-isolation=none');
+  if (options.namePatternSource.length > 0) {
+    ArrayPrototypePush(
+      args, `--bench-name-pattern=${options.namePatternSource}`);
+  }
+  if (options.samples !== undefined) {
+    ArrayPrototypePush(args, `--bench-samples=${options.samples}`);
+  }
+  if (options.warmup !== undefined) {
+    ArrayPrototypePush(args, `--bench-warmup=${options.warmup}`);
+  }
+  ArrayPrototypePush(args, '--', resolve(options.cwd, path));
+  return args;
+}
+
+async function runChild(path, options, scope, onRecord) {
+  if (options.signal?.aborted) {
+    return {
+      __proto__: null,
+      aborted: true,
+      error: new AbortError(undefined, {
+        __proto__: null,
+        cause: options.signal.reason,
+      }),
+    };
+  }
+  const resource = resolve(options.cwd, path);
+  if (permission.isEnabled() &&
+      !permission.has('fs.read', resource) &&
+      !permission.isAuditMode()) {
+    throw new ERR_ACCESS_DENIED(
+      'Access to this API has been restricted. Use --allow-fs-read to manage permissions.',
+      'FileSystemRead',
+      resource,
+    );
+  }
+  const child = spawn(
+    options.execPath ?? process.execPath,
+    getChildArgs(path, options),
+    {
+      __proto__: null,
+      cwd: options.cwd,
+      env: {
+        __proto__: null,
+        ...(options.env ?? process.env),
+        NODE_BENCH_CONTEXT: 'child',
+        NODE_BENCH_FILE_RUN_ID: scope.fileRunId,
+        NODE_BENCH_RUN_ID: options.runId,
+      },
+      serialization: 'advanced',
+      stdio: ['inherit', 'pipe', 'pipe', 'ipc'],
+    },
+  );
+  let childClosed = false;
+  let forceKillTimer;
+  const terminateChild = () => {
+    if (childClosed) return;
+    child.kill();
+    forceKillTimer ??= setTimeout(() => {
+      child.kill('SIGKILL');
+    }, kForceKillDelay);
+  };
+  const closed = PromiseWithResolvers();
+  let closeTracked = false;
+  let spawnError;
+  try {
+    child.once('close', (...status) => closed.resolve(status));
+    closeTracked = true;
+    child.once('error', (error) => {
+      spawnError ??= error;
+      terminateChild();
+    });
+  } catch (error) {
+    terminateChild();
+    if (closeTracked) {
+      try {
+        await closed.promise;
+      } catch {
+        // Preserve the setup error.
+      }
+    }
+    throw error;
+  }
+  let protocolError;
+  let abortError;
+  let aborted = false;
+  let activeBenchId;
+  let plansComplete = false;
+  let recordPending = false;
+  let summaryReceived = false;
+  let abortListener;
+  const closeListener = () => {
+    terminateChild();
+  };
+  try {
+    if (options.signal !== undefined) {
+      abortListener = addAbortListener(options.signal, () => {
+        aborted = true;
+        abortError = new AbortError(undefined, {
+          __proto__: null,
+          cause: options.signal.reason,
+        });
+        terminateChild();
+      });
+    }
+    options.output?.once('close', closeListener);
+    if (options.output?.destroyed) closeListener();
+  } catch (error) {
+    terminateChild();
+    try {
+      await closed.promise;
+    } catch {
+      // Preserve the setup error.
+    }
+    childClosed = true;
+    if (forceKillTimer !== undefined) clearTimeout(forceKillTimer);
+    abortListener?.[SymbolDispose]();
+    options.output?.removeListener('close', closeListener);
+    throw error;
+  }
+  const pendingRecords = new SafeSet();
+  const handleRecord = (record) => {
+    if (protocolError !== undefined) return;
+    try {
+      return onRecord(record);
+    } catch (error) {
+      protocolError = error;
+      terminateChild();
+    }
+  };
+  const trackPending = (pending, source) => {
+    if (pending === undefined) return;
+    source?.pause();
+    const tracked = PromisePrototypeThen(PromiseResolve(pending), () => {
+      pendingRecords.delete(tracked);
+      source?.resume();
+    }, (error) => {
+      pendingRecords.delete(tracked);
+      if (!aborted) protocolError ??= error;
+      terminateChild();
+    });
+    pendingRecords.add(tracked);
+  };
+  const reportOutput = (source, stream, message) => {
+    const pending = handleRecord({
+      __proto__: null,
+      type: 'bench:diagnostic',
+      data: {
+        __proto__: null,
+        runId: options.runId,
+        ...scope,
+        message,
+        level: 'info',
+        file: path,
+        stream,
+      },
+    });
+    trackPending(pending, source);
+  };
+  try {
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (data) => {
+      reportOutput(child.stdout, 'stdout', data);
+    });
+    child.stderr.on('data', (data) => {
+      reportOutput(child.stderr, 'stderr', data);
+    });
+    child.on('message', (message) => {
+      if (message?.type !== kChildMessageType) return;
+      try {
+        if (!NumberIsSafeInteger(message.id) || message.id < 0 || recordPending) {
+          throw new ERR_INVALID_ARG_VALUE(
+            'benchmark child message', message,
+            'does not have a valid record sequence');
+        }
+        recordPending = true;
+        const record = deserializeRecord(validateRecord(message.record));
+        const contextDiagnostic = isContextDiagnostic(record);
+        if (summaryReceived || (record.type === 'bench:plan' && plansComplete) ||
+            (record.type === 'bench:start' && activeBenchId !== undefined) ||
+            ((record.type === 'bench:sample' || contextDiagnostic) &&
+             activeBenchId !== record.data.benchId) ||
+            (record.type === 'bench:complete' && activeBenchId !== undefined &&
+             activeBenchId !== record.data.benchId) ||
+            (record.type === 'bench:summary' && activeBenchId !== undefined)) {
+          throw new ERR_INVALID_ARG_VALUE(
+            'benchmark child message', message,
+            'does not have a valid lifecycle sequence');
+        }
+        if (record.type !== 'bench:plan' &&
+            record.type !== 'bench:diagnostic') {
+          plansComplete = true;
+        }
+        if (record.type === 'bench:start') {
+          activeBenchId = record.data.benchId;
+        } else if (record.type === 'bench:complete' &&
+                   activeBenchId === record.data.benchId) {
+          activeBenchId = undefined;
+        }
+        if (record.type === 'bench:summary') summaryReceived = true;
+        record.data.runId = options.runId;
+        record.data.fileRunId = scope.fileRunId;
+        if (record.data.entryFile !== null) {
+          record.data.entryFile = scope.entryFile;
+        }
+        const pending = handleRecord(record);
+        if (protocolError === undefined) {
+          const acknowledged = PromisePrototypeThen(
+            PromiseResolve(pending), () => sendAck(child, message.id));
+          trackPending(PromisePrototypeThen(acknowledged, () => {
+            recordPending = false;
+          }));
+        }
+      } catch (error) {
+        if (!aborted) protocolError ??= error;
+        terminateChild();
+      }
+    });
+  } catch (error) {
+    terminateChild();
+    try {
+      await closed.promise;
+    } catch {
+      // Preserve the setup error.
+    }
+    childClosed = true;
+    if (forceKillTimer !== undefined) clearTimeout(forceKillTimer);
+    abortListener?.[SymbolDispose]();
+    options.output?.removeListener('close', closeListener);
+    throw error;
+  }
+  let status;
+  try {
+    status = await closed.promise;
+  } finally {
+    childClosed = true;
+    if (forceKillTimer !== undefined) clearTimeout(forceKillTimer);
+    abortListener?.[SymbolDispose]();
+    options.output?.removeListener('close', closeListener);
+  }
+  const { 0: code, 1: signal } = status;
+  await SafePromiseAllReturnVoid(ArrayFrom(pendingRecords));
+  if (!aborted && spawnError !== undefined) throw spawnError;
+  if (!aborted && protocolError !== undefined) throw protocolError;
+  return {
+    __proto__: null,
+    aborted,
+    code,
+    error: abortError,
+    signal,
+  };
+}
+
+async function runIsolated(files, options, output) {
+  const counts = {
+    __proto__: null,
+    completed: 0,
+    failed: 0,
+    skipped: 0,
+    total: 0,
+  };
+  const start = hrtime();
+  let success = true;
+
+  for (let i = 0; i < files.length; i++) {
+    const path = files[i];
+    const scope = options.fileScopes[i];
+    const observedCounts = {
+      __proto__: null,
+      completed: 0,
+      failed: 0,
+      skipped: 0,
+      total: 0,
+    };
+    let childSummary;
+    let result;
+    try {
+      result = await runChild(path, options, scope, (record) => {
+        if (record.type === 'bench:summary') {
+          childSummary = record.data;
+          return;
+        }
+        if (record.type === 'bench:plan') observedCounts.total++;
+        if (record.type === 'bench:complete') {
+          if (ObjectPrototypeHasOwnProperty(record.data, 'error')) {
+            observedCounts.failed++;
+          } else if (ObjectPrototypeHasOwnProperty(record.data, 'skip')) {
+            observedCounts.skipped++;
+          } else {
+            observedCounts.completed++;
+          }
+        }
+        return emitRecordAndWait(output, record);
+      });
+    } catch (error) {
+      success = false;
+      await emitRecordAndWait(output, {
+        __proto__: null,
+        type: 'bench:diagnostic',
+        data: {
+          __proto__: null,
+          runId: options.runId,
+          ...scope,
+          message: error.message,
+          error,
+          level: 'error',
+          file: path,
+        },
+      });
+      counts.completed += observedCounts.completed;
+      counts.failed += observedCounts.failed;
+      counts.skipped += observedCounts.skipped;
+      counts.total += MathMax(
+        observedCounts.total,
+        observedCounts.completed + observedCounts.failed +
+          observedCounts.skipped);
+      continue;
+    }
+
+    if (result.aborted) {
+      success = false;
+      await emitRecordAndWait(output, {
+        __proto__: null,
+        type: 'bench:diagnostic',
+        data: {
+          __proto__: null,
+          runId: options.runId,
+          ...scope,
+          message: result.error.message,
+          error: result.error,
+          level: 'error',
+          file: path,
+        },
+      });
+    }
+    if (childSummary !== undefined) {
+      success &&= childSummary.success;
+      counts.completed += childSummary.counts.completed;
+      counts.failed += childSummary.counts.failed;
+      counts.skipped += childSummary.counts.skipped;
+      counts.total += childSummary.counts.total;
+    } else {
+      counts.completed += observedCounts.completed;
+      counts.failed += observedCounts.failed;
+      counts.skipped += observedCounts.skipped;
+      counts.total += MathMax(
+        observedCounts.total,
+        observedCounts.completed + observedCounts.failed +
+          observedCounts.skipped);
+    }
+    if (!result.aborted && (childSummary === undefined || result.code !== 0 ||
+        result.signal !== null)) {
+      success = false;
+      if (childSummary === undefined || childSummary.success) {
+        const status = result.signal === null ?
+          `exit code ${result.code}` : `signal ${result.signal}`;
+        await emitRecordAndWait(output, {
+          __proto__: null,
+          type: 'bench:diagnostic',
+          data: {
+            __proto__: null,
+            runId: options.runId,
+            ...scope,
+            message: `Benchmark file '${path}' failed with ${status}`,
+            level: 'error',
+            file: path,
+          },
+        });
+      }
+    }
+  }
+
+  const scope = files.length === 1 ? options.fileScopes[0] : null;
+  const summary = {
+    __proto__: null,
+    runId: options.runId,
+    fileRunId: scope?.fileRunId ?? null,
+    entryFile: scope?.entryFile ?? null,
+    success: success && (options.useProcessExitCode === false ||
+      (process.exitCode ?? 0) === 0),
+    counts,
+    duration_ns: hrtime() - start,
+    file: files.length === 1 ? resolve(options.cwd, files[0]) : null,
+  };
+  await emitRecordAndWait(output, {
+    __proto__: null,
+    type: 'bench:summary',
+    data: summary,
+  });
+  return summary;
+}
+
+function runFile(path, options = kEmptyObject) {
+  path = getValidatedPath(path);
+  if (typeof path !== 'string') path = BufferToString(path);
+  const file = resolve(path);
+  validateObject(options, 'options');
+  const {
+    env = process.env,
+    execArgv,
+    signal,
+  } = options;
+  let childExecArgv;
+  if (execArgv !== undefined) {
+    validateArray(execArgv, 'options.execArgv');
+    childExecArgv = [];
+    const length = execArgv.length;
+    for (let i = 0; i < length; i++) {
+      const arg = execArgv[i];
+      validateStringWithoutNullBytes(arg, `options.execArgv[${i}]`);
+      if (!StringPrototypeStartsWith(arg, '-') || arg === '-' || arg === '--') {
+        throw new ERR_INVALID_ARG_VALUE(
+          `options.execArgv[${i}]`, arg,
+          'must be a Node.js command-line option');
+      }
+      if (kIncompatibleExecArgv.has(getRunFileOptionName(arg))) {
+        throw new ERR_INVALID_ARG_VALUE(
+          `options.execArgv[${i}]`, arg,
+          'is not compatible with benchmark execution');
+      }
+      if (runFileOptionRequiresValue(arg)) {
+        const equals = StringPrototypeIndexOf(arg, '=');
+        if (equals !== -1) {
+          throw new ERR_INVALID_ARG_VALUE(
+            `options.execArgv[${i}]`, arg,
+            'must include a non-empty value');
+        }
+        if (i + 1 >= length) {
+          throw new ERR_INVALID_ARG_VALUE(
+            `options.execArgv[${i}]`, arg,
+            'must be followed by a value');
+        }
+        ArrayPrototypePush(childExecArgv, arg);
+        i++;
+        const value = execArgv[i];
+        validateStringWithoutNullBytes(value, `options.execArgv[${i}]`);
+        if (value.length === 0) {
+          throw new ERR_INVALID_ARG_VALUE(
+            `options.execArgv[${i}]`, value,
+            'must not be empty');
+        }
+        ArrayPrototypePush(childExecArgv, value);
+        continue;
+      }
+      if (!StringPrototypeStartsWith(arg, '--') &&
+          StringPrototypeIndexOf(arg, '=') !== -1) {
+        throw new ERR_INVALID_ARG_VALUE(
+          `options.execArgv[${i}]`, arg,
+          'must not use = with a short option');
+      }
+      ArrayPrototypePush(childExecArgv, arg);
+    }
+    if (ArrayPrototypeFilter(childExecArgv, filterExecArgv).length !==
+        childExecArgv.length) {
+      throw new ERR_INVALID_ARG_VALUE(
+        'options.execArgv', childExecArgv,
+        'must not contain benchmark runner options');
+    }
+  } else {
+    childExecArgv = ArrayPrototypeFilter(
+      getInheritedChildArgs(), filterRunFileExecArgv);
+  }
+  validateObject(env, 'options.env');
+  const childEnv = { __proto__: null };
+  const envKeys = ObjectKeys(env);
+  for (let i = 0; i < envKeys.length; i++) {
+    const key = envKeys[i];
+    validateStringWithoutNullBytes(key, 'options.env key');
+    const value = env[key];
+    if (value === undefined) continue;
+    validateStringWithoutNullBytes(value, `options.env.${key}`);
+    if (kIPCEnvironmentVariables.has(StringPrototypeToUpperCase(key))) continue;
+    childEnv[key] = value;
+  }
+  validateAbortSignal(signal, 'options.signal');
+  if (signal !== undefined &&
+      (typeof signal.addEventListener !== 'function' ||
+       typeof signal.removeEventListener !== 'function')) {
+    throw new ERR_INVALID_ARG_TYPE('options.signal', 'AbortSignal', signal);
+  }
+
+  const runId = createRunId();
+  const scope = {
+    __proto__: null,
+    entryFile: file,
+    fileRunId: createRunId(),
+  };
+  const output = new BenchmarksStream();
+  const runOptions = {
+    __proto__: null,
+    cwd: process.cwd(),
+    env: childEnv,
+    execPath: process.execPath,
+    execArgv: childExecArgv,
+    fileScopes: [scope],
+    namePatternSource: '',
+    output,
+    runId,
+    signal,
+    useProcessExitCode: false,
+  };
+  const execution = PromisePrototypeThen(PromiseResolve(), () =>
+    (output.destroyed ? undefined : runIsolated([file], runOptions, output)));
+  PromisePrototypeThen(execution, () => output.end(),
+                       (error) => output.destroy(error));
+  return output;
+}
+
+async function run(patterns) {
+  const options = parseCommandLine();
+  const files = options.isChild ?
+    createChildFileList(patterns, options.cwd) :
+    createBenchmarkFileList(patterns, options.cwd);
+  if (files === null) return { __proto__: null, success: false };
+
+  options.runId ??= createRunId();
+  options.fileScopes = createFileScopes(files, options);
+  const scope = files.length === 1 ? options.fileScopes[0] : {
+    __proto__: null,
+    entryFile: null,
+    fileRunId: options.runId,
+  };
+  configureRunScope({
+    __proto__: null,
+    runId: options.runId,
+    ...scope,
+  });
+
+  if (options.isChild) {
+    try {
+      const modules = await loadUserImports(options);
+      return await loadBenchmarkFiles(
+        files, options, modules, sendRecord);
+    } finally {
+      if (process.connected) process.disconnect();
+    }
+  }
+
+  const output = new BenchmarksStream();
+  let executionError;
+  let reporterState;
+  let summary;
+  try {
+    options.modules = await loadUserImports(options);
+    reporterState = await setupReporters(
+      output, options.reporters, options.destinations);
+    if (options.isolation === 'process') {
+      summary = await runIsolated(files, options, output);
+    } else {
+      summary = await loadBenchmarkFiles(
+        files,
+        options,
+        options.modules,
+        (record) => emitRecordAndWait(output, record),
+      );
+    }
+  } catch (error) {
+    executionError = error;
+  } finally {
+    output.end();
+  }
+  if (reporterState !== undefined) await finishReporters(reporterState);
+  if (executionError !== undefined) throw executionError;
+  return summary;
+}
+
+module.exports = { run, runFile };
diff --git a/lib/internal/bench_runner/harness.js b/lib/internal/bench_runner/harness.js
new file mode 100644
index 000000000000..985440634217
--- /dev/null
+++ b/lib/internal/bench_runner/harness.js
@@ -0,0 +1,1139 @@
+'use strict';
+
+const {
+  ArrayPrototypePush,
+  ArrayPrototypeReverse,
+  ArrayPrototypeSlice,
+  BigInt,
+  FunctionPrototypeCall,
+  JSONStringify,
+  MathCeil,
+  Number,
+  Promise,
+  PromisePrototypeThen,
+  PromiseResolve,
+  PromiseWithResolvers,
+  ReflectApply,
+  RegExp,
+  RegExpPrototypeExec,
+  SafeMap,
+  SafePromiseRace,
+  String,
+  SymbolDispose,
+} = primordials;
+const { getCallerLocation } = internalBinding('util');
+const { exitCodes: { kGenericUserError } } = internalBinding('errors');
+const { AsyncLocalStorage } = require('async_hooks');
+const {
+  subscribe: subscribeToChannel,
+  unsubscribe: unsubscribeFromChannel,
+} = require('diagnostics_channel');
+const { AbortController } = require('internal/abort_controller');
+const {
+  AbortError,
+  codes: {
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_STATE,
+    ERR_OPERATION_FAILED,
+  },
+} = require('internal/errors');
+const { addAbortListener } = require('internal/events/abort_listener');
+const {
+  kEmptyObject,
+} = require('internal/util');
+const { isRegExp } = require('internal/util/types');
+const {
+  validateAbortSignal,
+  validateBoolean,
+  validateFunction,
+  validateObject,
+  validateUint32,
+} = require('internal/validators');
+const { queueMicrotask } = require('internal/process/task_queues');
+const { getOptionValue } = require('internal/options');
+const { clearTimeout, setImmediate, setTimeout } = require('timers');
+const {
+  Bench,
+  BenchContext,
+  Suite,
+  normalizeArgs,
+  summarizeSamples,
+} = require('internal/bench_runner/benchmark');
+const {
+  BenchmarksStream,
+} = require('internal/bench_runner/benchmarks_stream');
+
+const { bigint: hrtime } = process.hrtime;
+const kCancellationGracePeriod = 100;
+const kHookNames = ['after', 'afterEach', 'before', 'beforeEach'];
+const kIsCliRunner = getOptionValue('--bench');
+let nextRunId = 0;
+
+function createRunId() {
+  return `${process.pid}:${String(hrtime())}:${nextRunId++}`;
+}
+
+function eventLoopTurn() {
+  return new Promise((resolve) => setImmediate(resolve));
+}
+
+async function settlesPromptly(work) {
+  const timeout = PromiseWithResolvers();
+  const timer = setTimeout(
+    () => timeout.resolve(false), kCancellationGracePeriod);
+  try {
+    return await SafePromiseRace([
+      PromisePrototypeThen(work, () => true, () => true),
+      timeout.promise,
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function createAbortError(signal) {
+  return new AbortError(undefined, { __proto__: null, cause: signal.reason });
+}
+
+function createTimeoutError(benchmark) {
+  return new ERR_OPERATION_FAILED(
+    `Benchmark timed out after ${benchmark.timeout}ms`);
+}
+
+class Harness {
+  #abortReason = null;
+  #autoRun;
+  #buildPromises = [];
+  #duplicateErrors = new SafeMap();
+  #explicitRun = false;
+  #fileScopeStorage = new AsyncLocalStorage();
+  #hasOnly = false;
+  #runPromise = null;
+  #scheduled = false;
+  #starting = false;
+  #storage = new AsyncLocalStorage();
+  #yieldBetweenSamples;
+
+  constructor(options = kEmptyObject) {
+    validateObject(options, 'options');
+    const {
+      autoRun = true,
+      yieldBetweenSamples = true,
+    } = options;
+    validateBoolean(autoRun, 'options.autoRun');
+    validateBoolean(
+      yieldBetweenSamples, 'options.yieldBetweenSamples');
+    this.#autoRun = autoRun;
+    this.#yieldBetweenSamples = yieldBetweenSamples;
+    this.runId = createRunId();
+    this.fileRunId = this.runId;
+    this.entryFile = process.argv?.[1] ?? null;
+    this.stream = new BenchmarksStream();
+    this.state = 'collecting';
+    this.namePattern = null;
+    this.outerSignal = undefined;
+    this.samples = undefined;
+    this.success = true;
+    this.warmup = undefined;
+    this.counts = {
+      __proto__: null,
+      completed: 0,
+      failed: 0,
+      skipped: 0,
+      total: 0,
+    };
+    this.root = new Suite(
+      this,
+      null,
+      '<root>',
+      kEmptyObject,
+      undefined,
+      undefined,
+      true,
+    );
+  }
+
+  getFileScope() {
+    return this.#fileScopeStorage.getStore() ?? null;
+  }
+
+  runInFileScope(scope, fn) {
+    return this.#fileScopeStorage.run(scope, fn);
+  }
+
+  setRunScope({ entryFile, fileRunId, runId }) {
+    if (this.state !== 'collecting') {
+      throw new ERR_INVALID_STATE(
+        'benchmark execution scope cannot change after execution has started');
+    }
+    this.entryFile = entryFile;
+    this.fileRunId = fileRunId;
+    this.runId = runId;
+  }
+
+  #ensureCollecting() {
+    if (this.state === 'building' &&
+        this.#storage.getStore() instanceof Suite) return;
+    if (!this.#explicitRun && !this.#starting &&
+        this.state === 'collecting') return;
+    throw new ERR_INVALID_STATE(
+      'benchmarks cannot be declared after execution has started');
+  }
+
+  #getParent() {
+    const current = this.#storage.getStore();
+    return current instanceof Suite ? current : this.root;
+  }
+
+  createBench(name, options, fn, overrides = kEmptyObject) {
+    this.#ensureCollecting();
+    const normalized = normalizeArgs('benchmark', name, options, fn);
+    const parent = this.#getParent();
+    const benchmark = new Bench(
+      this,
+      parent,
+      normalized.name,
+      { __proto__: null, ...normalized.options, ...overrides },
+      normalized.fn,
+      overrides.loc,
+    );
+    ArrayPrototypePush(parent.children, benchmark);
+    this.#schedule();
+    return parent.isRoot ? benchmark.completion.promise : PromiseResolve();
+  }
+
+  createSuite(name, options, fn, overrides = kEmptyObject) {
+    this.#ensureCollecting();
+    const normalized = normalizeArgs('suite', name, options, fn);
+    const parent = this.#getParent();
+    const suite = new Suite(
+      this,
+      parent,
+      normalized.name,
+      { __proto__: null, ...normalized.options, ...overrides },
+      normalized.fn,
+      overrides.loc,
+    );
+    ArrayPrototypePush(parent.children, suite);
+    this.#buildSuite(suite);
+    this.#schedule();
+    return parent.isRoot ? suite.completion.promise : PromiseResolve();
+  }
+
+  createHook(name, fn, options = kEmptyObject) {
+    this.#ensureCollecting();
+    validateFunction(fn, 'hook function');
+    validateObject(options, 'options');
+    const parent = this.#getParent();
+    ArrayPrototypePush(parent.hooks[name], {
+      __proto__: null,
+      fileScope: parent.isRoot ? this.getFileScope() : parent.fileScope,
+      fn,
+      loc: getCallerLocation(),
+    });
+    this.#schedule();
+  }
+
+  #buildSuite(suite) {
+    let result;
+    try {
+      result = suite.runInAsyncScope(() => this.#storage.run(
+        suite,
+        () => FunctionPrototypeCall(suite.fn),
+      ));
+    } catch (error) {
+      suite.buildError = error;
+      result = undefined;
+    }
+
+    suite.buildPromise = PromisePrototypeThen(
+      PromiseResolve(result),
+      undefined,
+      (error) => {
+        suite.buildError = error;
+      },
+    );
+    ArrayPrototypePush(this.#buildPromises, suite.buildPromise);
+  }
+
+  configure(options = kEmptyObject) {
+    validateObject(options, 'options');
+
+    const {
+      namePattern,
+      samples,
+      signal,
+      warmup,
+      yieldBetweenSamples,
+    } = options;
+    let nextNamePattern = this.namePattern;
+    let nextSamples = this.samples;
+    let nextWarmup = this.warmup;
+    let nextYieldBetweenSamples = this.#yieldBetweenSamples;
+    if (namePattern !== undefined) {
+      if (typeof namePattern === 'string') {
+        nextNamePattern = new RegExp(namePattern);
+      } else if (isRegExp(namePattern)) {
+        nextNamePattern = new RegExp(namePattern);
+      } else {
+        throw new ERR_INVALID_ARG_TYPE(
+          'options.namePattern', ['string', 'RegExp'], namePattern);
+      }
+    }
+    if (samples !== undefined) {
+      validateUint32(samples, 'options.samples', true);
+      nextSamples = samples;
+    }
+    validateAbortSignal(signal, 'options.signal');
+    if (warmup !== undefined) {
+      validateUint32(warmup, 'options.warmup');
+      nextWarmup = warmup;
+    }
+    if (yieldBetweenSamples !== undefined) {
+      validateBoolean(
+        yieldBetweenSamples, 'options.yieldBetweenSamples');
+      nextYieldBetweenSamples = yieldBetweenSamples;
+    }
+
+    this.namePattern = nextNamePattern;
+    this.samples = nextSamples;
+    this.outerSignal = signal;
+    this.warmup = nextWarmup;
+    this.#yieldBetweenSamples = nextYieldBetweenSamples;
+  }
+
+  #ensureCanRun() {
+    if (this.#explicitRun || this.#starting || this.state !== 'collecting') {
+      throw new ERR_INVALID_STATE('benchmark execution has already started');
+    }
+  }
+
+  run(options = kEmptyObject, force = false) {
+    if (kIsCliRunner && !force) {
+      throw new ERR_INVALID_STATE(
+        'run() cannot be called from a file run with --bench');
+    }
+    this.#ensureCanRun();
+    this.#starting = true;
+    try {
+      this.configure(options);
+      this.#explicitRun = true;
+    } finally {
+      this.#starting = false;
+    }
+    this.#schedule(force, true);
+    return this.stream;
+  }
+
+  #schedule(force = false, explicit = false) {
+    if (!force && kIsCliRunner) return;
+    if (!explicit && !this.#autoRun) return;
+    if (this.#scheduled) return;
+    this.#scheduled = true;
+    queueMicrotask(() => {
+      if (this.#runPromise === null) {
+        if (!this.#explicitRun) this.stream.resume();
+        this.#runPromise = PromisePrototypeThen(
+          this.#execute(), undefined, (error) => this.#recover(error));
+      }
+    });
+  }
+
+  async #recover(error) {
+    this.#settleSubtree(this.root, error);
+    if (this.state !== 'finished') {
+      try {
+        await this.#diagnostic(error, undefined, 'error');
+      } catch {
+        // The stream can fail while reporting the original error.
+      }
+    }
+    try {
+      await this.#finish();
+    } catch {
+      // Stream failure has already been reported to its consumer.
+    }
+  }
+
+  #settleSubtree(node, error) {
+    for (let i = 0; i < node.children.length; i++) {
+      const child = node.children[i];
+      if (child.finished) continue;
+      if (child instanceof Suite) {
+        this.#settleSubtree(child, error);
+        child.finished = true;
+        child.completion.resolve();
+      } else {
+        this.success = false;
+        this.counts.failed++;
+        const result = this.#createResult(
+          child, [], { __proto__: null, error });
+        child.finished = true;
+        child.result = result;
+        child.completion.resolve(result);
+      }
+      child.emitDestroy();
+    }
+  }
+
+  async #waitForBuild() {
+    for (let i = 0; i < this.#buildPromises.length; i++) {
+      await this.#buildPromises[i];
+    }
+  }
+
+  #walk(node, callback) {
+    for (let i = 0; i < node.children.length; i++) {
+      const child = node.children[i];
+      callback(child);
+      if (child instanceof Suite) this.#walk(child, callback);
+    }
+  }
+
+  #prepare() {
+    const identities = new SafeMap();
+    this.#walk(this.root, (node) => {
+      if (node.only) this.#hasOnly = true;
+      if (!(node instanceof Bench)) return;
+
+      this.counts.total++;
+      const identity = JSONStringify([
+        this.#getRecordScope(node).fileRunId,
+        node.benchId,
+      ]);
+      const existing = identities.get(identity);
+      if (existing === undefined) {
+        identities.set(identity, node);
+      } else {
+        this.#duplicateErrors.set(node, new ERR_INVALID_STATE(
+          `duplicate benchmark identity for "${node.fullName}"`));
+      }
+    });
+  }
+
+  async #emitPlans() {
+    const benchmarks = [];
+    this.#walk(this.root, (node) => {
+      if (node instanceof Bench) ArrayPrototypePush(benchmarks, node);
+    });
+    for (let i = 0; i < benchmarks.length; i++) {
+      const benchmark = benchmarks[i];
+      const skip = this.#getSkip(benchmark);
+      const data = {
+        __proto__: null,
+        ...this.#getRecordScope(benchmark),
+        benchId: benchmark.benchId,
+        parentId: benchmark.parentId,
+        name: benchmark.name,
+        namePath: ArrayPrototypeSlice(benchmark.namePath),
+        diagnosticChannels: ArrayPrototypeSlice(benchmark.diagnosticChannels),
+        file: benchmark.loc.file,
+        line: benchmark.loc.line,
+        column: benchmark.loc.column,
+        tags: ArrayPrototypeSlice(benchmark.tags),
+        params: benchmark.params,
+        samples: this.samples ?? benchmark.samples,
+        warmup: this.warmup ?? benchmark.warmup,
+        timeout: benchmark.timeout === Infinity ? null : benchmark.timeout,
+        yieldBetweenSamples: this.#yieldBetweenSamples,
+        selected: skip === null,
+      };
+      if (skip !== null) data.skip = skip;
+      await this.#waitForStream(this.stream.plan(data));
+    }
+  }
+
+  #hasSelectedAncestor(benchmark) {
+    for (let current = benchmark; current !== null; current = current.parent) {
+      if (current.only) return true;
+    }
+    return false;
+  }
+
+  #getSkip(benchmark) {
+    for (let current = benchmark; current !== null; current = current.parent) {
+      if (current.skip !== undefined && current.skip !== false) {
+        return current.skip;
+      }
+    }
+    if (this.#hasOnly && !this.#hasSelectedAncestor(benchmark)) return 'only';
+    if (this.namePattern !== null) {
+      this.namePattern.lastIndex = 0;
+      if (RegExpPrototypeExec(this.namePattern, benchmark.fullName) === null) {
+        return 'name pattern';
+      }
+    }
+    return null;
+  }
+
+  #suiteHasActiveBench(suite) {
+    for (let i = 0; i < suite.children.length; i++) {
+      const child = suite.children[i];
+      if (child instanceof Suite) {
+        if (this.#suiteHasActiveBench(child)) return true;
+      } else if (this.#getSkip(child) === null) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  async #invoke(resource, store, fn, args) {
+    const result = resource.runInAsyncScope(() => this.#storage.run(
+      store,
+      () => ReflectApply(fn, undefined, args),
+    ));
+    return PromiseResolve(result);
+  }
+
+  async #runHooks(suite, name, resource, store, context) {
+    const hooks = suite.hooks[name];
+    for (let i = 0; i < hooks.length; i++) {
+      await this.#invoke(resource, store, hooks[i].fn, [context]);
+    }
+  }
+
+  async #runSuiteHooks(suite, name) {
+    const context = {
+      __proto__: null,
+      name: suite.name,
+      signal: this.outerSignal,
+    };
+    const hooks = suite.hooks[name];
+    for (let i = 0; i < hooks.length; i++) {
+      try {
+        await this.#invoke(suite, suite, hooks[i].fn, [context]);
+      } catch (error) {
+        return { __proto__: null, error, hook: hooks[i] };
+      }
+    }
+    return null;
+  }
+
+  #getRecordScope(node = undefined) {
+    const scope = node?.fileScope;
+    if (scope !== null && scope !== undefined) {
+      return {
+        __proto__: null,
+        runId: this.runId,
+        fileRunId: scope.fileRunId,
+        entryFile: scope.entryFile,
+      };
+    }
+    if (node !== undefined && kIsCliRunner) {
+      return {
+        __proto__: null,
+        runId: this.runId,
+        fileRunId: this.fileRunId,
+        entryFile: null,
+      };
+    }
+    return {
+      __proto__: null,
+      runId: this.runId,
+      fileRunId: this.fileRunId,
+      entryFile: this.entryFile,
+    };
+  }
+
+  async #waitForStream(canContinue) {
+    if (canContinue) return;
+    try {
+      await this.stream.waitForDrain();
+    } catch (error) {
+      if (!this.stream.destroyed) throw error;
+    }
+  }
+
+  async #diagnostic(error, loc, level = 'info', node = undefined) {
+    this.success = false;
+    await this.#waitForStream(this.stream.diagnostic({
+      __proto__: null,
+      ...this.#getRecordScope(node),
+      message: error?.message ?? `${error}`,
+      error,
+      level,
+      file: loc?.file ?? loc?.[2],
+      line: loc?.line ?? loc?.[0],
+      column: loc?.column ?? loc?.[1],
+    }));
+  }
+
+  async #emitSampleDiagnostics(benchmark, phase, index, diagnostics) {
+    for (let i = 0; i < diagnostics.length; i++) {
+      const diagnostic = diagnostics[i];
+      const data = {
+        __proto__: null,
+        ...this.#getRecordScope(benchmark),
+        benchId: benchmark.benchId,
+        parentId: benchmark.parentId,
+        name: benchmark.name,
+        namePath: ArrayPrototypeSlice(benchmark.namePath),
+        phase,
+        index,
+        message: diagnostic.message,
+        level: diagnostic.level,
+        file: benchmark.loc.file,
+        line: benchmark.loc.line,
+        column: benchmark.loc.column,
+      };
+      if (diagnostic.detail !== undefined) data.detail = diagnostic.detail;
+      await this.#waitForStream(this.stream.diagnostic(data));
+    }
+  }
+
+  async #completeSubtree(node, error) {
+    for (let i = 0; i < node.children.length; i++) {
+      const child = node.children[i];
+      if (child instanceof Suite) {
+        await this.#completeSubtree(child, error);
+        child.finished = true;
+        child.completion.resolve();
+        child.emitDestroy();
+      } else {
+        await this.#executeBench(child, error);
+      }
+    }
+  }
+
+  async #executeSuite(suite) {
+    if (this.#abortReason !== null) {
+      await this.#completeSubtree(suite, this.#abortReason);
+      suite.finished = true;
+      suite.completion.resolve();
+      if (!suite.isRoot) suite.emitDestroy();
+      return;
+    }
+
+    if (suite.buildError !== null) {
+      await this.#diagnostic(suite.buildError, suite.loc, 'error', suite);
+      await this.#completeSubtree(suite, suite.buildError);
+      suite.finished = true;
+      suite.completion.resolve();
+      suite.emitDestroy();
+      return;
+    }
+
+    const active = this.#suiteHasActiveBench(suite);
+    let beforeError;
+    if (active) {
+      const failure = await this.#runSuiteHooks(suite, 'before');
+      if (failure !== null) {
+        beforeError = failure.error;
+        await this.#diagnostic(
+          failure.error, failure.hook.loc, 'error', failure.hook);
+      }
+    }
+
+    if (beforeError !== undefined) {
+      await this.#completeSubtree(suite, beforeError);
+    } else {
+      for (let i = 0; i < suite.children.length; i++) {
+        const child = suite.children[i];
+        if (child instanceof Suite) {
+          await this.#executeSuite(child);
+        } else {
+          await this.#executeBench(child);
+        }
+      }
+    }
+
+    if (active && this.#abortReason === null) {
+      const failure = await this.#runSuiteHooks(suite, 'after');
+      if (failure !== null) {
+        await this.#diagnostic(
+          failure.error, failure.hook.loc, 'error', failure.hook);
+      }
+    }
+    suite.finished = true;
+    suite.completion.resolve();
+    if (!suite.isRoot) suite.emitDestroy();
+  }
+
+  #getHookSuites(benchmark) {
+    const suites = [];
+    for (let current = benchmark.parent; current !== null; current = current.parent) {
+      ArrayPrototypePush(suites, current);
+    }
+    ArrayPrototypeReverse(suites);
+    return suites;
+  }
+
+  async #runBenchHooks(benchmark, name, context) {
+    const suites = this.#getHookSuites(benchmark);
+    if (name === 'afterEach') ArrayPrototypeReverse(suites);
+    for (let i = 0; i < suites.length; i++) {
+      await this.#runHooks(
+        suites[i], name, benchmark, benchmark, context);
+    }
+  }
+
+  async #runWithStop(benchmark, controller, callback, deadline) {
+    const signals = [];
+    if (this.outerSignal !== undefined) {
+      ArrayPrototypePush(signals, this.outerSignal);
+    }
+    if (benchmark.outerSignal !== undefined &&
+        benchmark.outerSignal !== this.outerSignal) {
+      ArrayPrototypePush(signals, benchmark.outerSignal);
+    }
+
+    for (let i = 0; i < signals.length; i++) {
+      if (signals[i].aborted) {
+        const error = createAbortError(signals[i]);
+        controller.abort(error);
+        throw error;
+      }
+    }
+
+    const stop = PromiseWithResolvers();
+    const listeners = [];
+    let pausedWork;
+    let timer;
+    for (let i = 0; i < signals.length; i++) {
+      const signal = signals[i];
+      ArrayPrototypePush(listeners, addAbortListener(signal, () => {
+        const error = createAbortError(signal);
+        controller.abort(error);
+        stop.reject(error);
+      }));
+    }
+    const armTimer = () => {
+      let remaining = deadline.value - hrtime();
+      if (remaining < 0n) remaining = 0n;
+      timer = setTimeout(() => {
+        const error = createTimeoutError(benchmark);
+        controller.abort(error);
+        stop.reject(error);
+      }, Number(remaining) / 1e6);
+    };
+    if (deadline !== null) armTimer();
+
+    const pause = (work) => {
+      pausedWork = (async () => {
+        if (deadline === null) return work();
+        clearTimeout(timer);
+        timer = undefined;
+        const start = hrtime();
+        try {
+          return await work();
+        } finally {
+          deadline.value += hrtime() - start;
+          if (!controller.signal.aborted) armTimer();
+        }
+      })();
+      return pausedWork;
+    };
+
+    const work = callback(pause);
+    try {
+      if (signals.length === 0 && timer === undefined) return await work;
+      return await SafePromiseRace([work, stop.promise]);
+    } catch (error) {
+      try {
+        await pausedWork;
+      } catch {
+        // Preserve the error that stopped benchmark execution.
+      }
+      if (!await settlesPromptly(work) && this.#abortReason === null) {
+        this.#abortReason = new AbortError(
+          'The benchmark run was aborted because asynchronous work did not ' +
+          'settle after cancellation',
+          { __proto__: null, cause: error },
+        );
+      }
+      throw error;
+    } finally {
+      if (timer !== undefined) clearTimeout(timer);
+      for (let i = 0; i < listeners.length; i++) {
+        listeners[i][SymbolDispose]();
+      }
+    }
+  }
+
+  async #runSample(benchmark, signal, phase, index) {
+    const diagnostics = [];
+    const context = new BenchContext(
+      benchmark, signal, phase, index,
+      (diagnostic) => ArrayPrototypePush(diagnostics, diagnostic));
+    const channels = benchmark.diagnosticChannels;
+    let abortSubscription;
+    let diagnosticError;
+    let diagnosticFailed = false;
+    let subscribed = 0;
+    const onMessage = (message, name) => {
+      if (signal.aborted || diagnosticFailed) return;
+      try {
+        context.diagnostic({ __proto__: null, name, message });
+      } catch (error) {
+        diagnosticError = error;
+        diagnosticFailed = true;
+      }
+    };
+    const unsubscribe = () => {
+      while (subscribed > 0) {
+        subscribed--;
+        unsubscribeFromChannel(channels[subscribed], onMessage);
+      }
+    };
+    try {
+      for (let i = 0; i < channels.length; i++) {
+        subscribeToChannel(channels[i], onMessage);
+        subscribed++;
+      }
+      if (subscribed > 0) {
+        abortSubscription = addAbortListener(signal, unsubscribe);
+      }
+      await this.#invoke(
+        benchmark, benchmark, benchmark.fn, [context]);
+      if (diagnosticFailed) throw diagnosticError;
+      const { done, sample } = context.finish();
+      return {
+        __proto__: null,
+        diagnostics,
+        done,
+        failed: false,
+        sample,
+      };
+    } catch (error) {
+      context.close();
+      return {
+        __proto__: null,
+        diagnostics,
+        error,
+        failed: true,
+      };
+    } finally {
+      abortSubscription?.[SymbolDispose]();
+      unsubscribe();
+    }
+  }
+
+  #createResult(benchmark, samples, extra = kEmptyObject) {
+    return {
+      __proto__: null,
+      ...this.#getRecordScope(benchmark),
+      benchId: benchmark.benchId,
+      parentId: benchmark.parentId,
+      name: benchmark.name,
+      namePath: ArrayPrototypeSlice(benchmark.namePath),
+      file: benchmark.loc.file,
+      line: benchmark.loc.line,
+      column: benchmark.loc.column,
+      tags: ArrayPrototypeSlice(benchmark.tags),
+      params: benchmark.params,
+      samples,
+      ...extra,
+    };
+  }
+
+  async #recordResult(benchmark, result) {
+    benchmark.finished = true;
+    benchmark.result = result;
+    let canContinue;
+    try {
+      canContinue = this.stream.complete(result);
+    } finally {
+      benchmark.completion.resolve(result);
+      benchmark.emitDestroy();
+    }
+    await this.#waitForStream(canContinue);
+  }
+
+  async #executeBench(benchmark, forcedError = undefined) {
+    const duplicateError = this.#duplicateErrors.get(benchmark);
+    if (duplicateError !== undefined) {
+      this.success = false;
+      this.counts.failed++;
+      await this.#recordResult(benchmark, this.#createResult(
+        benchmark,
+        [],
+        { __proto__: null, error: duplicateError },
+      ));
+      return;
+    }
+
+    const skip = this.#getSkip(benchmark);
+    if (skip !== null) {
+      this.counts.skipped++;
+      await this.#recordResult(benchmark, this.#createResult(
+        benchmark,
+        [],
+        { __proto__: null, skip },
+      ));
+      return;
+    }
+
+    if (this.#abortReason !== null) forcedError = this.#abortReason;
+    if (forcedError !== undefined) {
+      this.success = false;
+      this.counts.failed++;
+      await this.#recordResult(benchmark, this.#createResult(
+        benchmark,
+        [],
+        { __proto__: null, error: forcedError },
+      ));
+      return;
+    }
+
+    await this.#waitForStream(this.stream.start({
+      __proto__: null,
+      ...this.#getRecordScope(benchmark),
+      benchId: benchmark.benchId,
+      parentId: benchmark.parentId,
+      name: benchmark.name,
+      namePath: ArrayPrototypeSlice(benchmark.namePath),
+      file: benchmark.loc.file,
+      line: benchmark.loc.line,
+      column: benchmark.loc.column,
+      tags: ArrayPrototypeSlice(benchmark.tags),
+      params: benchmark.params,
+    }));
+
+    const controller = new AbortController();
+    const deadline = benchmark.timeout === Infinity ? null : {
+      __proto__: null,
+      value: hrtime() + BigInt(MathCeil(benchmark.timeout * 1e6)),
+    };
+    const checkDeadline = () => {
+      if (deadline !== null && hrtime() >= deadline.value) {
+        const timeoutError = createTimeoutError(benchmark);
+        controller.abort(timeoutError);
+        throw timeoutError;
+      }
+    };
+    const samples = [];
+    const hookContext = {
+      __proto__: null,
+      name: benchmark.name,
+      params: benchmark.params,
+      signal: controller.signal,
+    };
+    let error;
+    let failed = false;
+    const runAfterEach = async () => {
+      await this.#runBenchHooks(
+        benchmark, 'afterEach', hookContext);
+      checkDeadline();
+    };
+
+    try {
+      await this.#runWithStop(benchmark, controller, async (pause) => {
+        try {
+          await this.#runBenchHooks(
+            benchmark, 'beforeEach', hookContext);
+          checkDeadline();
+          const warmup = this.warmup ?? benchmark.warmup;
+          const total = warmup + (this.samples ?? benchmark.samples);
+          for (let i = 0; i < total; i++) {
+            if (controller.signal.aborted) {
+              throw controller.signal.reason;
+            }
+            const phase = i < warmup ? 'warmup' : 'measurement';
+            const index = phase === 'warmup' ? i : i - warmup;
+            const outcome = await this.#runSample(
+              benchmark, controller.signal, phase, index);
+            if (!outcome.failed) {
+              checkDeadline();
+              if (controller.signal.aborted) {
+                throw controller.signal.reason;
+              }
+              if (i >= warmup) {
+                ArrayPrototypePush(samples, outcome.sample);
+              }
+            }
+
+            let diagnosticError;
+            let diagnosticFailed = false;
+            if (outcome.diagnostics.length > 0 &&
+                !controller.signal.aborted) {
+              try {
+                await pause(() => this.#emitSampleDiagnostics(
+                  benchmark, phase, index, outcome.diagnostics));
+              } catch (cause) {
+                diagnosticFailed = true;
+                diagnosticError = cause;
+              }
+            }
+            if (outcome.failed) throw outcome.error;
+            if (diagnosticFailed) throw diagnosticError;
+            if (controller.signal.aborted) {
+              throw controller.signal.reason;
+            }
+            if (i >= warmup) {
+              await pause(() => this.#waitForStream(this.stream.sample({
+                __proto__: null,
+                ...this.#getRecordScope(benchmark),
+                benchId: benchmark.benchId,
+                parentId: benchmark.parentId,
+                name: benchmark.name,
+                namePath: ArrayPrototypeSlice(benchmark.namePath),
+                index: i - warmup,
+                ...outcome.sample,
+              })));
+              if (controller.signal.aborted) {
+                throw controller.signal.reason;
+              }
+            }
+            if (outcome.done) break;
+            if (i + 1 < total && this.#yieldBetweenSamples) {
+              await eventLoopTurn();
+            }
+          }
+        } finally {
+          await runAfterEach();
+        }
+      }, deadline);
+    } catch (cause) {
+      failed = true;
+      error = cause;
+    } finally {
+      controller.abort();
+    }
+
+    if (failed) {
+      this.success = false;
+      this.counts.failed++;
+      await this.#recordResult(benchmark, this.#createResult(
+        benchmark,
+        samples,
+        { __proto__: null, error },
+      ));
+      return;
+    }
+
+    this.counts.completed++;
+    await this.#recordResult(benchmark, this.#createResult(
+      benchmark,
+      samples,
+      { __proto__: null, summary: summarizeSamples(samples) },
+    ));
+  }
+
+  async #finish(startTime) {
+    if (this.state === 'finished') return;
+    this.state = 'finished';
+    const duration = startTime === undefined ? 0n : hrtime() - startTime;
+    try {
+      await this.#waitForStream(this.stream.summary({
+        __proto__: null,
+        ...this.#getRecordScope(),
+        success: this.success,
+        counts: this.counts,
+        duration_ns: duration,
+        file: this.entryFile,
+      }));
+    } catch (error) {
+      try {
+        await this.#diagnostic(error, undefined, 'error');
+      } catch {
+        // The stream can fail while reporting the summary listener error.
+      }
+    } finally {
+      this.stream.end();
+      this.root.finished = true;
+      this.root.completion.resolve();
+      this.root.emitDestroy();
+      this.#storage.disable();
+      if (!this.#explicitRun && !this.success) {
+        process.exitCode = kGenericUserError;
+      }
+    }
+  }
+
+  async #execute() {
+    this.state = 'building';
+    const startTime = hrtime();
+    await this.#waitForBuild();
+    this.#fileScopeStorage.disable();
+    this.#prepare();
+    this.state = 'running';
+    await this.#emitPlans();
+    await this.#executeSuite(this.root);
+    await this.#finish(startTime);
+  }
+}
+
+let globalHarness;
+
+function lazyHarness() {
+  globalHarness ??= new Harness();
+  return globalHarness;
+}
+
+function createDeclaration(type, getHarness) {
+  const declare = (name, options, fn, overrides = kEmptyObject) => {
+    const harness = getHarness();
+    const loc = getCallerLocation();
+    const declarationOptions = { __proto__: null, ...overrides, loc };
+    return type === 'benchmark' ?
+      harness.createBench(name, options, fn, declarationOptions) :
+      harness.createSuite(name, options, fn, declarationOptions);
+  };
+
+  if (type === 'benchmark') {
+    declare.skip = (name, options, fn) => declare(
+      name, options, fn, { __proto__: null, skip: true });
+    declare.only = (name, options, fn) => declare(
+      name, options, fn, { __proto__: null, only: true });
+  }
+  return declare;
+}
+
+function createHook(name, getHarness) {
+  return (fn, options) => getHarness().createHook(name, fn, options);
+}
+
+const bench = createDeclaration('benchmark', lazyHarness);
+const suite = createDeclaration('suite', lazyHarness);
+
+function createRunner(options = kEmptyObject) {
+  validateObject(options, 'options');
+  const harness = new Harness({
+    __proto__: null,
+    autoRun: false,
+    yieldBetweenSamples: options.yieldBetweenSamples === undefined ?
+      true : options.yieldBetweenSamples,
+  });
+  const getHarness = () => harness;
+  const runnerBench = createDeclaration('benchmark', getHarness);
+  const runnerSuite = createDeclaration('suite', getHarness);
+  return {
+    __proto__: null,
+    after: createHook(kHookNames[0], getHarness),
+    afterEach: createHook(kHookNames[1], getHarness),
+    before: createHook(kHookNames[2], getHarness),
+    beforeEach: createHook(kHookNames[3], getHarness),
+    bench: runnerBench,
+    describe: runnerSuite,
+    run: (runOptions = kEmptyObject) => harness.run(runOptions),
+    suite: runnerSuite,
+  };
+}
+
+function configureRunScope(scope) {
+  lazyHarness().setRunScope(scope);
+}
+
+function runInFileScope(scope, fn) {
+  return lazyHarness().runInFileScope(scope, fn);
+}
+
+function runBenchmarks(options, force) {
+  return lazyHarness().run(options, force);
+}
+
+module.exports = {
+  Harness,
+  after: createHook(kHookNames[0], lazyHarness),
+  afterEach: createHook(kHookNames[1], lazyHarness),
+  before: createHook(kHookNames[2], lazyHarness),
+  beforeEach: createHook(kHookNames[3], lazyHarness),
+  bench,
+  configureRunScope,
+  createRunId,
+  createRunner,
+  runInFileScope,
+  runBenchmarks,
+  suite,
+};
diff --git a/lib/internal/bench_runner/reporter/json.js b/lib/internal/bench_runner/reporter/json.js
new file mode 100644
index 000000000000..3237a3e1b26c
--- /dev/null
+++ b/lib/internal/bench_runner/reporter/json.js
@@ -0,0 +1,64 @@
+'use strict';
+
+const {
+  ArrayIsArray,
+  ArrayPrototypePush,
+  JSONStringify,
+  ObjectKeys,
+  SafeWeakSet,
+  String,
+} = primordials;
+const { isError } = require('internal/util');
+
+function toJSONValue(value, seen) {
+  if (typeof value === 'bigint') return String(value);
+  if (value === null || typeof value !== 'object') return value;
+  if (seen.has(value)) return '[Circular]';
+  seen.add(value);
+
+  if (isError(value)) {
+    const result = {
+      __proto__: null,
+      name: value.name,
+      message: value.message,
+      stack: value.stack,
+      code: value.code,
+    };
+    if (value.cause !== undefined) {
+      result.cause = toJSONValue(value.cause, seen);
+    }
+    if (value.errors !== undefined) {
+      result.errors = toJSONValue(value.errors, seen);
+    }
+    return result;
+  }
+
+  if (ArrayIsArray(value)) {
+    const result = [];
+    for (let i = 0; i < value.length; i++) {
+      ArrayPrototypePush(result, toJSONValue(value[i], seen));
+    }
+    return result;
+  }
+
+  const result = { __proto__: null };
+  const keys = ObjectKeys(value);
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    result[key] = toJSONValue(value[key], seen);
+  }
+  return result;
+}
+
+function stringify(record) {
+  return JSONStringify(record === undefined ? null :
+    toJSONValue(record, new SafeWeakSet()));
+}
+
+async function* jsonReporter(source) {
+  for await (const record of source) {
+    yield `${stringify(record)}\n`;
+  }
+}
+
+module.exports = jsonReporter;
diff --git a/lib/internal/bench_runner/reporter/spec.js b/lib/internal/bench_runner/reporter/spec.js
new file mode 100644
index 000000000000..34f5831553f3
--- /dev/null
+++ b/lib/internal/bench_runner/reporter/spec.js
@@ -0,0 +1,149 @@
+'use strict';
+
+const {
+  ArrayPrototypeJoin,
+  ArrayPrototypePush,
+  JSONStringify,
+  MathAbs,
+  NumberIsFinite,
+  NumberPrototypeToFixed,
+  NumberPrototypeToPrecision,
+  ObjectEntries,
+  String,
+  StringPrototypeReplaceAll,
+} = primordials;
+const Transform = require('internal/streams/transform');
+
+const kHeader =
+  'benchmark | samples | mean rate | 95% CI | median rate | warning\n';
+
+function escapeCell(value) {
+  let result = String(value);
+  result = StringPrototypeReplaceAll(result, '\r', '\\r');
+  result = StringPrototypeReplaceAll(result, '\n', '\\n');
+  return StringPrototypeReplaceAll(result, '|', '\\|');
+}
+
+function formatName(data) {
+  const name = escapeCell(data.name);
+  const entries = ObjectEntries(data.params);
+  if (entries.length === 0) return name;
+
+  const params = [];
+  for (let i = 0; i < entries.length; i++) {
+    const { 0: key, 1: value } = entries[i];
+    ArrayPrototypePush(
+      params, `${escapeCell(key)}=${escapeCell(JSONStringify(value))}`);
+  }
+  return `${name} [${ArrayPrototypeJoin(params, ', ')}]`;
+}
+
+function formatRate(rate) {
+  if (!NumberIsFinite(rate)) return '-';
+
+  const absolute = MathAbs(rate);
+  let divisor = 1;
+  let prefix = '';
+  if (absolute >= 1e9) {
+    divisor = 1e9;
+    prefix = 'G';
+  } else if (absolute >= 1e6) {
+    divisor = 1e6;
+    prefix = 'M';
+  } else if (absolute >= 1e3) {
+    divisor = 1e3;
+    prefix = 'k';
+  }
+
+  const scaled = rate / divisor;
+  const formatted = MathAbs(scaled) > 0 && MathAbs(scaled) < 1 ?
+    NumberPrototypeToPrecision(scaled, 3) :
+    NumberPrototypeToFixed(scaled, 2);
+  return `${formatted}${prefix} ops/s`;
+}
+
+function formatWarning(summary) {
+  const warnings = [];
+  if (NumberIsFinite(summary.coefficientOfVariation) &&
+      summary.coefficientOfVariation > 0.05) {
+    ArrayPrototypePush(warnings, 'noisy');
+  }
+  if (NumberIsFinite(summary.skewness) && MathAbs(summary.skewness) > 1) {
+    ArrayPrototypePush(warnings, 'skewed');
+  }
+  return ArrayPrototypeJoin(warnings, ', ');
+}
+
+function formatResult(data) {
+  const name = formatName(data);
+  if (data.skip !== undefined) {
+    const reason = typeof data.skip === 'string' && data.skip.length > 0 ?
+      `: ${escapeCell(data.skip)}` : '';
+    return `${name} | 0 | - | - | - | skipped${reason}\n`;
+  }
+  if (data.error !== undefined) {
+    const message = data.error?.message ?? data.error;
+    return `${name} | ${data.samples.length} | - | - | - | ` +
+      `error: ${escapeCell(message)}\n`;
+  }
+
+  const { confidenceInterval, median } = data.summary;
+  return `${name} | ${data.samples.length} | ` +
+    `${formatRate(data.summary.mean)} | ` +
+    `[${formatRate(confidenceInterval.lower)}, ` +
+    `${formatRate(confidenceInterval.upper)}] | ` +
+    `${formatRate(median)} | ${formatWarning(data.summary)}\n`;
+}
+
+class SpecReporter extends Transform {
+  #diagnostics = [];
+  #reported = false;
+  #results = [];
+
+  constructor() {
+    super({ __proto__: null, writableObjectMode: true });
+  }
+
+  #format(summary = undefined) {
+    let output = kHeader;
+    for (let i = 0; i < this.#results.length; i++) {
+      output += formatResult(this.#results[i]);
+    }
+    for (let i = 0; i < this.#diagnostics.length; i++) {
+      output += `diagnostic: ${escapeCell(this.#diagnostics[i].message)}\n`;
+    }
+    if (summary !== undefined) {
+      const { completed, failed, skipped } = summary.counts;
+      output += `\n${completed} completed, ${failed} failed, ` +
+        `${skipped} skipped\n`;
+    }
+    return output;
+  }
+
+  _transform({ type, data }, _encoding, callback) {
+    switch (type) {
+      case 'bench:complete':
+        ArrayPrototypePush(this.#results, data);
+        break;
+      case 'bench:diagnostic':
+        ArrayPrototypePush(this.#diagnostics, data);
+        break;
+      case 'bench:summary':
+        this.#reported = true;
+        callback(null, this.#format(data));
+        return;
+    }
+    callback();
+  }
+
+  _flush(callback) {
+    if (this.#reported ||
+        (this.#results.length === 0 && this.#diagnostics.length === 0)) {
+      callback();
+      return;
+    }
+    callback(null, this.#format());
+  }
+}
+
+module.exports = SpecReporter;
diff --git a/lib/internal/bench_runner/runner.js b/lib/internal/bench_runner/runner.js
new file mode 100644
index 000000000000..c48a0a5339fa
--- /dev/null
+++ b/lib/internal/bench_runner/runner.js
@@ -0,0 +1,21 @@
+'use strict';
+
+const { kEmptyObject } = require('internal/util');
+const {
+  createRunner,
+  runBenchmarks,
+} = require('internal/bench_runner/harness');
+
+function run(options = kEmptyObject) {
+  return runBenchmarks(options);
+}
+
+function runFile(path, options = kEmptyObject) {
+  return require('internal/bench_runner/cli').runFile(path, options);
+}
+
+module.exports = {
+  createRunner,
+  run,
+  runFile,
+};
diff --git a/lib/internal/blob.js b/lib/internal/blob.js
index 25626f0ed906..316518ca401b 100644
--- a/lib/internal/blob.js
+++ b/lib/internal/blob.js
@@ -30,7 +30,7 @@ const {
 } = internalBinding('buffer');
 
 const {
-  TextDecoder,
+  getUtf8Decoder,
   TextEncoder,
 } = require('internal/encoding');
 const { URL } = require('internal/url');
@@ -88,7 +88,6 @@ let ReadableStream;
 let TextDecoderStream;
 
 const enc = new TextEncoder();
-let dec;
 
 // Yes, lazy loading is annoying but because of circular
 // references between the url, internal/blob, and buffer
@@ -306,7 +305,7 @@ class Blob {
     if (!isBlob(this))
       return PromiseReject(new ERR_INVALID_THIS('Blob'));
 
-    dec ??= new TextDecoder();
+    const dec = getUtf8Decoder();
 
     return PromisePrototypeThen(
       arrayBuffer(this),
@@ -460,6 +459,43 @@ function arrayBuffer(blob) {
   return promise;
 }
 
+/**
+ * Read a blob's data synchronously. This is only possible when every part
+ * of the blob is memory-resident, in which case the reader's pull callbacks
+ * are invoked synchronously; otherwise (e.g. for file-backed blobs)
+ * undefined is returned.
+ * @param {Blob} blob
+ * @returns {ArrayBuffer|undefined}
+ */
+function getBlobDataSync(blob) {
+  const reader = blob[kHandle].getReader();
+  const buffers = [];
+  let result;
+  let ended = false;
+  while (!ended) {
+    let sync = false;
+    reader.pull((status, buffer) => {
+      sync = true;
+      if (status === 0) {
+        // EOS; buffer should be undefined here.
+        result = concat(buffers);
+        ended = true;
+        return;
+      } else if (status < 0) {
+        ended = true;
+        return;
+      }
+      if (buffer !== undefined)
+        ArrayPrototypePush(buffers, buffer);
+    });
+    if (!sync) {
+      // The data is not available synchronously.
+      break;
+    }
+  }
+  return result;
+}
+
 function createBlobReaderStream(reader) {
   return new lazyReadableStream({
     type: 'bytes',
@@ -568,17 +604,31 @@ function createBlobReaderStream(reader) {
   }, { highWaterMark: 0 });
 }
 
-// Maximum number of chunks to collect in a single batch to prevent
-// unbounded memory growth when the DataQueue has a large burst of data.
+// Upper bound on the number of chunks collected in a single batch. This is
+// only a cap on the length of the yielded array -- the primary limit is the
+// byte budget below, since under a byte-budget backpressure model the size of
+// a batch is what matters, not how many pieces it arrives in.
 const kMaxBatchChunks = 16;
 
+// Default number of bytes to collect in a single batch. Entries in the
+// DataQueue can each be as large as the peer's flow control window, so a
+// purely count-based limit could produce enormous batches (16 entries of
+// 1 MB each).
+//
+// This matters for more than just the size of the yielded array. Consumers
+// like QUIC return flow control credit from the reader's pull path -- once
+// per pull, not once per batch -- so every pull this loop performs invites
+// the peer to send that many more bytes. Pulling greedily therefore grants
+// credit for data the consumer has not looked at yet. Bounding the loop by
+// bytes limits how far ahead of actual consumption that credit can run,
+// which is what keeps the amount of data buffered in JS bounded.
+const kDefaultMaxBatchBytes = 65536;
+
 async function* createBlobReaderIterable(reader, options = kEmptyObject) {
-  const { getReadError } = options;
+  const { getReadError, maxBatchBytes = kDefaultMaxBatchBytes } = options;
   let wakeup = PromiseWithResolvers();
   let immediate;
-  let fin = false;
-  reader.setWakeup((setfin) => {
-    fin ||= setfin;
+  reader.setWakeup(() => {
     immediate ??= setImmediate(() => {
       immediate = undefined;
       wakeup.resolve?.();
@@ -588,6 +638,7 @@ async function* createBlobReaderIterable(reader, options = kEmptyObject) {
   try {
     while (true) {
       const batch = [];
+      let batchBytes = 0;
       let blocked = false;
       let eos = false;
       let error = null;
@@ -616,8 +667,15 @@ async function* createBlobReaderIterable(reader, options = kEmptyObject) {
           blocked = true;
           break;
         }
-        ArrayPrototypePush(batch, new Uint8Array(pullResult.buffer));
-        if (batch.length >= kMaxBatchChunks) break;
+        const chunk = new Uint8Array(pullResult.buffer);
+        ArrayPrototypePush(batch, chunk);
+        // Stop collecting once the batch is large enough. The byte budget is
+        // the primary limit; the chunk count is a secondary bound so that a
+        // long run of tiny chunks cannot produce an unwieldy array.
+        batchBytes += chunk.byteLength;
+        if (batchBytes >= maxBatchBytes || batch.length >= kMaxBatchChunks) {
+          break;
+        }
       }
 
       if (batch.length > 0) {
@@ -630,12 +688,6 @@ async function* createBlobReaderIterable(reader, options = kEmptyObject) {
       if (blocked) {
         await wakeup.promise;
         wakeup = PromiseWithResolvers();
-        // If the wakeup was triggered by FIN (EndReadable), the DataQueue
-        // is capped. Continue the loop to pull again -- the next pull will
-        // return EOS. Without this, a race between the data notification
-        // and the FIN notification can leave the iterator waiting for a
-        // wakeup that will never come.
-        if (fin) continue;
       }
     }
   } finally {
@@ -649,8 +701,10 @@ module.exports = {
   createBlobFromFilePath,
   createBlobReaderIterable,
   createBlobReaderStream,
+  getBlobDataSync,
   isBlob,
   kHandle,
+  kType,
   resolveObjectURL,
   TransferableBlob,
 };
diff --git a/lib/internal/blocklist.js b/lib/internal/blocklist.js
index f290c7ada405..9436078eaa2c 100644
--- a/lib/internal/blocklist.js
+++ b/lib/internal/blocklist.js
@@ -46,7 +46,7 @@ const {
   ERR_INVALID_ARG_TYPE,
 } = require('internal/errors').codes;
 
-const { validateInt32, validateString } = require('internal/validators');
+const { validateArray, validateInt32, validateString } = require('internal/validators');
 
 function parseCIDR(cidr) {
   validateString(cidr, 'cidr');
@@ -131,9 +131,7 @@ class BlockList {
    * @param {string} [family]
    */
   addAddresses(addresses, family = 'ipv4') {
-    if (!ArrayIsArray(addresses)) {
-      throw new ERR_INVALID_ARG_TYPE('addresses', 'Array', addresses);
-    }
+    validateArray(addresses, 'addresses');
     validateString(family, 'family');
     const handles = [];
     for (let i = 0; i < addresses.length; i++) {
@@ -215,9 +213,7 @@ class BlockList {
    * @param {string[]} cidrs
    */
   addCIDRs(cidrs) {
-    if (!ArrayIsArray(cidrs)) {
-      throw new ERR_INVALID_ARG_TYPE('cidrs', 'Array', cidrs);
-    }
+    validateArray(cidrs, 'cidrs');
     // Validate and parse all entries first so that an exception mid-array
     // does not leave the blocklist half-modified.
     const parsed = [];
@@ -387,7 +383,7 @@ class BlockList {
         // - 2001:db8:85a3::8a2e:370:7334/64 (compressed)
         // - 2001:db8:85a3::192.0.2.128/64 (mixed)
         const ipv6SubnetMatch = item.match(
-          /Subnet: IPv6 ([0-9a-fA-F:]{1,39})\/([0-9]{1,3})/i,
+          /Subnet: IPv6 ([0-9a-fA-F:.]{1,45})\/([0-9]{1,3})/i,
         );
         if (ipv6SubnetMatch) {
           const { 1: network, 2: prefix } = ipv6SubnetMatch;
@@ -400,7 +396,7 @@ class BlockList {
         // - 2001:0db8:85a3:0000:0000:8a2e:0370:7334 (full)
         // - 2001:db8:85a3::8a2e:370:7334 (compressed)
         // - 2001:db8:85a3::192.0.2.128 (mixed)
-        const ipv6AddressMatch = item.match(/Address: IPv6 ([0-9a-fA-F:]{1,39})/i);
+        const ipv6AddressMatch = item.match(/Address: IPv6 ([0-9a-fA-F:.]{1,45})/i);
         if (ipv6AddressMatch) {
           const { 1: address } = ipv6AddressMatch;
           this.addAddress(address, 'ipv6');
@@ -412,7 +408,7 @@ class BlockList {
         // - 2001:0db8:85a3:0000:0000:8a2e:0370:7334-2001:0db8:85a3:0000:0000:8a2e:0370:7335 (full)
         // - 2001:db8:85a3::8a2e:370:7334-2001:db8:85a3::8a2e:370:7335 (compressed)
         // - 2001:db8:85a3::192.0.2.128-2001:db8:85a3::192.0.2.129 (mixed)
-        const ipv6RangeMatch = item.match(/Range: IPv6 ([0-9a-fA-F:]{1,39})-([0-9a-fA-F:]{1,39})/i);
+        const ipv6RangeMatch = item.match(/Range: IPv6 ([0-9a-fA-F:.]{1,45})-([0-9a-fA-F:.]{1,45})/i);
         if (ipv6RangeMatch) {
           const { 1: start, 2: end } = ipv6RangeMatch;
           this.addRange(start, end, 'ipv6');
diff --git a/lib/internal/bootstrap/node.js b/lib/internal/bootstrap/node.js
index 8bb014426a03..bde4cb2be84b 100644
--- a/lib/internal/bootstrap/node.js
+++ b/lib/internal/bootstrap/node.js
@@ -285,6 +285,11 @@ const features = {
   get require_module() {
     return getOptionValue('--require-module');
   },
+  get dtls() {
+    return process.config.variables.node_use_dtls &&
+           hasOpenSSL &&
+           getOptionValue('--experimental-dtls');
+  },
   get quic() {
     // TODO(@jasnell): When the implementation is updated to support Boring,
     // then this should be refactored to depend not only on the OpenSSL version.
diff --git a/lib/internal/bootstrap/realm.js b/lib/internal/bootstrap/realm.js
index 4e45a85a12b2..92314a873d3e 100644
--- a/lib/internal/bootstrap/realm.js
+++ b/lib/internal/bootstrap/realm.js
@@ -124,6 +124,9 @@ const legacyWrapperList = new SafeSet([
 // beginning with "internal/".
 // Modules that can only be imported via the node: scheme.
 const schemelessBlockList = new SafeSet([
+  'bench',
+  'bench/reporters',
+  'dtls',
   'ffi',
   'sea',
   'sqlite',
@@ -134,6 +137,9 @@ const schemelessBlockList = new SafeSet([
 ]);
 // Modules that will only be enabled at run time.
 const experimentalModuleList = new SafeSet([
+  'bench',
+  'bench/reporters',
+  'dtls',
   'ffi',
   'quic',
   'sqlite',
@@ -332,7 +338,16 @@ class BuiltinModule {
 
   static getAllBuiltinModuleIds() {
     const allBuiltins = ArrayFrom(canBeRequiredByUsersWithoutSchemeList);
-    ArrayPrototypePushApply(allBuiltins, ArrayFrom(schemelessBlockList, (x) => `node:${x}`));
+    ArrayPrototypePushApply(
+      allBuiltins,
+      ArrayPrototypeMap(
+        ArrayPrototypeFilter(
+          ArrayFrom(schemelessBlockList),
+          (id) => canBeRequiredByUsersList.has(id),
+        ),
+        (id) => 'node:' + id,
+      ),
+    );
     return allBuiltins;
   }
 
diff --git a/lib/internal/bootstrap/switches/is_not_main_thread.js b/lib/internal/bootstrap/switches/is_not_main_thread.js
index 6fa30aec748a..1716bea20149 100644
--- a/lib/internal/bootstrap/switches/is_not_main_thread.js
+++ b/lib/internal/bootstrap/switches/is_not_main_thread.js
@@ -6,6 +6,12 @@ const {
 
 delete process._debugProcess;
 delete process._debugEnd;
+// Also drop the other main-thread-only helpers is_main_thread.js installs, so
+// that this switch can be applied on top of a context bootstrapped for the
+// main thread (as when a worker starts from the built-in snapshot).
+delete process._debugPause;
+delete process._startProfilerIdleNotifier;
+delete process._stopProfilerIdleNotifier;
 
 function defineStream(name, getter) {
   ObjectDefineProperty(process, name, {
diff --git a/lib/internal/bootstrap/web/exposed-window-or-worker.js b/lib/internal/bootstrap/web/exposed-window-or-worker.js
index e9edc4ceb616..35cb1d5120e1 100644
--- a/lib/internal/bootstrap/web/exposed-window-or-worker.js
+++ b/lib/internal/bootstrap/web/exposed-window-or-worker.js
@@ -51,6 +51,8 @@ exposeLazyInterfaces(globalThis, 'internal/worker/io', ['BroadcastChannel']);
 exposeLazyInterfaces(globalThis, 'internal/worker/io', [
   'MessageChannel', 'MessagePort',
 ]);
+// https://html.spec.whatwg.org/multipage/workers.html#dedicated-workers-and-the-worker-interface
+exposeLazyInterfaces(globalThis, 'internal/webworker', ['Worker']);
 // https://www.w3.org/TR/FileAPI/#dfn-Blob
 exposeLazyInterfaces(globalThis, 'internal/blob', ['Blob']);
 // https://www.w3.org/TR/FileAPI/#dfn-file
diff --git a/lib/internal/buffer.js b/lib/internal/buffer.js
index 5977bdf23768..325df6ca01ad 100644
--- a/lib/internal/buffer.js
+++ b/lib/internal/buffer.js
@@ -5,6 +5,7 @@ const {
   Float32Array,
   Float64Array,
   MathFloor,
+  MathMax,
   Number,
   Symbol,
   Uint8Array,
@@ -1114,24 +1115,33 @@ function createUnsafeBuffer(size) {
   return new FastBuffer(createUnsafeArrayBuffer(size));
 }
 
+// Reaching an aligned address needs at most `alignment - 1` extra bytes, but a
+// multiple of 8 is padded instead. Backing store addresses are 8 byte aligned
+// too, so the bytes left over after the buffer then remain a whole number of
+// elements of any typed array created over its ArrayBuffer.
+function alignmentPadding(alignment) {
+  return MathMax(alignment, 8);
+}
+
 // Returns an uninitialized buffer of `size` bytes whose first byte is located at
 // a memory address that is a multiple of `alignment`. `alignment` must be a
-// power of two, and `size + alignment - 1` must not exceed the maximum buffer
-// length. Since the address of a backing store cannot be chosen, `alignment - 1`
-// extra bytes are allocated and skipped, which leaves the returned buffer with a
-// non-zero `byteOffset` into a larger ArrayBuffer.
+// power of two, and `size` plus its padding must not exceed the maximum buffer
+// length. Since the address of a backing store cannot be chosen, that padding is
+// allocated and skipped, which leaves the returned buffer with a non-zero
+// `byteOffset` into a larger ArrayBuffer.
 function createUnsafeAlignedBuffer(size, alignment) {
   if (size === 0) {
     return new FastBuffer();
   }
 
-  const ab = createUnsafeArrayBuffer(size + alignment - 1);
+  const ab = createUnsafeArrayBuffer(size + alignmentPadding(alignment));
   return new FastBuffer(ab, arrayBufferAlignedOffset(ab, alignment), size);
 }
 
 module.exports = {
   FastBuffer,
   addBufferPrototypeMethods,
+  alignmentPadding,
   markAsUntransferable,
   isMarkedAsUntransferable,
   createUnsafeBuffer,
diff --git a/lib/internal/crypto/cfrg.js b/lib/internal/crypto/cfrg.js
index 9eea26aa36a0..1f7b3202fb10 100644
--- a/lib/internal/crypto/cfrg.js
+++ b/lib/internal/crypto/cfrg.js
@@ -146,6 +146,12 @@ function cfrgImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.d === undefined;
+      verifyAcceptableKeyUse(
+        name,
+        usagesSet,
+        isPublic ? allowedUsages.public : allowedUsages.private);
+
       const expectedUse = (name === 'X25519' || name === 'X448') ? 'enc' : 'sig';
       validateJwk(keyData, 'OKP', extractable, usagesSet, expectedUse);
 
@@ -159,11 +165,6 @@ function cfrgImportKey(
             'JWK "alg" does not match the requested algorithm', 'DataError');
       }
 
-      const isPublic = keyData.d === undefined;
-      verifyAcceptableKeyUse(
-        name,
-        usagesSet,
-        isPublic ? allowedUsages.public : allowedUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }
diff --git a/lib/internal/crypto/cipher.js b/lib/internal/crypto/cipher.js
index dafcc59d5066..4b4165c55084 100644
--- a/lib/internal/crypto/cipher.js
+++ b/lib/internal/crypto/cipher.js
@@ -33,6 +33,7 @@ const {
 
 const {
   validateEncoding,
+  validateOneOf,
   validateUint32,
   validateObject,
   validateString,
@@ -60,6 +61,9 @@ const { normalizeEncoding, kEmptyObject } = require('internal/util');
 
 const { StringDecoder } = require('string_decoder');
 
+const kCtsModes = ['CS1', 'CS2', 'CS3'];
+const kXtsStandards = ['GB', 'IEEE'];
+
 function rsaFunctionFor(method, defaultPadding, keyType) {
   const keyName = keyType === 'private' ? 'privateKey' : undefined;
   return (key, buffer) => {
@@ -119,8 +123,32 @@ function getUIntOption(options, key) {
 }
 
 function createCipherBase(cipher, credential, options, isEncrypt, iv) {
-  const authTagLength = getUIntOption(options, 'authTagLength');
-  this[kHandle] = new CipherBase(isEncrypt, cipher, credential, iv, authTagLength);
+  let authTagLength = -1;
+  let ctsMode;
+  let xtsStandard;
+  if (options != null) {
+    authTagLength = getUIntOption(options, 'authTagLength');
+    ctsMode = getStringOption(options, 'ctsMode') ?? undefined;
+    xtsStandard = getStringOption(options, 'xtsStandard') ?? undefined;
+    if (ctsMode !== undefined)
+      validateOneOf(ctsMode, 'options.ctsMode', kCtsModes);
+    if (xtsStandard !== undefined)
+      validateOneOf(xtsStandard, 'options.xtsStandard', kXtsStandards);
+  }
+
+  if (ctsMode === undefined && xtsStandard === undefined) {
+    this[kHandle] = new CipherBase(
+      isEncrypt, cipher, credential, iv, authTagLength);
+  } else {
+    this[kHandle] = new CipherBase(
+      isEncrypt,
+      cipher,
+      credential,
+      iv,
+      authTagLength,
+      ctsMode,
+      xtsStandard);
+  }
   this._decoder = null;
 
   FunctionPrototypeCall(LazyTransform, this, options);
diff --git a/lib/internal/crypto/ec.js b/lib/internal/crypto/ec.js
index cbd89dd11c7e..0f1e0555202d 100644
--- a/lib/internal/crypto/ec.js
+++ b/lib/internal/crypto/ec.js
@@ -164,6 +164,12 @@ function ecImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.d === undefined;
+      verifyAcceptableKeyUse(
+        name,
+        usagesSet,
+        isPublic ? allowedUsages.public : allowedUsages.private);
+
       const expectedUse = name === 'ECDH' ? 'enc' : 'sig';
       validateJwk(keyData, 'EC', extractable, usagesSet, expectedUse);
 
@@ -185,11 +191,6 @@ function ecImportKey(
             'DataError');
       }
 
-      const isPublic = keyData.d === undefined;
-      verifyAcceptableKeyUse(
-        name,
-        usagesSet,
-        isPublic ? allowedUsages.public : allowedUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }
diff --git a/lib/internal/crypto/hash.js b/lib/internal/crypto/hash.js
index a32d74f65cb4..3c727543248a 100644
--- a/lib/internal/crypto/hash.js
+++ b/lib/internal/crypto/hash.js
@@ -7,6 +7,7 @@ const {
   StringPrototypeToLowerCase,
   Symbol,
   TypedArrayPrototypeGetBuffer,
+  TypedArrayPrototypeIncludes,
 } = primordials;
 
 const {
@@ -31,6 +32,8 @@ const {
   kHandle,
   getCachedHashId,
   getHashCache,
+  getArrayBufferOrView,
+  getBufferSourceBytes,
   getOptionalByteLength,
 } = require('internal/crypto/util');
 
@@ -93,6 +96,17 @@ const maybeEmitDeprecationWarning = getDeprecationWarningEmitter(
   },
 );
 
+function normalizeCShakeParameter(value, name) {
+  if (value === undefined) return undefined;
+
+  value = getArrayBufferOrView(value, name);
+  if (TypedArrayPrototypeIncludes(getBufferSourceBytes(value), 0)) {
+    throw new ERR_INVALID_ARG_VALUE(
+      name, value, 'must not contain NUL bytes');
+  }
+  return value;
+}
+
 function Hash(algorithm, options) {
   if (!new.target)
     return new Hash(algorithm, options);
@@ -106,10 +120,36 @@ function Hash(algorithm, options) {
     // Coerce -0 to +0.
     xofLen += 0;
   }
+  let functionName;
+  let customization;
+  if (!isCopy && options !== undefined && options !== null) {
+    const functionNameOption = options.functionName;
+    if (functionNameOption !== undefined) {
+      functionName = normalizeCShakeParameter(
+        functionNameOption, 'options.functionName');
+    }
+    const customizationOption = options.customization;
+    if (customizationOption !== undefined) {
+      customization = normalizeCShakeParameter(
+        customizationOption, 'options.customization');
+    }
+  }
   // Lookup the cached ID from JS land because it's faster than decoding
   // the string in C++ land.
   const algorithmId = isCopy ? -1 : getCachedHashId(algorithm);
-  this[kHandle] = new _Hash(algorithm, xofLen, algorithmId, getHashCache());
+  if (functionName === undefined && customization === undefined) {
+    this[kHandle] = new _Hash(
+      algorithm, xofLen, algorithmId, getHashCache());
+  } else {
+    this[kHandle] = new _Hash(
+      algorithm,
+      xofLen,
+      algorithmId,
+      getHashCache(),
+      functionName,
+      customization,
+    );
+  }
   this[kState] = {
     [kFinalized]: false,
   };
@@ -205,7 +245,12 @@ Hmac.prototype.digest = function digest(outputEncoding) {
   return ret;
 };
 
-Hmac.prototype._flush = Hash.prototype._flush;
+Hmac.prototype._flush = function _flush(callback) {
+  this.push(this[kHandle].digest());
+  this[kState][kFinalized] = true; // This diverges from Hash.prototype._flush:
+  // Hash instances are still usable after a flush, Hmac are not, see DEP0206.
+  callback();
+};
 Hmac.prototype._transform = Hash.prototype._transform;
 
 // Implementation for WebCrypto subtle.digest()
@@ -294,8 +339,15 @@ function hash(algorithm, input, options) {
   if (typeof input !== 'string' && !isArrayBufferView(input)) {
     throw new ERR_INVALID_ARG_TYPE('input', ['Buffer', 'TypedArray', 'DataView', 'string'], input);
   }
+  if (options === undefined) {
+    maybeEmitDeprecationWarning(algorithm);
+    return oneShotDigest(algorithm, getCachedHashId(algorithm), getHashCache(),
+                         input, 'hex', encodingsMap.hex, undefined);
+  }
   let outputEncoding;
   let outputLength;
+  let functionName;
+  let customization;
 
   if (typeof options === 'string') {
     outputEncoding = options;
@@ -303,6 +355,16 @@ function hash(algorithm, input, options) {
     validateObject(options, 'options');
     outputLength = options.outputLength;
     outputEncoding = options.outputEncoding;
+    const functionNameOption = options.functionName;
+    if (functionNameOption !== undefined) {
+      functionName = normalizeCShakeParameter(
+        functionNameOption, 'options.functionName');
+    }
+    const customizationOption = options.customization;
+    if (customizationOption !== undefined) {
+      customization = normalizeCShakeParameter(
+        customizationOption, 'options.customization');
+    }
   }
 
   outputEncoding ??= 'hex';
@@ -333,8 +395,13 @@ function hash(algorithm, input, options) {
     maybeEmitDeprecationWarning(algorithm);
   }
 
+  if (functionName === undefined && customization === undefined) {
+    return oneShotDigest(algorithm, getCachedHashId(algorithm), getHashCache(),
+                         input, normalized, encodingsMap[normalized], outputLength);
+  }
   return oneShotDigest(algorithm, getCachedHashId(algorithm), getHashCache(),
-                       input, normalized, encodingsMap[normalized], outputLength);
+                       input, normalized, encodingsMap[normalized], outputLength,
+                       functionName, customization);
 }
 
 module.exports = {
diff --git a/lib/internal/crypto/hkdf.js b/lib/internal/crypto/hkdf.js
index d55968907541..fcff7070164f 100644
--- a/lib/internal/crypto/hkdf.js
+++ b/lib/internal/crypto/hkdf.js
@@ -22,7 +22,6 @@ const {
 const { kMaxLength } = require('buffer');
 
 const {
-  getDigestSizeInBytes,
   jobPromise,
   normalizeHashName,
   toBuf,
@@ -142,6 +141,22 @@ function hkdfSync(hash, key, salt, info, length) {
   return bits;
 }
 
+function getDigestSizeInBytes(name) {
+  switch (name) {
+    case 'SHA-1':
+      return 20;
+    case 'SHA-256': // Fall through
+    case 'SHA3-256':
+      return 32;
+    case 'SHA-384': // Fall through
+    case 'SHA3-384':
+      return 48;
+    case 'SHA-512': // Fall through
+    case 'SHA3-512':
+      return 64;
+  }
+}
+
 function validateHkdfDeriveBitsLength(length, hash) {
   if (length === null)
     throw lazyDOMException('length cannot be null', 'OperationError');
diff --git a/lib/internal/crypto/keys.js b/lib/internal/crypto/keys.js
index a7f3b4f47cfb..e82e48ad653f 100644
--- a/lib/internal/crypto/keys.js
+++ b/lib/internal/crypto/keys.js
@@ -16,9 +16,11 @@ const {
   createNativeKeyObjectClass,
   // eslint-disable-next-line no-restricted-syntax -- intended here
   getKeyObjectSlots: nativeGetKeyObjectSlots,
+  isKeyObject: isNativeKeyObject,
   createCryptoKeyClass,
   // eslint-disable-next-line no-restricted-syntax -- intended here
   getCryptoKeySlots: nativeGetCryptoKeySlots,
+  isCryptoKey: isNativeCryptoKey,
   kKeyTypeSecret,
   kKeyTypePublic,
   kKeyTypePrivate,
@@ -115,11 +117,13 @@ for (const m of [[kKeyEncodingPKCS1, 'pkcs1'], [kKeyEncodingPKCS8, 'pkcs8'],
                  [kKeyEncodingSPKI, 'spki'], [kKeyEncodingSEC1, 'sec1']])
   encodingNames[m[0]] = m[1];
 
-// KeyObject state lives on the native NativeKeyObject base class. JS reads
-// the native type enum and a KeyObjectHandle in one call and caches that
-// slot tuple in a private field so no forgeable own Symbols are exposed on
-// public KeyObject instances.
+// KeyObject state lives on the native NativeKeyObject base class. JS caches
+// the constructor-known type enum in a private field, then replaces it with
+// the native type and KeyObjectHandle tuple when the handle is first needed.
+// No forgeable own Symbols are exposed on public KeyObject instances.
 let getKeyObjectSlots; // Populated by the createNativeKeyObjectClass callback.
+let isKeyObject;
+let getKeyObjectTypeValue;
 
 const kKeyObjectSlotType = 0;
 const kKeyObjectSlotHandle = 1;
@@ -159,12 +163,18 @@ const {
     #slots;
 
     constructor(type, handle) {
-      if (type !== 'secret' && type !== 'public' && type !== 'private')
-        throw new ERR_INVALID_ARG_VALUE('type', type);
+      let keyType;
+      switch (type) {
+        case 'secret': keyType = kKeyTypeSecret; break;
+        case 'public': keyType = kKeyTypePublic; break;
+        case 'private': keyType = kKeyTypePrivate; break;
+        default: throw new ERR_INVALID_ARG_VALUE('type', type);
+      }
       if (typeof handle !== 'object' || !(handle instanceof KeyObjectHandle))
         throw new ERR_INVALID_ARG_TYPE('handle', 'object', handle);
 
       super(handle);
+      this.#slots = keyType;
     }
 
     get type() {
@@ -225,12 +235,27 @@ const {
     }
 
     static {
+      isKeyObject = (key) => {
+        if (key == null || typeof key !== 'object') return false;
+        return #slots in key || isNativeKeyObject(key);
+      };
+      getKeyObjectTypeValue = (key) => {
+        if (!key || typeof key !== 'object')
+          throw new ERR_INVALID_THIS('KeyObject');
+        if (#slots in key) {
+          const cached = key.#slots;
+          if (typeof cached === 'number') return cached;
+          if (cached !== undefined) return cached[kKeyObjectSlotType];
+        }
+        return getKeyObjectSlots(key)[kKeyObjectSlotType];
+      };
+
       getKeyObjectSlots = (key) => {
         if (!key || typeof key !== 'object')
           throw new ERR_INVALID_THIS('KeyObject');
         if (#slots in key) {
           const cached = key.#slots;
-          if (cached !== undefined) return cached;
+          if (cached !== undefined && typeof cached !== 'number') return cached;
         }
         const slots = nativeGetKeyObjectSlots(key);
         key.#slots = slots;
@@ -954,7 +979,7 @@ function keyObjectTypeToString(type) {
  * @returns {'secret' | 'public' | 'private'}
  */
 function getKeyObjectType(key) {
-  return keyObjectTypeToString(getKeyObjectSlots(key)[kKeyObjectSlotType]);
+  return keyObjectTypeToString(getKeyObjectTypeValue(key));
 }
 
 /**
@@ -1044,18 +1069,6 @@ function getKeyObjectAsymmetricKeyDetails(key) {
   return cached;
 }
 
-function isKeyObject(obj) {
-  if (obj == null || typeof obj !== 'object')
-    return false;
-
-  try {
-    getKeyObjectSlots(obj);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 // CryptoKey is a plain JS class whose prototype's [[Prototype]] is
 // Object.prototype, as Web Crypto requires. Instance storage (type enum,
 // extractable, algorithm, usages mask, and the KeyObject handle) lives
@@ -1067,11 +1080,11 @@ function isKeyObject(obj) {
 //            -> CryptoKey.prototype
 //            -> Object.prototype
 //
-// All five internal slots are read from C++ in a single call via
-// `getCryptoKeySlots`. The resulting array is cached in a private
-// class field on `InternalCryptoKey` so that it is invisible to
-// reflection (`Object.getOwnPropertySymbols` etc.) and leaves each
-// CryptoKey's hidden class pristine. The `getCryptoKey{Type,
+// Normal construction caches all five internal slots in a private class
+// field on `InternalCryptoKey`. Partially initialized transferred keys read
+// them from C++ in a single `getCryptoKeySlots` call on first access. The
+// cache is invisible to reflection (`Object.getOwnPropertySymbols` etc.) and
+// leaves each CryptoKey's hidden class pristine. The `getCryptoKey{Type,
 // Extractable,Algorithm,Usages,Handle}` helpers index into that
 // array and convert native enums/masks back to Web Crypto strings.
 // The internal algorithm object is stored as a null-prototype clone
@@ -1081,6 +1094,7 @@ function isKeyObject(obj) {
 // requires repeat reads to return the same object so a consumer's
 // mutation is visible next time).
 let getSlots; // Populated by the createCryptoKeyClass callback below.
+let isCryptoKey;
 
 const kSlotType = 0;
 const kSlotExtractable = 1;
@@ -1179,9 +1193,22 @@ const {
       if (algorithm !== undefined)
         algorithm = cloneInternalAlgorithm(algorithm);
       super(handle, algorithm, usagesMask, extractable);
+      if (algorithm !== undefined) {
+        this.#slots = [
+          handle.getKeyType(),
+          extractable,
+          algorithm,
+          usagesMask,
+          handle,
+        ];
+      }
     }
 
     static {
+      isCryptoKey = (key) => {
+        if (key == null || typeof key !== 'object') return false;
+        return #slots in key || isNativeCryptoKey(key);
+      };
       getSlots = (key) => {
         if (!key || typeof key !== 'object')
           throw new ERR_INVALID_THIS('CryptoKey');
@@ -1215,12 +1242,10 @@ const {
   return [CryptoKey, InternalCryptoKey];
 });
 
-// The helpers below return a CryptoKey's internal slot value,
-// populating the per-instance cache on first access via a single
-// native call. The public `type` getter converts the native enum to
-// the Web Crypto string. The `usages` helper converts the native usage
-// mask to Web Crypto strings. The public `algorithm` / `usages` getters
-// on `CryptoKey.prototype` cache their returned objects.
+// The helpers below return a CryptoKey's internal slot value. The public
+// `type` getter converts the native enum to the Web Crypto string. The
+// `usages` helper converts the native usage mask to Web Crypto strings. The
+// public `algorithm` / `usages` getters cache their returned objects.
 
 /**
  * Returns the value of a CryptoKey's `[[type]]` internal slot.
@@ -1313,18 +1338,6 @@ function getCryptoKeyHandle(key) {
   return getSlots(key)[kSlotHandle];
 }
 
-function isCryptoKey(obj) {
-  if (obj == null || typeof obj !== 'object')
-    return false;
-
-  try {
-    getSlots(obj);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 function importGenericSecretKey(
   algorithm,
   format,
diff --git a/lib/internal/crypto/ml_dsa.js b/lib/internal/crypto/ml_dsa.js
index 0756198312c0..108ec22fc791 100644
--- a/lib/internal/crypto/ml_dsa.js
+++ b/lib/internal/crypto/ml_dsa.js
@@ -158,17 +158,18 @@ function mlDsaImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.priv === undefined;
+      verifyAcceptableKeyUse(
+        name,
+        usagesSet,
+        isPublic ? kUsages.public : kUsages.private);
+
       validateJwk(keyData, 'AKP', extractable, usagesSet, 'sig');
 
       if (keyData.alg !== name)
         throw lazyDOMException(
           'JWK "alg" Parameter and algorithm name mismatch', 'DataError');
 
-      const isPublic = keyData.priv === undefined;
-      verifyAcceptableKeyUse(
-        name,
-        usagesSet,
-        isPublic ? kUsages.public : kUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }
diff --git a/lib/internal/crypto/ml_kem.js b/lib/internal/crypto/ml_kem.js
index c917c88c0f29..da077ac8344d 100644
--- a/lib/internal/crypto/ml_kem.js
+++ b/lib/internal/crypto/ml_kem.js
@@ -169,17 +169,18 @@ function mlKemImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.priv === undefined;
+      verifyAcceptableKeyUse(
+        name,
+        usagesSet,
+        isPublic ? kUsages.public : kUsages.private);
+
       validateJwk(keyData, 'AKP', extractable, usagesSet, 'enc');
 
       if (keyData.alg !== name)
         throw lazyDOMException(
           'JWK "alg" Parameter and algorithm name mismatch', 'DataError');
 
-      const isPublic = keyData.priv === undefined;
-      verifyAcceptableKeyUse(
-        name,
-        usagesSet,
-        isPublic ? kUsages.public : kUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }
diff --git a/lib/internal/crypto/provider_mac.js b/lib/internal/crypto/provider_mac.js
new file mode 100644
index 000000000000..f972ac00be21
--- /dev/null
+++ b/lib/internal/crypto/provider_mac.js
@@ -0,0 +1,262 @@
+'use strict';
+
+const {
+  FunctionPrototypeCall,
+  ObjectSetPrototypeOf,
+  StringPrototypeIncludes,
+  StringPrototypeToLowerCase,
+  Symbol,
+} = primordials;
+
+const {
+  Mac: _Mac,
+} = internalBinding('crypto');
+
+const {
+  getCachedMacId,
+  getMacCache,
+  kHandle,
+} = require('internal/crypto/util');
+
+const {
+  getKeyObjectHandle,
+  getKeyObjectType,
+  isKeyObject,
+} = require('internal/crypto/keys');
+
+const {
+  normalizeEncoding,
+} = require('internal/util');
+
+const {
+  codes: {
+    ERR_CRYPTO_MAC_FINALIZED,
+    ERR_CRYPTO_MAC_UPDATE_FAILED,
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_ARG_VALUE,
+  },
+} = require('internal/errors');
+
+const {
+  validateEncoding,
+  validateObject,
+  validateString,
+  validateUint32,
+} = require('internal/validators');
+
+const {
+  isAnyArrayBuffer,
+  isArrayBufferView,
+} = require('internal/util/types');
+
+const LazyTransform = require('internal/streams/lazy_transform');
+
+const kState = Symbol('kState');
+const kFinalized = Symbol('kFinalized');
+
+function validateName(value, name) {
+  validateString(value, name);
+  if (value.length === 0 || StringPrototypeIncludes(value, '\0')) {
+    throw new ERR_INVALID_ARG_VALUE(
+      name, value, 'must be non-empty and contain no NUL bytes');
+  }
+  return value;
+}
+
+function normalizeBytes(value, name) {
+  if (!isArrayBufferView(value) && !isAnyArrayBuffer(value)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      name, ['ArrayBuffer', 'Buffer', 'TypedArray', 'DataView'], value);
+  }
+  return value;
+}
+
+function createHandle(algorithm, key, options) {
+  const name = validateName(algorithm, 'algorithm');
+  let digest;
+  let cipher;
+  let iv;
+  let customization;
+  let salt;
+  let outputLength;
+  let hasExtendedOptions = false;
+
+  if (options !== undefined) {
+    validateObject(options, 'options');
+
+    const digestOption = options.digest;
+    if (digestOption !== undefined) {
+      digest = validateName(digestOption, 'options.digest');
+    }
+    const cipherOption = options.cipher;
+    if (cipherOption !== undefined) {
+      cipher = validateName(cipherOption, 'options.cipher');
+      hasExtendedOptions = true;
+    }
+    const ivOption = options.iv;
+    if (ivOption !== undefined) {
+      iv = normalizeBytes(ivOption, 'options.iv');
+      hasExtendedOptions = true;
+    }
+    const customizationOption = options.customization;
+    if (customizationOption !== undefined) {
+      customization = normalizeBytes(
+        customizationOption, 'options.customization');
+      hasExtendedOptions = true;
+    }
+    const saltOption = options.salt;
+    if (saltOption !== undefined) {
+      salt = normalizeBytes(saltOption, 'options.salt');
+      hasExtendedOptions = true;
+    }
+    const outputLengthOption = options.outputLength;
+    if (outputLengthOption !== undefined) {
+      outputLength = outputLengthOption;
+      validateUint32(outputLength, 'options.outputLength');
+      outputLength += 0;
+      hasExtendedOptions = true;
+    }
+  }
+
+  key = normalizeKey(key);
+  const id = getCachedMacId(name);
+  const cache = getMacCache();
+  if (!hasExtendedOptions) {
+    return new _Mac(name, id, cache, key, digest);
+  }
+  return new _Mac(
+    name,
+    id,
+    cache,
+    key,
+    digest,
+    cipher,
+    iv,
+    customization,
+    salt,
+    outputLength,
+  );
+}
+
+function normalizeKey(key) {
+  if (isKeyObject(key)) {
+    if (getKeyObjectType(key) !== 'secret') {
+      throw new ERR_INVALID_ARG_TYPE(
+        'key', ['ArrayBuffer', 'Buffer', 'TypedArray', 'DataView', 'KeyObject'], key);
+    }
+    return getKeyObjectHandle(key);
+  }
+  if (!isArrayBufferView(key) && !isAnyArrayBuffer(key)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'key', ['ArrayBuffer', 'Buffer', 'TypedArray', 'DataView', 'KeyObject'], key);
+  }
+  return key;
+}
+
+function normalizeOutputEncoding(outputEncoding) {
+  if (outputEncoding === undefined) return 'buffer';
+  validateString(outputEncoding, 'outputEncoding');
+  if (StringPrototypeToLowerCase(outputEncoding) === 'buffer') return 'buffer';
+  const normalized = normalizeEncoding(outputEncoding);
+  if (normalized === undefined) {
+    throw new ERR_INVALID_ARG_VALUE('outputEncoding', outputEncoding);
+  }
+  return normalized;
+}
+
+function normalizeInputEncoding(data, inputEncoding) {
+  if (inputEncoding === undefined) return undefined;
+  validateString(inputEncoding, 'inputEncoding');
+  const normalized = normalizeEncoding(inputEncoding);
+  if (normalized === undefined) {
+    throw new ERR_INVALID_ARG_VALUE('inputEncoding', inputEncoding);
+  }
+  validateEncoding(data, normalized);
+  return normalized;
+}
+
+function updateHandle(mac, data, encoding) {
+  const state = mac[kState];
+  let updated;
+  try {
+    updated = mac[kHandle].update(data, encoding);
+  } catch (error) {
+    state[kFinalized] = true;
+    throw error;
+  }
+  if (!updated) {
+    state[kFinalized] = true;
+    throw new ERR_CRYPTO_MAC_UPDATE_FAILED();
+  }
+}
+
+function finalizeHandle(mac, outputEncoding) {
+  const state = mac[kState];
+  state[kFinalized] = true;
+  return mac[kHandle].final(outputEncoding);
+}
+
+function Mac(algorithm, key, options) {
+  if (!new.target) return new Mac(algorithm, key, options);
+  this[kHandle] = createHandle(algorithm, key, options);
+  this[kState] = {
+    [kFinalized]: false,
+  };
+  FunctionPrototypeCall(LazyTransform, this, options);
+}
+
+ObjectSetPrototypeOf(Mac.prototype, LazyTransform.prototype);
+ObjectSetPrototypeOf(Mac, LazyTransform);
+
+Mac.prototype._transform = function _transform(chunk, encoding, callback) {
+  if (this[kState][kFinalized]) {
+    callback(new ERR_CRYPTO_MAC_FINALIZED());
+    return;
+  }
+  try {
+    updateHandle(this, chunk, encoding);
+  } catch (error) {
+    callback(error);
+    return;
+  }
+  callback();
+};
+
+Mac.prototype._flush = function _flush(callback) {
+  if (this[kState][kFinalized]) {
+    callback(new ERR_CRYPTO_MAC_FINALIZED());
+    return;
+  }
+  try {
+    const result = finalizeHandle(this);
+    if (result.length !== 0) this.push(result);
+  } catch (error) {
+    callback(error);
+    return;
+  }
+  callback();
+};
+
+Mac.prototype.update = function update(data, encoding) {
+  if (this[kState][kFinalized]) throw new ERR_CRYPTO_MAC_FINALIZED();
+  if (typeof data === 'string') {
+    encoding = normalizeInputEncoding(data, encoding);
+  } else if (!isArrayBufferView(data)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'data', ['string', 'Buffer', 'TypedArray', 'DataView'], data);
+  }
+  updateHandle(this, data, encoding);
+  return this;
+};
+
+Mac.prototype.final = function final(outputEncoding) {
+  if (this[kState][kFinalized]) throw new ERR_CRYPTO_MAC_FINALIZED();
+  if (outputEncoding === undefined) return finalizeHandle(this);
+  outputEncoding = normalizeOutputEncoding(outputEncoding);
+  if (outputEncoding === 'buffer') return finalizeHandle(this);
+  return finalizeHandle(this, outputEncoding);
+};
+
+module.exports = {
+  Mac,
+};
diff --git a/lib/internal/crypto/rsa.js b/lib/internal/crypto/rsa.js
index 846b6b7bf748..27b23087d563 100644
--- a/lib/internal/crypto/rsa.js
+++ b/lib/internal/crypto/rsa.js
@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  MathCeil,
   TypedArrayPrototypeGetBuffer,
   Uint8Array,
 } = primordials;
@@ -24,12 +23,11 @@ const {
 } = internalBinding('crypto');
 
 const {
-  validateInt32,
+  isInt32,
 } = require('internal/validators');
 
 const {
   bigIntArrayToUnsignedInt,
-  getDigestSizeInBytes,
   getUsagesMask,
   jobPromise,
   normalizeHashName,
@@ -188,6 +186,12 @@ function rsaImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.d === undefined;
+      verifyAcceptableKeyUse(
+        algorithm.name,
+        usagesSet,
+        isPublic ? allowedUsages.public : allowedUsages.private);
+
       const expectedUse = algorithm.name === 'RSA-OAEP' ? 'enc' : 'sig';
       validateJwk(keyData, 'RSA', extractable, usagesSet, expectedUse);
 
@@ -204,11 +208,6 @@ function rsaImportKey(
             'DataError');
       }
 
-      const isPublic = keyData.d === undefined;
-      verifyAcceptableKeyUse(
-        algorithm.name,
-        usagesSet,
-        isPublic ? allowedUsages.public : allowedUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }
@@ -241,19 +240,16 @@ function rsaSignVerify(key, data, { saltLength }, signature) {
     throw lazyDOMException(`Key must be a ${type} key`, 'InvalidAccessError');
 
   const algorithm = getCryptoKeyAlgorithm(key);
-  if (algorithm.name === 'RSA-PSS') {
-    try {
-      validateInt32(
-        saltLength,
-        'algorithm.saltLength',
-        0,
-        MathCeil((algorithm.modulusLength - 1) / 8) -
-          getDigestSizeInBytes(algorithm.hash.name) - 2);
-    } catch (err) {
-      throw lazyDOMException(
-        'The operation failed for an operation-specific reason',
-        { name: 'OperationError', cause: err });
-    }
+  // RsaPssParams converts saltLength to an unsigned long, but SignJob only
+  // accepts int32 values.
+  if (algorithm.name === 'RSA-PSS' && !isInt32(saltLength)) {
+    // EMSA-PSS-VERIFY treats an impossible salt length as inconsistent.
+    if (mode === kSignJobModeVerify)
+      return false;
+
+    throw lazyDOMException(
+      'The operation failed for an operation-specific reason',
+      'OperationError');
   }
 
   return jobPromise(() => new SignJob(
diff --git a/lib/internal/crypto/util.js b/lib/internal/crypto/util.js
index 08088069f9f6..ebaf0bfd620c 100644
--- a/lib/internal/crypto/util.js
+++ b/lib/internal/crypto/util.js
@@ -5,6 +5,7 @@ const {
   ArrayBufferPrototypeGetByteLength,
   ArrayPrototypeIncludes,
   ArrayPrototypePush,
+  ArrayPrototypeSlice,
   BigInt,
   DataViewPrototypeGetBuffer,
   DataViewPrototypeGetByteLength,
@@ -35,9 +36,11 @@ const {
   getCiphers: _getCiphers,
   getCurves: _getCurves,
   getHashes: _getHashes,
+  getMacs: _getMacs,
   setEngine: _setEngine,
   secureHeapUsed: _secureHeapUsed,
   getCachedAliases,
+  getCachedMacAliases,
   getOpenSSLSecLevelCrypto: getOpenSSLSecLevel,
   EVP_PKEY_ML_DSA_44,
   EVP_PKEY_ML_DSA_65,
@@ -48,6 +51,7 @@ const {
   kKeyVariantAES_OCB_128: hasAesOcbMode,
   Argon2Job,
   getFipsCrypto,
+  getFipsCryptoGeneration,
   KmacJob,
 } = internalBinding('crypto');
 
@@ -117,24 +121,82 @@ function toBuf(val, encoding) {
 }
 
 let _hashCache;
+let _macCache;
+if (isBuildingSnapshot()) {
+  addSerializeCallback(() => {
+    _hashCache = undefined;
+    _macCache = undefined;
+  });
+}
+
 function getHashCache() {
-  if (_hashCache === undefined) {
-    _hashCache = getCachedAliases();
-    if (isBuildingSnapshot()) {
-      // For dynamic linking, clear the map.
-      addSerializeCallback(() => { _hashCache = undefined; });
-    }
+  while (_hashCache === undefined) {
+    const generation = getFipsCryptoGeneration();
+    const cache = getCachedAliases();
+    if (generation !== getFipsCryptoGeneration()) continue;
+    _hashCache = cache;
   }
   return _hashCache;
 }
 
+function getMacCache() {
+  while (_macCache === undefined) {
+    const generation = getFipsCryptoGeneration();
+    const cache = getCachedMacAliases();
+    if (generation !== getFipsCryptoGeneration()) continue;
+    _macCache = cache;
+  }
+  return _macCache;
+}
+
+function cachedArrayByFipsGeneration(fn, onRefresh) {
+  let result;
+  let generation;
+  if (isBuildingSnapshot()) {
+    addSerializeCallback(() => {
+      result = undefined;
+      generation = undefined;
+    });
+  }
+
+  return () => {
+    while (true) {
+      const current = getFipsCryptoGeneration();
+      if (result === undefined || generation !== current) {
+        const next = fn();
+        if (current !== getFipsCryptoGeneration()) continue;
+        result = next;
+        generation = current;
+        if (onRefresh !== undefined) onRefresh();
+      }
+      return ArrayPrototypeSlice(result);
+    }
+  };
+}
+
 function getCachedHashId(algorithm) {
   const result = getHashCache()[algorithm];
   return result === undefined ? -1 : result;
 }
 
-const getCiphers = cachedResult(() => filterDuplicateStrings(_getCiphers()));
-const getHashes = cachedResult(() => filterDuplicateStrings(_getHashes()));
+function getCachedMacId(algorithm) {
+  const result = getMacCache()[algorithm];
+  return result === undefined ? -1 : result;
+}
+
+const getCiphers = cachedArrayByFipsGeneration(
+  () => filterDuplicateStrings(_getCiphers()));
+const getHashes = cachedArrayByFipsGeneration(
+  () => filterDuplicateStrings(_getHashes()),
+  () => {
+    _hashCache = undefined;
+  });
+const getMacs = cachedArrayByFipsGeneration(
+  () => filterDuplicateStrings(_getMacs(), true),
+  () => {
+    _macCache = undefined;
+  });
+
 const getCurves = cachedResult(() => filterDuplicateStrings(_getCurves()));
 
 function setEngine(id, flags) {
@@ -1034,22 +1096,6 @@ function getBlockSize(name) {
   }
 }
 
-function getDigestSizeInBytes(name) {
-  switch (name) {
-    case 'SHA-1':
-      return 20;
-    case 'SHA-256': // Fall through
-    case 'SHA3-256':
-      return 32;
-    case 'SHA-384': // Fall through
-    case 'SHA3-384':
-      return 48;
-    case 'SHA-512': // Fall through
-    case 'SHA3-512':
-      return 64;
-  }
-}
-
 function validateKeyOps(keyOps, usagesSet) {
   if (keyOps === undefined) return;
   validateArray(keyOps, 'keyData.key_ops');
@@ -1099,6 +1145,7 @@ module.exports = {
   getCurves,
   getDataViewOrTypedArrayBuffer,
   getHashes,
+  getMacs,
   getOptionalByteLength,
   kHandle,
   setEngine,
@@ -1123,7 +1170,6 @@ module.exports = {
   bigIntArrayToUnsignedBigInt,
   bigIntArrayToUnsignedInt,
   getBlockSize,
-  getDigestSizeInBytes,
   getStringOption,
   getUsagesMask,
   getUsagesFromMask,
@@ -1132,5 +1178,7 @@ module.exports = {
   secureHeapUsed,
   getCachedHashId,
   getHashCache,
+  getCachedMacId,
+  getMacCache,
   getOpenSSLSecLevel,
 };
diff --git a/lib/internal/crypto/webcrypto.js b/lib/internal/crypto/webcrypto.js
index 55953d8e4745..f8a1ef8d00e7 100644
--- a/lib/internal/crypto/webcrypto.js
+++ b/lib/internal/crypto/webcrypto.js
@@ -482,19 +482,20 @@ function deriveKeyImpl(
 }
 
 function exportKeySpki(key) {
+  let exporter;
   switch (getCryptoKeyAlgorithm(key).name) {
     case 'RSASSA-PKCS1-v1_5':
       // Fall through
     case 'RSA-PSS':
       // Fall through
     case 'RSA-OAEP':
-      return require('internal/crypto/rsa')
-        .rsaExportKey(key, kWebCryptoKeyFormatSPKI);
+      exporter = require('internal/crypto/rsa').rsaExportKey;
+      break;
     case 'ECDSA':
       // Fall through
     case 'ECDH':
-      return require('internal/crypto/ec')
-        .ecExportKey(key, kWebCryptoKeyFormatSPKI);
+      exporter = require('internal/crypto/ec').ecExportKey;
+      break;
     case 'Ed25519':
       // Fall through
     case 'Ed448':
@@ -502,41 +503,47 @@ function exportKeySpki(key) {
     case 'X25519':
       // Fall through
     case 'X448':
-      return require('internal/crypto/cfrg')
-        .cfrgExportKey(key, kWebCryptoKeyFormatSPKI);
+      exporter = require('internal/crypto/cfrg').cfrgExportKey;
+      break;
     case 'ML-DSA-44':
       // Fall through
     case 'ML-DSA-65':
       // Fall through
     case 'ML-DSA-87':
-      return require('internal/crypto/ml_dsa')
-        .mlDsaExportKey(key, kWebCryptoKeyFormatSPKI);
+      exporter = require('internal/crypto/ml_dsa').mlDsaExportKey;
+      break;
     case 'ML-KEM-512':
       // Fall through
     case 'ML-KEM-768':
       // Fall through
     case 'ML-KEM-1024':
-      return require('internal/crypto/ml_kem')
-        .mlKemExportKey(key, kWebCryptoKeyFormatSPKI);
+      exporter = require('internal/crypto/ml_kem').mlKemExportKey;
+      break;
     default:
       return undefined;
   }
+
+  if (getCryptoKeyType(key) !== 'public')
+    throw lazyDOMException('Key must be a public key', 'InvalidAccessError');
+
+  return exporter(key, kWebCryptoKeyFormatSPKI);
 }
 
 function exportKeyPkcs8(key) {
+  let exporter;
   switch (getCryptoKeyAlgorithm(key).name) {
     case 'RSASSA-PKCS1-v1_5':
       // Fall through
     case 'RSA-PSS':
       // Fall through
     case 'RSA-OAEP':
-      return require('internal/crypto/rsa')
-        .rsaExportKey(key, kWebCryptoKeyFormatPKCS8);
+      exporter = require('internal/crypto/rsa').rsaExportKey;
+      break;
     case 'ECDSA':
       // Fall through
     case 'ECDH':
-      return require('internal/crypto/ec')
-        .ecExportKey(key, kWebCryptoKeyFormatPKCS8);
+      exporter = require('internal/crypto/ec').ecExportKey;
+      break;
     case 'Ed25519':
       // Fall through
     case 'Ed448':
@@ -544,25 +551,30 @@ function exportKeyPkcs8(key) {
     case 'X25519':
       // Fall through
     case 'X448':
-      return require('internal/crypto/cfrg')
-        .cfrgExportKey(key, kWebCryptoKeyFormatPKCS8);
+      exporter = require('internal/crypto/cfrg').cfrgExportKey;
+      break;
     case 'ML-DSA-44':
       // Fall through
     case 'ML-DSA-65':
       // Fall through
     case 'ML-DSA-87':
-      return require('internal/crypto/ml_dsa')
-        .mlDsaExportKey(key, kWebCryptoKeyFormatPKCS8);
+      exporter = require('internal/crypto/ml_dsa').mlDsaExportKey;
+      break;
     case 'ML-KEM-512':
       // Fall through
     case 'ML-KEM-768':
       // Fall through
     case 'ML-KEM-1024':
-      return require('internal/crypto/ml_kem')
-        .mlKemExportKey(key, kWebCryptoKeyFormatPKCS8);
+      exporter = require('internal/crypto/ml_kem').mlKemExportKey;
+      break;
     default:
       return undefined;
   }
+
+  if (getCryptoKeyType(key) !== 'private')
+    throw lazyDOMException('Key must be a private key', 'InvalidAccessError');
+
+  return exporter(key, kWebCryptoKeyFormatPKCS8);
 }
 
 function exportKeyRawPublic(key, format) {
@@ -767,15 +779,11 @@ function exportKeySync(format, key) {
   let result;
   switch (format) {
     case 'spki': {
-      if (type === 'public') {
-        result = exportKeySpki(key);
-      }
+      result = exportKeySpki(key);
       break;
     }
     case 'pkcs8': {
-      if (type === 'private') {
-        result = exportKeyPkcs8(key);
-      }
+      result = exportKeyPkcs8(key);
       break;
     }
     case 'jwk': {
diff --git a/lib/internal/crypto/x509.js b/lib/internal/crypto/x509.js
index a75425ffcac8..cf1de4474756 100644
--- a/lib/internal/crypto/x509.js
+++ b/lib/internal/crypto/x509.js
@@ -1,13 +1,15 @@
 'use strict';
 
 const {
+  FunctionPrototypeCall,
+  ObjectGetPrototypeOf,
   ObjectSetPrototypeOf,
-  SafeMap,
-  Symbol,
+  SafeWeakMap,
 } = primordials;
 
 const {
-  parseX509,
+  createX509CertificateClass,
+  isX509Certificate: isNativeX509Certificate,
   X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT,
   X509_CHECK_FLAG_NEVER_CHECK_SUBJECT,
   X509_CHECK_FLAG_NO_WILDCARDS,
@@ -46,26 +48,13 @@ const {
   codes: {
     ERR_INVALID_ARG_TYPE,
     ERR_INVALID_ARG_VALUE,
+    ERR_INVALID_THIS,
   },
 } = require('internal/errors');
 
-const {
-  markTransferMode,
-  kClone,
-  kDeserialize,
-} = require('internal/worker/js_transferable');
-
-const {
-  kHandle,
-} = require('internal/crypto/util');
-
 let lazyTranslatePeerCertificate;
 
-const kInternalState = Symbol('kInternalState');
-
-function isX509Certificate(value) {
-  return value[kInternalState] !== undefined;
-}
+let isX509Certificate;
 
 function getFlags(options = kEmptyObject) {
   validateObject(options, 'options');
@@ -96,312 +85,347 @@ function getFlags(options = kEmptyObject) {
   return flags;
 }
 
-class InternalX509Certificate {
-  [kInternalState] = new SafeMap();
-
-  constructor(handle) {
-    markTransferMode(this, true, false);
-    this[kHandle] = handle;
-  }
+const crossRealmState = new SafeWeakMap();
+
+const kSlotSubject = 0;
+const kSlotSubjectAltName = 1;
+const kSlotIssuer = 2;
+const kSlotIssuerCertificate = 3;
+const kSlotInfoAccess = 4;
+const kSlotValidFrom = 5;
+const kSlotValidTo = 6;
+const kSlotValidFromDate = 7;
+const kSlotValidToDate = 8;
+const kSlotFingerprint = 9;
+const kSlotFingerprint256 = 10;
+const kSlotFingerprint512 = 11;
+const kSlotKeyUsage = 12;
+const kSlotSerialNumber = 13;
+const kSlotSignatureAlgorithm = 14;
+const kSlotSignatureAlgorithmOid = 15;
+const kSlotRaw = 16;
+const kSlotPublicKey = 17;
+const kSlotPem = 18;
+const kSlotCA = 19;
+const kStateCacheMask = 20;
+
+function createState() {
+  const state = [];
+  state[kStateCacheMask] = 0;
+  return state;
 }
 
-class X509Certificate {
-  [kInternalState] = new SafeMap();
-
-  constructor(buffer) {
-    if (typeof buffer === 'string')
-      buffer = Buffer.from(buffer);
-    if (!isArrayBufferView(buffer)) {
-      throw new ERR_INVALID_ARG_TYPE(
-        'buffer',
-        ['string', 'Buffer', 'TypedArray', 'DataView'],
-        buffer);
+let InternalX509Certificate;
+
+const {
+  0: X509Certificate,
+  1: InternalX509CertificateConstructor,
+} = createX509CertificateClass((NativeX509Certificate) => {
+  const {
+    checkCA: nativeCheckCA,
+    checkEmail: nativeCheckEmail,
+    checkHost: nativeCheckHost,
+    checkIP: nativeCheckIP,
+    checkIssued: nativeCheckIssued,
+    checkPrivateKey: nativeCheckPrivateKey,
+    fingerprint: nativeFingerprint,
+    fingerprint256: nativeFingerprint256,
+    fingerprint512: nativeFingerprint512,
+    getIssuerCert: nativeGetIssuerCert,
+    infoAccess: nativeInfoAccess,
+    issuer: nativeIssuer,
+    keyUsage: nativeKeyUsage,
+    pem: nativePem,
+    publicKey: nativePublicKey,
+    raw: nativeRaw,
+    serialNumber: nativeSerialNumber,
+    signatureAlgorithm: nativeSignatureAlgorithm,
+    signatureAlgorithmOid: nativeSignatureAlgorithmOid,
+    subject: nativeSubject,
+    subjectAltName: nativeSubjectAltName,
+    toLegacy: nativeToLegacy,
+    validFrom: nativeValidFrom,
+    validFromDate: nativeValidFromDate,
+    validTo: nativeValidTo,
+    validToDate: nativeValidToDate,
+    verify: nativeVerify,
+  } = NativeX509Certificate.prototype;
+
+  let getState;
+
+  function getCachedValue(cert, index, getter) {
+    const state = getState(cert);
+    const bit = 1 << index;
+    if ((state[kStateCacheMask] & bit) === 0) {
+      state[index] = FunctionPrototypeCall(getter, cert);
+      state[kStateCacheMask] |= bit;
+    }
+    return state[index];
+  }
+
+  class X509Certificate {
+    constructor(buffer) {
+      if (typeof buffer === 'string')
+        buffer = Buffer.from(buffer);
+      if (!isArrayBufferView(buffer)) {
+        throw new ERR_INVALID_ARG_TYPE(
+          'buffer',
+          ['string', 'Buffer', 'TypedArray', 'DataView'],
+          buffer);
+      }
+      const prototype = ObjectGetPrototypeOf(this);
+      const certificate = new InternalX509Certificate(buffer);
+      ObjectSetPrototypeOf(certificate, prototype);
+      // eslint-disable-next-line no-constructor-return
+      return certificate;
     }
-    markTransferMode(this, true, false);
-    this[kHandle] = parseX509(buffer);
-  }
 
-  [kInspect](depth, options) {
-    if (depth < 0)
-      return this;
-
-    const opts = {
-      ...options,
-      depth: options.depth == null ? null : options.depth - 1,
-    };
-
-    return `X509Certificate ${inspect({
-      subject: this.subject,
-      subjectAltName: this.subjectAltName,
-      issuer: this.issuer,
-      infoAccess: this.infoAccess,
-      validFrom: this.validFrom,
-      validTo: this.validTo,
-      validFromDate: this.validFromDate,
-      validToDate: this.validToDate,
-      fingerprint: this.fingerprint,
-      fingerprint256: this.fingerprint256,
-      fingerprint512: this.fingerprint512,
-      keyUsage: this.keyUsage,
-      serialNumber: this.serialNumber,
-      signatureAlgorithm: this.signatureAlgorithm,
-      signatureAlgorithmOid: this.signatureAlgorithmOid,
-    }, opts)}`;
-  }
+    [kInspect](depth, options) {
+      if (depth < 0)
+        return this;
+
+      const opts = {
+        ...options,
+        depth: options.depth == null ? null : options.depth - 1,
+      };
+
+      return `X509Certificate ${inspect({
+        subject: getCachedValue(this, kSlotSubject, nativeSubject),
+        subjectAltName:
+          getCachedValue(this, kSlotSubjectAltName, nativeSubjectAltName),
+        issuer: getCachedValue(this, kSlotIssuer, nativeIssuer),
+        infoAccess: getCachedValue(this, kSlotInfoAccess, nativeInfoAccess),
+        validFrom: getCachedValue(this, kSlotValidFrom, nativeValidFrom),
+        validTo: getCachedValue(this, kSlotValidTo, nativeValidTo),
+        validFromDate:
+          getCachedValue(this, kSlotValidFromDate, nativeValidFromDate),
+        validToDate:
+          getCachedValue(this, kSlotValidToDate, nativeValidToDate),
+        fingerprint:
+          getCachedValue(this, kSlotFingerprint, nativeFingerprint),
+        fingerprint256:
+          getCachedValue(this, kSlotFingerprint256, nativeFingerprint256),
+        fingerprint512:
+          getCachedValue(this, kSlotFingerprint512, nativeFingerprint512),
+        keyUsage: getCachedValue(this, kSlotKeyUsage, nativeKeyUsage),
+        serialNumber:
+          getCachedValue(this, kSlotSerialNumber, nativeSerialNumber),
+        signatureAlgorithm:
+          getCachedValue(
+            this, kSlotSignatureAlgorithm, nativeSignatureAlgorithm),
+        signatureAlgorithmOid:
+          getCachedValue(
+            this, kSlotSignatureAlgorithmOid, nativeSignatureAlgorithmOid),
+      }, opts)}`;
+    }
 
-  [kClone]() {
-    const handle = this[kHandle];
-    return {
-      data: { handle },
-      deserializeInfo: 'internal/crypto/x509:InternalX509Certificate',
-    };
-  }
+    get subject() {
+      return getCachedValue(this, kSlotSubject, nativeSubject);
+    }
 
-  [kDeserialize]({ handle }) {
-    this[kHandle] = handle;
-  }
+    get subjectAltName() {
+      return getCachedValue(
+        this, kSlotSubjectAltName, nativeSubjectAltName);
+    }
 
-  get subject() {
-    let value = this[kInternalState].get('subject');
-    if (value === undefined) {
-      value = this[kHandle].subject();
-      this[kInternalState].set('subject', value);
+    get issuer() {
+      return getCachedValue(this, kSlotIssuer, nativeIssuer);
     }
-    return value;
-  }
 
-  get subjectAltName() {
-    let value = this[kInternalState].get('subjectAltName');
-    if (value === undefined) {
-      value = this[kHandle].subjectAltName();
-      this[kInternalState].set('subjectAltName', value);
+    get issuerCertificate() {
+      const state = getState(this);
+      const bit = 1 << kSlotIssuerCertificate;
+      if ((state[kStateCacheMask] & bit) === 0) {
+        const cert = FunctionPrototypeCall(nativeGetIssuerCert, this);
+        state[kSlotIssuerCertificate] = cert ?
+          new InternalX509Certificate(cert) : undefined;
+        state[kStateCacheMask] |= bit;
+      }
+      return state[kSlotIssuerCertificate];
     }
-    return value;
-  }
 
-  get issuer() {
-    let value = this[kInternalState].get('issuer');
-    if (value === undefined) {
-      value = this[kHandle].issuer();
-      this[kInternalState].set('issuer', value);
+    get infoAccess() {
+      return getCachedValue(this, kSlotInfoAccess, nativeInfoAccess);
     }
-    return value;
-  }
 
-  get issuerCertificate() {
-    let value = this[kInternalState].get('issuerCertificate');
-    if (value === undefined) {
-      const cert = this[kHandle].getIssuerCert();
-      if (cert)
-        value = new InternalX509Certificate(cert);
-      this[kInternalState].set('issuerCertificate', value);
+    get validFrom() {
+      return getCachedValue(this, kSlotValidFrom, nativeValidFrom);
     }
-    return value;
-  }
 
-  get infoAccess() {
-    let value = this[kInternalState].get('infoAccess');
-    if (value === undefined) {
-      value = this[kHandle].infoAccess();
-      this[kInternalState].set('infoAccess', value);
+    get validTo() {
+      return getCachedValue(this, kSlotValidTo, nativeValidTo);
     }
-    return value;
-  }
 
-  get validFrom() {
-    let value = this[kInternalState].get('validFrom');
-    if (value === undefined) {
-      value = this[kHandle].validFrom();
-      this[kInternalState].set('validFrom', value);
+    get validFromDate() {
+      return getCachedValue(this, kSlotValidFromDate, nativeValidFromDate);
     }
-    return value;
-  }
 
-  get validTo() {
-    let value = this[kInternalState].get('validTo');
-    if (value === undefined) {
-      value = this[kHandle].validTo();
-      this[kInternalState].set('validTo', value);
+    get validToDate() {
+      return getCachedValue(this, kSlotValidToDate, nativeValidToDate);
     }
-    return value;
-  }
 
-  get validFromDate() {
-    let value = this[kInternalState].get('validFromDate');
-    if (value === undefined) {
-      value = this[kHandle].validFromDate();
-      this[kInternalState].set('validFromDate', value);
+    get fingerprint() {
+      return getCachedValue(this, kSlotFingerprint, nativeFingerprint);
     }
-    return value;
-  }
 
-  get validToDate() {
-    let value = this[kInternalState].get('validToDate');
-    if (value === undefined) {
-      value = this[kHandle].validToDate();
-      this[kInternalState].set('validToDate', value);
+    get fingerprint256() {
+      return getCachedValue(this, kSlotFingerprint256, nativeFingerprint256);
     }
-    return value;
-  }
 
-  get fingerprint() {
-    let value = this[kInternalState].get('fingerprint');
-    if (value === undefined) {
-      value = this[kHandle].fingerprint();
-      this[kInternalState].set('fingerprint', value);
+    get fingerprint512() {
+      return getCachedValue(this, kSlotFingerprint512, nativeFingerprint512);
     }
-    return value;
-  }
 
-  get fingerprint256() {
-    let value = this[kInternalState].get('fingerprint256');
-    if (value === undefined) {
-      value = this[kHandle].fingerprint256();
-      this[kInternalState].set('fingerprint256', value);
+    get keyUsage() {
+      return getCachedValue(this, kSlotKeyUsage, nativeKeyUsage);
     }
-    return value;
-  }
 
-  get fingerprint512() {
-    let value = this[kInternalState].get('fingerprint512');
-    if (value === undefined) {
-      value = this[kHandle].fingerprint512();
-      this[kInternalState].set('fingerprint512', value);
+    get serialNumber() {
+      return getCachedValue(this, kSlotSerialNumber, nativeSerialNumber);
     }
-    return value;
-  }
 
-  get keyUsage() {
-    let value = this[kInternalState].get('keyUsage');
-    if (value === undefined) {
-      value = this[kHandle].keyUsage();
-      this[kInternalState].set('keyUsage', value);
+    get signatureAlgorithm() {
+      return getCachedValue(
+        this, kSlotSignatureAlgorithm, nativeSignatureAlgorithm);
     }
-    return value;
-  }
 
-  get serialNumber() {
-    let value = this[kInternalState].get('serialNumber');
-    if (value === undefined) {
-      value = this[kHandle].serialNumber();
-      this[kInternalState].set('serialNumber', value);
+    get signatureAlgorithmOid() {
+      return getCachedValue(
+        this, kSlotSignatureAlgorithmOid, nativeSignatureAlgorithmOid);
     }
-    return value;
-  }
 
-  get signatureAlgorithm() {
-    let value = this[kInternalState].get('signatureAlgorithm');
-    if (value === undefined) {
-      value = this[kHandle].signatureAlgorithm();
-      this[kInternalState].set('signatureAlgorithm', value);
+    get raw() {
+      return getCachedValue(this, kSlotRaw, nativeRaw);
     }
-    return value;
-  }
 
-  get signatureAlgorithmOid() {
-    let value = this[kInternalState].get('signatureAlgorithmOid');
-    if (value === undefined) {
-      value = this[kHandle].signatureAlgorithmOid();
-      this[kInternalState].set('signatureAlgorithmOid', value);
+    get publicKey() {
+      const state = getState(this);
+      const bit = 1 << kSlotPublicKey;
+      if ((state[kStateCacheMask] & bit) === 0) {
+        state[kSlotPublicKey] = new PublicKeyObject(
+          FunctionPrototypeCall(nativePublicKey, this));
+        state[kStateCacheMask] |= bit;
+      }
+      return state[kSlotPublicKey];
     }
-    return value;
-  }
 
-  get raw() {
-    let value = this[kInternalState].get('raw');
-    if (value === undefined) {
-      value = this[kHandle].raw();
-      this[kInternalState].set('raw', value);
+    toString() {
+      return getCachedValue(this, kSlotPem, nativePem);
     }
-    return value;
-  }
 
-  get publicKey() {
-    let value = this[kInternalState].get('publicKey');
-    if (value === undefined) {
-      value = new PublicKeyObject(this[kHandle].publicKey());
-      this[kInternalState].set('publicKey', value);
+    // There's no standardized JSON encoding for X509 certs so we
+    // fallback to providing the PEM encoding as a string.
+    toJSON() { return getCachedValue(this, kSlotPem, nativePem); }
+
+    get ca() {
+      return getCachedValue(this, kSlotCA, nativeCheckCA);
     }
-    return value;
-  }
 
-  toString() {
-    let value = this[kInternalState].get('pem');
-    if (value === undefined) {
-      value = this[kHandle].pem();
-      this[kInternalState].set('pem', value);
+    checkHost(name, options) {
+      getState(this);
+      validateString(name, 'name');
+      return FunctionPrototypeCall(
+        nativeCheckHost, this, name, getFlags(options));
     }
-    return value;
-  }
 
-  // There's no standardized JSON encoding for X509 certs so we
-  // fallback to providing the PEM encoding as a string.
-  toJSON() { return this.toString(); }
+    checkEmail(email, options) {
+      getState(this);
+      validateString(email, 'email');
+      return FunctionPrototypeCall(
+        nativeCheckEmail, this, email, getFlags(options));
+    }
 
-  get ca() {
-    let value = this[kInternalState].get('ca');
-    if (value === undefined) {
-      value = this[kHandle].checkCA();
-      this[kInternalState].set('ca', value);
+    checkIP(ip, options) {
+      getState(this);
+      validateString(ip, 'ip');
+      // The options argument is currently undocumented since none of the
+      // options have any effect on the behavior of this function. However, we
+      // still parse the options argument in case OpenSSL adds flags in the
+      // future that do affect the behavior of X509_check_ip. This ensures that
+      // no invalid values are passed as the second argument in the meantime.
+      return FunctionPrototypeCall(
+        nativeCheckIP, this, ip, getFlags(options));
     }
-    return value;
-  }
 
-  checkHost(name, options) {
-    validateString(name, 'name');
-    return this[kHandle].checkHost(name, getFlags(options));
-  }
+    checkIssued(otherCert) {
+      getState(this);
+      if (!isX509Certificate(otherCert)) {
+        throw new ERR_INVALID_ARG_TYPE(
+          'otherCert', 'X509Certificate', otherCert);
+      }
+      return FunctionPrototypeCall(nativeCheckIssued, this, otherCert);
+    }
 
-  checkEmail(email, options) {
-    validateString(email, 'email');
-    return this[kHandle].checkEmail(email, getFlags(options));
-  }
+    checkPrivateKey(pkey) {
+      getState(this);
+      if (!isKeyObject(pkey))
+        throw new ERR_INVALID_ARG_TYPE('pkey', 'KeyObject', pkey);
+      if (getKeyObjectType(pkey) !== 'private')
+        throw new ERR_INVALID_ARG_VALUE('pkey', pkey);
+      return FunctionPrototypeCall(
+        nativeCheckPrivateKey, this, getKeyObjectHandle(pkey));
+    }
 
-  checkIP(ip, options) {
-    validateString(ip, 'ip');
-    // The options argument is currently undocumented since none of the options
-    // have any effect on the behavior of this function. However, we still parse
-    // the options argument in case OpenSSL adds flags in the future that do
-    // affect the behavior of X509_check_ip. This ensures that no invalid values
-    // are passed as the second argument in the meantime.
-    return this[kHandle].checkIP(ip, getFlags(options));
-  }
+    verify(pkey) {
+      getState(this);
+      if (!isKeyObject(pkey))
+        throw new ERR_INVALID_ARG_TYPE('pkey', 'KeyObject', pkey);
+      if (getKeyObjectType(pkey) !== 'public')
+        throw new ERR_INVALID_ARG_VALUE('pkey', pkey);
+      return FunctionPrototypeCall(
+        nativeVerify, this, getKeyObjectHandle(pkey));
+    }
 
-  checkIssued(otherCert) {
-    if (!isX509Certificate(otherCert))
-      throw new ERR_INVALID_ARG_TYPE('otherCert', 'X509Certificate', otherCert);
-    return this[kHandle].checkIssued(otherCert[kHandle]);
+    toLegacyObject() {
+      getState(this);
+      // TODO(tniessen): do not depend on translatePeerCertificate here, return
+      // the correct legacy representation from the binding
+      lazyTranslatePeerCertificate ??=
+        require('internal/tls/common').translatePeerCertificate;
+      return lazyTranslatePeerCertificate(
+        FunctionPrototypeCall(nativeToLegacy, this));
+    }
   }
 
-  checkPrivateKey(pkey) {
-    if (!isKeyObject(pkey))
-      throw new ERR_INVALID_ARG_TYPE('pkey', 'KeyObject', pkey);
-    if (getKeyObjectType(pkey) !== 'private')
-      throw new ERR_INVALID_ARG_VALUE('pkey', pkey);
-    return this[kHandle].checkPrivateKey(getKeyObjectHandle(pkey));
-  }
+  InternalX509Certificate = class InternalX509Certificate
+    extends NativeX509Certificate {
+    #state = createState();
+
+    static {
+      isX509Certificate = (value) => {
+        if (value == null || typeof value !== 'object') return false;
+        return #state in value || isNativeX509Certificate(value);
+      };
+
+      getState = (cert) => {
+        try {
+          return cert.#state;
+        } catch {
+          // Continue with the cross-realm native brand check.
+        }
+        if (!isNativeX509Certificate(cert)) {
+          throw new ERR_INVALID_THIS('X509Certificate');
+        }
+        let state = crossRealmState.get(cert);
+        if (state === undefined) {
+          state = createState();
+          crossRealmState.set(cert, state);
+        }
+        return state;
+      };
+    }
+  };
 
-  verify(pkey) {
-    if (!isKeyObject(pkey))
-      throw new ERR_INVALID_ARG_TYPE('pkey', 'KeyObject', pkey);
-    if (getKeyObjectType(pkey) !== 'public')
-      throw new ERR_INVALID_ARG_VALUE('pkey', pkey);
-    return this[kHandle].verify(getKeyObjectHandle(pkey));
-  }
+  InternalX509Certificate.prototype.constructor = X509Certificate;
+  ObjectSetPrototypeOf(
+    InternalX509Certificate.prototype,
+    X509Certificate.prototype);
 
-  toLegacyObject() {
-    // TODO(tniessen): do not depend on translatePeerCertificate here, return
-    // the correct legacy representation from the binding
-    lazyTranslatePeerCertificate ??=
-      require('internal/tls/common').translatePeerCertificate;
-    return lazyTranslatePeerCertificate(this[kHandle].toLegacy());
-  }
-}
+  return [X509Certificate, InternalX509Certificate];
+});
 
-InternalX509Certificate.prototype.constructor = X509Certificate;
-ObjectSetPrototypeOf(
-  InternalX509Certificate.prototype,
-  X509Certificate.prototype);
+// Keep the binding-returned constructor and the closure reference aligned.
+InternalX509Certificate = InternalX509CertificateConstructor;
 
 module.exports = {
   X509Certificate,
diff --git a/lib/internal/dtls/dtls.js b/lib/internal/dtls/dtls.js
new file mode 100644
index 000000000000..e6017e3e8761
--- /dev/null
+++ b/lib/internal/dtls/dtls.js
@@ -0,0 +1,703 @@
+'use strict';
+
+// TODO(@jasnell) Temporarily ignoring c8 coverage for this file while tests
+// are still being developed.
+/* c8 ignore start */
+
+const {
+  ArrayIsArray,
+  FunctionPrototypeBind,
+  PromisePrototypeThen,
+  PromiseWithResolvers,
+  SafeSet,
+  SymbolAsyncDispose,
+} = primordials;
+
+const {
+  getOptionValue,
+} = require('internal/options');
+
+// DTLS requires that Node.js be compiled with crypto support.
+if (!process.features.dtls || !getOptionValue('--experimental-dtls')) {
+  return;
+}
+
+const {
+  codes: {
+    ERR_ILLEGAL_CONSTRUCTOR,
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_STATE,
+    ERR_MISSING_ARGS,
+  },
+} = require('internal/errors');
+
+const {
+  validateFunction,
+  validateObject,
+  validateString,
+  validateInteger,
+} = require('internal/validators');
+
+const {
+  Buffer,
+} = require('buffer');
+
+const {
+  isIP,
+} = require('internal/net');
+
+const {
+  DTLSEndpointState,
+  DTLSSessionState,
+} = require('internal/dtls/state');
+
+const {
+  DTLSEndpointStats,
+  DTLSSessionStats,
+} = require('internal/dtls/stats');
+
+const {
+  kOwner,
+  kPrivateConstructor,
+  kSessionHandshake,
+  kSessionMessage,
+  kSessionError,
+  kSessionClose,
+  kSessionKeylog,
+} = require('internal/dtls/symbols');
+
+const {
+  DTLSContext: DTLSContext_,
+  DTLSEndpoint: DTLSEndpoint_,
+  SSL_VERIFY_NONE_VALUE,
+  SSL_VERIFY_PEER_VALUE,
+  SSL_VERIFY_FAIL_IF_NO_PEER_CERT_VALUE,
+} = internalBinding('dtls');
+
+const kEmptyObject = { __proto__: null };
+
+// ============================================================================
+// DTLSSession -- represents a single DTLS peer association
+// ============================================================================
+
+class DTLSSession {
+  #handle;
+  #endpoint;
+  #state;
+  #stats;
+  #pendingOpen;
+  #pendingClose;
+  #onmessage;
+  #onerror;
+  #onhandshake;
+  #onkeylog;
+  #ownsEndpoint = false;
+
+  constructor(privateSymbol, handle, endpoint) {
+    if (privateSymbol !== kPrivateConstructor) {
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    }
+
+    this.#handle = handle;
+    this.#handle[kOwner] = this;
+    this.#endpoint = endpoint;
+    this.#state = new DTLSSessionState(
+      kPrivateConstructor, handle.getState());
+    this.#stats = new DTLSSessionStats(
+      kPrivateConstructor, handle.getStats());
+    this.#pendingOpen = PromiseWithResolvers();
+    this.#pendingClose = PromiseWithResolvers();
+    // opened/closed may reject (handshake error, destroy(error)). Attach a
+    // no-op rejection handler so a caller that uses the callback API and never
+    // awaits them does not trigger an unhandled rejection; an explicit
+    // await/then/catch on opened/closed still observes the rejection.
+    PromisePrototypeThen(this.#pendingOpen.promise, undefined, () => {});
+    PromisePrototypeThen(this.#pendingClose.promise, undefined, () => {});
+  }
+
+  // --- Callback setters ---
+
+  set onmessage(fn) {
+    if (fn !== undefined && fn !== null) {
+      validateFunction(fn, 'onmessage');
+      this.#onmessage = FunctionPrototypeBind(fn, this);
+      this.#state.hasMessageListener = true;
+    } else {
+      this.#onmessage = undefined;
+      this.#state.hasMessageListener = false;
+    }
+  }
+
+  get onmessage() { return this.#onmessage; }
+
+  set onerror(fn) {
+    if (fn !== undefined && fn !== null) {
+      validateFunction(fn, 'onerror');
+      this.#onerror = FunctionPrototypeBind(fn, this);
+    } else {
+      this.#onerror = undefined;
+    }
+  }
+
+  get onerror() { return this.#onerror; }
+
+  set onhandshake(fn) {
+    if (fn !== undefined && fn !== null) {
+      validateFunction(fn, 'onhandshake');
+      this.#onhandshake = FunctionPrototypeBind(fn, this);
+    } else {
+      this.#onhandshake = undefined;
+    }
+  }
+
+  get onhandshake() { return this.#onhandshake; }
+
+  set onkeylog(fn) {
+    if (fn !== undefined && fn !== null) {
+      validateFunction(fn, 'onkeylog');
+      this.#onkeylog = FunctionPrototypeBind(fn, this);
+    } else {
+      this.#onkeylog = undefined;
+    }
+  }
+
+  get onkeylog() { return this.#onkeylog; }
+
+  // --- Send data ---
+
+  send(data) {
+    if (this.#handle === null) {
+      throw new ERR_INVALID_STATE('Session is destroyed');
+    }
+    if (typeof data === 'string') {
+      data = Buffer.from(data);
+    }
+    if (!Buffer.isBuffer(data)) {
+      throw new ERR_INVALID_ARG_TYPE('data', ['string', 'Buffer'], data);
+    }
+    return this.#handle.send(data);
+  }
+
+  // --- Lifecycle ---
+
+  close() {
+    if (this.#handle === null) return this.closed;
+    const handle = this.#handle;
+    this.#handle = null;
+    handle.close();
+    return this.closed;
+  }
+
+  destroy(error) {
+    if (this.#handle === null) return;
+    const handle = this.#handle;
+    this.#handle = null;
+    handle.destroy();
+    if (error) {
+      this.#pendingClose.reject(error);
+    } else {
+      this.#pendingClose.resolve();
+    }
+  }
+
+  get opened() { return this.#pendingOpen.promise; }
+  get closed() { return this.#pendingClose.promise; }
+
+  // --- Properties ---
+
+  get remoteAddress() {
+    if (this.#handle === null) return undefined;
+    return this.#handle.getRemoteAddress();
+  }
+
+  get protocol() {
+    if (this.#handle === null) return undefined;
+    return this.#handle.getProtocol();
+  }
+
+  get cipher() {
+    if (this.#handle === null) return undefined;
+    return this.#handle.getCipher();
+  }
+
+  get peerCertificate() {
+    if (this.#handle === null) return undefined;
+    return this.#handle.getPeerCertificate();
+  }
+
+  get alpnProtocol() {
+    if (this.#handle === null) return undefined;
+    return this.#handle.getALPNProtocol();
+  }
+
+  get srtpProfile() {
+    if (this.#handle === null) return undefined;
+    return this.#handle.getSRTPProfile();
+  }
+
+  get servername() {
+    if (this.#handle === null) return undefined;
+    return this.#handle.getServername();
+  }
+
+  get state() { return this.#state; }
+  get stats() { return this.#stats; }
+  get endpoint() { return this.#endpoint; }
+
+  exportKeyingMaterial(length, label, context) {
+    if (this.#handle === null) {
+      throw new ERR_INVALID_STATE('Session is destroyed');
+    }
+    return this.#handle.exportKeyingMaterial(length, label, context);
+  }
+
+  // --- Internal callbacks (called from C++ via endpoint dispatch) ---
+
+  [kSessionHandshake](protocol) {
+    this.#pendingOpen.resolve({ protocol });
+    if (this.#onhandshake) {
+      this.#onhandshake(protocol);
+    }
+  }
+
+  [kSessionMessage](data) {
+    if (this.#onmessage) {
+      this.#onmessage(data);
+    }
+  }
+
+  [kSessionError](message) {
+    const error = new ERR_INVALID_STATE(message);
+    if (this.#onerror) {
+      this.#onerror(error);
+    }
+    this.#pendingOpen.reject(error);
+
+    // The session has failed and cannot continue. Tear it down so it does not
+    // linger in the endpoint's table, and -- for a client session that owns
+    // its internal endpoint -- close the endpoint too so the event loop can
+    // drain. destroy() removes the session from the C++ table first, so the
+    // endpoint.close() below won't try to re-close it. Reentrant destroy from
+    // within the error emit is safe: Cycle()/the timer hold a strong ref.
+    const endpoint = this.#endpoint;
+    const ownsEndpoint = this.#ownsEndpoint;
+    this.destroy();
+    if (endpoint) {
+      endpoint.sessions.delete(this);
+      if (ownsEndpoint) {
+        endpoint.close();
+      }
+    }
+  }
+
+  [kSessionClose]() {
+    this.#pendingClose.resolve();
+    this.#handle = null;
+    // Remove from the endpoint's JS-side session set.
+    if (this.#endpoint) {
+      this.#endpoint.sessions.delete(this);
+    }
+    // If this session owns its endpoint (client-side connect()),
+    // close the endpoint too so the process can exit.
+    if (this.#ownsEndpoint && this.#endpoint) {
+      this.#endpoint.close();
+    }
+  }
+
+  // Mark that this session owns its endpoint (for client sessions
+  // created by connect() where the endpoint is internal).
+  get ownsEndpoint() { return this.#ownsEndpoint; }
+  set ownsEndpoint(val) { this.#ownsEndpoint = val; }
+
+  [kSessionKeylog](line) {
+    if (this.#onkeylog) {
+      this.#onkeylog(line);
+    }
+  }
+
+  async [SymbolAsyncDispose]() {
+    await this.close();
+  }
+}
+
+// ============================================================================
+// DTLSEndpoint -- manages a UDP socket and routes datagrams to sessions
+// ============================================================================
+
+class DTLSEndpoint {
+  #handle;
+  #state;
+  #stats;
+  #sessions = new SafeSet();
+  #pendingClose;
+  #onsession;
+  #onerror;
+
+  constructor(options = kEmptyObject) {
+    this.#handle = new DTLSEndpoint_();
+    this.#handle[kOwner] = this;
+    this.#state = new DTLSEndpointState(
+      kPrivateConstructor, this.#handle.getState());
+    this.#stats = new DTLSEndpointStats(
+      kPrivateConstructor, this.#handle.getStats());
+    this.#pendingClose = PromiseWithResolvers();
+    // See DTLSSession: keep an unobserved closed rejection from surfacing as an
+    // unhandled rejection.
+    PromisePrototypeThen(this.#pendingClose.promise, undefined, () => {});
+
+    if (options.mtu !== undefined) {
+      validateInteger(options.mtu, 'options.mtu', 256, 65535);
+      this.#handle.setMTU(options.mtu);
+    }
+
+    // Set up the callback dispatch from C++ to JS.
+    this.#handle.setCallbacks({
+      __proto__: null,
+      onEndpointClose: () => this.#onEndpointClose(),
+      onEndpointError: (msg) => this.#onEndpointError(msg),
+      onSessionNew: (handle) => this.#onSessionNew(handle),
+      onSessionClose: function() {
+        this[kOwner]?.[kSessionClose]();
+      },
+      onSessionError: function(msg) {
+        this[kOwner]?.[kSessionError](msg);
+      },
+      onSessionHandshake: function(protocol) {
+        this[kOwner]?.[kSessionHandshake](protocol);
+      },
+      onSessionMessage: function(data) {
+        this[kOwner]?.[kSessionMessage](data);
+      },
+      onSessionKeylog: function(line) {
+        this[kOwner]?.[kSessionKeylog](line);
+      },
+      onSessionTicket: function() {
+        // Session ticket handling - placeholder for resumption.
+      },
+    });
+  }
+
+  // --- Server mode ---
+
+  listen(callback, context) {
+    validateFunction(callback, 'callback');
+    this.#onsession = callback;
+    this.#handle.listen(context);
+    return this;
+  }
+
+  // --- Client mode ---
+
+  connect(context, host, port, servername) {
+    // Resolve SNI and the expected peer identity here so that every caller of
+    // the endpoint API -- not only the top-level dtls.connect() -- gets safe
+    // defaults. The identity is always bound to the requested servername (or,
+    // failing that, the host). OpenSSL only *enforces* it when the context is
+    // in a verifying mode, so binding it is a no-op for non-verifying
+    // (rejectUnauthorized: false) contexts.
+    //
+    // These are applied to the client SSL inside the binding, before the
+    // handshake's ClientHello is emitted; they cannot be set afterwards.
+    let sni = servername !== undefined ? (servername || undefined) : host;
+    if (sni !== undefined && isIP(sni) !== 0) {
+      sni = undefined;  // SNI is never sent for IP literals (matching TLS).
+    }
+    const verifyHost = servername || host;
+    const verifyIsIp = isIP(verifyHost) !== 0;
+
+    const sessionHandle = this.#handle.connect(
+      context, host, port, sni, verifyHost, verifyIsIp);
+    const session = new DTLSSession(
+      kPrivateConstructor, sessionHandle, this);
+    this.#sessions.add(session);
+    return session;
+  }
+
+  // --- Bind ---
+
+  bind(host, port) {
+    this.#handle.bind(host, port);
+    return this;
+  }
+
+  // --- Lifecycle ---
+
+  close() {
+    if (this.#handle === null) return this.closed;
+    const handle = this.#handle;
+    this.#handle = null;
+    handle.close();
+    return this.closed;
+  }
+
+  destroy(error) {
+    if (this.#handle === null) return;
+    const handle = this.#handle;
+    this.#handle = null;
+    handle.destroy();
+    if (error) {
+      this.#pendingClose.reject(error);
+    } else {
+      this.#pendingClose.resolve();
+    }
+  }
+
+  get closed() { return this.#pendingClose.promise; }
+
+  // --- Properties ---
+
+  get address() {
+    if (this.#handle === null) return undefined;
+    return this.#handle.getAddress();
+  }
+
+  get state() { return this.#state; }
+  get stats() { return this.#stats; }
+  get sessions() { return this.#sessions; }
+
+  get onerror() { return this.#onerror; }
+  set onerror(fn) {
+    if (fn !== undefined && fn !== null) {
+      validateFunction(fn, 'onerror');
+      this.#onerror = fn;
+    } else {
+      this.#onerror = undefined;
+    }
+  }
+
+  set busy(val) {
+    this.#state.busy = !!val;
+  }
+
+  get busy() {
+    return this.#state.busy;
+  }
+
+  // --- Internal callbacks ---
+
+  #onEndpointClose() {
+    this.#sessions.clear();
+    this.#pendingClose.resolve();
+    this.#handle = null;
+  }
+
+  #onEndpointError(message) {
+    if (this.#onerror) {
+      this.#onerror(new ERR_INVALID_STATE(message));
+    }
+  }
+
+  #onSessionNew(handle) {
+    const session = new DTLSSession(kPrivateConstructor, handle, this);
+    this.#sessions.add(session);
+    if (this.#onsession) {
+      this.#onsession(session);
+    }
+  }
+
+  async [SymbolAsyncDispose]() {
+    await this.close();
+  }
+}
+
+// ============================================================================
+// Public API functions
+// ============================================================================
+
+function createContext(options = kEmptyObject) {
+  validateObject(options, 'options');
+
+  const isServer = options.isServer === true;
+  const context = new DTLSContext_(isServer);
+
+  // Certificate
+  if (options.cert !== undefined) {
+    let cert = options.cert;
+    if (Buffer.isBuffer(cert)) cert = cert.toString();
+    validateString(cert, 'options.cert');
+    context.setCert(cert);
+  }
+
+  // Private key
+  if (options.key !== undefined) {
+    let key = options.key;
+    if (Buffer.isBuffer(key)) key = key.toString();
+    validateString(key, 'options.key');
+    context.setKey(key);
+  }
+
+  // CA certificates: if custom CAs are provided, use only those.
+  // Otherwise load system default CAs. This matches Node.js TLS behavior.
+  if (options.ca !== undefined) {
+    const cas = ArrayIsArray(options.ca) ? options.ca : [options.ca];
+    for (let ca of cas) {
+      if (Buffer.isBuffer(ca)) ca = ca.toString();
+      validateString(ca, 'options.ca');
+      context.addCACert(ca);
+    }
+  } else {
+    context.loadDefaultCAs();
+  }
+
+  // Ciphers
+  if (options.ciphers !== undefined) {
+    validateString(options.ciphers, 'options.ciphers');
+    context.setCiphers(options.ciphers);
+  }
+
+  // ECDH curve (default: 'auto' = OpenSSL default selection)
+  const ecdhCurve = options.ecdhCurve || 'auto';
+  validateString(ecdhCurve, 'options.ecdhCurve');
+  context.setECDHCurve(ecdhCurve);
+
+  // ALPN protocols
+  if (options.alpn !== undefined) {
+    let protocols = options.alpn;
+    if (ArrayIsArray(protocols)) {
+      // Convert string array to wire-format buffer.
+      const bufs = [];
+      for (const proto of protocols) {
+        validateString(proto, 'options.alpn[]');
+        const buf = Buffer.from(proto);
+        bufs.push(Buffer.from([buf.length]), buf);
+      }
+      protocols = Buffer.concat(bufs);
+    }
+    if (!Buffer.isBuffer(protocols)) {
+      throw new ERR_INVALID_ARG_TYPE(
+        'options.alpn', ['string[]', 'Buffer'], protocols);
+    }
+    context.setALPN(protocols);
+  }
+
+  // SRTP profiles
+  if (options.srtp !== undefined) {
+    validateString(options.srtp, 'options.srtp');
+    context.setSRTP(options.srtp);
+  }
+
+  // Verification mode
+  if (options.rejectUnauthorized !== undefined) {
+    const mode = options.rejectUnauthorized ?
+      (SSL_VERIFY_PEER_VALUE | SSL_VERIFY_FAIL_IF_NO_PEER_CERT_VALUE) :
+      SSL_VERIFY_NONE_VALUE;
+    context.setVerifyMode(mode);
+  } else if (options.requestCert) {
+    context.setVerifyMode(
+      SSL_VERIFY_PEER_VALUE | SSL_VERIFY_FAIL_IF_NO_PEER_CERT_VALUE);
+  }
+
+  return context;
+}
+
+/**
+ * Start a DTLS server.
+ * @param {Function} onsession Callback invoked for each new DTLS session.
+ * @param {object} options Server configuration.
+ * @param {string|Buffer} options.cert Server certificate (PEM).
+ * @param {string|Buffer} options.key Server private key (PEM).
+ * @param {string|Buffer|Array} [options.ca] CA certificates (PEM).
+ * @param {string} [options.host] Bind address.
+ * @param {number} options.port Bind port.
+ * @param {number} [options.mtu] MTU for DTLS records.
+ * @param {string[]} [options.alpn] ALPN protocol list.
+ * @param {string} [options.srtp] SRTP profile string.
+ * @param {boolean} [options.requestCert] Request client certificates.
+ * @returns {DTLSEndpoint}
+ */
+function listen(onsession, options = kEmptyObject) {
+  validateFunction(onsession, 'onsession');
+  validateObject(options, 'options');
+
+  if (options.cert === undefined) {
+    throw new ERR_MISSING_ARGS('options.cert');
+  }
+  if (options.key === undefined) {
+    throw new ERR_MISSING_ARGS('options.key');
+  }
+  if (options.port === undefined) {
+    throw new ERR_MISSING_ARGS('options.port');
+  }
+
+  const host = options.host || '0.0.0.0';
+  const port = options.port;
+
+  validateString(host, 'options.host');
+  validateInteger(port, 'options.port', 0, 65535);
+
+  const context = createContext({
+    ...options,
+    isServer: true,
+  });
+
+  const endpoint = new DTLSEndpoint({
+    mtu: options.mtu,
+  });
+
+  endpoint.bind(host, port);
+  endpoint.listen(onsession, context);
+
+  return endpoint;
+}
+
+/**
+ * Connect to a DTLS server.
+ * @param {string} host Remote host.
+ * @param {number} port Remote port.
+ * @param {object} [options] Client configuration.
+ * @param {string|Buffer|Array} [options.ca] CA certificates (PEM).
+ * @param {string|Buffer} [options.cert] Client certificate (PEM).
+ * @param {string|Buffer} [options.key] Client private key (PEM).
+ * @param {boolean} [options.rejectUnauthorized] When true (default), verify
+ *   the server certificate against the trusted CAs and check its identity
+ *   against servername (or host); aborts the handshake on failure.
+ * @param {string} [options.servername] Server name for the SNI extension and
+ *   the identity checked during certificate verification. Defaults to host;
+ *   set to '' to disable SNI. Never sent for IP address literals.
+ * @param {string} [options.bindHost] Local bind address.
+ * @param {number} [options.bindPort] Local bind port (0 = ephemeral).
+ * @param {number} [options.mtu] MTU for DTLS records.
+ * @param {string[]} [options.alpn] ALPN protocol list.
+ * @param {string} [options.srtp] SRTP profile string.
+ * @returns {DTLSSession}
+ */
+function connect(host, port, options = kEmptyObject) {
+  validateString(host, 'host');
+  validateInteger(port, 'port', 0, 65535);
+  validateObject(options, 'options');
+
+  const bindHost = options.bindHost || '0.0.0.0';
+  const bindPort = options.bindPort || 0;
+
+  const context = createContext({
+    ...options,
+    isServer: false,
+    rejectUnauthorized: options.rejectUnauthorized !== false,
+  });
+
+  const endpoint = new DTLSEndpoint({
+    mtu: options.mtu,
+  });
+
+  endpoint.bind(bindHost, bindPort);
+
+  // SNI and peer-identity verification are resolved inside
+  // DTLSEndpoint.connect(), which defaults both to the host argument (matching
+  // Node.js TLS). The identity is enforced whenever the context verifies, i.e.
+  // unless rejectUnauthorized is false.
+  const session = endpoint.connect(context, host, port, options.servername);
+  // Mark that this session owns the endpoint so it gets closed
+  // automatically when the session closes, allowing process exit.
+  session.ownsEndpoint = true;
+  return session;
+}
+
+module.exports = {
+  connect,
+  listen,
+  createContext,
+  DTLSEndpoint,
+  DTLSSession,
+};
+
+/* c8 ignore stop */
diff --git a/lib/internal/dtls/state.js b/lib/internal/dtls/state.js
new file mode 100644
index 000000000000..5d86b556f1ad
--- /dev/null
+++ b/lib/internal/dtls/state.js
@@ -0,0 +1,174 @@
+'use strict';
+
+// TODO(@jasnell) Temporarily ignoring c8 coverage for this file while tests
+// are still being developed.
+/* c8 ignore start */
+
+const {
+  DataView,
+  DataViewPrototypeGetByteLength,
+  DataViewPrototypeGetUint32,
+  DataViewPrototypeGetUint8,
+  DataViewPrototypeSetUint8,
+} = primordials;
+
+const {
+  getOptionValue,
+} = require('internal/options');
+
+if (!process.features.dtls || !getOptionValue('--experimental-dtls')) {
+  return;
+}
+
+const {
+  codes: {
+    ERR_ILLEGAL_CONSTRUCTOR,
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+
+const {
+  kPrivateConstructor,
+} = require('internal/dtls/symbols');
+
+const {
+  IDX_ENDPOINT_STATE_BOUND,
+  IDX_ENDPOINT_STATE_LISTENING,
+  IDX_ENDPOINT_STATE_CLOSING,
+  IDX_ENDPOINT_STATE_DESTROYED,
+  IDX_ENDPOINT_STATE_SESSION_COUNT,
+  IDX_ENDPOINT_STATE_BUSY,
+  IDX_SESSION_STATE_HANDSHAKING,
+  IDX_SESSION_STATE_OPEN,
+  IDX_SESSION_STATE_CLOSING,
+  IDX_SESSION_STATE_DESTROYED,
+  IDX_SESSION_STATE_HAS_MESSAGE_LISTENER,
+} = internalBinding('dtls');
+
+function isAlive(view) {
+  return DataViewPrototypeGetByteLength(view) > 0;
+}
+
+// DTLSEndpointState wraps the shared ArrayBuffer from C++.
+// The C++ struct layout (DTLSEndpointStateData) is:
+//   uint8_t bound;          // offset 0
+//   uint8_t listening;      // offset 1
+//   uint8_t closing;        // offset 2
+//   uint8_t destroyed;      // offset 3
+//   uint32_t session_count; // offset 4 (4-byte aligned)
+//   uint8_t busy;           // offset 8
+class DTLSEndpointState {
+  #handle;
+
+  constructor(privateSymbol, buffer) {
+    if (privateSymbol !== kPrivateConstructor) {
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    }
+    this.#handle = new DataView(buffer);
+  }
+
+  get bound() {
+    if (!isAlive(this.#handle)) return false;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_ENDPOINT_STATE_BOUND) === 1;
+  }
+
+  get listening() {
+    if (!isAlive(this.#handle)) return false;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_ENDPOINT_STATE_LISTENING) === 1;
+  }
+
+  get closing() {
+    if (!isAlive(this.#handle)) return false;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_ENDPOINT_STATE_CLOSING) === 1;
+  }
+
+  get destroyed() {
+    if (!isAlive(this.#handle)) return true;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_ENDPOINT_STATE_DESTROYED) === 1;
+  }
+
+  get sessionCount() {
+    if (!isAlive(this.#handle)) return 0;
+    return DataViewPrototypeGetUint32(
+      this.#handle, IDX_ENDPOINT_STATE_SESSION_COUNT, true);
+  }
+
+  get busy() {
+    if (!isAlive(this.#handle)) return false;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_ENDPOINT_STATE_BUSY) === 1;
+  }
+
+  set busy(val) {
+    if (!isAlive(this.#handle)) {
+      throw new ERR_INVALID_STATE('Endpoint is destroyed');
+    }
+    DataViewPrototypeSetUint8(
+      this.#handle, IDX_ENDPOINT_STATE_BUSY, val ? 1 : 0);
+  }
+}
+
+// DTLSSessionState wraps the shared ArrayBuffer from C++.
+// The C++ struct layout (DTLSSessionStateData) is:
+//   uint8_t handshaking;          // offset 0
+//   uint8_t open;                 // offset 1
+//   uint8_t closing;              // offset 2
+//   uint8_t destroyed;            // offset 3
+//   uint8_t has_message_listener; // offset 4
+class DTLSSessionState {
+  #handle;
+
+  constructor(privateSymbol, buffer) {
+    if (privateSymbol !== kPrivateConstructor) {
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    }
+    this.#handle = new DataView(buffer);
+  }
+
+  get handshaking() {
+    if (!isAlive(this.#handle)) return false;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_SESSION_STATE_HANDSHAKING) === 1;
+  }
+
+  get open() {
+    if (!isAlive(this.#handle)) return false;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_SESSION_STATE_OPEN) === 1;
+  }
+
+  get closing() {
+    if (!isAlive(this.#handle)) return false;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_SESSION_STATE_CLOSING) === 1;
+  }
+
+  get destroyed() {
+    if (!isAlive(this.#handle)) return true;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_SESSION_STATE_DESTROYED) === 1;
+  }
+
+  get hasMessageListener() {
+    if (!isAlive(this.#handle)) return false;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_SESSION_STATE_HAS_MESSAGE_LISTENER) === 1;
+  }
+
+  set hasMessageListener(val) {
+    if (!isAlive(this.#handle)) return;
+    DataViewPrototypeSetUint8(
+      this.#handle, IDX_SESSION_STATE_HAS_MESSAGE_LISTENER, val ? 1 : 0);
+  }
+}
+
+module.exports = {
+  DTLSEndpointState,
+  DTLSSessionState,
+};
+
+/* c8 ignore stop */
diff --git a/lib/internal/dtls/stats.js b/lib/internal/dtls/stats.js
new file mode 100644
index 000000000000..b3393fe6b76d
--- /dev/null
+++ b/lib/internal/dtls/stats.js
@@ -0,0 +1,341 @@
+'use strict';
+
+// TODO(@jasnell) Temporarily ignoring c8 coverage for this file while tests
+// are still being developed.
+/* c8 ignore start */
+
+const {
+  BigUint64Array,
+  JSONStringify,
+} = primordials;
+
+const {
+  getOptionValue,
+} = require('internal/options');
+
+if (!process.features.dtls || !getOptionValue('--experimental-dtls')) {
+  return;
+}
+
+const {
+  isArrayBuffer,
+} = require('util/types');
+
+const {
+  codes: {
+    ERR_ILLEGAL_CONSTRUCTOR,
+    ERR_INVALID_ARG_TYPE,
+  },
+} = require('internal/errors');
+
+const { inspect } = require('internal/util/inspect');
+const assert = require('internal/assert');
+
+const {
+  kFinishClose,
+  kPrivateConstructor,
+} = require('internal/dtls/symbols');
+
+// This file defines the helper objects for accessing statistics collected
+// by DTLS endpoints and sessions. Each wraps a BigUint64Array backed by
+// a shared ArrayBuffer that is updated by the C++ internals.
+
+const {
+  IDX_STATS_ENDPOINT_CREATED_AT,
+  IDX_STATS_ENDPOINT_DESTROYED_AT,
+  IDX_STATS_ENDPOINT_BYTES_RECEIVED,
+  IDX_STATS_ENDPOINT_BYTES_SENT,
+  IDX_STATS_ENDPOINT_PACKETS_RECEIVED,
+  IDX_STATS_ENDPOINT_PACKETS_SENT,
+  IDX_STATS_ENDPOINT_SERVER_SESSIONS,
+  IDX_STATS_ENDPOINT_CLIENT_SESSIONS,
+  IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT,
+
+  IDX_STATS_SESSION_CREATED_AT,
+  IDX_STATS_SESSION_DESTROYED_AT,
+  IDX_STATS_SESSION_CLOSING_AT,
+  IDX_STATS_SESSION_HANDSHAKE_COMPLETED_AT,
+  IDX_STATS_SESSION_BYTES_RECEIVED,
+  IDX_STATS_SESSION_BYTES_SENT,
+  IDX_STATS_SESSION_MESSAGES_RECEIVED,
+  IDX_STATS_SESSION_MESSAGES_SENT,
+  IDX_STATS_SESSION_RETRANSMIT_COUNT,
+} = internalBinding('dtls');
+
+assert(IDX_STATS_ENDPOINT_CREATED_AT !== undefined);
+assert(IDX_STATS_ENDPOINT_DESTROYED_AT !== undefined);
+assert(IDX_STATS_ENDPOINT_BYTES_RECEIVED !== undefined);
+assert(IDX_STATS_ENDPOINT_BYTES_SENT !== undefined);
+assert(IDX_STATS_ENDPOINT_PACKETS_RECEIVED !== undefined);
+assert(IDX_STATS_ENDPOINT_PACKETS_SENT !== undefined);
+assert(IDX_STATS_ENDPOINT_SERVER_SESSIONS !== undefined);
+assert(IDX_STATS_ENDPOINT_CLIENT_SESSIONS !== undefined);
+assert(IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT !== undefined);
+assert(IDX_STATS_SESSION_CREATED_AT !== undefined);
+assert(IDX_STATS_SESSION_DESTROYED_AT !== undefined);
+assert(IDX_STATS_SESSION_CLOSING_AT !== undefined);
+assert(IDX_STATS_SESSION_HANDSHAKE_COMPLETED_AT !== undefined);
+assert(IDX_STATS_SESSION_BYTES_RECEIVED !== undefined);
+assert(IDX_STATS_SESSION_BYTES_SENT !== undefined);
+assert(IDX_STATS_SESSION_MESSAGES_RECEIVED !== undefined);
+assert(IDX_STATS_SESSION_MESSAGES_SENT !== undefined);
+assert(IDX_STATS_SESSION_RETRANSMIT_COUNT !== undefined);
+
+class DTLSEndpointStats {
+  /** @type {BigUint64Array} */
+  #handle;
+  /** @type {boolean} */
+  #disconnected = false;
+
+  /**
+   * @param {symbol} privateSymbol
+   * @param {ArrayBuffer} buffer
+   */
+  constructor(privateSymbol, buffer) {
+    if (privateSymbol !== kPrivateConstructor) {
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    }
+    if (!isArrayBuffer(buffer)) {
+      throw new ERR_INVALID_ARG_TYPE('buffer', ['ArrayBuffer'], buffer);
+    }
+    this.#handle = new BigUint64Array(buffer);
+  }
+
+  /** @type {bigint} */
+  get createdAt() {
+    return this.#handle[IDX_STATS_ENDPOINT_CREATED_AT];
+  }
+
+  /** @type {bigint} */
+  get destroyedAt() {
+    return this.#handle[IDX_STATS_ENDPOINT_DESTROYED_AT];
+  }
+
+  /** @type {bigint} */
+  get bytesReceived() {
+    return this.#handle[IDX_STATS_ENDPOINT_BYTES_RECEIVED];
+  }
+
+  /** @type {bigint} */
+  get bytesSent() {
+    return this.#handle[IDX_STATS_ENDPOINT_BYTES_SENT];
+  }
+
+  /** @type {bigint} */
+  get packetsReceived() {
+    return this.#handle[IDX_STATS_ENDPOINT_PACKETS_RECEIVED];
+  }
+
+  /** @type {bigint} */
+  get packetsSent() {
+    return this.#handle[IDX_STATS_ENDPOINT_PACKETS_SENT];
+  }
+
+  /** @type {bigint} */
+  get serverSessions() {
+    return this.#handle[IDX_STATS_ENDPOINT_SERVER_SESSIONS];
+  }
+
+  /** @type {bigint} */
+  get clientSessions() {
+    return this.#handle[IDX_STATS_ENDPOINT_CLIENT_SESSIONS];
+  }
+
+  /** @type {bigint} */
+  get serverBusyCount() {
+    return this.#handle[IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT];
+  }
+
+  toString() {
+    return JSONStringify(this.toJSON());
+  }
+
+  toJSON() {
+    return {
+      __proto__: null,
+      connected: this.isConnected,
+      createdAt: `${this.createdAt}`,
+      destroyedAt: `${this.destroyedAt}`,
+      bytesReceived: `${this.bytesReceived}`,
+      bytesSent: `${this.bytesSent}`,
+      packetsReceived: `${this.packetsReceived}`,
+      packetsSent: `${this.packetsSent}`,
+      serverSessions: `${this.serverSessions}`,
+      clientSessions: `${this.clientSessions}`,
+      serverBusyCount: `${this.serverBusyCount}`,
+    };
+  }
+
+  [inspect.custom](depth, options) {
+    if (depth < 0)
+      return this;
+
+    const opts = {
+      __proto__: null,
+      ...options,
+      depth: options.depth == null ? null : options.depth - 1,
+    };
+
+    return `DTLSEndpointStats ${inspect({
+      connected: this.isConnected,
+      createdAt: this.createdAt,
+      destroyedAt: this.destroyedAt,
+      bytesReceived: this.bytesReceived,
+      bytesSent: this.bytesSent,
+      packetsReceived: this.packetsReceived,
+      packetsSent: this.packetsSent,
+      serverSessions: this.serverSessions,
+      clientSessions: this.clientSessions,
+      serverBusyCount: this.serverBusyCount,
+    }, opts)}`;
+  }
+
+  /**
+   * True if this stats object is still connected to the underlying
+   * stats source. If false, the stats are stale.
+   * @type {boolean}
+   */
+  get isConnected() {
+    return !this.#disconnected;
+  }
+
+  [kFinishClose]() {
+    // Snapshot the stats into a new BigUint64Array since the underlying
+    // buffer will be destroyed.
+    this.#handle = new BigUint64Array(this.#handle);
+    this.#disconnected = true;
+  }
+}
+
+class DTLSSessionStats {
+  /** @type {BigUint64Array} */
+  #handle;
+  /** @type {boolean} */
+  #disconnected = false;
+
+  /**
+   * @param {symbol} privateSymbol
+   * @param {ArrayBuffer} buffer
+   */
+  constructor(privateSymbol, buffer) {
+    if (privateSymbol !== kPrivateConstructor) {
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    }
+    if (!isArrayBuffer(buffer)) {
+      throw new ERR_INVALID_ARG_TYPE('buffer', ['ArrayBuffer'], buffer);
+    }
+    this.#handle = new BigUint64Array(buffer);
+  }
+
+  /** @type {bigint} */
+  get createdAt() {
+    return this.#handle[IDX_STATS_SESSION_CREATED_AT];
+  }
+
+  /** @type {bigint} */
+  get destroyedAt() {
+    return this.#handle[IDX_STATS_SESSION_DESTROYED_AT];
+  }
+
+  /** @type {bigint} */
+  get closingAt() {
+    return this.#handle[IDX_STATS_SESSION_CLOSING_AT];
+  }
+
+  /** @type {bigint} */
+  get handshakeCompletedAt() {
+    return this.#handle[IDX_STATS_SESSION_HANDSHAKE_COMPLETED_AT];
+  }
+
+  /** @type {bigint} */
+  get bytesReceived() {
+    return this.#handle[IDX_STATS_SESSION_BYTES_RECEIVED];
+  }
+
+  /** @type {bigint} */
+  get bytesSent() {
+    return this.#handle[IDX_STATS_SESSION_BYTES_SENT];
+  }
+
+  /** @type {bigint} */
+  get messagesReceived() {
+    return this.#handle[IDX_STATS_SESSION_MESSAGES_RECEIVED];
+  }
+
+  /** @type {bigint} */
+  get messagesSent() {
+    return this.#handle[IDX_STATS_SESSION_MESSAGES_SENT];
+  }
+
+  /** @type {bigint} */
+  get retransmitCount() {
+    return this.#handle[IDX_STATS_SESSION_RETRANSMIT_COUNT];
+  }
+
+  toString() {
+    return JSONStringify(this.toJSON());
+  }
+
+  toJSON() {
+    return {
+      __proto__: null,
+      connected: this.isConnected,
+      createdAt: `${this.createdAt}`,
+      destroyedAt: `${this.destroyedAt}`,
+      closingAt: `${this.closingAt}`,
+      handshakeCompletedAt: `${this.handshakeCompletedAt}`,
+      bytesReceived: `${this.bytesReceived}`,
+      bytesSent: `${this.bytesSent}`,
+      messagesReceived: `${this.messagesReceived}`,
+      messagesSent: `${this.messagesSent}`,
+      retransmitCount: `${this.retransmitCount}`,
+    };
+  }
+
+  [inspect.custom](depth, options) {
+    if (depth < 0)
+      return this;
+
+    const opts = {
+      __proto__: null,
+      ...options,
+      depth: options.depth == null ? null : options.depth - 1,
+    };
+
+    return `DTLSSessionStats ${inspect({
+      connected: this.isConnected,
+      createdAt: this.createdAt,
+      destroyedAt: this.destroyedAt,
+      closingAt: this.closingAt,
+      handshakeCompletedAt: this.handshakeCompletedAt,
+      bytesReceived: this.bytesReceived,
+      bytesSent: this.bytesSent,
+      messagesReceived: this.messagesReceived,
+      messagesSent: this.messagesSent,
+      retransmitCount: this.retransmitCount,
+    }, opts)}`;
+  }
+
+  /**
+   * True if this stats object is still connected to the underlying
+   * stats source. If false, the stats are stale.
+   * @type {boolean}
+   */
+  get isConnected() {
+    return !this.#disconnected;
+  }
+
+  [kFinishClose]() {
+    // Snapshot the stats into a new BigUint64Array since the underlying
+    // buffer will be destroyed.
+    this.#handle = new BigUint64Array(this.#handle);
+    this.#disconnected = true;
+  }
+}
+
+module.exports = {
+  DTLSEndpointStats,
+  DTLSSessionStats,
+};
+
+/* c8 ignore stop */
diff --git a/lib/internal/dtls/symbols.js b/lib/internal/dtls/symbols.js
new file mode 100644
index 000000000000..fbeeadc562a0
--- /dev/null
+++ b/lib/internal/dtls/symbols.js
@@ -0,0 +1,43 @@
+'use strict';
+
+// TODO(@jasnell) Temporarily ignoring c8 coverage for this file while tests
+// are still being developed.
+/* c8 ignore start */
+
+const {
+  Symbol,
+} = primordials;
+
+const {
+  getOptionValue,
+} = require('internal/options');
+
+if (!process.features.dtls || !getOptionValue('--experimental-dtls')) {
+  return;
+}
+
+module.exports = {
+  // Private symbols for internal communication between classes.
+  kOwner: Symbol('kOwner'),
+  kHandle: Symbol('kHandle'),
+  kListen: Symbol('kListen'),
+  kConnect: Symbol('kConnect'),
+  kFinishClose: Symbol('kFinishClose'),
+  kNewSession: Symbol('kNewSession'),
+  kRemoveSession: Symbol('kRemoveSession'),
+  kHandshake: Symbol('kHandshake'),
+  kReceive: Symbol('kReceive'),
+  kError: Symbol('kError'),
+  kClose: Symbol('kClose'),
+  kMessage: Symbol('kMessage'),
+  kKeylog: Symbol('kKeylog'),
+  kTicket: Symbol('kTicket'),
+  kPrivateConstructor: Symbol('kPrivateConstructor'),
+  kSessionHandshake: Symbol('dtls.session.handshake'),
+  kSessionMessage: Symbol('dtls.session.message'),
+  kSessionError: Symbol('dtls.session.error'),
+  kSessionClose: Symbol('dtls.session.close'),
+  kSessionKeylog: Symbol('dtls.session.keylog'),
+};
+
+/* c8 ignore stop */
diff --git a/lib/internal/encoding.js b/lib/internal/encoding.js
index 7d4747abc23b..11003db8bc51 100644
--- a/lib/internal/encoding.js
+++ b/lib/internal/encoding.js
@@ -614,8 +614,17 @@ ObjectDefineProperties(TextDecoder.prototype, {
   },
 });
 
+// A lazily created TextDecoder for the common case of decoding UTF-8 with
+// the default options, shared between internal modules.
+let utf8Decoder;
+function getUtf8Decoder() {
+  utf8Decoder ??= new TextDecoder();
+  return utf8Decoder;
+}
+
 module.exports = {
   getEncodingFromLabel,
+  getUtf8Decoder,
   TextDecoder,
   TextEncoder,
 };
diff --git a/lib/internal/error_serdes.js b/lib/internal/error_serdes.js
index efe75192d9f5..d473da06fd49 100644
--- a/lib/internal/error_serdes.js
+++ b/lib/internal/error_serdes.js
@@ -1,6 +1,7 @@
 'use strict';
 
 const {
+  AggregateError,
   ArrayPrototypeForEach,
   Error,
   EvalError,
@@ -41,7 +42,14 @@ const kCircularReference = 5;
 const kSymbolStringLength = 'Symbol('.length;
 
 const errors = {
-  Error, TypeError, RangeError, URIError, SyntaxError, ReferenceError, EvalError,
+  AggregateError,
+  Error,
+  EvalError,
+  RangeError,
+  ReferenceError,
+  SyntaxError,
+  TypeError,
+  URIError,
 };
 const errorConstructorNames = new SafeSet(ObjectKeys(errors));
 
diff --git a/lib/internal/errors.js b/lib/internal/errors.js
index d98495aa6566..b9b1490c31ee 100644
--- a/lib/internal/errors.js
+++ b/lib/internal/errors.js
@@ -1035,11 +1035,16 @@ function determineSpecificType(value) {
       return `type symbol (${String(value)})`;
     case 'function':
       return `function ${value.name}`;
-    case 'object':
-      if (value.constructor && 'name' in value.constructor) {
-        return `an instance of ${value.constructor.name}`;
+    case 'object': {
+      // `constructor` may be user-controlled: it need not be an object, and
+      // its `name` need not be a non-empty string. Reading either can invoke
+      // an accessor, so read each one once.
+      const name = value.constructor?.name;
+      if (typeof name === 'string' && name !== '') {
+        return `an instance of ${name}`;
       }
       return `${lazyInternalUtilInspect().inspect(value, { depth: -1 })}`;
+    }
     case 'string':
       value.length > 28 && (value = `${StringPrototypeSlice(value, 0, 25)}...`);
       if (StringPrototypeIndexOf(value, "'") === -1) {
@@ -1186,8 +1191,12 @@ E('ERR_CRYPTO_INVALID_DIGEST', 'Invalid digest: %s', TypeError);
 E('ERR_CRYPTO_INVALID_JWK', 'Invalid JWK data', TypeError);
 E('ERR_CRYPTO_INVALID_KEY_OBJECT_TYPE',
   'Invalid key object type %s, expected %s.', TypeError);
+E('ERR_CRYPTO_INVALID_MAC', 'Invalid MAC: %s', TypeError);
 E('ERR_CRYPTO_INVALID_STATE', 'Invalid state for operation %s', Error);
 E('ERR_CRYPTO_KEM_NOT_SUPPORTED', 'KEM is not supported', Error);
+E('ERR_CRYPTO_MAC_FINALIZED', 'MAC already finalized', Error);
+E('ERR_CRYPTO_MAC_NOT_SUPPORTED', 'MAC is not supported', Error);
+E('ERR_CRYPTO_MAC_UPDATE_FAILED', 'MAC update failed', Error);
 E('ERR_CRYPTO_PBKDF2_ERROR', 'PBKDF2 error', Error);
 E('ERR_CRYPTO_SCRYPT_NOT_SUPPORTED', 'Scrypt algorithm not supported', Error);
 // Switch to TypeError. The current implementation does not seem right.
diff --git a/lib/internal/event_target.js b/lib/internal/event_target.js
index bfb948bb1ced..23a2ef702739 100644
--- a/lib/internal/event_target.js
+++ b/lib/internal/event_target.js
@@ -14,6 +14,7 @@ const {
   ReflectApply,
   SafeFinalizationRegistry,
   SafeMap,
+  SafeSet,
   SafeWeakMap,
   SafeWeakRef,
   SafeWeakSet,
@@ -491,8 +492,17 @@ class Listener {
         listener: this,
         eventType,
       }, this);
-      // Make the retainer retain the listener in a WeakMap
-      weakListeners().map.set(weak, listener);
+      // Store only a WeakRef to the retainer here. Listener instances are
+      // Strongly reachable from the EventTarget's listener list for as long
+      // as they're registered, so a plain strong reference would keep the
+      // retainer (and listener) alive forever, defeating weak retention
+      this.weakKeyRef = new SafeWeakRef(weak);
+      let retained = weakListeners().map.get(weak);
+      if (retained === undefined) {
+        retained = new SafeSet();
+        weakListeners().map.set(weak, retained);
+      }
+      retained.add(listener);
       this.listener = this.callback;
     } else if (typeof listener === 'function') {
       this.callback = listener;
@@ -545,8 +555,19 @@ class Listener {
     if (this.next !== undefined)
       this.next.previous = this.previous;
     this.removed = true;
-    if (this.weak)
+    if (this.weak) {
       weakListeners().registry.unregister(this);
+      const weakKey = this.weakKeyRef?.deref();
+      const listener = this.callback?.deref();
+      if (weakKey !== undefined && listener !== undefined) {
+        const retained = weakListeners().map.get(weakKey);
+        if (retained !== undefined) {
+          retained.delete(listener);
+          if (retained.size === 0)
+            weakListeners().map.delete(weakKey);
+        }
+      }
+    }
   }
 }
 
@@ -722,7 +743,10 @@ class EventTarget {
       return;
 
     type = webidl.converters.DOMString(type);
-    const capture = options?.capture === true;
+    // Flatten the options argument like addEventListener does.
+    // Refs: https://dom.spec.whatwg.org/#concept-flatten-options
+    const capture = typeof options === 'boolean' ?
+      options : options?.capture === true;
 
     if (this[kEvents] === undefined)
       return;
@@ -1155,6 +1179,13 @@ function defineEventHandler(emitter, name, event = name) {
 
   function set(value) {
     validateThisInternalField(this, kHandlers, 'EventTarget');
+    // Event handler IDL attributes are [LegacyTreatNonObjectAsNull]: values
+    // that are neither callable nor objects deactivate the handler.
+    // Refs: https://html.spec.whatwg.org/multipage/webappapis.html#event-handler-idl-attributes
+    if (typeof value !== 'function' &&
+        (typeof value !== 'object' || value === null)) {
+      value = null;
+    }
     if (this[kHandlers] === undefined)
       this[kHandlers] = new SafeMap();
     let wrappedHandler = this[kHandlers].get(event);
diff --git a/lib/internal/freeze_intrinsics.js b/lib/internal/freeze_intrinsics.js
index 05437199726c..5dd425cb0934 100644
--- a/lib/internal/freeze_intrinsics.js
+++ b/lib/internal/freeze_intrinsics.js
@@ -54,6 +54,8 @@ const {
   EvalErrorPrototype,
   FinalizationRegistry,
   FinalizationRegistryPrototype,
+  Float16Array,
+  Float16ArrayPrototype,
   Float32Array,
   Float32ArrayPrototype,
   Float64Array,
@@ -196,6 +198,7 @@ module.exports = function() {
     Uint16ArrayPrototype,
     Int32ArrayPrototype,
     Uint32ArrayPrototype,
+    Float16ArrayPrototype,
     Float32ArrayPrototype,
     Float64ArrayPrototype,
     BigInt64ArrayPrototype,
@@ -296,6 +299,7 @@ module.exports = function() {
     Uint16Array,
     Int32Array,
     Uint32Array,
+    Float16Array,
     Float32Array,
     Float64Array,
     BigInt64Array,
diff --git a/lib/internal/fs/cp/cp-sync.js b/lib/internal/fs/cp/cp-sync.js
index f2b00f3f82bb..ecd06dfd6002 100644
--- a/lib/internal/fs/cp/cp-sync.js
+++ b/lib/internal/fs/cp/cp-sync.js
@@ -179,6 +179,9 @@ function copyDir(src, dest, opts, mkDir, srcMode) {
   } finally {
     dir.closeSync();
 
+    if (opts.preserveTimestamps) {
+      setDestTimestamps(src, dest);
+    }
     if (srcMode !== undefined) {
       setDestMode(dest, srcMode);
     }
diff --git a/lib/internal/fs/cp/cp.js b/lib/internal/fs/cp/cp.js
index 2eb4f0ffdd83..1ec5a2d89cac 100644
--- a/lib/internal/fs/cp/cp.js
+++ b/lib/internal/fs/cp/cp.js
@@ -6,6 +6,8 @@ const {
   ArrayPrototypeEvery,
   ArrayPrototypeFilter,
   Boolean,
+  ErrorCaptureStackTrace,
+  Promise,
   PromisePrototypeThen,
   PromiseReject,
   SafePromiseAll,
@@ -55,6 +57,7 @@ const {
   sep,
 } = require('path');
 const fsBinding = internalBinding('fs');
+const permission = require('internal/process/permission');
 
 async function cpFn(src, dest, opts) {
   // Warn about using preserveTimestamps on 32-bit node
@@ -211,30 +214,19 @@ async function getStatsForCopy(destStat, src, dest, opts) {
     return onFile(srcStat, destStat, src, dest, opts);
   } else if (srcStat.isSymbolicLink()) {
     return onLink(destStat, src, dest, opts);
-  } else if (srcStat.isSocket()) {
-    throw new ERR_FS_CP_SOCKET({
-      message: `cannot copy a socket file: ${dest}`,
-      path: dest,
-      syscall: 'cp',
-      errno: EINVAL,
-      code: 'EINVAL',
-    });
-  } else if (srcStat.isFIFO()) {
-    throw new ERR_FS_CP_FIFO_PIPE({
-      message: `cannot copy a FIFO pipe: ${dest}`,
-      path: dest,
-      syscall: 'cp',
-      errno: EINVAL,
-      code: 'EINVAL',
-    });
   }
-  throw new ERR_FS_CP_UNKNOWN({
-    message: `cannot copy an unknown file type: ${dest}`,
-    path: dest,
-    syscall: 'cp',
-    errno: EINVAL,
-    code: 'EINVAL',
-  });
+  throw errorForSpecialFile(srcStat.isSocket() ? 'socket' : srcStat.isFIFO() ? 'fifo' : 'unknown', dest);
+}
+
+function errorForSpecialFile(kind, dest) {
+  const info = { path: dest, syscall: 'cp', errno: EINVAL, code: 'EINVAL' };
+  if (kind === 'socket') {
+    return new ERR_FS_CP_SOCKET({ message: `cannot copy a socket file: ${dest}`, ...info });
+  }
+  if (kind === 'fifo') {
+    return new ERR_FS_CP_FIFO_PIPE({ message: `cannot copy a FIFO pipe: ${dest}`, ...info });
+  }
+  return new ERR_FS_CP_UNKNOWN({ message: `cannot copy an unknown file type: ${dest}`, ...info });
 }
 
 function onFile(srcStat, destStat, src, dest, opts) {
@@ -311,15 +303,51 @@ async function onDir(srcStat, destStat, src, dest, opts) {
       code: 'EEXIST',
     });
   }
-  return copyDir(src, dest, opts);
+  await copyDir(src, dest, opts);
+  if (opts.preserveTimestamps) {
+    await setDestTimestamps(src, dest);
+  }
 }
 
 async function mkDirAndCopy(srcMode, src, dest, opts) {
+  // A destination directory that does not exist yet is filled in one thread
+  // pool request by the walk fs.cpSync() uses, unless a filter has to run per
+  // entry, links inside the tree must be dereferenced, or the permission model
+  // has to check each path. Copying into an existing tree keeps the per-entry
+  // walk below and its rules for what may already be there.
+  if (!opts.filter && !opts.dereference && !permission.isEnabled()) {
+    // Creates dest itself, with the mode of src.
+    return copyDirNative(src, dest, opts);
+  }
   await mkdir(dest);
   await copyDir(src, dest, opts);
+  if (opts.preserveTimestamps) {
+    await setDestTimestamps(src, dest);
+  }
   return setDestMode(dest, srcMode);
 }
 
+function copyDirNative(src, dest, opts) {
+  return new Promise((resolve, reject) => {
+    const job = new fsBinding.CpDirJob(src, dest, opts.force, opts.dereference, opts.errorOnExist,
+                                       opts.verbatimSymlinks, opts.preserveTimestamps, opts.mode);
+    // Sockets, FIFOs and unknown entries come back as (kind, path) so that
+    // they reject with the same errors as the walk above.
+    job.ondone = (err, specialFile, specialFilePath) => {
+      if (specialFile !== undefined) {
+        err = errorForSpecialFile(specialFile, specialFilePath);
+      }
+      if (err != null) {
+        ErrorCaptureStackTrace(err, copyDirNative);
+        reject(err);
+      } else {
+        resolve();
+      }
+    };
+    job.run();
+  });
+}
+
 async function copyDir(src, dest, opts) {
   const dir = await opendir(src);
 
diff --git a/lib/internal/fs/glob.js b/lib/internal/fs/glob.js
index efa590a55749..b5949c471813 100644
--- a/lib/internal/fs/glob.js
+++ b/lib/internal/fs/glob.js
@@ -5,6 +5,7 @@ const {
   ArrayIsArray,
   ArrayPrototypeAt,
   ArrayPrototypeFlatMap,
+  ArrayPrototypeJoin,
   ArrayPrototypeMap,
   ArrayPrototypePop,
   ArrayPrototypePush,
@@ -14,6 +15,10 @@ const {
   SafeMap,
   SafeSet,
   StringPrototypeEndsWith,
+  StringPrototypeSlice,
+  StringPrototypeSplit,
+  StringPrototypeStartsWith,
+  StringPrototypeToLowerCase,
 } = primordials;
 
 const {
@@ -22,13 +27,14 @@ const {
   realpathSync,
   statSync,
 } = require('fs');
+const realpathSyncNative = realpathSync.native;
 const {
   lstat,
   readdir,
   realpath,
   stat,
 } = require('fs/promises');
-const { join, resolve, basename, isAbsolute, dirname } = require('path');
+const { join, resolve, relative, basename, isAbsolute, dirname, parse, sep } = require('path');
 
 const {
   kEmptyObject,
@@ -37,6 +43,7 @@ const {
 } = require('internal/util');
 const {
   validateBoolean,
+  validateInteger,
   validateObject,
   validateString,
   validateStringArray,
@@ -132,10 +139,71 @@ function cloneSet(values) {
   return cloned;
 }
 
+function isOutsidePath(path) {
+  return isAbsolute(path) ||
+    path === '..' ||
+    StringPrototypeStartsWith(path, `..${sep}`);
+}
+
+function isStrictDescendant(path) {
+  return path !== '' && !isOutsidePath(path);
+}
+
+function pathDepth(path) {
+  if (path === '') {
+    return 0;
+  }
+  if (isAbsolute(path)) {
+    return Infinity;
+  }
+  return StringPrototypeSplit(path, sep).length;
+}
+
+function ancestorAtDepth(path, relativePath) {
+  let ancestor = path;
+  if (relativePath !== '') {
+    const depth = pathDepth(relativePath);
+    for (let i = 0; i < depth; i++) {
+      ancestor = dirname(ancestor);
+    }
+  }
+  return ancestor;
+}
+
+function caseSensitiveRelative(path, otherPath) {
+  const pathRoot = parse(path).root;
+  const otherPathRoot = parse(otherPath).root;
+  if (StringPrototypeToLowerCase(pathRoot) !==
+      StringPrototypeToLowerCase(otherPathRoot)) {
+    return otherPath;
+  }
+  const pathTail = StringPrototypeSlice(path, pathRoot.length);
+  const otherPathTail = StringPrototypeSlice(otherPath, otherPathRoot.length);
+  const pathParts = pathTail === '' ? [] : StringPrototypeSplit(pathTail, sep);
+  const otherPathParts = otherPathTail === '' ?
+    [] : StringPrototypeSplit(otherPathTail, sep);
+  let common = 0;
+  while (common < pathParts.length &&
+         common < otherPathParts.length &&
+         pathParts[common] === otherPathParts[common]) {
+    common++;
+  }
+  const parts = [];
+  for (let i = common; i < pathParts.length; i++) {
+    ArrayPrototypePush(parts, '..');
+  }
+  for (let i = common; i < otherPathParts.length; i++) {
+    ArrayPrototypePush(parts, otherPathParts[i]);
+  }
+  return ArrayPrototypeJoin(parts, sep);
+}
+
 class Cache {
   #cache = new SafeMap();
   #statsCache = new SafeMap();
   #followStatsCache = new SafeMap();
+  #identityCache = new SafeMap();
+  #identityRealpathCache = new SafeMap();
   #readdirCache = new SafeMap();
   #realpathCache = new SafeMap();
 
@@ -181,6 +249,57 @@ class Cache {
     this.#followStatsCache.set(path, val);
     return val;
   }
+  identity(path) {
+    const cached = this.#identityCache.get(path);
+    if (cached) {
+      return cached;
+    }
+    const promise = PromisePrototypeThen(
+      lstat(path),
+      ({ dev, ino }) => `${dev}:${ino}`,
+      () => null,
+    );
+    this.#identityCache.set(path, promise);
+    return promise;
+  }
+  identitySync(path) {
+    const cached = this.#identityCache.get(path);
+    if (cached && !(cached instanceof Promise)) {
+      return cached;
+    }
+    let val;
+    try {
+      const { dev, ino } = lstatSync(path);
+      val = `${dev}:${ino}`;
+    } catch {
+      val = null;
+    }
+    this.#identityCache.set(path, val);
+    return val;
+  }
+  identityRealpath(path) {
+    const cached = this.#identityRealpathCache.get(path);
+    if (cached) {
+      return cached;
+    }
+    const promise = PromisePrototypeThen(realpath(path), null, () => null);
+    this.#identityRealpathCache.set(path, promise);
+    return promise;
+  }
+  identityRealpathSync(path) {
+    const cached = this.#identityRealpathCache.get(path);
+    if (cached && !(cached instanceof Promise)) {
+      return cached;
+    }
+    let val;
+    try {
+      val = realpathSyncNative(path);
+    } catch {
+      val = null;
+    }
+    this.#identityRealpathCache.set(path, val);
+    return val;
+  }
   realpath(path) {
     const cached = this.#realpathCache.get(path);
     if (cached) {
@@ -245,6 +364,192 @@ class Cache {
   }
 }
 
+class DepthLimiter {
+  #root;
+  #maxDepth;
+  #cache;
+  #relativeCache = new SafeMap();
+
+  constructor(root, maxDepth, cache) {
+    this.#root = resolve(root);
+    this.#maxDepth = maxDepth;
+    this.#cache = cache;
+  }
+
+  #relativeCandidate(path) {
+    const fullpath = resolve(this.#root, path);
+    const pathFromRoot = relative(this.#root, fullpath);
+    if (isWindows && !isOutsidePath(pathFromRoot)) {
+      return {
+        __proto__: null,
+        pathFromRoot,
+        caseVariantRoot: ancestorAtDepth(fullpath, pathFromRoot),
+        differentPath: caseSensitiveRelative(this.#root, fullpath),
+      };
+    }
+    if (isMacOS && !isAbsolute(pathFromRoot) && isOutsidePath(pathFromRoot)) {
+      const foldedPathFromRoot = relative(
+        StringPrototypeToLowerCase(this.#root),
+        StringPrototypeToLowerCase(fullpath),
+      );
+      if (!isOutsidePath(foldedPathFromRoot)) {
+        return {
+          __proto__: null,
+          pathFromRoot: foldedPathFromRoot,
+          caseVariantRoot: ancestorAtDepth(fullpath, foldedPathFromRoot),
+          differentPath: pathFromRoot,
+        };
+      }
+    }
+    return { __proto__: null, pathFromRoot };
+  }
+
+  #isSamePath(path, otherPath) {
+    if (path === otherPath) {
+      return true;
+    }
+    if (isWindows) {
+      const realPath = this.#cache.identityRealpathSync(path);
+      return realPath !== null &&
+        realPath === this.#cache.identityRealpathSync(otherPath);
+    }
+    const identity = this.#cache.identitySync(path);
+    return identity !== null &&
+      identity === this.#cache.identitySync(otherPath);
+  }
+
+  async #isSamePathAsync(path, otherPath) {
+    if (path === otherPath) {
+      return true;
+    }
+    if (isWindows) {
+      const realPath = await this.#cache.identityRealpath(path);
+      return realPath !== null &&
+        realPath === await this.#cache.identityRealpath(otherPath);
+    }
+    const identity = await this.#cache.identity(path);
+    return identity !== null &&
+      identity === await this.#cache.identity(otherPath);
+  }
+
+  #relativeFromRoot(path) {
+    const cached = this.#relativeCache.get(path);
+    if (cached !== undefined && !(cached instanceof Promise)) {
+      return cached;
+    }
+    const candidate = this.#relativeCandidate(path);
+    const relativePath = candidate.caseVariantRoot === undefined ||
+        this.#isSamePath(this.#root, candidate.caseVariantRoot) ?
+      candidate.pathFromRoot :
+      candidate.differentPath;
+    this.#relativeCache.set(path, relativePath);
+    return relativePath;
+  }
+
+  #relativeFromRootAsync(path) {
+    const cached = this.#relativeCache.get(path);
+    if (cached !== undefined) {
+      return cached;
+    }
+    const candidate = this.#relativeCandidate(path);
+    if (candidate.caseVariantRoot === undefined) {
+      this.#relativeCache.set(path, candidate.pathFromRoot);
+      return candidate.pathFromRoot;
+    }
+    const promise = PromisePrototypeThen(
+      this.#isSamePathAsync(this.#root, candidate.caseVariantRoot),
+      (isSamePath) => (isSamePath ?
+        candidate.pathFromRoot :
+        candidate.differentPath),
+    );
+    this.#relativeCache.set(path, promise);
+    return promise;
+  }
+
+  #ancestorCandidate(path) {
+    const fullpath = resolve(this.#root, path);
+    const rootFromPath = relative(fullpath, this.#root);
+    if (isStrictDescendant(rootFromPath)) {
+      return { __proto__: null, fullpath, needsIdentity: isWindows };
+    }
+    if (isMacOS) {
+      const foldedRootFromPath = relative(
+        StringPrototypeToLowerCase(fullpath),
+        StringPrototypeToLowerCase(this.#root),
+      );
+      if (isStrictDescendant(foldedRootFromPath)) {
+        return { __proto__: null, fullpath, needsIdentity: true };
+      }
+    }
+    return null;
+  }
+
+  #isAncestorOfRoot(path) {
+    const candidate = this.#ancestorCandidate(path);
+    if (candidate === null) {
+      return false;
+    }
+    if (!candidate.needsIdentity) {
+      return true;
+    }
+    const realRoot = this.#cache.identityRealpathSync(this.#root);
+    const realFullpath = this.#cache.identityRealpathSync(candidate.fullpath);
+    if (realRoot === null || realFullpath === null) {
+      return false;
+    }
+    const realRootFromPath = isWindows ?
+      caseSensitiveRelative(realFullpath, realRoot) :
+      relative(realFullpath, realRoot);
+    return isStrictDescendant(realRootFromPath);
+  }
+
+  async #isAncestorOfRootAsync(path) {
+    const candidate = this.#ancestorCandidate(path);
+    if (candidate === null) {
+      return false;
+    }
+    if (!candidate.needsIdentity) {
+      return true;
+    }
+    const realRoot = await this.#cache.identityRealpath(this.#root);
+    const realFullpath =
+      await this.#cache.identityRealpath(candidate.fullpath);
+    if (realRoot === null || realFullpath === null) {
+      return false;
+    }
+    const realRootFromPath = isWindows ?
+      caseSensitiveRelative(realFullpath, realRoot) :
+      relative(realFullpath, realRoot);
+    return isStrictDescendant(realRootFromPath);
+  }
+
+  includes(path) {
+    return pathDepth(this.#relativeFromRoot(path)) <= this.#maxDepth;
+  }
+
+  async includesAsync(path) {
+    return pathDepth(await this.#relativeFromRootAsync(path)) <= this.#maxDepth;
+  }
+
+  canTraverse(path, isAbsolutePattern) {
+    return (isAbsolutePattern && this.#isAncestorOfRoot(path)) ||
+      pathDepth(this.#relativeFromRoot(path)) < this.#maxDepth;
+  }
+
+  async canTraverseAsync(path, isAbsolutePattern) {
+    return (isAbsolutePattern && await this.#isAncestorOfRootAsync(path)) ||
+      pathDepth(await this.#relativeFromRootAsync(path)) < this.#maxDepth;
+  }
+}
+
+function createDepthLimiter(root, maxDepth, cache) {
+  if (maxDepth == null || maxDepth === Infinity) {
+    return null;
+  }
+  validateInteger(maxDepth, 'options.maxDepth', 0);
+  return new DepthLimiter(root, maxDepth, cache);
+}
+
 class Pattern {
   #pattern;
   #globStrings;
@@ -252,12 +557,14 @@ class Pattern {
   symlinks;
   realpaths;
   last;
+  isAbsolute;
 
-  constructor(pattern, globStrings, indexes, symlinks, realpaths = new SafeSet()) {
+  constructor(pattern, globStrings, indexes, symlinks, isAbsolute, realpaths = new SafeSet()) {
     this.#pattern = pattern;
     this.#globStrings = globStrings;
     this.indexes = indexes;
     this.symlinks = symlinks;
+    this.isAbsolute = isAbsolute;
     this.realpaths = realpaths;
     this.last = pattern.length - 1;
   }
@@ -277,7 +584,7 @@ class Pattern {
     return ArrayPrototypeAt(this.#pattern, index);
   }
   child(indexes, symlinks = new SafeSet(), realpaths = this.realpaths) {
-    return new Pattern(this.#pattern, this.#globStrings, indexes, symlinks, realpaths);
+    return new Pattern(this.#pattern, this.#globStrings, indexes, symlinks, this.isAbsolute, realpaths);
   }
   test(index, path) {
     if (index > this.#pattern.length) {
@@ -336,15 +643,18 @@ class Glob {
   #patterns;
   #withFileTypes;
   #followSymlinks = false;
+  #depthLimiter;
   #isExcluded = () => false;
   constructor(pattern, options = kEmptyObject) {
     validateObject(options, 'options');
-    const { exclude, cwd, followSymlinks, withFileTypes } = options;
+    const { exclude, cwd, followSymlinks, maxDepth, withFileTypes } = options;
     this.#root = toPathIfFileURL(cwd) ?? '.';
     if (followSymlinks != null) {
       validateBoolean(followSymlinks, 'options.followSymlinks');
       this.#followSymlinks = followSymlinks;
     }
+    this.#depthLimiter =
+      createDepthLimiter(this.#root, maxDepth, this.#cache);
     this.#withFileTypes = !!withFileTypes;
     if (exclude != null) {
       validateStringArrayOrFunction(exclude, 'options.exclude');
@@ -354,7 +664,10 @@ class Glob {
         // consistent comparison before instantiating matchers.
         const matchers = exclude
           .map((pattern) => resolve(this.#root, pattern))
-          .map((pattern) => createMatcher(pattern));
+          // Exclude matching is a pure string comparison with no filesystem
+          // lookups, so unlike include patterns, literal patterns must also
+          // match case-insensitively on case-insensitive platforms.
+          .map((pattern) => createMatcher(pattern, { nocaseMagicOnly: false }));
         this.#isExcluded = (value) =>
           matchers.some((matcher) => matcher.match(value));
         this.#results.setup(this.#root, this.#isExcluded);
@@ -371,13 +684,34 @@ class Glob {
       patterns = [pattern];
     }
     this.matchers = ArrayPrototypeMap(patterns, (pattern) => createMatcher(pattern));
-    this.#patterns = ArrayPrototypeFlatMap(this.matchers, (matcher) => ArrayPrototypeMap(matcher.set,
-                                                                                         (pattern, i) => new Pattern(
-                                                                                           pattern,
-                                                                                           matcher.globParts[i],
-                                                                                           new SafeSet().add(0),
-                                                                                           new SafeSet(),
-                                                                                         )));
+    this.#patterns = ArrayPrototypeFlatMap(this.matchers, (matcher) =>
+      ArrayPrototypeMap(matcher.set, (pattern, i) => new Pattern(
+        pattern,
+        matcher.globParts[i],
+        new SafeSet().add(0),
+        new SafeSet(),
+        isAbsolute(ArrayPrototypeJoin(matcher.globParts[i], sep)),
+      )));
+  }
+
+  #addResult(path) {
+    return (this.#depthLimiter === null ||
+      this.#depthLimiter.includes(path)) &&
+      this.#results.add(path);
+  }
+
+  async #addResultAsync(path) {
+    return await this.#depthLimiter.includesAsync(path) &&
+      this.#results.add(path);
+  }
+
+  #canTraverse(path, pattern) {
+    return this.#depthLimiter === null ||
+      this.#depthLimiter.canTraverse(path, pattern.isAbsolute);
+  }
+
+  async #canTraverseAsync(path, pattern) {
+    return this.#depthLimiter.canTraverseAsync(path, pattern.isAbsolute);
   }
 
   globSync() {
@@ -532,7 +866,7 @@ class Glob {
       const p = pattern.at(-1);
       const stat = this.#cache.statSync(join(fullpath, p));
       if (stat && (p || isDirectory)) {
-        this.#results.add(join(path, p));
+        this.#addResult(join(path, p));
       }
       if (pattern.indexes.size === 1 && pattern.indexes.has(last)) {
         return;
@@ -541,10 +875,12 @@ class Glob {
      (path !== '.' || pattern.at(0) === '.' || (last === 0 && stat))) {
       // If pattern ends with **, add to results
       // if path is ".", add it only if pattern starts with "." or pattern is exactly "**"
-      this.#results.add(path);
+      this.#addResult(path);
     }
 
-    if (!isDirectory || this.#isCyclicSync(fullpath, isDirectory, pattern)) {
+    if (!isDirectory ||
+        !this.#canTraverse(path, pattern) ||
+        this.#isCyclicSync(fullpath, isDirectory, pattern)) {
       return;
     }
 
@@ -601,14 +937,14 @@ class Glob {
             subPatterns.add(index);
           } else if (!fromSymlink && index === last) {
             // If ** is last, add to results
-            this.#results.add(entryPath);
+            this.#addResult(entryPath);
           }
 
           // Any pattern after ** is also a potential pattern
           // so we can already test it here
           if (nextMatches && nextIndex === last && !isLast) {
             // If next pattern is the last one, add to results
-            this.#results.add(entryPath);
+            this.#addResult(entryPath);
           } else if (nextMatches && entryIsDirectory) {
             // Pattern matched, meaning two patterns forward
             // are also potential patterns
@@ -616,9 +952,9 @@ class Glob {
             subPatterns.add(index + 2);
           }
           if ((nextMatches || pattern.at(0) === '.') &&
-           (entryIsDirectory || entry.isSymbolicLink()) && !fromSymlink) {
+           entryIsDirectory && !fromSymlink) {
             // If pattern after ** matches, or pattern starts with "."
-            // and entry is a directory or symlink, add to potential patterns
+            // and entry is a directory, add to potential patterns
             subPatterns.add(nextIndex);
           }
 
@@ -641,11 +977,11 @@ class Glob {
             } else {
               if (!this.#cache.seen(path, pattern, nextIndex)) {
                 this.#cache.add(path, pattern.child(new SafeSet().add(nextIndex)));
-                this.#results.add(path);
+                this.#addResult(path);
               }
               if (!this.#cache.seen(path, pattern, nextIndex) || !this.#cache.seen(parent, pattern, nextIndex)) {
                 this.#cache.add(parent, pattern.child(new SafeSet().add(nextIndex)));
-                this.#results.add(parent);
+                this.#addResult(parent);
               }
             }
           }
@@ -658,7 +994,7 @@ class Glob {
           } else if (current === '.' && pattern.test(nextIndex, entry.name)) {
             // If current pattern is ".", proceed to test next pattern
             if (nextIndex === last) {
-              this.#results.add(entryPath);
+              this.#addResult(entryPath);
             } else {
               subPatterns.add(nextIndex + 1);
             }
@@ -668,7 +1004,7 @@ class Glob {
           // If current pattern is a regex that matches entry name (e.g *.js)
           // add next pattern to potential patterns, or to results if it's the last pattern
           if (index === last) {
-            this.#results.add(entryPath);
+            this.#addResult(entryPath);
           } else if (entryIsDirectory) {
             subPatterns.add(nextIndex);
           }
@@ -705,6 +1041,7 @@ class Glob {
     const isDirectory = await this.#isDirectory(fullpath, stat, pattern);
     const isLast = pattern.isLast(isDirectory);
     const isFirst = pattern.isFirst();
+    const finiteDepth = this.#depthLimiter !== null;
 
     if (this.#isExcluded(fullpath)) {
       return;
@@ -737,7 +1074,9 @@ class Glob {
       if (stat && (p || isDirectory)) {
         const result = join(path, p);
         if (!this.#results.has(result)) {
-          if (this.#results.add(result)) {
+          if (!finiteDepth ?
+            this.#results.add(result) :
+            await this.#addResultAsync(result)) {
             yield this.#withFileTypes ? stat : result;
           }
         }
@@ -750,13 +1089,21 @@ class Glob {
       // If pattern ends with **, add to results
       // if path is ".", add it only if pattern starts with "." or pattern is exactly "**"
       if (!this.#results.has(path)) {
-        if (this.#results.add(path)) {
+        if (!finiteDepth ?
+          this.#results.add(path) :
+          await this.#addResultAsync(path)) {
           yield this.#withFileTypes ? stat : path;
         }
       }
     }
 
-    if (!isDirectory || await this.#isCyclic(fullpath, isDirectory, pattern)) {
+    let canTraverse = true;
+    if (isDirectory && finiteDepth) {
+      canTraverse = await this.#canTraverseAsync(path, pattern);
+    }
+    if (!isDirectory ||
+        !canTraverse ||
+        await this.#isCyclic(fullpath, isDirectory, pattern)) {
       return;
     }
 
@@ -815,7 +1162,10 @@ class Glob {
             subPatterns.add(index);
           } else if (!fromSymlink && index === last) {
             // If ** is last, add to results
-            if (!this.#results.has(entryPath) && this.#results.add(entryPath)) {
+            if (!this.#results.has(entryPath) &&
+                (!finiteDepth ?
+                  this.#results.add(entryPath) :
+                  await this.#addResultAsync(entryPath))) {
               yield this.#withFileTypes ? entry : entryPath;
             }
           }
@@ -824,7 +1174,10 @@ class Glob {
           // so we can already test it here
           if (nextMatches && nextIndex === last && !isLast) {
             // If next pattern is the last one, add to results
-            if (!this.#results.has(entryPath) && this.#results.add(entryPath)) {
+            if (!this.#results.has(entryPath) &&
+                (!finiteDepth ?
+                  this.#results.add(entryPath) :
+                  await this.#addResultAsync(entryPath))) {
               yield this.#withFileTypes ? entry : entryPath;
             }
           } else if (nextMatches && entryIsDirectory) {
@@ -834,9 +1187,9 @@ class Glob {
             subPatterns.add(index + 2);
           }
           if ((nextMatches || pattern.at(0) === '.') &&
-           (entryIsDirectory || entry.isSymbolicLink()) && !fromSymlink) {
+           entryIsDirectory && !fromSymlink) {
             // If pattern after ** matches, or pattern starts with "."
-            // and entry is a directory or symlink, add to potential patterns
+            // and entry is a directory, add to potential patterns
             subPatterns.add(nextIndex);
           }
 
@@ -860,7 +1213,9 @@ class Glob {
               if (!this.#cache.seen(path, pattern, nextIndex)) {
                 this.#cache.add(path, pattern.child(new SafeSet().add(nextIndex)));
                 if (!this.#results.has(path)) {
-                  if (this.#results.add(path)) {
+                  if (!finiteDepth ?
+                    this.#results.add(path) :
+                    await this.#addResultAsync(path)) {
                     yield this.#withFileTypes ? this.#cache.statSync(fullpath) : path;
                   }
                 }
@@ -868,7 +1223,9 @@ class Glob {
               if (!this.#cache.seen(path, pattern, nextIndex) || !this.#cache.seen(parent, pattern, nextIndex)) {
                 this.#cache.add(parent, pattern.child(new SafeSet().add(nextIndex)));
                 if (!this.#results.has(parent)) {
-                  if (this.#results.add(parent)) {
+                  if (!finiteDepth ?
+                    this.#results.add(parent) :
+                    await this.#addResultAsync(parent)) {
                     yield this.#withFileTypes ? this.#cache.statSync(join(this.#root, parent)) : parent;
                   }
                 }
@@ -885,7 +1242,9 @@ class Glob {
             // If current pattern is ".", proceed to test next pattern
             if (nextIndex === last) {
               if (!this.#results.has(entryPath)) {
-                if (this.#results.add(entryPath)) {
+                if (!finiteDepth ?
+                  this.#results.add(entryPath) :
+                  await this.#addResultAsync(entryPath)) {
                   yield this.#withFileTypes ? entry : entryPath;
                 }
               }
@@ -899,7 +1258,9 @@ class Glob {
           // add next pattern to potential patterns, or to results if it's the last pattern
           if (index === last) {
             if (!this.#results.has(entryPath)) {
-              if (this.#results.add(entryPath)) {
+              if (!finiteDepth ?
+                this.#results.add(entryPath) :
+                await this.#addResultAsync(entryPath)) {
                 yield this.#withFileTypes ? entry : entryPath;
               }
             }
diff --git a/lib/internal/fs/promises.js b/lib/internal/fs/promises.js
index ce69512fa5c9..d5a6b9a2c853 100644
--- a/lib/internal/fs/promises.js
+++ b/lib/internal/fs/promises.js
@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  ArrayPrototypePop,
   ArrayPrototypePush,
   Error,
   ErrorCaptureStackTrace,
@@ -32,9 +31,6 @@ const {
   O_WRONLY,
   S_IFMT,
   S_IFREG,
-  UV_DIRENT_DIR,
-  UV_DIRENT_LINK,
-  UV_DIRENT_UNKNOWN,
 } = constants;
 
 const binding = internalBinding('fs');
@@ -65,9 +61,10 @@ const {
     kReadFileUnknownBufferLength,
     kWriteFileMaxChunkSize,
   },
+  collectRecursiveReaddirResult,
   copyObject,
-  getDirent,
   getDirents,
+  getRecursiveDirents,
   getOptions,
   getStatFsFromBinding,
   getStatsFromBinding,
@@ -164,8 +161,9 @@ const lazyReadableStream = getLazy(() =>
 let newStreamsPull;
 let newStreamsPullSync;
 let newStreamsParsePullArgs;
-let newStreamsToUint8Array;
+let newStreamsToWriterUint8Array;
 let newStreamsConvertChunks;
+let newStreamsGetWriterSignal;
 function lazyNewStreams() {
   if (newStreamsPull === undefined) {
     const pullModule = require('internal/streams/iter/pull');
@@ -173,8 +171,9 @@ function lazyNewStreams() {
     newStreamsPullSync = pullModule.pullSync;
     const utils = require('internal/streams/iter/utils');
     newStreamsParsePullArgs = utils.parsePullArgs;
-    newStreamsToUint8Array = utils.toUint8Array;
+    newStreamsToWriterUint8Array = utils.toWriterUint8Array;
     newStreamsConvertChunks = utils.convertChunks;
+    newStreamsGetWriterSignal = utils.getWriterSignal;
   }
 }
 
@@ -885,6 +884,8 @@ if (getOptionValue('--experimental-stream-iter')) {
     return {
       __proto__: null,
       write(chunk, options = kNullPrototo) {
+        chunk = newStreamsToWriterUint8Array(chunk);
+        const signal = newStreamsGetWriterSignal(options);
         if (error) {
           return PromiseReject(error);
         }
@@ -892,17 +893,9 @@ if (getOptionValue('--experimental-stream-iter')) {
           return PromiseReject(
             new ERR_INVALID_STATE.TypeError('The writer is closed'));
         }
-        validateObject(options, 'options');
-        const {
-          signal,
-        } = options;
-        if (signal !== undefined) {
-          validateAbortSignal(signal, 'options.signal');
-          if (signal.aborted) {
-            return PromiseReject(signal.reason);
-          }
+        if (signal?.aborted) {
+          return PromiseReject(signal.reason);
         }
-        chunk = newStreamsToUint8Array(chunk);
         if (bytesRemaining >= 0 && chunk.byteLength > bytesRemaining) {
           return PromiseReject(
             new ERR_OUT_OF_RANGE('write', `<= ${bytesRemaining} bytes`,
@@ -915,6 +908,8 @@ if (getOptionValue('--experimental-stream-iter')) {
       },
 
       writev(chunks, options = kNullPrototo) {
+        chunks = newStreamsConvertChunks(chunks);
+        const signal = newStreamsGetWriterSignal(options);
         if (error) {
           return PromiseReject(error);
         }
@@ -922,17 +917,9 @@ if (getOptionValue('--experimental-stream-iter')) {
           return PromiseReject(
             new ERR_INVALID_STATE.TypeError('The writer is closed'));
         }
-        validateObject(options, 'options');
-        const {
-          signal,
-        } = options;
-        if (signal !== undefined) {
-          validateAbortSignal(signal, 'options.signal');
-          if (signal?.aborted) {
-            return PromiseReject(signal.reason);
-          }
+        if (signal?.aborted) {
+          return PromiseReject(signal.reason);
         }
-        chunks = newStreamsConvertChunks(chunks);
         let totalSize = 0;
         for (let i = 0; i < chunks.length; i++) {
           totalSize += chunks[i].byteLength;
@@ -949,8 +936,8 @@ if (getOptionValue('--experimental-stream-iter')) {
       },
 
       writeSync(chunk) {
+        chunk = newStreamsToWriterUint8Array(chunk);
         if (error || closed || asyncPending) return false;
-        chunk = newStreamsToUint8Array(chunk);
         const length = chunk.byteLength;
         if (length > syncWriteThreshold) return false;
         if (length === 0) return true;
@@ -980,8 +967,8 @@ if (getOptionValue('--experimental-stream-iter')) {
       },
 
       writevSync(chunks) {
-        if (error || closed || asyncPending) return false;
         chunks = newStreamsConvertChunks(chunks);
+        if (error || closed || asyncPending) return false;
         let totalSize = 0;
         for (let i = 0; i < chunks.length; i++) {
           totalSize += chunks[i].byteLength;
@@ -1016,6 +1003,7 @@ if (getOptionValue('--experimental-stream-iter')) {
       },
 
       end(options = kNullPrototo) {
+        const signal = newStreamsGetWriterSignal(options);
         if (error) {
           return PromiseReject(error);
         }
@@ -1025,15 +1013,8 @@ if (getOptionValue('--experimental-stream-iter')) {
         if (closing) {
           return pendingEndPromise;
         }
-        validateObject(options, 'options');
-        const {
-          signal,
-        } = options;
-        if (signal !== undefined) {
-          validateAbortSignal(signal, 'options.signal');
-          if (signal.aborted) {
-            return PromiseReject(signal.reason);
-          }
+        if (signal?.aborted) {
+          return PromiseReject(signal.reason);
         }
         closing = true;
         pendingEndPromise = PromisePrototypeThen(
@@ -1598,6 +1579,9 @@ async function rmdir(path, options) {
 }
 
 async function fdatasync(handle) {
+  if (permission.isEnabled()) {
+    throw new ERR_ACCESS_DENIED('fdatasync API is disabled when Permission Model is enabled.');
+  }
   return await PromisePrototypeThen(
     binding.fdatasync(handle.fd, kUsePromises),
     undefined,
@@ -1606,6 +1590,9 @@ async function fdatasync(handle) {
 }
 
 async function fsync(handle) {
+  if (permission.isEnabled()) {
+    throw new ERR_ACCESS_DENIED('fsync API is disabled when Permission Model is enabled.');
+  }
   return await PromisePrototypeThen(
     binding.fsync(handle.fd, kUsePromises),
     undefined,
@@ -1642,42 +1629,42 @@ async function mkdir(path, options) {
 }
 
 async function readdirRecursive(originalPath, options) {
+  if (permission.isEnabled()) {
+    return readdirRecursiveWithPermissionModel(originalPath, options);
+  }
   const withFileTypes = !!options.withFileTypes;
-  const readdirWithTypes = (path) => PromisePrototypeThen(
-    binding.readdir(path, options.encoding, true, kUsePromises),
+  const result = await PromisePrototypeThen(
+    binding.readdirRecursive(
+      originalPath,
+      options.encoding,
+      withFileTypes,
+      kUsePromises,
+    ),
     undefined,
     handleErrorFromBinding,
   );
-  const result = [];
-  const queue = [[originalPath, '', await readdirWithTypes(originalPath)]];
-
-  while (queue.length > 0) {
-    // If we want to implement BFS make this a `shift` call instead of `pop`
-    const { 0: path, 1: prefix, 2: { 0: names, 1: types } } = ArrayPrototypePop(queue);
-    for (let i = 0; i < names.length; i++) {
-      const name = names[i];
-      const relative = prefix === '' ? name : `${prefix}${pathModule.sep}${name}`;
-      let isDirectory;
-      if (withFileTypes) {
-        const dirent = getDirent(path, name, types[i]);
-        ArrayPrototypePush(result, dirent);
-        isDirectory = dirent.isDirectory();
-      } else {
-        ArrayPrototypePush(result, relative);
-        // Entries that are, or may be, symbolic links to directories are followed.
-        const type = types[i];
-        isDirectory = type === UV_DIRENT_DIR ||
-          ((type === UV_DIRENT_LINK || type === UV_DIRENT_UNKNOWN) &&
-           binding.internalModuleStat(pathModule.join(path, name)) === 1);
-      }
-      if (isDirectory) {
-        const direntPath = pathModule.join(path, name);
-        ArrayPrototypePush(queue, [direntPath, relative, await readdirWithTypes(direntPath)]);
-      }
-    }
-  }
+  return withFileTypes ? getRecursiveDirents(originalPath, result) : result;
+}
 
-  return result;
+// TODO: native?
+async function readdirRecursiveWithPermissionModel(basePath, options) {
+  const { encoding } = options;
+  const context = {
+    withFileTypes: !!options.withFileTypes,
+    results: [],
+    dirs: [basePath],
+    prefixes: [''],
+  };
+  for (let i = 0; i < context.dirs.length; i++) {
+    const dir = context.dirs[i];
+    const result = await PromisePrototypeThen(
+      binding.readdir(dir, encoding, true, kUsePromises),
+      undefined,
+      handleErrorFromBinding,
+    );
+    collectRecursiveReaddirResult(dir, context.prefixes[i], result, context);
+  }
+  return context.results;
 }
 
 async function readdir(path, options) {
@@ -1745,7 +1732,8 @@ async function symlink(target, path, type) {
   // Due to the nature of Node.js runtime, symlinks has different edge cases that can bypass
   // the permission model security guarantees. Thus, this API is disabled unless fs.read
   // and fs.write permission has been given.
-  if (permission.isEnabled() && !permission.has('fs')) {
+  if (permission.isEnabled() && !permission.has('fs') &&
+      !permission.isAuditMode()) {
     throw new ERR_ACCESS_DENIED('fs.symlink API requires full fs.read and fs.write permissions.');
   }
 
@@ -1790,7 +1778,8 @@ async function lstat(path, options = { __proto__: null, bigint: false }) {
     if (promise !== undefined) return await promise;
   }
   path = getValidatedPath(path);
-  if (permission.isEnabled() && !permission.has('fs.read', path)) {
+  if (permission.isEnabled() && !permission.has('fs.read', path) &&
+      !permission.isAuditMode()) {
     const resource = pathModule.toNamespacedPath(BufferIsBuffer(path) ? BufferToString(path) : path);
     throw new ERR_ACCESS_DENIED('Access to this API has been restricted', 'FileSystemRead', resource);
   }
@@ -2113,6 +2102,14 @@ async function writeFile(path, data, options) {
 
   checkAborted(options.signal);
 
+  if (!flush && !isCustomIterable(data) && data.byteLength <= kWriteFileMaxChunkSize) {
+    path = getValidatedPath(path);
+    await writeFileInOneRoundTrip(path, stringToFlags(flag, 'options.flag'),
+                                  parseFileMode(options.mode, 'mode', 0o666), data);
+    checkAborted(options.signal);  // An abort during the write still wins.
+    return;
+  }
+
   const fd = await open(path, flag, options.mode);
   let writeOp = writeFileHandle(fd, data, options.signal, options.encoding);
 
@@ -2123,6 +2120,33 @@ async function writeFile(path, data, options) {
   return handleFdClose(writeOp, fd.close);
 }
 
+/**
+ * Open + write + close as one thread pool round trip.
+ * @param {string|Buffer} path Validated path
+ * @param {number} flagsNumber
+ * @param {number} mode
+ * @param {ArrayBufferView} data
+ * @returns {Promise<void>}
+ */
+function writeFileInOneRoundTrip(path, flagsNumber, mode, data) {
+  return new Promise((resolve, reject) => {
+    const job = new binding.WriteFileJob(path, flagsNumber, mode, data);
+    job.ondone = (err) => {
+      if (err != null) {
+        ErrorCaptureStackTrace(err, writeFileInOneRoundTrip);
+        reject(err);
+      } else {
+        resolve();
+      }
+    };
+    const accessError = job.run(path);
+    if (accessError !== undefined) {
+      ErrorCaptureStackTrace(accessError, writeFileInOneRoundTrip);
+      reject(accessError);
+    }
+  });
+}
+
 function isCustomIterable(obj) {
   return isIterable(obj) && !isArrayBufferView(obj) && typeof obj !== 'string';
 }
diff --git a/lib/internal/fs/recursive_watch.js b/lib/internal/fs/recursive_watch.js
index 2f71aeda9f79..85d84f9dd8f3 100644
--- a/lib/internal/fs/recursive_watch.js
+++ b/lib/internal/fs/recursive_watch.js
@@ -17,7 +17,7 @@ const {
   },
 } = require('internal/errors');
 const { getValidatedPath } = require('internal/fs/utils');
-const { createIgnoreMatcher, kFSWatchStart, StatWatcher } = require('internal/fs/watchers');
+const { createIgnoreMatcher, kFSWatchStart } = require('internal/fs/watchers');
 const { kEmptyObject } = require('internal/util');
 const { validateBoolean, validateAbortSignal, validateIgnoreOption } = require('internal/validators');
 const {
@@ -37,14 +37,40 @@ function lazyLoadFsSync() {
 
 let kResistStopPropagation;
 
+const kIsAIX = process.platform === 'aix';
+
+function isPathMissingForWatch(error, file) {
+  if (error.code === 'ENOENT') {
+    return true;
+  }
+  // AIX reports ENODEV when the path disappears before fs.watch() starts.
+  // Check that it is actually gone so other ENODEV errors still propagate.
+  if (!kIsAIX || error.code !== 'ENODEV') {
+    return false;
+  }
+  try {
+    return lazyLoadFsSync().statSync(file, { throwIfNoEntry: false }) === undefined;
+  } catch {
+    return false;
+  }
+}
+
+// Inotify reports changes to a directory's entries, with their names, on the
+// directory's own watch, so one watcher per directory is enough on Linux.
+// kqueue and event ports only report that the directory itself changed, so
+// elsewhere every file keeps a watcher of its own as well.
+const kDirectoryWatchReportsEntries = process.platform === 'linux';
+
 class FSWatcher extends EventEmitter {
   #options = null;
   #closed = false;
-  #files = new SafeMap();
+  // Every path below the root that has been reported (or existed at start).
+  #entries = new SafeSet();
+  // One fs.watch() per directory and symbolic link (and per file where the
+  // directory watch does not report its entries).
   #watchers = new SafeMap();
-  #symbolicFiles = new SafeSet();
+  #symbolicLinks = new SafeSet();
   #rootPath = pathResolve();
-  #watchingFile = false;
   #ignoreMatcher = null;
 
   constructor(options = kEmptyObject) {
@@ -94,129 +120,199 @@ class FSWatcher extends EventEmitter {
 
     this.#closed = true;
 
-    for (const file of this.#files.keys()) {
-      this.#watchers.get(file)?.close();
-      this.#watchers.delete(file);
+    for (const watcher of this.#watchers.values()) {
+      watcher.close();
     }
-
-    this.#files.clear();
-    this.#symbolicFiles.clear();
+    this.#watchers.clear();
+    this.#entries.clear();
+    this.#symbolicLinks.clear();
     this.emit('close');
   }
 
-  #unwatchFiles(file) {
-    this.#symbolicFiles.delete(file);
+  #emit(eventType, file) {
+    this.emit('change', eventType, pathRelative(this.#rootPath, file));
+  }
+
+  #forget(file) {
+    const watcher = this.#watchers.get(file);
+    if (watcher !== undefined) {
+      watcher.close();
+      this.#watchers.delete(file);
+    }
+    this.#entries.delete(file);
+    this.#symbolicLinks.delete(file);
 
     const childPrefix = file + pathSep;
-    for (const filename of this.#files.keys()) {
-      if (filename === file ||
-          StringPrototypeStartsWith(filename, childPrefix)) {
-        this.#files.delete(filename);
-        this.#watchers.get(filename)?.close();
-        this.#watchers.delete(filename);
+    for (const entry of this.#entries) {
+      if (StringPrototypeStartsWith(entry, childPrefix)) {
+        this.#entries.delete(entry);
+        this.#symbolicLinks.delete(entry);
+        const childWatcher = this.#watchers.get(entry);
+        if (childWatcher !== undefined) {
+          childWatcher.close();
+          this.#watchers.delete(entry);
+        }
       }
     }
   }
 
-  #watchFolder(folder) {
-    const { readdirSync } = lazyLoadFsSync();
-
+  // Report an entry that vanished between being listed and being watched so
+  // the caller can discard its stale bookkeeping.
+  #watch(file, onChange) {
+    if (this.#closed) {
+      return false;
+    }
+    if (this.#watchers.has(file)) {
+      return true;
+    }
+    const { watch } = lazyLoadFsSync();
+    let watcher;
     try {
-      const files = readdirSync(folder, {
-        withFileTypes: true,
-      });
-
-      for (const file of files) {
-        if (this.#closed) {
-          break;
-        }
+      watcher = watch(file, { persistent: this.#options.persistent }, onChange);
+    } catch (err) {
+      if (isPathMissingForWatch(err, file) &&
+          (file !== this.#rootPath || !this.#options.throwIfNoEntry)) {
+        return false;
+      }
+      throw err;
+    }
+    this.#watchers.set(file, watcher);
+    return true;
+  }
 
-        const f = pathJoin(folder, file.name);
-        const relativePath = pathRelative(this.#rootPath, f);
+  // Arms one watcher for `folder`, then registers entries that are not known
+  // yet (emitting 'rename' for them unless this is the initial scan);
+  // #addEntry() descends into subdirectories.
+  #scanFolder(folder, initial) {
+    if (!this.#watch(folder, (eventType, filename) => this.#onFolderEvent(folder, filename))) {
+      this.#forget(folder);
+      return;
+    }
 
-        // Skip watching ignored paths entirely to avoid kernel resource pressure
-        if (this.#ignoreMatcher?.(relativePath)) {
-          continue;
+    const { readdirSync } = lazyLoadFsSync();
+    let entries;
+    try {
+      entries = readdirSync(folder, { withFileTypes: true });
+    } catch (error) {
+      if (error.code === 'ENOENT' || error.code === 'ENOTDIR') {
+        if (folder === this.#rootPath && initial &&
+            (error.code !== 'ENOENT' || this.#options.throwIfNoEntry)) {
+          throw error;
         }
-
-        if (!this.#files.has(f)) {
-          this.emit('change', 'rename', relativePath);
-
-          if (file.isSymbolicLink()) {
-            this.#symbolicFiles.add(f);
-          }
-
-          try {
-            this.#watchFile(f);
-            if (file.isDirectory() && !file.isSymbolicLink()) {
-              this.#watchFolder(f);
-            }
-          } catch (err) {
-            // Ignore ENOENT
-            if (err.code !== 'ENOENT') {
-              throw err;
-            }
-          }
+        if (!initial && !this.#closed) {
+          this.#emit('rename', folder);
         }
-      }
-    } catch (error) {
-      if (error.code !== 'ENOENT') {
+        this.#forget(folder);
+      } else {
         this.emit('error', error);
       }
+      return;
+    }
+
+    for (const entry of entries) {
+      if (this.#closed) {
+        break;
+      }
+      const file = pathJoin(folder, entry.name);
+      if (!this.#entries.has(file) && !this.#ignoreMatcher?.(pathRelative(this.#rootPath, file))) {
+        this.#addEntry(file, entry, initial);
+      }
+    }
+  }
+
+  // `entry` is the Dirent or the lstat() Stats of `file`.
+  #addEntry(file, entry, initial) {
+    this.#entries.add(file);
+    if (!initial) {
+      this.#emit('rename', file);
+    }
+    if (entry.isSymbolicLink()) {
+      // The link target is watched so that changes behind the link surface
+      // as a 'rename' of the link, as they always have on this code path.
+      this.#symbolicLinks.add(file);
+      if (!this.#watch(file, () => this.#emit('rename', file))) {
+        this.#forget(file);
+      }
+    } else if (entry.isDirectory()) {
+      this.#scanFolder(file, initial);
+    } else if (!kDirectoryWatchReportsEntries) {
+      if (!this.#watch(file, () => this.#onEntryEvent(file))) {
+        this.#forget(file);
+      }
     }
   }
 
-  #watchFile(file) {
+  #onFolderEvent(folder, filename) {
     if (this.#closed) {
       return;
     }
+    const { lstatSync, statSync } = lazyLoadFsSync();
+    if (!kDirectoryWatchReportsEntries || filename == null) {
+      // All that is known is that something about `folder` changed.
+      if (statSync(folder, { throwIfNoEntry: false }) === undefined) {
+        this.#emit('rename', folder);
+        this.#forget(folder);
+      } else {
+        this.#scanFolder(folder, false);
+      }
+      return;
+    }
+    // Events about the watched directory itself are reported under its own
+    // name; those take the "unknown entry" path and are resolved by the parent.
+    const file = pathJoin(folder, filename);
 
-    const { watch, statSync } = lazyLoadFsSync();
-
-    if (this.#files.has(file)) {
+    if (!this.#entries.has(file)) {
+      if (this.#ignoreMatcher?.(pathRelative(this.#rootPath, file))) {
+        return;
+      }
+      const entry = lstatSync(file, { throwIfNoEntry: false });
+      if (entry !== undefined) {
+        this.#addEntry(file, entry, false);
+      } else if (folder === this.#rootPath && statSync(folder, { throwIfNoEntry: false }) === undefined) {
+        this.#emit('rename', folder);
+        this.#forget(folder);
+      }
       return;
     }
 
-    {
-      const existingStat = statSync(file);
-      this.#files.set(file, existingStat);
+    this.#onEntryEvent(file);
+  }
+
+  // Something happened to a known entry: work out what from its current state.
+  #onEntryEvent(file) {
+    if (this.#closed) {
+      return;
+    }
+    const { statSync } = lazyLoadFsSync();
+    const stats = statSync(file, { throwIfNoEntry: false });
+    if (stats === undefined) {
+      this.#emit('rename', file);
+      this.#forget(file);
+    } else if (this.#symbolicLinks.has(file)) {
+      this.#emit('rename', file);
+    } else if (stats.isDirectory()) {
+      this.#scanFolder(file, false);
+    } else {
+      this.#emit('change', file);
     }
+  }
 
-    const watcher = watch(file, {
-      persistent: this.#options.persistent,
-    }, (eventType, filename) => {
-      const existingStat = this.#files.get(file);
-      let currentStats;
-
-      try {
-        currentStats = statSync(file);
-        this.#files.set(file, currentStats);
-      } catch {
-        // This happens if the file was removed
+  #watchRootFile(file) {
+    const { statSync } = lazyLoadFsSync();
+    this.#entries.add(file);
+    if (!this.#watch(file, () => {
+      if (this.#closed) {
+        return;
       }
-
-      if (currentStats === undefined || (currentStats.birthtimeMs === 0 && existingStat.birthtimeMs !== 0)) {
-        // The file is now deleted
-        this.#files.delete(file);
-        this.#watchers.delete(file);
-        watcher.close();
-        this.emit('change', 'rename', pathRelative(this.#rootPath, file));
-        this.#unwatchFiles(file);
-      } else if (file === this.#rootPath && this.#watchingFile) {
-        // This case will only be triggered when watching a file with fs.watch
-        this.emit('change', 'change', pathBasename(file));
-      } else if (this.#symbolicFiles.has(file)) {
-        // Stats from watchFile does not return correct value for currentStats.isSymbolicLink()
-        // Since it is only valid when using fs.lstat(). Therefore, check the existing symbolic files.
-        this.emit('change', 'rename', pathRelative(this.#rootPath, file));
-      } else if (currentStats.isDirectory()) {
-        this.#watchFolder(file);
+      if (statSync(file, { throwIfNoEntry: false }) === undefined) {
+        this.#emit('rename', file);
+        this.#forget(file);
       } else {
-        // Watching a directory will trigger a change event for child files)
-        this.emit('change', 'change', pathRelative(this.#rootPath, file));
+        this.emit('change', 'change', pathBasename(file));
       }
-    });
-    this.#watchers.set(file, watcher);
+    })) {
+      this.#forget(file);
+    }
   }
 
   [kFSWatchStart](filename) {
@@ -227,15 +323,16 @@ class FSWatcher extends EventEmitter {
 
       this.#rootPath = filename;
       this.#closed = false;
-      this.#watchingFile = file.isFile();
 
-      this.#watchFile(filename);
       if (file.isDirectory()) {
-        this.#watchFolder(filename);
+        this.#scanFolder(filename, true);
+      } else {
+        this.#watchRootFile(filename);
       }
     } catch (error) {
-      if (!this.#options.throwIfNoEntry && error.code === 'ENOENT') {
+      if (this.#options.throwIfNoEntry || error.code !== 'ENOENT') {
         error.filename = filename;
+        this.close();
         throw error;
       }
     }
@@ -243,19 +340,15 @@ class FSWatcher extends EventEmitter {
   }
 
   ref() {
-    this.#files.forEach((file) => {
-      if (file instanceof StatWatcher) {
-        file.ref();
-      }
-    });
+    for (const watcher of this.#watchers.values()) {
+      watcher.ref();
+    }
   }
 
   unref() {
-    this.#files.forEach((file) => {
-      if (file instanceof StatWatcher) {
-        file.unref();
-      }
-    });
+    for (const watcher of this.#watchers.values()) {
+      watcher.unref();
+    }
   }
 
   [SymbolAsyncIterator]() {
diff --git a/lib/internal/fs/utils.js b/lib/internal/fs/utils.js
index 70aaa7e7c58e..3aadc19c4732 100644
--- a/lib/internal/fs/utils.js
+++ b/lib/internal/fs/utils.js
@@ -2,6 +2,7 @@
 
 const {
   ArrayIsArray,
+  ArrayPrototypePush,
   BigInt,
   Date,
   DateNow,
@@ -65,6 +66,11 @@ const {
   validateUint32,
 } = require('internal/validators');
 const pathModule = require('path');
+const binding = internalBinding('fs');
+const {
+  CHAR_BACKWARD_SLASH,
+  CHAR_FORWARD_SLASH,
+} = require('internal/constants');
 const kType = Symbol('type');
 const kStats = Symbol('stats');
 const kPartialAtimeNs = Symbol('partialAtimeNs');
@@ -323,6 +329,81 @@ function getDirent(path, name, type, callback) {
   }
 }
 
+/**
+ * Builds the Dirent objects for a `binding.readdirRecursive()` result, whose
+ * entries are grouped by directory: `counts[i]` entries under `dirs[i]`.
+ * @param {string | Buffer} basePath
+ * @param {[string[] | Buffer[], Uint8Array, Uint32Array, string[] | Buffer[]]} result
+ * @returns {Dirent[]}
+ */
+function getRecursiveDirents(basePath, { 0: names, 1: types, 2: counts, 3: dirs }) {
+  let i = 0;
+  for (let d = 0; d < dirs.length; d++) {
+    // The root keeps the path as given, the directories below it get the
+    // relative directory joined onto it.
+    const parentPath = d === 0 ? basePath : joinParentPath(basePath, dirs[d]);
+    for (const end = i + counts[d]; i < end; i++) {
+      names[i] = new Dirent(names[i], types[i], parentPath);
+    }
+  }
+  return names;
+}
+
+/**
+ * Joins the relative path of a directory onto the path a recursive readdir
+ * was given.
+ * @param {string | Buffer} basePath
+ * @param {string | Buffer} relative
+ * @returns {string | Buffer}
+ */
+function joinParentPath(basePath, relative) {
+  if (typeof basePath === 'string' && typeof relative === 'string') {
+    return pathModule.join(basePath, relative);
+  }
+  const base = typeof basePath === 'string' ? Buffer.from(basePath) : basePath;
+  const parts = [base];
+  const last = base.length === 0 ? -1 : base[base.length - 1];
+  if (last !== CHAR_FORWARD_SLASH && (!isWindows || last !== CHAR_BACKWARD_SLASH)) {
+    ArrayPrototypePush(parts, Buffer.from(pathModule.sep));
+  }
+  ArrayPrototypePush(parts, typeof relative === 'string' ? Buffer.from(relative) : relative);
+  return Buffer.concat(parts);
+}
+
+/**
+ * Appends one directory's entries to `context.results` and the subdirectories
+ * still to visit to `context.dirs`.
+ * @param {string} dir
+ * @param {string} prefix
+ * @param {[string[], number[]]} result
+ * @param {{ withFileTypes: boolean, results: (string | Dirent)[], dirs: string[], prefixes: string[] }} context
+ */
+function collectRecursiveReaddirResult(dir, prefix, { 0: names, 1: types }, context) {
+  const { length } = names;
+  for (let i = 0; i < length; i++) {
+    const name = names[i];
+    const relative = prefix === '' ? name : `${prefix}${pathModule.sep}${name}`;
+    let isDirectory;
+    if (context.withFileTypes) {
+      const dirent = getDirent(dir, name, types[i]);
+      ArrayPrototypePush(context.results, dirent);
+      // https://github.com/nodejs/node/issues/52663
+      isDirectory = dirent.isDirectory() ||
+        (dirent.isSymbolicLink() && binding.internalModuleStat(pathModule.join(dir, name)) === 1);
+    } else {
+      ArrayPrototypePush(context.results, relative);
+      const type = types[i];
+      isDirectory = type === UV_DIRENT_DIR ||
+        ((type === UV_DIRENT_LINK || type === UV_DIRENT_UNKNOWN) &&
+         binding.internalModuleStat(pathModule.join(dir, name)) === 1);
+    }
+    if (isDirectory) {
+      ArrayPrototypePush(context.dirs, pathModule.join(dir, name));
+      ArrayPrototypePush(context.prefixes, relative);
+    }
+  }
+}
+
 function getOptions(options, defaultOptions = kEmptyObject) {
   if (options == null || typeof options === 'function') {
     return defaultOptions;
@@ -1111,6 +1192,7 @@ const vfsState = { __proto__: null, handlers: null };
 function setVfsHandlers(handlers) { vfsState.handlers = handlers; }
 
 module.exports = {
+  collectRecursiveReaddirResult,
   constants: {
     kIoMaxLength,
     kMaxUserId,
@@ -1128,6 +1210,7 @@ module.exports = {
   getDirent,
   getDirents,
   getOptions,
+  getRecursiveDirents,
   getValidatedFd,
   getValidatedPath,
   handleErrorFromBinding,
diff --git a/lib/internal/histogram.js b/lib/internal/histogram.js
index 952f6058019f..f325adab484e 100644
--- a/lib/internal/histogram.js
+++ b/lib/internal/histogram.js
@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  ArrayIsArray,
   Float64Array,
   Map,
   MapPrototypeEntries,
@@ -33,11 +32,16 @@ const {
 } = require('internal/errors');
 
 const {
+  validateArray,
   validateInteger,
   validateNumber,
   validateObject,
 } = require('internal/validators');
 
+const {
+  isUint8Array,
+} = require('internal/util/types');
+
 const kDestroy = Symbol('kDestroy');
 const kHandle = Symbol('kHandle');
 const kRecordable = Symbol('kRecordable');
@@ -193,6 +197,30 @@ class Histogram {
     return this[kHandle]?.mean();
   }
 
+  /**
+   * Returns a confidence interval for the mean using Student's t-distribution.
+   * @param {{ confidence?: number }} [options]
+   * @returns {{ mean: number, lower: number, upper: number }}
+   */
+  meanCI(options = kEmptyObject) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    validateObject(options, 'options');
+    const { confidence = 0.95 } = options;
+    validateNumber(confidence, 'options.confidence');
+    if (NumberIsNaN(confidence) || confidence <= 0 || confidence >= 1)
+      throw new ERR_OUT_OF_RANGE('options.confidence',
+                                 '> 0 && < 1', confidence);
+    const result = this[kHandle]?.meanCI(confidence);
+    if (result === undefined) return undefined;
+    return {
+      __proto__: null,
+      mean: result[0],
+      lower: result[1],
+      upper: result[2],
+    };
+  }
+
   /**
    * @readonly
    * @type {number}
@@ -213,6 +241,18 @@ class Histogram {
     return this[kHandle]?.exceedsBigInt();
   }
 
+  /**
+   * Serializes the histogram to a CBOR-encoded Uint8Array suitable for
+   * transmission or storage. The data can be reconstructed into a new
+   * histogram using `importHistogram()`.
+   * @returns {Uint8Array}
+   */
+  export() {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    return this[kHandle]?.export();
+  }
+
   /**
    * Returns the exponentially weighted moving average of recorded values.
    * Only active when the histogram was created with a `halfLife` option.
@@ -539,8 +579,7 @@ class Histogram {
   percentilesAt(percentiles) {
     if (!isHistogram(this))
       throw new ERR_INVALID_THIS('Histogram');
-    if (!ArrayIsArray(percentiles))
-      throw new ERR_INVALID_ARG_TYPE('percentiles', 'Array', percentiles);
+    validateArray(percentiles, 'percentiles');
     for (let i = 0; i < percentiles.length; i++) {
       validateNumber(percentiles[i], `percentiles[${i}]`);
       if (NumberIsNaN(percentiles[i]) ||
@@ -756,6 +795,18 @@ function createHistogram(options = kEmptyObject) {
     new _Histogram(lowest, highest, figures, halfLife, threshold));
 }
 
+/**
+ * Reconstructs a histogram from a CBOR-encoded Uint8Array previously
+ * produced by `histogram.export()`.
+ * @param {Uint8Array} data
+ * @returns {RecordableHistogram}
+ */
+function importHistogram(data) {
+  if (!isUint8Array(data))
+    throw new ERR_INVALID_ARG_TYPE('data', 'Uint8Array', data);
+  return createRecordableHistogram(_Histogram.import(data));
+}
+
 module.exports = {
   Histogram,
   RecordableHistogram,
@@ -766,4 +817,5 @@ module.exports = {
   kHandle,
   kSkipThrow,
   createHistogram,
+  importHistogram,
 };
diff --git a/lib/internal/http2/core.js b/lib/internal/http2/core.js
index 8042ae2b6782..fcf94db8a1e1 100644
--- a/lib/internal/http2/core.js
+++ b/lib/internal/http2/core.js
@@ -470,7 +470,11 @@ function onSessionHeaders(handle, id, cat, flags, headers, sensitiveHeaders) {
     }
   }
   if (endOfStream) {
-    stream.push(null);
+    const reqAsync = stream[kRequestAsyncResource];
+    if (reqAsync)
+      reqAsync.runInAsyncScope(() => stream.push(null));
+    else
+      stream.push(null);
   }
 }
 
@@ -591,7 +595,7 @@ function onPing(payload) {
 // point, close them. If there is an open fd for file send, close that also.
 // At this point the underlying node::http2:Http2Stream handle is no
 // longer usable so destroy it also.
-function onStreamClose(code) {
+function onStreamClose(code, peerReset) {
   const stream = this[kOwner];
   if (!stream || stream.destroyed)
     return false;
@@ -610,8 +614,9 @@ function onStreamClose(code) {
     // If errored or ended, we can destroy immediately.
     stream.destroy();
   } else {
-    // Wait for end to destroy.
-    stream.on('end', stream[kMaybeDestroy]);
+    // Preserve buffered reads after a clean reset, but do not wait for
+    // pending writes: the peer reset may prevent them from finishing.
+    stream.on('end', peerReset ? stream.destroy : stream[kMaybeDestroy]);
     // Push a null so the stream can end whenever the client consumes
     // it completely.
     stream.push(null);
diff --git a/lib/internal/main/bench_runner.js b/lib/internal/main/bench_runner.js
new file mode 100644
index 000000000000..ff3647fe785c
--- /dev/null
+++ b/lib/internal/main/bench_runner.js
@@ -0,0 +1,31 @@
+'use strict';
+
+const {
+  ArrayPrototypeSlice,
+  PromisePrototypeThen,
+} = primordials;
+const {
+  markBootstrapComplete,
+  prepareTestRunnerMainExecution,
+} = require('internal/process/pre_execution');
+const { emitExperimentalWarning } = require('internal/util');
+const {
+  triggerUncaughtException,
+  exitCodes: { kGenericUserError },
+} = internalBinding('errors');
+
+prepareTestRunnerMainExecution();
+markBootstrapComplete();
+if (process.env.NODE_BENCH_CONTEXT !== 'child' ||
+    typeof process.send !== 'function') {
+  emitExperimentalWarning('Benchmarks');
+}
+
+const { run } = require('internal/bench_runner/cli');
+const patterns = ArrayPrototypeSlice(process.argv, 1);
+
+PromisePrototypeThen(run(patterns), ({ success }) => {
+  if (!success) process.exitCode = kGenericUserError;
+}, (error) => {
+  triggerUncaughtException(error, true /* fromPromise */);
+});
diff --git a/lib/internal/main/embedding.js b/lib/internal/main/embedding.js
index 863f90a32f40..31c55459a13e 100644
--- a/lib/internal/main/embedding.js
+++ b/lib/internal/main/embedding.js
@@ -12,10 +12,15 @@
 const {
   prepareMainThreadExecution,
 } = require('internal/process/pre_execution');
-const { isExperimentalSeaWarningNeeded, isSea } = internalBinding('sea');
+const {
+  isExperimentalSeaWarningNeeded,
+  isSea,
+  isVfsEnabled,
+  mainCodePath: seaMainCodePath,
+} = internalBinding('sea');
 const { emitExperimentalWarning } = require('internal/util');
 const { emitWarningSync } = require('internal/process/warning');
-const { Module } = require('internal/modules/cjs/loader');
+const { Module, wrapModuleLoad } = require('internal/modules/cjs/loader');
 const { compileFunctionForCJSLoader } = internalBinding('contextify');
 const { maybeCacheSourceMap } = require('internal/source_map/source_map_cache');
 const { pathToFileURL } = require('internal/url');
@@ -120,10 +125,54 @@ function embedderRunESM(content, filename) {
   return wrap.getNamespace();
 }
 
+/* c8 ignore start -- only reachable in an actual SEA binary */
+/**
+ * Mounts the SEA virtual file system with the main script placed at the
+ * mount point root, and returns the path of the main script inside the
+ * mount, or null when the VFS could not be set up.
+ * @param {string} content The source of the SEA main script
+ * @returns {string|null} The VFS path of the main script
+ */
+function setUpSeaVfs(content) {
+  const mainName = path.basename(seaMainCodePath || process.execPath);
+  const { initSeaVfs } = require('internal/vfs/sea');
+  const seaVfs = initSeaVfs({ extraFiles: { [mainName]: content } });
+  if (seaVfs === null) {
+    return null;
+  }
+  return path.join(seaVfs.mountPoint, mainName);
+}
+/* c8 ignore stop */
+
 function embedderRunEntryPoint(content, format, filename) {
   format ||= moduleFormats.kCommonJS;
   filename ||= process.execPath;
 
+  /* c8 ignore start -- only reachable in an actual SEA binary */
+  if (isLoadingSea && isVfsEnabled()) {
+    // Run the main script from inside the SEA VFS mount so that
+    // `__filename`, `__dirname`, `import.meta`, relative requires and
+    // imports, and `node_modules` lookups all resolve against the
+    // bundled assets.
+    const vfsMain = setUpSeaVfs(content);
+    if (vfsMain !== null) {
+      if (format === moduleFormats.kCommonJS) {
+        return wrapModuleLoad(vfsMain, null, true);
+      } else if (format === moduleFormats.kModule) {
+        const { runEntryPointWithESMLoader } =
+          require('internal/modules/run_main');
+        const mainURL = pathToFileURL(vfsMain);
+        return runEntryPointWithESMLoader((cascadedLoader) => {
+          // Note that if the graph contains unsettled TLA, this may never
+          // resolve even after the event loop stops running.
+          return cascadedLoader.import(
+            mainURL, undefined, { __proto__: null }, undefined, true);
+        });
+      }
+    }
+  }
+  /* c8 ignore stop */
+
   if (format === moduleFormats.kCommonJS) {
     return embedderRunCjs(content, filename);
   } else if (format === moduleFormats.kModule) {
diff --git a/lib/internal/main/worker_thread.js b/lib/internal/main/worker_thread.js
index 8a58dc0cba0f..45e5efddb6f8 100644
--- a/lib/internal/main/worker_thread.js
+++ b/lib/internal/main/worker_thread.js
@@ -100,6 +100,7 @@ port.on('message', (message) => {
       hasStdin,
       publicPort,
       workerData,
+      webWorkerData,
       mainThreadPort,
     } = message;
 
@@ -116,6 +117,11 @@ port.on('message', (message) => {
     require('internal/worker').assignEnvironmentData(environmentData);
     setupMainThreadPort(mainThreadPort);
 
+    if (webWorkerData !== undefined) {
+      require('internal/webworker')
+        .installDedicatedWorkerGlobalScope(webWorkerData.url, webWorkerData);
+    }
+
     // The counter is only passed to the workers created by the main thread,
     // not to workers created by other workers.
     let cachedCwd = '';
@@ -155,7 +161,12 @@ port.on('message', (message) => {
         break;
       }
 
-      case 'classic': if (getOptionValue('--input-type') !== 'module') {
+      case 'classic': if (webWorkerData?.source !== undefined) {
+        // The source of a web Worker script loaded from a blob: or data:
+        // URL.
+        runWebWorkerScript(webWorkerData.source, webWorkerData);
+        break;
+      } else if (getOptionValue('--input-type') !== 'module') {
         const name = '[worker eval]';
         // This is necessary for CJS module compilation.
         // TODO: pass this with something really internal.
@@ -215,6 +226,13 @@ port.on('message', (message) => {
       }
 
       default: {
+        if (webWorkerData !== undefined) {
+          // A web Worker script loaded from a file: URL. Its type decides
+          // how the source is run, regardless of the file extension.
+          const source = require('fs').readFileSync(filename, 'utf8');
+          runWebWorkerScript(source, webWorkerData);
+          break;
+        }
         // script filename
         // runMain here might be monkey-patched by users in --require.
         // XXX: the monkey-patchability here should probably be deprecated.
@@ -289,6 +307,21 @@ function workerOnGlobalUncaughtException(error, fromPromise) {
   process.exit();
 }
 
+function runWebWorkerScript(source, webWorkerData) {
+  const webworker = require('internal/webworker');
+  if (webWorkerData.type === 'module') {
+    PromisePrototypeThen(
+      webworker.runModuleScriptSource(source, webWorkerData.url),
+      undefined,
+      (error) => workerOnGlobalUncaughtException(error, true),
+    );
+  } else {
+    // Unlike a worker eval, "run a classic script" evaluates the source in
+    // the worker's global scope.
+    webworker.runClassicScriptSource(source, webWorkerData.url);
+  }
+}
+
 // Patch the global uncaught exception handler so it gets picked up by
 // node::errors::TriggerUncaughtException().
 process._fatalException = workerOnGlobalUncaughtException;
diff --git a/lib/internal/modules/cjs/loader.js b/lib/internal/modules/cjs/loader.js
index 554746b6e2b3..1995eef579e8 100644
--- a/lib/internal/modules/cjs/loader.js
+++ b/lib/internal/modules/cjs/loader.js
@@ -113,6 +113,7 @@ const kFormat = Symbol('kFormat');
 
 // Set first due to cycle with ESM loader functions.
 module.exports = {
+  purgeModuleCachesForPrefix,
   kModuleSource,
   kModuleExport,
   kModuleExportNames,
@@ -155,19 +156,18 @@ const {
 } = internalBinding('contextify');
 
 const assert = require('internal/assert');
-const fs = require('fs');
 const path = require('path');
-const internalFsBinding = internalBinding('fs');
 const { safeGetenv } = internalBinding('credentials');
 const {
+  cleanForVfsPrefix,
   getCjsConditions,
   getCjsConditionsArray,
   initializeCjsConditions,
+  loaderMethods,
   loadBuiltinModule,
   makeRequireFunction,
   setHasStartedUserCJSExecution,
   stripBOM,
-  toRealPath,
   getRequireStack,
 } = require('internal/modules/helpers');
 const {
@@ -278,7 +278,7 @@ function stat(filename) {
     const result = statCache.get(filename);
     if (result !== undefined) { return result; }
   }
-  const result = internalFsBinding.internalModuleStat(filename);
+  const result = loaderMethods.internalModuleStat(filename);
   if (statCache !== null && result >= 0) {
     // Only set cache when `internalModuleStat(filename)` succeeds.
     statCache.set(filename, result);
@@ -286,6 +286,22 @@ function stat(filename) {
   return result;
 }
 
+/**
+ * Drop every module-loader cache entry (Module._cache,
+ * Module._pathCache, the stat cache) whose filename lives under
+ * `mountPoint`. Called by internal/vfs/setup.js when a VFS is
+ * unmounted. VFS mount points live in a reserved namespace that
+ * cannot collide with real paths, so a prefix scan is exact:
+ * real-fs entries and other-VFS entries never match.
+ * @param {string} mountPoint Absolute mount-point path
+ */
+function purgeModuleCachesForPrefix(mountPoint) {
+  cleanForVfsPrefix(Module._cache, mountPoint);
+  // Module._pathCache keys are `request\0parent` tokens; match on value.
+  cleanForVfsPrefix(Module._pathCache, mountPoint, true);
+  if (statCache !== null) { cleanForVfsPrefix(statCache, mountPoint); }
+}
+
 let _stat = stat;
 ObjectDefineProperty(Module, '_stat', {
   __proto__: null,
@@ -492,17 +508,7 @@ Module.isBuiltin = BuiltinModule.isBuiltin;
 function initializeCJS() {
   // This need to be done at runtime in case --expose-internals is set.
 
-  let modules = Module.builtinModules = BuiltinModule.getAllBuiltinModuleIds();
-  if (!getOptionValue('--experimental-quic')) {
-    modules = modules.filter((i) => i !== 'node:quic');
-  }
-  if (!getOptionValue('--experimental-ffi')) {
-    modules = modules.filter((i) => i !== 'node:ffi');
-  }
-  if (!getOptionValue('--experimental-vfs')) {
-    modules = modules.filter((i) => i !== 'node:vfs');
-  }
-  Module.builtinModules = ObjectFreeze(modules);
+  Module.builtinModules = ObjectFreeze(BuiltinModule.getAllBuiltinModuleIds());
 
   initializeCjsConditions();
 
@@ -595,7 +601,7 @@ function tryFile(requestPath, isMain) {
   if (getOptionValue(isMain ? '--preserve-symlinks-main' : '--preserve-symlinks')) {
     return path.resolve(requestPath);
   }
-  return toRealPath(requestPath);
+  return loaderMethods.realpathSync(requestPath);
 }
 
 /**
@@ -839,7 +845,7 @@ Module._findPath = function(request, paths, isMain, conditions = getCjsCondition
           if (getOptionValue('--preserve-symlinks')) {
             filename = path.resolve(basePath);
           } else {
-            filename = toRealPath(basePath);
+            filename = loaderMethods.realpathSync(basePath);
           }
         } else if (getOptionValue('--preserve-symlinks-main')) {
           // For the main module, we use the --preserve-symlinks-main flag instead
@@ -852,7 +858,7 @@ Module._findPath = function(request, paths, isMain, conditions = getCjsCondition
           // is needed.
           filename = path.resolve(basePath);
         } else {
-          filename = toRealPath(basePath);
+          filename = loaderMethods.realpathSync(basePath);
         }
       }
 
@@ -913,6 +919,11 @@ if (isWindows) {
       return [from + 'node_modules'];
     }
 
+    // The walk stops at the resolution root (e.g. a VFS mount point)
+    // instead of continuing to the file system root.
+    const resolutionRoot = loaderMethods.getResolutionRoot(from);
+    const stopLen = resolutionRoot === undefined ? -1 : resolutionRoot.length;
+
     /** @type {string[]} */
     const paths = [];
     for (let i = from.length - 1, p = 0, last = from.length; i >= 0; --i) {
@@ -931,6 +942,9 @@ if (isWindows) {
             StringPrototypeSlice(from, 0, last) + '\\node_modules',
           );
         }
+        if (last === stopLen) {
+          return paths;
+        }
         last = i;
         p = 0;
       } else if (p !== -1) {
@@ -959,6 +973,11 @@ if (isWindows) {
       return ['/node_modules'];
     }
 
+    // The walk stops at the resolution root (e.g. a VFS mount point)
+    // instead of continuing to the file system root.
+    const resolutionRoot = loaderMethods.getResolutionRoot(from);
+    const stopLen = resolutionRoot === undefined ? -1 : resolutionRoot.length;
+
     // note: this approach *only* works when the path is guaranteed
     // to be absolute.  Doing a fully-edge-case-correct path.split
     // that works on both Windows and Posix is non-trivial.
@@ -973,6 +992,9 @@ if (isWindows) {
             StringPrototypeSlice(from, 0, last) + '/node_modules',
           );
         }
+        if (last === stopLen) {
+          return paths;
+        }
         last = i;
         p = 0;
       } else if (p !== -1) {
@@ -1245,7 +1267,7 @@ function defaultLoadImpl(filename, format) {
     case 'module-typescript':
     case 'commonjs-typescript':
     case 'typescript': {
-      return fs.readFileSync(filename, 'utf8');
+      return loaderMethods.readFileSync(filename, 'utf8');
     }
     case 'builtin':
       return null;
diff --git a/lib/internal/modules/esm/get_format.js b/lib/internal/modules/esm/get_format.js
index b486337fac83..e69a0a01d996 100644
--- a/lib/internal/modules/esm/get_format.js
+++ b/lib/internal/modules/esm/get_format.js
@@ -10,7 +10,6 @@ const {
 } = primordials;
 const { getOptionValue } = require('internal/options');
 const { getValidatedPath } = require('internal/fs/utils');
-const fsBindings = internalBinding('fs');
 const { internal: internalConstants } = internalBinding('constants');
 
 const extensionFormatMap = {
@@ -66,7 +65,8 @@ function mimeToFormat(mime) {
  */
 function getFormatOfExtensionlessFile(url) {
   const path = getValidatedPath(url);
-  switch (fsBindings.getFormatOfExtensionlessFile(path)) {
+  const { loaderMethods } = require('internal/modules/helpers');
+  switch (loaderMethods.getFormatOfExtensionlessFile(path)) {
     case internalConstants.EXTENSIONLESS_FORMAT_WASM:
       return 'wasm';
     default:
diff --git a/lib/internal/modules/esm/load.js b/lib/internal/modules/esm/load.js
index f8487eda020d..06f60f9f6725 100644
--- a/lib/internal/modules/esm/load.js
+++ b/lib/internal/modules/esm/load.js
@@ -9,7 +9,7 @@ const {
 
 const { defaultGetFormat } = require('internal/modules/esm/get_format');
 const { validateAttributes, emitImportAssertionWarning } = require('internal/modules/esm/assert');
-const fs = require('fs');
+const { loaderMethods } = require('internal/modules/helpers');
 
 const { Buffer: { from: BufferFrom } } = require('buffer');
 
@@ -35,7 +35,7 @@ function getSourceSync(url, context) {
     // behavior - DO NOT depend on the patchability in new code: Node.js
     // internals may stop going through the JavaScript fs module entirely.
     // Prefer module.registerHooks() or other more formal fs hooks released in the future.
-    source = fs.readFileSync(url);
+    source = loaderMethods.readFileSync(url);
   } else if (protocol === 'data:') {
     const { dataURLProcessor } = require('internal/data_url');  // Only for data: URLs.
     const result = dataURLProcessor(url);
diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
index 3916e79328ed..0d00f014147d 100644
--- a/lib/internal/modules/esm/resolve.js
+++ b/lib/internal/modules/esm/resolve.js
@@ -9,7 +9,6 @@ const {
   ObjectPrototypeHasOwnProperty,
   RegExpPrototypeExec,
   RegExpPrototypeSymbolReplace,
-  SafeMap,
   SafeSet,
   String,
   StringPrototypeEndsWith,
@@ -23,16 +22,13 @@ const {
   encodeURIComponent,
 } = primordials;
 const assert = require('internal/assert');
-const internalFS = require('internal/fs/utils');
 const { BuiltinModule } = require('internal/bootstrap/realm');
-const fs = require('fs');
 const { getOptionValue } = require('internal/options');
 // Do not eagerly grab .manifest, it may be in TDZ
 const { sep, posix: { relative: relativePosixPath }, resolve, join } = require('path');
 const { URL, pathToFileURL, fileURLToPath, isURL, URLParse } = require('internal/url');
 const { getCWDURL, setOwnProperty, kEmptyObject } = require('internal/util');
 const { canParse: URLCanParse } = internalBinding('url');
-const { legacyMainResolve: FSLegacyMainResolve } = internalBinding('fs');
 const {
   ERR_INPUT_TYPE_NOT_ALLOWED,
   ERR_INVALID_ARG_TYPE,
@@ -49,7 +45,11 @@ const {
 const { defaultGetFormatWithoutErrors } = require('internal/modules/esm/get_format');
 const { getConditionsSet } = require('internal/modules/esm/utils');
 const packageJsonReader = require('internal/modules/package_json_reader');
-const internalFsBinding = internalBinding('fs');
+const {
+  legacyMainResolveExtensions,
+  legacyMainResolveExtensionsIndexes,
+  loaderMethods,
+} = require('internal/modules/helpers');
 
 /**
  * @typedef {import('internal/modules/esm/package_config.js').PackageConfig} PackageConfig
@@ -150,37 +150,6 @@ function emitLegacyIndexDeprecation(url, path, pkgPath, base, main) {
   }
 }
 
-const realpathCache = new SafeMap();
-
-const legacyMainResolveExtensions = [
-  '',
-  '.js',
-  '.json',
-  '.node',
-  '/index.js',
-  '/index.json',
-  '/index.node',
-  './index.js',
-  './index.json',
-  './index.node',
-];
-
-const legacyMainResolveExtensionsIndexes = {
-  // 0-6: when packageConfig.main is defined
-  kResolvedByMain: 0,
-  kResolvedByMainJs: 1,
-  kResolvedByMainJson: 2,
-  kResolvedByMainNode: 3,
-  kResolvedByMainIndexJs: 4,
-  kResolvedByMainIndexJson: 5,
-  kResolvedByMainIndexNode: 6,
-  // 7-9: when packageConfig.main is NOT defined,
-  //      or when the previous case didn't found the file
-  kResolvedByPackageAndJs: 7,
-  kResolvedByPackageAndJson: 8,
-  kResolvedByPackageAndNode: 9,
-};
-
 /**
  * Legacy CommonJS main resolution:
  * 1. let M = pkg_url + (json main field)
@@ -199,7 +168,7 @@ function legacyMainResolve(packageJSONUrl, packageConfig, base) {
 
   const baseStringified = isURL(base) ? base.href : base;
 
-  const resolvedOption = FSLegacyMainResolve(pkgPath, packageConfig.main, baseStringified);
+  const resolvedOption = loaderMethods.legacyMainResolve(pkgPath, packageConfig.main, baseStringified);
 
   const maybeMain = resolvedOption <= legacyMainResolveExtensionsIndexes.kResolvedByMainIndexNode ?
     packageConfig.main || './' : '';
@@ -245,7 +214,7 @@ function finalizeResolution(resolved, base, preserveSymlinks) {
     throw err;
   }
 
-  const stats = internalFsBinding.internalModuleStat(
+  const stats = loaderMethods.internalModuleStat(
     StringPrototypeEndsWith(path, '/') ? StringPrototypeSlice(path, -1) : path,
   );
 
@@ -278,9 +247,7 @@ function finalizeResolution(resolved, base, preserveSymlinks) {
     // behavior - DO NOT depend on the patchability in new code: Node.js
     // internals may stop going through the JavaScript fs module entirely.
     // Prefer module.registerHooks() or other more formal fs hooks released in the future.
-    const real = fs.realpathSync(path, {
-      [internalFS.realpathCacheKey]: realpathCache,
-    });
+    const real = loaderMethods.realpathSync(path);
     const { search, hash } = resolved;
     resolved =
         pathToFileURL(real + (StringPrototypeEndsWith(path, sep) ? '/' : ''));
diff --git a/lib/internal/modules/helpers.js b/lib/internal/modules/helpers.js
index dec084b291bb..83ead57520cc 100644
--- a/lib/internal/modules/helpers.js
+++ b/lib/internal/modules/helpers.js
@@ -3,15 +3,20 @@
 const {
   ArrayPrototypeForEach,
   ArrayPrototypePush,
+  MapPrototypeForEach,
+  MapPrototypeGet,
   ObjectDefineProperty,
   ObjectFreeze,
+  ObjectKeys,
   ObjectPrototypeHasOwnProperty,
+  ReflectApply,
   SafeMap,
   SafeSet,
   StringPrototypeCharCodeAt,
   StringPrototypeIncludes,
   StringPrototypeSlice,
   StringPrototypeStartsWith,
+  Symbol,
 } = primordials;
 const {
   ERR_INVALID_ARG_TYPE,
@@ -28,7 +33,7 @@ const { pathToFileURL, fileURLToPath, URL } = require('internal/url');
 const assert = require('internal/assert');
 
 const { getOptionValue } = require('internal/options');
-const { setOwnProperty, getLazy } = require('internal/util');
+const { kEmptyObject, setOwnProperty, getLazy } = require('internal/util');
 const { inspect } = require('internal/util/inspect');
 const { emitWarningSync } = require('internal/process/warning');
 const {
@@ -39,13 +44,15 @@ const {
 const lazyTmpdir = getLazy(() => require('os').tmpdir());
 const { join } = path;
 
+const internalFsBinding = internalBinding('fs');
 const { canParse: URLCanParse } = internalBinding('url');
+const modulesBinding = internalBinding('modules');
 const {
   enableCompileCache: _enableCompileCache,
   getCompileCacheDir: _getCompileCacheDir,
   compileCacheStatus: _compileCacheStatus,
   flushCompileCache,
-} = internalBinding('modules');
+} = modulesBinding;
 
 const lazyCJSLoader = getLazy(() => require('internal/modules/cjs/loader'));
 let debug = require('internal/util/debuglog').debuglog('module', (fn) => {
@@ -61,15 +68,128 @@ let debug = require('internal/util/debuglog').debuglog('module', (fn) => {
  * @type {Map<string, string>}
  */
 const realpathCache = new SafeMap();
+
+// Toggleable loader hooks for VFS support. Overrides that return
+// `undefined` fall through to the pinned native implementation.
+const nativeLoaderMethods = {
+  internalModuleStat: (filename) => internalFsBinding.internalModuleStat(filename),
+  readFileSync: (filename, options) => fs.readFileSync(filename, options),
+  realpathSync: (requestPath) => fs.realpathSync(requestPath, {
+    [internalFS.realpathCacheKey]: realpathCache,
+  }),
+  legacyMainResolve: (pkgPath, main, base) =>
+    internalFsBinding.legacyMainResolve(pkgPath, main, base),
+  getFormatOfExtensionlessFile: (filePath) =>
+    internalFsBinding.getFormatOfExtensionlessFile(filePath),
+  readPackageJSON: (jsonPath, isESM, base, specifier) =>
+    modulesBinding.readPackageJSON(jsonPath, isESM, base, specifier),
+  getNearestParentPackageJSON: (checkPath) =>
+    modulesBinding.getNearestParentPackageJSON(checkPath),
+  getPackageScopeConfig: (resolved) =>
+    modulesBinding.getPackageScopeConfig(resolved),
+  getPackageType: (url) => modulesBinding.getPackageType(url),
+  // Synthetic hook with no native counterpart: returns the directory at
+  // which upward walks (node_modules lookups) must stop for `path`, or
+  // undefined to walk to the file system root.
+  getResolutionRoot: () => undefined,
+};
+const loaderMethodKeys = ObjectKeys(nativeLoaderMethods);
+// Overrides use this sentinel when they handled a request but their method's
+// meaningful result is `undefined`. A plain `undefined` means fall through to
+// the native implementation.
+const kLoaderOverrideNoResult = Symbol('kLoaderOverrideNoResult');
+const loaderOverrides = new SafeMap();
+let hasLoaderOverrides = false;
+
 /**
- * Resolves the path of a given `require` specifier, following symlinks.
- * @param {string} requestPath The `require` specifier
- * @returns {string}
+ * @param {string} key Name of the wrapped method in `nativeLoaderMethods`.
+ * @param {Function} originalFn Native fallback pinned at load time.
+ * @returns {Function} Wrapper that consults `loaderOverrides` and falls
+ *   through to `originalFn` when no override is set or when the
+ *   override returns `undefined`.
  */
-function toRealPath(requestPath) {
-  return fs.realpathSync(requestPath, {
-    [internalFS.realpathCacheKey]: realpathCache,
-  });
+function wrapLoaderMethod(key, originalFn) {
+  return function loaderMethodWrapper(...args) {
+    if (hasLoaderOverrides) {
+      const override = MapPrototypeGet(loaderOverrides, key);
+      if (override !== undefined) {
+        const result = ReflectApply(override, undefined, args);
+        if (result === kLoaderOverrideNoResult) { return undefined; }
+        if (result !== undefined) { return result; }
+      }
+    }
+    return ReflectApply(originalFn, undefined, args);
+  };
+}
+
+/**
+ * Toggleable versions of the loader's fs and package.json methods, keyed
+ * like `nativeLoaderMethods`. The module loader calls these instead of the
+ * native implementations so that VFS overrides can be consulted first.
+ */
+const loaderMethods = { __proto__: null };
+for (let i = 0; i < loaderMethodKeys.length; i++) {
+  const key = loaderMethodKeys[i];
+  loaderMethods[key] = wrapLoaderMethod(key, nativeLoaderMethods[key]);
+}
+
+/**
+ * Set override functions for the module loader's fs and package.json
+ * operations. Fields are keyed like `nativeLoaderMethods`; missing or
+ * nullish fields disable that hook (fast-path restored).
+ * @param {Record<string, Function|undefined>} overrides
+ */
+function setLoaderOverrides(overrides = kEmptyObject) {
+  for (let i = 0; i < loaderMethodKeys.length; i++) {
+    const key = loaderMethodKeys[i];
+    const override = overrides[key];
+    if (override) {
+      loaderOverrides.set(key, override);
+    } else {
+      loaderOverrides.delete(key);
+    }
+  }
+  hasLoaderOverrides = loaderOverrides.size > 0;
+}
+
+/**
+ * Delete every entry in `cache` whose owned string is under
+ * `mountPoint`. `cache` is either a plain object (Module._cache,
+ * Module._pathCache) or a SafeMap (statCache, realpathCache,
+ * the package.json caches). By default the entry KEY is tested;
+ * pass `byValue: true` to test the entry value instead (used for
+ * Module._pathCache whose keys are `request\0parent` tokens and
+ * whose values are the resolved filenames).
+ *
+ * Mount points live in the reserved VFS namespace so a prefix scan
+ * on strings is exact - real-fs entries never match.
+ * @param {object|Map<string, *>} cache
+ * @param {string} mountPoint Absolute mount-point path
+ * @param {boolean} [byValue] Test the entry value instead of the key
+ */
+function cleanForVfsPrefix(cache, mountPoint, byValue = false) {
+  const prefix = mountPoint + path.sep;
+  const owns = (s) =>
+    typeof s === 'string' &&
+    (s === mountPoint || StringPrototypeStartsWith(s, prefix));
+  if (typeof cache.forEach === 'function') {
+    MapPrototypeForEach(cache, (v, k) => {
+      if (owns(byValue ? v : k)) { cache.delete(k); }
+    });
+  } else {
+    ArrayPrototypeForEach(ObjectKeys(cache), (k) => {
+      if (owns(byValue ? cache[k] : k)) { delete cache[k]; }
+    });
+  }
+}
+
+/**
+ * Drop realpath-cache entries under an unmounted VFS mount point.
+ * Called by internal/vfs/setup.js.
+ * @param {string} mountPoint Absolute mount-point path
+ */
+function purgeRealpathCacheForPrefix(mountPoint) {
+  cleanForVfsPrefix(realpathCache, mountPoint);
 }
 
 /** @type {Set<string>} */
@@ -446,8 +566,6 @@ function assertBufferSource(body, allowString, hookName) {
   );
 }
 
-let DECODER = null;
-
 /**
  * Converts a buffer or buffer-like object to a string.
  * @param {string | ArrayBuffer | ArrayBufferView} body - The buffer or buffer-like object to convert to a string.
@@ -456,9 +574,7 @@ let DECODER = null;
 function stringify(body) {
   if (typeof body === 'string') { return body; }
   assertBufferSource(body, false, 'load');
-  const { TextDecoder } = require('internal/encoding');
-  DECODER = DECODER === null ? new TextDecoder() : DECODER;
-  return DECODER.decode(body);
+  return require('internal/encoding').getUtf8Decoder().decode(body);
 }
 
 /**
@@ -536,9 +652,41 @@ function getRequireStack(parent) {
   return requireStack;
 }
 
+// Suffixes tried by legacy CommonJS `main` resolution; indexes match
+// the values returned by the `legacyMainResolve` C++ binding.
+const legacyMainResolveExtensions = [
+  '',
+  '.js',
+  '.json',
+  '.node',
+  '/index.js',
+  '/index.json',
+  '/index.node',
+  './index.js',
+  './index.json',
+  './index.node',
+];
+
+const legacyMainResolveExtensionsIndexes = {
+  // 0-6: when packageConfig.main is defined
+  kResolvedByMain: 0,
+  kResolvedByMainJs: 1,
+  kResolvedByMainJson: 2,
+  kResolvedByMainNode: 3,
+  kResolvedByMainIndexJs: 4,
+  kResolvedByMainIndexJson: 5,
+  kResolvedByMainIndexNode: 6,
+  // 7-9: when packageConfig.main is not defined
+  kResolvedByPackageAndJs: 7,
+  kResolvedByPackageAndJson: 8,
+  kResolvedByPackageAndNode: 9,
+};
+
 module.exports = {
   addBuiltinLibsToObject,
   assertBufferSource,
+  cleanForVfsPrefix,
+  purgeRealpathCacheForPrefix,
   constants,
   enableCompileCache,
   flushCompileCache,
@@ -547,13 +695,17 @@ module.exports = {
   getCjsConditionsArray,
   getCompileCacheDir,
   initializeCjsConditions,
+  legacyMainResolveExtensions,
+  legacyMainResolveExtensionsIndexes,
+  kLoaderOverrideNoResult,
+  loaderMethods,
   loadBuiltinModuleForEmbedder,
   loadBuiltinModule,
   makeRequireFunction,
   normalizeReferrerURL,
+  setLoaderOverrides,
   stringify,
   stripBOM,
-  toRealPath,
   hasStartedUserCJSExecution() {
     return _hasStartedUserCJSExecution;
   },
diff --git a/lib/internal/modules/package_json_reader.js b/lib/internal/modules/package_json_reader.js
index c33cf166f53b..ea6b7d26395e 100644
--- a/lib/internal/modules/package_json_reader.js
+++ b/lib/internal/modules/package_json_reader.js
@@ -8,6 +8,7 @@ const {
   SafeMap,
   StringPrototypeIndexOf,
   StringPrototypeSlice,
+  StringPrototypeStartsWith,
 } = primordials;
 const {
   fileURLToPath,
@@ -25,10 +26,12 @@ const {
 } = require('internal/errors');
 const { kEmptyObject, isWindows } = require('internal/util');
 const permission = require('internal/process/permission');
-const modulesBinding = internalBinding('modules');
 const path = require('path');
 const { validateString } = require('internal/validators');
-const internalFsBinding = internalBinding('fs');
+const {
+  cleanForVfsPrefix,
+  loaderMethods,
+} = require('internal/modules/helpers');
 
 
 /**
@@ -123,7 +126,7 @@ const requiresJSONParse = (value) => (value !== undefined && (value[0] === '[' |
 function read(jsonPath, { base, specifier, isESM } = kEmptyObject) {
   // This function will be called by both CJS and ESM, so we need to make sure
   // non-null attributes are converted to strings.
-  const parsed = modulesBinding.readPackageJSON(
+  const parsed = loaderMethods.readPackageJSON(
     jsonPath,
     isESM,
     base == null ? undefined : `${base}`,
@@ -194,7 +197,7 @@ function getNearestParentPackageJSON(checkPath) {
   const key = permissionEnabled ? checkPath : getTraversalStartDirectory(checkPath);
   let parentPackageJSONPath = cache.get(key);
   if (parentPackageJSONPath === undefined) {
-    const result = modulesBinding.getNearestParentPackageJSON(checkPath);
+    const result = loaderMethods.getNearestParentPackageJSON(checkPath);
     if (result === undefined) {
       parentPackageJSONPath = null;
     } else {
@@ -220,7 +223,7 @@ function getNearestParentPackageJSON(checkPath) {
  * @returns {import('typings/internalBinding/modules').PackageConfig} - The package configuration.
  */
 function getPackageScopeConfig(resolved) {
-  const result = modulesBinding.getPackageScopeConfig(`${resolved}`);
+  const result = loaderMethods.getPackageScopeConfig(`${resolved}`);
 
   if (ArrayIsArray(result)) {
     const { data, exists, path } = deserializePackageJSON(`${resolved}`, result);
@@ -249,7 +252,7 @@ function getPackageScopeConfig(resolved) {
  * @returns {string}
  */
 function getPackageType(url) {
-  const type = modulesBinding.getPackageType(`${url}`);
+  const type = loaderMethods.getPackageType(`${url}`);
   return type ?? 'none';
 }
 
@@ -308,9 +311,14 @@ function getPackageJSONURL(specifier, base) {
 
   let packageJSONUrl = new URL(`./node_modules/${packageName}/package.json`, base);
   let packageJSONPath = fileURLToPath(packageJSONUrl);
+  // The walk stops at the resolution root (e.g. a VFS mount point)
+  // instead of continuing to the file system root.
+  const resolutionRoot = loaderMethods.getResolutionRoot(packageJSONPath);
+  const resolutionRootPrefix =
+    resolutionRoot === undefined ? undefined : resolutionRoot + path.sep;
   let lastPath;
   do {
-    const stat = internalFsBinding.internalModuleStat(
+    const stat = loaderMethods.internalModuleStat(
       StringPrototypeSlice(packageJSONPath, 0, packageJSONPath.length - 13),
     );
     // Check for !stat.isDirectory()
@@ -321,6 +329,10 @@ function getPackageJSONURL(specifier, base) {
         packageJSONUrl,
       );
       packageJSONPath = fileURLToPath(packageJSONUrl);
+      if (resolutionRootPrefix !== undefined &&
+          !StringPrototypeStartsWith(packageJSONPath, resolutionRootPrefix)) {
+        break;
+      }
       continue;
     }
 
@@ -383,6 +395,20 @@ function findPackageJSON(specifier, base = 'data:') {
   return pkg?.path;
 }
 
+/**
+ * Drop package.json-cache entries under an unmounted VFS mount point.
+ * Called by internal/vfs/setup.js. A module path and its owning
+ * package.json path always live in the same mount (the pjson search
+ * walks up from the module and stops at the mount root), so a single
+ * key test on each map is exact.
+ * @param {string} mountPoint Absolute mount-point path
+ */
+function purgePackageJSONCacheForPrefix(mountPoint) {
+  cleanForVfsPrefix(directoryToParentPackageJSONPathCache, mountPoint);
+  cleanForVfsPrefix(moduleToParentPackageJSONCache, mountPoint);
+  cleanForVfsPrefix(deserializedPackageJSONCache, mountPoint);
+}
+
 module.exports = {
   read,
   getNearestParentPackageJSON,
@@ -390,4 +416,5 @@ module.exports = {
   getPackageType,
   getPackageJSONURL,
   findPackageJSON,
+  purgePackageJSONCacheForPrefix,
 };
diff --git a/lib/internal/modules/run_main.js b/lib/internal/modules/run_main.js
index 2974459755ec..50ae8c281b02 100644
--- a/lib/internal/modules/run_main.js
+++ b/lib/internal/modules/run_main.js
@@ -37,8 +37,8 @@ function resolveMainPath(main) {
 
   const preserveSymlinksMain = getOptionValue('--preserve-symlinks-main');
   if (!preserveSymlinksMain) {
-    const { toRealPath } = require('internal/modules/helpers');
-    mainPath = toRealPath(mainPath);
+    const { loaderMethods } = require('internal/modules/helpers');
+    mainPath = loaderMethods.realpathSync(mainPath);
   }
 
   return mainPath;
diff --git a/lib/internal/navigator.js b/lib/internal/navigator.js
index d8681c899904..35d2c8266502 100644
--- a/lib/internal/navigator.js
+++ b/lib/internal/navigator.js
@@ -159,6 +159,7 @@ ObjectDefineProperties(Navigator.prototype, {
 
 module.exports = {
   getNavigatorPlatform,
+  kInitialize,
   navigator: new Navigator(kInitialize),
   Navigator,
 };
diff --git a/lib/internal/net.js b/lib/internal/net.js
index cea3dda23d61..2553449f0505 100644
--- a/lib/internal/net.js
+++ b/lib/internal/net.js
@@ -94,7 +94,9 @@ function isLoopback(host) {
     hostLower === 'localhost' ||
     hostLower.startsWith('127.') ||
     hostLower === '[::1]' ||
-    hostLower === '[0:0:0:0:0:0:0:1]'
+    hostLower === '::1' ||
+    hostLower === '[0:0:0:0:0:0:0:1]' ||
+    hostLower === '0:0:0:0:0:0:0:1'
   );
 }
 
diff --git a/lib/internal/per_context/primordials.js b/lib/internal/per_context/primordials.js
index 49576c2d9497..2e610f4ab508 100644
--- a/lib/internal/per_context/primordials.js
+++ b/lib/internal/per_context/primordials.js
@@ -196,6 +196,7 @@ function copyPrototype(src, dest, prefix) {
   'Error',
   'EvalError',
   'FinalizationRegistry',
+  'Float16Array',
   'Float32Array',
   'Float64Array',
   'Function',
diff --git a/lib/internal/perf/resource_timing.js b/lib/internal/perf/resource_timing.js
index f8459efa48e3..6b8f0d2aa524 100644
--- a/lib/internal/perf/resource_timing.js
+++ b/lib/internal/perf/resource_timing.js
@@ -17,6 +17,7 @@ const { enqueue, bufferResourceTiming } = require('internal/perf/observe');
 const { validateThisInternalField } = require('internal/validators');
 const { kEnumerableProperty } = require('internal/util');
 
+const kBodyInfo = Symbol('kBodyInfo');
 const kCacheMode = Symbol('kCacheMode');
 const kRequestedUrl = Symbol('kRequestedUrl');
 const kTimingInfo = Symbol('kTimingInfo');
@@ -110,11 +111,22 @@ class PerformanceResourceTiming extends PerformanceEntry {
     return this[kTimingInfo].finalNetworkRequestStartTime;
   }
 
-  get responseStart() {
+  get finalResponseHeadersStart() {
     validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
     return this[kTimingInfo].finalNetworkResponseStartTime;
   }
 
+  get firstInterimResponseStart() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kTimingInfo].firstInterimNetworkResponseStartTime ?? 0;
+  }
+
+  get responseStart() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kTimingInfo].firstInterimNetworkResponseStartTime ||
+      this[kTimingInfo].finalNetworkResponseStartTime;
+  }
+
   get responseEnd() {
     validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
     return this[kTimingInfo].endTime;
@@ -148,6 +160,22 @@ class PerformanceResourceTiming extends PerformanceEntry {
     return this[kResponseStatus];
   }
 
+  get renderBlockingStatus() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kTimingInfo].renderBlocking === true ?
+      'blocking' : 'non-blocking';
+  }
+
+  get contentType() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kBodyInfo]?.contentType ?? '';
+  }
+
+  get contentEncoding() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kBodyInfo]?.contentEncoding ?? '';
+  }
+
   toJSON() {
     validateThisInternalField(this, kInitiatorType, 'PerformanceResourceTiming');
     return {
@@ -167,6 +195,8 @@ class PerformanceResourceTiming extends PerformanceEntry {
       connectEnd: this.connectEnd,
       secureConnectionStart: this.secureConnectionStart,
       requestStart: this.requestStart,
+      finalResponseHeadersStart: this.finalResponseHeadersStart,
+      firstInterimResponseStart: this.firstInterimResponseStart,
       responseStart: this.responseStart,
       responseEnd: this.responseEnd,
       transferSize: this.transferSize,
@@ -174,6 +204,9 @@ class PerformanceResourceTiming extends PerformanceEntry {
       decodedBodySize: this.decodedBodySize,
       deliveryType: this.deliveryType,
       responseStatus: this.responseStatus,
+      renderBlockingStatus: this.renderBlockingStatus,
+      contentType: this.contentType,
+      contentEncoding: this.contentEncoding,
     };
   }
 }
@@ -191,6 +224,8 @@ ObjectDefineProperties(PerformanceResourceTiming.prototype, {
   connectEnd: kEnumerableProperty,
   secureConnectionStart: kEnumerableProperty,
   requestStart: kEnumerableProperty,
+  finalResponseHeadersStart: kEnumerableProperty,
+  firstInterimResponseStart: kEnumerableProperty,
   responseStart: kEnumerableProperty,
   responseEnd: kEnumerableProperty,
   transferSize: kEnumerableProperty,
@@ -198,6 +233,9 @@ ObjectDefineProperties(PerformanceResourceTiming.prototype, {
   decodedBodySize: kEnumerableProperty,
   deliveryType: kEnumerableProperty,
   responseStatus: kEnumerableProperty,
+  renderBlockingStatus: kEnumerableProperty,
+  contentType: kEnumerableProperty,
+  contentEncoding: kEnumerableProperty,
   toJSON: kEnumerableProperty,
   [SymbolToStringTag]: {
     __proto__: null,
@@ -224,6 +262,7 @@ function createPerformanceResourceTiming(
   // The spec doesn't say to validate it in the class construction.
   resourceTiming[kTimingInfo] = timingInfo;
   resourceTiming[kCacheMode] = cacheMode;
+  resourceTiming[kBodyInfo] = bodyInfo;
   resourceTiming[kDeliveryType] = deliveryType;
   resourceTiming[kResponseStatus] = responseStatus;
 
diff --git a/lib/internal/process/per_thread.js b/lib/internal/process/per_thread.js
index 86a5e8080974..6f43502a0c6c 100644
--- a/lib/internal/process/per_thread.js
+++ b/lib/internal/process/per_thread.js
@@ -392,6 +392,9 @@ function buildAllowedFlags() {
 
   const allowedNodeEnvironmentFlags = [];
   for (const { 0: name, 1: info } of options) {
+    // Bracketed options are internal parser targets. They can be allowed in
+    // NODE_OPTIONS so aliases expand to them, but are not public flags.
+    if (name[0] === '[') continue;
     if (info.envVarSettings === kAllowedInEnvvar) {
       ArrayPrototypePush(allowedNodeEnvironmentFlags, name);
       if (info.type === kBoolean) {
diff --git a/lib/internal/process/permission.js b/lib/internal/process/permission.js
index 8dd92b1709b2..acfbab036bbb 100644
--- a/lib/internal/process/permission.js
+++ b/lib/internal/process/permission.js
@@ -3,17 +3,44 @@
 const {
   ArrayPrototypePush,
   ObjectFreeze,
+  StringPrototypeStartsWith,
 } = primordials;
 
 const permission = internalBinding('permission');
-const { validateString, validateBuffer } = require('internal/validators');
-const { Buffer } = require('buffer');
-const { isBuffer } = Buffer;
+const { validateString } = require('internal/validators');
+const { isUint8Array } = require('internal/util/types');
+const { isURL, fileURLToPath } = require('internal/url');
 
 let _permission;
 let _audit;
 let _ffi;
 
+function normalizeReference(scope, reference, name) {
+  if (reference == null) {
+    return reference;
+  }
+
+  if (isURL(reference)) {
+    // Reference is only meaningful for fs.* scopes (FSPermission does
+    // per-path checks); every other scope ignores it (BooleanPermission),
+    // so only fs.* scopes require a file: URL.
+    if (StringPrototypeStartsWith(scope, 'fs')) {
+      return fileURLToPath(reference);
+    }
+    return reference.href;
+  }
+
+  if (isUint8Array(reference)) {
+    // Passed through as-is: the native binding copies the raw bytes
+    // directly instead of forcing a (potentially lossy) UTF-8 string
+    // conversion, since paths are not guaranteed to be valid UTF-8.
+    return reference;
+  }
+
+  validateString(reference, name);
+  return reference;
+}
+
 module.exports = ObjectFreeze({
   __proto__: null,
   isEnabled() {
@@ -32,28 +59,11 @@ module.exports = ObjectFreeze({
   },
   has(scope, reference) {
     validateString(scope, 'scope');
-    if (reference != null) {
-      // TODO: add support for WHATWG URLs and Uint8Arrays.
-      if (isBuffer(reference)) {
-        validateBuffer(reference, 'reference');
-      } else {
-        validateString(reference, 'reference');
-      }
-    }
-
-    return permission.has(scope, reference);
+    return permission.has(scope, normalizeReference(scope, reference, 'reference'));
   },
   drop(scope, reference) {
     validateString(scope, 'scope');
-    if (reference != null) {
-      if (isBuffer(reference)) {
-        validateBuffer(reference, 'reference');
-      } else {
-        validateString(reference, 'reference');
-      }
-    }
-
-    permission.drop(scope, reference);
+    permission.drop(scope, normalizeReference(scope, reference, 'reference'));
   },
   availableFlags() {
     if (_ffi === undefined) {
diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
index 59c63d59ed64..5275f95e6af7 100644
--- a/lib/internal/process/pre_execution.js
+++ b/lib/internal/process/pre_execution.js
@@ -114,12 +114,15 @@ function prepareExecution(options) {
   setupNetworkInspection();
   setupNavigator();
   setupWarningHandler();
+  setupBench();
   setupFFI();
   setupSQLite();
   setupStreamIter();
+  setupDTLS();
   setupVfs();
   setupQuic();
   setupWebStorage();
+  removeWebWorkersIfDisabled();
   setupWebsocket();
   setupEventsource();
   setupCodeCoverage();
@@ -127,7 +130,7 @@ function prepareExecution(options) {
   // Process initial diagnostic reporting configuration, if present.
   initializeReport();
 
-  setupDiagnosticsChannel();
+  setupDiagnosticsChannel(isMainThread);
 
   // Load permission system API
   initializePermission();
@@ -162,14 +165,12 @@ function prepareExecution(options) {
     // channel. This needs to be done before any user code gets executed
     // (including preload modules).
     initializeClusterIPC();
-
-    // TODO(joyeecheung): do this for worker threads as well.
-    runDeserializeCallbacks();
   } else {
     assert(!internalBinding('worker').isMainThread);
     // The setup should be called in LOAD_SCRIPT message handler.
     assert(!initializeModules);
   }
+  runDeserializeCallbacks();
 
   const { initializeExtensionFormatMap } = require('internal/modules/esm/get_format');
   initializeExtensionFormatMap();
@@ -364,6 +365,13 @@ function setupWebsocket() {
   }
 }
 
+// https://html.spec.whatwg.org/multipage/workers.html
+function removeWebWorkersIfDisabled() {
+  if (!getOptionValue('--experimental-web-worker')) {
+    delete globalThis.Worker;
+  }
+}
+
 // https://html.spec.whatwg.org/multipage/server-sent-events.html
 function setupEventsource() {
   if (!getOptionValue('--experimental-eventsource')) {
@@ -384,6 +392,16 @@ function setupNavigator() {
   defineReplaceableLazyAttribute(globalThis, 'internal/navigator', ['navigator'], false);
 }
 
+function setupBench() {
+  if (!getOptionValue('--experimental-bench')) {
+    return;
+  }
+
+  const { BuiltinModule } = require('internal/bootstrap/realm');
+  BuiltinModule.allowRequireByUsers('bench');
+  BuiltinModule.allowRequireByUsers('bench/reporters');
+}
+
 function setupFFI() {
   if (!getOptionValue('--experimental-ffi')) {
     return;
@@ -418,6 +436,15 @@ function setupStreamIter() {
   BuiltinModule.allowRequireByUsers('zlib/iter');
 }
 
+function setupDTLS() {
+  if (!getOptionValue('--experimental-dtls')) {
+    return;
+  }
+
+  const { BuiltinModule } = require('internal/bootstrap/realm');
+  BuiltinModule.allowRequireByUsers('dtls');
+}
+
 function setupQuic() {
   if (!getOptionValue('--experimental-quic')) {
     return;
@@ -659,7 +686,7 @@ function initializeClusterIPC() {
   }
 }
 
-function setupDiagnosticsChannel() {
+function setupDiagnosticsChannel(isMainThread) {
   // Re-link native channels after snapshot deserialization since
   // JS references are cleared during serialization.
   // Keep this callback in sync with the initial registration in
@@ -674,6 +701,11 @@ function setupDiagnosticsChannel() {
       (channel._stores?.size || 0);
     return channel;
   });
+  if (isMainThread &&
+      process.versions.openssl !== undefined &&
+      getOptionValue('--enable-fips-indicator-events')) {
+    internalBinding('crypto').setupFipsIndicatorChannel();
+  }
 }
 
 function initializePermission() {
diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
index 11152f070add..8ecd5fc776a3 100644
--- a/lib/internal/quic/quic.js
+++ b/lib/internal/quic/quic.js
@@ -138,8 +138,9 @@ const {
 } = require('internal/streams/iter/types');
 
 const {
-  toUint8Array,
   convertChunks,
+  getWriterSignal,
+  toWriterUint8Array,
 } = require('internal/streams/iter/utils');
 
 const {
@@ -164,7 +165,6 @@ const {
 } = require('internal/fs/promises');
 
 const {
-  validateAbortSignal,
   validateBoolean,
   validateFunction,
   validateInteger,
@@ -2197,7 +2197,7 @@ class QuicStream {
     // signals backpressure additional writes are rejected until the buffer has
     // capacity again.
 
-    function writeSync(chunk) {
+    function writeConvertedSync(chunk) {
       // If the stream is closed, errored, or write-ended, we cannot accept
       // more data. Refuse the sync write.
       // If a drain is already pending, another operation is waiting
@@ -2205,7 +2205,6 @@ class QuicStream {
       if (closed || errored || stream.#inner.state.writeEnded || drainWakeup != null) {
         return false;
       }
-      chunk = toUint8Array(chunk);
       const len = TypedArrayPrototypeGetByteLength(chunk);
       if (len === 0) return true;
       // Refuse the write only when there is no available capacity at
@@ -2223,13 +2222,18 @@ class QuicStream {
       return true;
     }
 
-    async function write(chunk, options = kEmptyObject) {
-      validateObject(options, 'options');
-      const { signal } = options;
-      if (signal !== undefined) {
-        validateAbortSignal(signal, 'options.signal');
-        signal.throwIfAborted();
-      }
+    function writeSync(chunk) {
+      return writeConvertedSync(toWriterUint8Array(chunk));
+    }
+
+    function write(chunk, options = kEmptyObject) {
+      chunk = toWriterUint8Array(chunk);
+      const signal = getWriterSignal(options);
+      return writeAsync(chunk, signal);
+    }
+
+    async function writeAsync(chunk, signal) {
+      signal?.throwIfAborted();
       if (errored) throw error;
       if (closed || stream.#inner.state.writeEnded) {
         throw new ERR_INVALID_STATE('Writer is closed');
@@ -2242,16 +2246,15 @@ class QuicStream {
         throw new ERR_INVALID_STATE('Stream write buffer is full');
       }
 
-      if (!writeSync(chunk)) {
+      if (!writeConvertedSync(chunk)) {
         throw new ERR_INVALID_STATE('Stream write buffer is full');
       }
     }
 
-    function writevSync(chunks) {
+    function writevConvertedSync(chunks) {
       if (closed || errored || stream.#inner.state.writeEnded || drainWakeup != null) {
         return false;
       }
-      chunks = convertChunks(chunks);
       let len = 0;
       for (const c of chunks) len += TypedArrayPrototypeGetByteLength(c);
       if (len === 0) return true;
@@ -2262,13 +2265,18 @@ class QuicStream {
       return true;
     }
 
-    async function writev(chunks, options = kEmptyObject) {
-      validateObject(options, 'options');
-      const { signal } = options;
-      if (signal !== undefined) {
-        validateAbortSignal(signal, 'options.signal');
-        signal.throwIfAborted();
-      }
+    function writevSync(chunks) {
+      return writevConvertedSync(convertChunks(chunks));
+    }
+
+    function writev(chunks, options = kEmptyObject) {
+      chunks = convertChunks(chunks);
+      const signal = getWriterSignal(options);
+      return writevAsync(chunks, signal);
+    }
+
+    async function writevAsync(chunks, signal) {
+      signal?.throwIfAborted();
 
       if (errored) throw error;
       if (closed || stream.#inner.state.writeEnded) {
@@ -2283,7 +2291,7 @@ class QuicStream {
         throw new ERR_INVALID_STATE('Stream write buffer is full');
       }
 
-      if (!writevSync(chunks)) {
+      if (!writevConvertedSync(chunks)) {
         throw new ERR_INVALID_STATE('Stream write buffer is full');
       }
     }
@@ -2308,11 +2316,13 @@ class QuicStream {
       return totalBytesWritten;
     }
 
-    async function end(options = kEmptyObject) {
-      validateObject(options, 'options');
-      const { signal } = options;
+    function end(options = kEmptyObject) {
+      const signal = getWriterSignal(options);
+      return endAsync(signal);
+    }
+
+    async function endAsync(signal) {
       if (signal !== undefined) {
-        validateAbortSignal(signal, 'options.signal');
         signal.throwIfAborted();
         // TODO(@jasnell): The stream/iter spec allows individual sync end
         // calls to be canceled via an AbortSignal. We currently do not support
@@ -5144,6 +5154,12 @@ function processTlsOptions(tls, forServer) {
     if (!forServer) {
       validateString(alpn, 'options.alpn');
     }
+    // QUIC has no default application protocol: a server that offers none
+    // cannot complete a handshake with anyone.
+    if (protocols.length === 0) {
+      throw new ERR_INVALID_ARG_VALUE('options.alpn', alpn,
+                                      'must offer at least one protocol');
+    }
     let totalLen = 0;
     for (let i = 0; i < protocols.length; i++) {
       validateString(protocols[i], `options.alpn[${i}]`);
diff --git a/lib/internal/source_map/source_map_cache.js b/lib/internal/source_map/source_map_cache.js
index 95b09090c473..e1fa55c5caba 100644
--- a/lib/internal/source_map/source_map_cache.js
+++ b/lib/internal/source_map/source_map_cache.js
@@ -9,6 +9,7 @@ const {
   RegExpPrototypeSymbolSplit,
   SafeMap,
   StringPrototypeCodePointAt,
+  StringPrototypeIndexOf,
   StringPrototypeSplit,
   StringPrototypeStartsWith,
 } = primordials;
@@ -176,16 +177,14 @@ function maybeCacheSourceMap(filename, content, moduleInstance, isGeneratedSourc
   // Normalize the sourceURL to a file URL if it is a path.
   sourceURL = normalizeReferrerURL(sourceURL);
 
-  const data = dataFromUrl(filename, sourceMapURL);
-  // `data` could be null if the source map is invalid.
-  // In this case, create a cache entry with null data with source url for test coverage.
-
+  // The payload is resolved on first use (see sourceMapData()), except under
+  // coverage, where it is serialized at exit when no more JS may run.
   const entry = {
     __proto__: null,
     lineLengths: lineLengths(content),
-    data,
-    // Save the source map url if it is not a data url.
-    sourceMapURL: data ? null : sourceMapURL,
+    data: process.env.NODE_V8_COVERAGE ? dataFromUrl(filename, sourceMapURL) : undefined,
+    filename,
+    sourceMapURL,
     sourceURL,
   };
 
@@ -254,20 +253,36 @@ function dataFromUrl(sourceURL, sourceMappingURL) {
   return sourceMapFromFile(mapURL);
 }
 
+const kUnicodeLineTerminators = /[\u2028\u2029]/;
+
 // Cache the length of each line in the file that a source map was extracted
 // from. This allows translation from byte offset V8 coverage reports,
 // to line/column offset Source Map V3.
 function lineLengths(content) {
+  if (RegExpPrototypeExec(kUnicodeLineTerminators, content) !== null) {
+    return lineLengthsWithUnicodeTerminators(content);
+  }
+  // We purposefully keep \r as part of the line-length calculation, in
+  // cases where there is a \r\n separator, so that this can be taken into
+  // account in coverage calculations.
+  const output = [];
+  let lineStart = 0;
+  let lineEnd;
+  while ((lineEnd = StringPrototypeIndexOf(content, '\n', lineStart)) !== -1) {
+    ArrayPrototypePush(output, lineEnd - lineStart);
+    lineStart = lineEnd + 1;
+  }
+  ArrayPrototypePush(output, content.length - lineStart);
+  return output;
+}
+
+function lineLengthsWithUnicodeTerminators(content) {
   const contentLength = content.length;
   const output = [];
   let lineLength = 0;
   for (let i = 0; i < contentLength; i++, lineLength++) {
     const codePoint = StringPrototypeCodePointAt(content, i);
-
-    // We purposefully keep \r as part of the line-length calculation, in
-    // cases where there is a \r\n separator, so that this can be taken into
-    // account in coverage calculations.
-    // codepoints for \n (new line), \u2028 (line separator) and \u2029 (paragraph separator)
+    // \n (new line), \u2028 (line separator) and \u2029 (paragraph separator)
     if (codePoint === 10 || codePoint === 0x2028 || codePoint === 0x2029) {
       ArrayPrototypePush(output, lineLength);
       lineLength = -1; // To not count the matched codePoint such as \n character
@@ -351,16 +366,31 @@ function sourceMapCacheToObject() {
 
   const obj = { __proto__: null };
   for (const { 0: k, 1: v } of moduleSourceMapCache) {
+    const data = v.data ?? null;
     obj[k] = {
       __proto__: null,
       lineLengths: v.lineLengths,
-      data: v.data,
-      url: v.sourceMapURL,
+      data,
+      // Save the source map url if it is not a data url.
+      url: data ? null : v.sourceMapURL,
     };
   }
   return obj;
 }
 
+/**
+ * Resolve and parse the payload of a cache entry the first time it is needed;
+ * `null` marks a source map that could not be loaded.
+ * @param {object} entry
+ * @returns {object|null}
+ */
+function sourceMapData(entry) {
+  if (entry.data === undefined) {
+    entry.data = dataFromUrl(entry.filename, entry.sourceMapURL);
+  }
+  return entry.data;
+}
+
 /**
  * Find a source map for a given actual source URL or path.
  *
@@ -390,7 +420,7 @@ function findSourceMap(sourceURL) {
       sourceURL = pathToFileURL(sourceURL).href;
     }
     const entry = getModuleSourceMapCache().get(sourceURL) ?? generatedSourceMapCache.get(sourceURL);
-    if (entry?.data == null) {
+    if (entry === undefined || sourceMapData(entry) === null) {
       return undefined;
     }
 
diff --git a/lib/internal/streams/fast-utf8-stream.js b/lib/internal/streams/fast-utf8-stream.js
index 51d80bbe5e74..8a1b6185e828 100644
--- a/lib/internal/streams/fast-utf8-stream.js
+++ b/lib/internal/streams/fast-utf8-stream.js
@@ -500,7 +500,9 @@ class Utf8Stream extends EventEmitter {
       // start
       if ((!this.#writing && this.#len > this.#minLength) || this.#flushPending) {
         this.#actualWrite();
-      } else if (reopening) {
+      } else if (reopening && !this.#writing) {
+        // Do not emit 'drain' if a 'ready' listener started a write:
+        // #release() will emit the real 'drain' when that write completes.
         process.nextTick(() => this.emit('drain'));
       }
     };
diff --git a/lib/internal/streams/iter/broadcast.js b/lib/internal/streams/iter/broadcast.js
index 0674d4d57037..16cb4c06533c 100644
--- a/lib/internal/streams/iter/broadcast.js
+++ b/lib/internal/streams/iter/broadcast.js
@@ -21,7 +21,6 @@ const {
   SymbolAsyncDispose,
   SymbolAsyncIterator,
   SymbolDispose,
-  TypedArrayPrototypeGetByteLength,
 } = primordials;
 
 const { lazyDOMException } = require('internal/util');
@@ -34,10 +33,7 @@ const {
   },
 } = require('internal/errors');
 const {
-  validateAbortSignal,
-  validateArray,
   validateInteger,
-  validateObject,
 } = require('internal/validators');
 
 const {
@@ -52,22 +48,26 @@ const {
 } = require('internal/streams/iter/from');
 
 const {
-  pull: pullWithTransforms,
+  pullWithConsumerCleanup,
 } = require('internal/streams/iter/pull');
 
 const {
   kMultiConsumerDefaultBudget,
   kResolvedPromise,
   convertChunks,
+  createBatchEntry,
   getWriterSignal,
   getMinCursor,
   hasProtocol,
   onSignalAbort,
   parsePullArgs,
   wrapError,
-  toUint8Array,
-  validateBackpressure,
+  toWriterUint8Array,
+  validateBatchEntry,
 } = require('internal/streams/iter/utils');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
   RingBuffer,
@@ -134,9 +134,13 @@ class BroadcastImpl {
   }
 
   push(...args) {
-    const { transforms, options } = parsePullArgs(args);
-    const signal = options?.signal;
-    validateAbortSignal(signal, 'options.signal');
+    const parsed = parsePullArgs(args);
+    const { transforms } = parsed;
+    const options = converters.PullOptions(parsed.options, {
+      __proto__: null,
+      context: 'options',
+    });
+    const { signal } = options;
 
     // Avoid registering a consumer that the pre-aborted pipeline will never
     // read or detach.
@@ -157,12 +161,7 @@ class BroadcastImpl {
     // When no transforms, return rawConsumer directly (controller elided
     // per PULL-02 optimization -- no transforms means no signal recipient).
     if (transforms.length > 0 || signal) {
-      const pullArgs = [...transforms];
-      if (signal) {
-        ArrayPrototypePush(pullArgs,
-                           { __proto__: null, signal });
-      }
-      return pullWithTransforms(rawConsumer, ...pullArgs);
+      return pullWithConsumerCleanup(rawConsumer, transforms, signal);
     }
     return rawConsumer;
   }
@@ -220,7 +219,8 @@ class BroadcastImpl {
 
             const bufferIndex = state.cursor - self.#bufferStart;
             if (bufferIndex < self.#buffer.length) {
-              const chunk = self.#buffer.get(bufferIndex);
+              const chunk = self.#readEntry(self.#buffer.get(bufferIndex));
+              if (chunk === null) return PromiseReject(self.#error);
               const cursor = state.cursor;
               state.cursor++;
               if (cursor === self.#cachedMinCursor &&
@@ -309,10 +309,11 @@ class BroadcastImpl {
 
   // Methods accessed by BroadcastWriter via symbol keys
 
-  [kWrite](chunk) {
+  [kWrite](entry) {
     if (this.#ended || this.#cancelled) return false;
 
-    const batchSize = this.#batchByteSize(chunk);
+    const batchSize = entry.byteLength;
+    let droppedOldest = false;
 
     // Skip empty chunks -- zero-byte writes would accumulate infinitely
     // without ever triggering backpressure under a byte-budget model.
@@ -324,10 +325,11 @@ class BroadcastImpl {
         case 'unbounded':
           return false;
         case 'drop-oldest':
+          droppedOldest = true;
           while (this.#bufferedBytes >= this.#options.budget &&
                  this.#buffer.length > 0) {
             const evicted = this.#buffer.shift();
-            this.#bufferedBytes -= this.#batchByteSize(evicted);
+            this.#bufferedBytes -= evicted.byteLength;
             this.#bufferStart++;
           }
           for (const consumer of this.#consumers) {
@@ -343,9 +345,13 @@ class BroadcastImpl {
       }
     }
 
-    this.#buffer.push(chunk);
+    this.#buffer.push(entry);
     this.#bufferedBytes += batchSize;
     this.#notifyConsumers();
+    if (droppedOldest &&
+        this.#bufferedBytes < this.#options.budget) {
+      this[kOnBufferDrained]?.();
+    }
     return true;
   }
 
@@ -357,7 +363,8 @@ class BroadcastImpl {
       while (consumer.resolve) {
         const bufferIndex = consumer.cursor - this.#bufferStart;
         if (bufferIndex < this.#buffer.length) {
-          const chunk = this.#buffer.get(bufferIndex);
+          const chunk = this.#readEntry(this.#buffer.get(bufferIndex));
+          if (chunk === null) return;
           const cursor = consumer.cursor;
           consumer.cursor++;
           if (cursor === this.#cachedMinCursor &&
@@ -401,15 +408,13 @@ class BroadcastImpl {
   }
 
   /**
-   * Check if the next write is likely to be accepted.
+   * Check whether the slots buffer has capacity.
    * Returns null if ended/cancelled, true/false otherwise.
    * @returns {boolean | null}
    */
   [kCanWrite]() {
     if (this.#ended || this.#cancelled) return null;
-    if ((this.#options.backpressure === 'strict' ||
-        this.#options.backpressure === 'unbounded') &&
-        this.#bufferedBytes >= this.#options.budget) {
+    if (this.#bufferedBytes >= this.#options.budget) {
       return false;
     }
     return true;
@@ -438,7 +443,7 @@ class BroadcastImpl {
     if (trimCount > 0) {
       for (let i = 0; i < trimCount; i++) {
         const evicted = this.#buffer.get(i);
-        this.#bufferedBytes -= this.#batchByteSize(evicted);
+        this.#bufferedBytes -= evicted.byteLength;
       }
       this.#buffer.trimFront(trimCount);
       this.#bufferStart = this.#cachedMinCursor;
@@ -450,12 +455,16 @@ class BroadcastImpl {
     }
   }
 
-  #batchByteSize(batch) {
-    let size = 0;
-    for (let i = 0; i < batch.length; i++) {
-      size += TypedArrayPrototypeGetByteLength(batch[i]);
+  #readEntry(entry) {
+    try {
+      return validateBatchEntry(entry);
+    } catch (error) {
+      this.#writer.fail(error);
+      if (this.#error === undefined) this[kAbort](error);
+      this.#buffer.clear();
+      this.#bufferedBytes = 0;
+      return null;
     }
-    return size;
   }
 
   #notifyConsumers() {
@@ -469,7 +478,8 @@ class BroadcastImpl {
       if (consumer.resolve) {
         const bufferIndex = consumer.cursor - this.#bufferStart;
         if (bufferIndex < this.#buffer.length) {
-          const chunk = this.#buffer.get(bufferIndex);
+          const chunk = this.#readEntry(this.#buffer.get(bufferIndex));
+          if (chunk === null) return;
           const cursor = consumer.cursor;
           consumer.cursor++;
           if (cursor === this.#cachedMinCursor &&
@@ -588,33 +598,34 @@ class BroadcastWriter {
   }
 
   write(chunk, options) {
+    const converted = toWriterUint8Array(chunk);
     const signal = getWriterSignal(options);
     // Fast path: no signal, writer open, buffer has space
     if (this.#canUseWriteFastPath(signal)) {
-      const converted = toUint8Array(chunk);
-      this.#broadcast[kWrite]([converted]);
-      this.#totalBytes += TypedArrayPrototypeGetByteLength(converted);
+      const batch = createBatchEntry([converted]);
+      this.#broadcast[kWrite](batch);
+      this.#totalBytes += batch.byteLength;
       return kResolvedPromise;
     }
-    return this.#writevSlow([chunk], signal);
+    return this.#writeBatchSlow(createBatchEntry([converted]), signal);
   }
 
   writev(chunks, options) {
-    validateArray(chunks, 'chunks');
+    const converted = convertChunks(chunks);
     const signal = getWriterSignal(options);
+    const batch = createBatchEntry(converted);
     // Fast path: no signal, writer open, buffer has space
     if (this.#canUseWriteFastPath(signal)) {
-      const converted = convertChunks(chunks);
-      this.#broadcast[kWrite](converted);
-      for (let i = 0; i < converted.length; i++) {
-        this.#totalBytes += TypedArrayPrototypeGetByteLength(converted[i]);
+      if (this.#state === 'open' && this.#broadcast[kWrite](batch)) {
+        this.#totalBytes += batch.byteLength;
+        return kResolvedPromise;
       }
-      return kResolvedPromise;
+      return this.#writeBatchSlow(batch, signal);
     }
-    return this.#writevSlow(chunks, signal);
+    return this.#writeBatchSlow(batch, signal);
   }
 
-  async #writevSlow(chunks, signal) {
+  async #writeBatchSlow(batch, signal) {
     if (this.#state === 'errored') {
       throw this.#error;
     }
@@ -624,12 +635,8 @@ class BroadcastWriter {
 
     signal?.throwIfAborted();
 
-    const converted = convertChunks(chunks);
-
-    if (this.#broadcast[kWrite](converted)) {
-      for (let i = 0; i < converted.length; i++) {
-        this.#totalBytes += TypedArrayPrototypeGetByteLength(converted[i]);
-      }
+    if (this.#broadcast[kWrite](batch)) {
+      this.#totalBytes += batch.byteLength;
       return;
     }
 
@@ -641,34 +648,30 @@ class BroadcastWriter {
           'Backpressure violation: too many pending writes. ' +
           'Await each write() call to respect backpressure.');
       }
-      return this.#createPendingWrite(converted, signal);
+      return this.#createPendingWrite(batch, signal);
     }
 
     // 'unbounded' policy
-    return this.#createPendingWrite(converted, signal);
+    return this.#createPendingWrite(batch, signal);
   }
 
   writeSync(chunk) {
+    const converted = toWriterUint8Array(chunk);
     if (this.#state !== 'open') return false;
-    if (!this.#broadcast[kCanWrite]()) return false;
-    const converted =
-      toUint8Array(chunk);
-    if (this.#broadcast[kWrite]([converted])) {
-      this.#totalBytes += TypedArrayPrototypeGetByteLength(converted);
+    const batch = createBatchEntry([converted]);
+    if (this.#broadcast[kWrite](batch)) {
+      this.#totalBytes += batch.byteLength;
       return true;
     }
     return false;
   }
 
   writevSync(chunks) {
-    validateArray(chunks, 'chunks');
-    if (this.#state !== 'open') return false;
-    if (!this.#broadcast[kCanWrite]()) return false;
     const converted = convertChunks(chunks);
-    if (this.#broadcast[kWrite](converted)) {
-      for (let i = 0; i < converted.length; i++) {
-        this.#totalBytes += TypedArrayPrototypeGetByteLength(converted[i]);
-      }
+    if (this.#state !== 'open') return false;
+    const batch = createBatchEntry(converted);
+    if (this.#broadcast[kWrite](batch)) {
+      this.#totalBytes += batch.byteLength;
       return true;
     }
     return false;
@@ -757,9 +760,9 @@ class BroadcastWriter {
    * promise rejects. Signal listeners are cleaned up on normal resolution.
    * @returns {Promise<void>}
    */
-  #createPendingWrite(chunk, signal) {
+  #createPendingWrite(batch, signal) {
     const { promise, resolve, reject } = PromiseWithResolvers();
-    const entry = { __proto__: null, chunk, resolve, reject };
+    const entry = { __proto__: null, batch, resolve, reject };
     this.#pendingWrites.push(entry);
     if (signal) {
       wireBroadcastWriteSignal(entry, signal, resolve, reject, this);
@@ -770,14 +773,17 @@ class BroadcastWriter {
   #resolvePendingWrites() {
     while (this.#pendingWrites.length > 0 && this.#broadcast[kCanWrite]()) {
       const pending = this.#pendingWrites.shift();
-      if (this.#broadcast[kWrite](pending.chunk)) {
-        for (let i = 0; i < pending.chunk.length; i++) {
-          this.#totalBytes += TypedArrayPrototypeGetByteLength(pending.chunk[i]);
+      try {
+        validateBatchEntry(pending.batch);
+        if (this.#broadcast[kWrite](pending.batch)) {
+          this.#totalBytes += pending.batch.byteLength;
+          pending.resolve();
+        } else {
+          this.#pendingWrites.unshift(pending);
+          break;
         }
-        pending.resolve();
-      } else {
-        this.#pendingWrites.unshift(pending);
-        break;
+      } catch (error) {
+        pending.reject(error);
       }
     }
     this.#finishEndIfReady();
@@ -811,18 +817,18 @@ function wireBroadcastWriteSignal(entry, signal, resolve, reject, self) {
     const pendingWrites = getBroadcastPendingWrites(self);
     const idx = pendingWrites.indexOf(entry);
     if (idx !== -1) pendingWrites.removeAt(idx);
-    entry.chunk = null;
+    entry.batch = null;
     reject(signal.reason ?? lazyDOMException('Aborted', 'AbortError'));
     if (idx !== -1) self[kPendingWriteRemoved]();
   };
   entry.resolve = function() {
     signal.removeEventListener('abort', onAbort);
-    entry.chunk = null;
+    entry.batch = null;
     resolve();
   };
   entry.reject = function(reason) {
     signal.removeEventListener('abort', onAbort);
-    entry.chunk = null;
+    entry.batch = null;
     reject(reason);
   };
   signal.addEventListener('abort', onAbort, { __proto__: null, once: true });
@@ -842,17 +848,16 @@ function onBroadcastCancel(broadcastImpl, signal) {
  * @returns {{ writer: Writer, broadcast: Broadcast }}
  */
 function broadcast(options = { __proto__: null }) {
-  validateObject(options, 'options');
+  options = converters.BroadcastOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const {
     budget = kMultiConsumerDefaultBudget,
     backpressure = 'strict',
     signal,
   } = options;
   validateInteger(budget, 'options.budget', 16384);
-  validateBackpressure(backpressure);
-  if (signal !== undefined) {
-    validateAbortSignal(signal, 'options.signal');
-  }
 
   const opts = {
     __proto__: null,
@@ -895,8 +900,12 @@ const Broadcast = {
         'input', ['Broadcastable', 'AsyncIterable', 'Iterable'], input);
     }
 
+    options = converters.BroadcastOptions(options, {
+      __proto__: null,
+      context: 'options',
+    });
     const result = broadcast(options);
-    const signal = options?.signal;
+    const { signal } = options;
 
     const pump = async () => {
       const w = result.writer;
diff --git a/lib/internal/streams/iter/classic.js b/lib/internal/streams/iter/classic.js
index 0769348a3981..28f6079e6fe2 100644
--- a/lib/internal/streams/iter/classic.js
+++ b/lib/internal/streams/iter/classic.js
@@ -40,7 +40,6 @@ const {
 } = require('internal/errors');
 
 const {
-  validateArray,
   validateInteger,
   validateObject,
 } = require('internal/validators');
@@ -60,9 +59,10 @@ const {
 } = require('internal/streams/iter/types');
 
 const {
+  convertChunks,
   getWriterSignal,
   validateBackpressure,
-  toUint8Array,
+  toWriterUint8Array,
 } = require('internal/streams/iter/utils');
 
 const { Buffer } = require('buffer');
@@ -538,7 +538,7 @@ function fromWritable(writable, options = kNullPrototype) {
   function writeChunks(chunks) {
     let ok = true;
     for (let i = 0; i < chunks.length; i++) {
-      const bytes = toUint8Array(chunks[i]);
+      const bytes = chunks[i];
       totalBytes += TypedArrayPrototypeGetByteLength(bytes);
       ok = writable.write(bytes);
     }
@@ -554,10 +554,12 @@ function fromWritable(writable, options = kNullPrototype) {
     },
 
     writeSync(chunk) {
+      toWriterUint8Array(chunk);
       return false;
     },
 
     writevSync(chunks) {
+      convertChunks(chunks);
       return false;
     },
 
@@ -576,18 +578,12 @@ function fromWritable(writable, options = kNullPrototype) {
     // otherwise ignored. Classic stream.Writable has no per-write abort signal
     // support; cancellation should be handled at the pipeline level instead.
     write(chunk, options) {
+      const bytes = toWriterUint8Array(chunk);
       getWriterSignal(options);
       if (!isWritable()) {
         return PromiseReject(new ERR_STREAM_WRITE_AFTER_END());
       }
 
-      let bytes;
-      try {
-        bytes = toUint8Array(chunk);
-      } catch (err) {
-        return PromiseReject(err);
-      }
-
       if (backpressure === 'strict' && isFull()) {
         return PromiseReject(new ERR_INVALID_STATE.RangeError(
           'Backpressure violation: buffer is full. ' +
@@ -619,7 +615,7 @@ function fromWritable(writable, options = kNullPrototype) {
     },
 
     writev(chunks, options) {
-      validateArray(chunks, 'chunks');
+      chunks = convertChunks(chunks);
       getWriterSignal(options);
       if (!isWritable()) {
         return PromiseReject(new ERR_STREAM_WRITE_AFTER_END());
@@ -634,8 +630,7 @@ function fromWritable(writable, options = kNullPrototype) {
       if (backpressure === 'drop-newest' && isFull()) {
         // Discard entire batch.
         for (let i = 0; i < chunks.length; i++) {
-          totalBytes +=
-            TypedArrayPrototypeGetByteLength(toUint8Array(chunks[i]));
+          totalBytes += TypedArrayPrototypeGetByteLength(chunks[i]);
         }
         return PromiseResolve();
       }
diff --git a/lib/internal/streams/iter/consumers.js b/lib/internal/streams/iter/consumers.js
index e3bd7856dcd4..75ad4026ad7c 100644
--- a/lib/internal/streams/iter/consumers.js
+++ b/lib/internal/streams/iter/consumers.js
@@ -18,6 +18,8 @@ const {
   Promise,
   PromisePrototypeThen,
   SafePromiseAllReturnVoid,
+  SafeSet,
+  Symbol,
   SymbolAsyncIterator,
   TypedArrayPrototypeGetBuffer,
   TypedArrayPrototypeGetByteLength,
@@ -34,11 +36,7 @@ const {
 } = require('internal/errors');
 const { TextDecoder } = require('internal/encoding');
 const {
-  validateAbortSignal,
   validateFunction,
-  validateInteger,
-  validateObject,
-  validateString,
 } = require('internal/validators');
 
 const {
@@ -54,6 +52,8 @@ const {
 
 const {
   concatBytes,
+  createBatchEntry,
+  validateBatchEntry,
   yieldAbortable,
 } = require('internal/streams/iter/utils');
 
@@ -62,6 +62,9 @@ const {
   toAsyncStreamable,
   toStreamable,
 } = require('internal/streams/iter/types');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
   isAnyArrayBuffer,
@@ -89,6 +92,17 @@ function isMergeOptions(value) {
 // Shared chunk collection helpers
 // =============================================================================
 
+function flattenBatchEntries(entries) {
+  const chunks = [];
+  for (let i = 0; i < entries.length; i++) {
+    const batch = validateBatchEntry(entries[i]);
+    for (let j = 0; j < batch.length; j++) {
+      ArrayPrototypePush(chunks, batch[j]);
+    }
+  }
+  return chunks;
+}
+
 /**
  * Collect chunks from a sync source into an array.
  * @param {Iterable<Uint8Array[]>} source
@@ -98,23 +112,23 @@ function isMergeOptions(value) {
 function collectSync(source, limit) {
   // Normalize source via fromSync() - accepts strings, ArrayBuffers, protocols, etc.
   const normalized = fromSync(source);
-  const chunks = [];
+  const entries = [];
   let totalBytes = 0;
 
   for (const batch of normalized) {
-    for (let i = 0; i < batch.length; i++) {
-      const chunk = batch[i];
-      if (limit !== undefined) {
-        totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+    const entry = createBatchEntry(batch);
+    if (limit !== undefined) {
+      for (let i = 0; i < entry.views.length; i++) {
+        totalBytes += entry.views[i].byteLength;
         if (totalBytes > limit) {
           throw new ERR_OUT_OF_RANGE('totalBytes', `<= ${limit}`, totalBytes);
         }
       }
-      ArrayPrototypePush(chunks, chunk);
     }
+    ArrayPrototypePush(entries, entry);
   }
 
-  return chunks;
+  return flattenBatchEntries(entries);
 }
 
 /**
@@ -128,19 +142,15 @@ async function collectAsync(source, signal, limit) {
   signal?.throwIfAborted();
 
   // Normalize source via from() - accepts strings, ArrayBuffers, protocols, etc.
-  const abortableSource = signal && isAsyncIterable(source) ?
-    yieldAbortable(source, signal) : source;
-  const normalized = from(abortableSource);
-  const chunks = [];
+  const normalized = from(source);
+  const entries = [];
 
   // Fast path: no signal and no limit
   if (!signal && limit === undefined) {
     for await (const batch of normalized) {
-      for (let i = 0; i < batch.length; i++) {
-        ArrayPrototypePush(chunks, batch[i]);
-      }
+      ArrayPrototypePush(entries, createBatchEntry(batch));
     }
-    return chunks;
+    return flattenBatchEntries(entries);
   }
 
   // Slow path: with signal or limit checks
@@ -149,19 +159,19 @@ async function collectAsync(source, signal, limit) {
 
   for await (const batch of iterable) {
     signal?.throwIfAborted();
-    for (let i = 0; i < batch.length; i++) {
-      const chunk = batch[i];
-      if (limit !== undefined) {
-        totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+    const entry = createBatchEntry(batch);
+    if (limit !== undefined) {
+      for (let i = 0; i < entry.views.length; i++) {
+        totalBytes += entry.views[i].byteLength;
         if (totalBytes > limit) {
           throw new ERR_OUT_OF_RANGE('totalBytes', `<= ${limit}`, totalBytes);
         }
       }
-      ArrayPrototypePush(chunks, chunk);
     }
+    ArrayPrototypePush(entries, entry);
   }
 
-  return chunks;
+  return flattenBatchEntries(entries);
 }
 
 /**
@@ -186,37 +196,6 @@ function toArrayBuffer(data) {
                                    byteOffset + byteLength);
 }
 
-// =============================================================================
-// Shared option validation
-// =============================================================================
-
-function validateBaseConsumerOptions(options) {
-  validateObject(options, 'options');
-  if (options.limit !== undefined) {
-    validateInteger(options.limit, 'options.limit', 0);
-  }
-  if (options.encoding !== undefined) {
-    validateString(options.encoding, 'options.encoding');
-    try {
-      new TextDecoder(options.encoding);
-    } catch {
-      throw new ERR_INVALID_ARG_VALUE.RangeError(
-        'options.encoding', options.encoding);
-    }
-  }
-}
-
-function validateConsumerOptions(options) {
-  validateBaseConsumerOptions(options);
-  if (options.signal !== undefined) {
-    validateAbortSignal(options.signal, 'options.signal');
-  }
-}
-
-function validateSyncConsumerOptions(options) {
-  validateBaseConsumerOptions(options);
-}
-
 // =============================================================================
 // Sync Consumers
 // =============================================================================
@@ -230,7 +209,10 @@ const kNullPrototype = { __proto__: null };
  * @returns {Uint8Array}
  */
 function bytesSync(source, options = kNullPrototype) {
-  validateSyncConsumerOptions(options);
+  options = converters.ConsumeSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   return concatBytes(collectSync(source, options.limit));
 }
 
@@ -241,9 +223,18 @@ function bytesSync(source, options = kNullPrototype) {
  * @returns {string}
  */
 function textSync(source, options = kNullPrototype) {
-  validateSyncConsumerOptions(options);
+  options = converters.TextConsumeSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
+  try {
+    new TextDecoder(options.encoding);
+  } catch {
+    throw new ERR_INVALID_ARG_VALUE.RangeError(
+      'options.encoding', options.encoding);
+  }
   const data = concatBytes(collectSync(source, options.limit));
-  const decoder = new TextDecoder(options.encoding ?? 'utf-8', {
+  const decoder = new TextDecoder(options.encoding, {
     __proto__: null,
     fatal: true,
   });
@@ -257,7 +248,10 @@ function textSync(source, options = kNullPrototype) {
  * @returns {ArrayBuffer}
  */
 function arrayBufferSync(source, options = kNullPrototype) {
-  validateSyncConsumerOptions(options);
+  options = converters.ConsumeSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   return toArrayBuffer(concatBytes(collectSync(source, options.limit)));
 }
 
@@ -268,7 +262,10 @@ function arrayBufferSync(source, options = kNullPrototype) {
  * @returns {Uint8Array[]}
  */
 function arraySync(source, options = kNullPrototype) {
-  validateSyncConsumerOptions(options);
+  options = converters.ConsumeSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   return collectSync(source, options.limit);
 }
 
@@ -283,7 +280,10 @@ function arraySync(source, options = kNullPrototype) {
  * @returns {Promise<Uint8Array>}
  */
 async function bytes(source, options = kNullPrototype) {
-  validateConsumerOptions(options);
+  options = converters.ConsumeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const chunks = await collectAsync(source, options.signal, options.limit);
   return concatBytes(chunks);
 }
@@ -295,10 +295,19 @@ async function bytes(source, options = kNullPrototype) {
  * @returns {Promise<string>}
  */
 async function text(source, options = kNullPrototype) {
-  validateConsumerOptions(options);
+  options = converters.TextConsumeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
+  try {
+    new TextDecoder(options.encoding);
+  } catch {
+    throw new ERR_INVALID_ARG_VALUE.RangeError(
+      'options.encoding', options.encoding);
+  }
   const chunks = await collectAsync(source, options.signal, options.limit);
   const data = concatBytes(chunks);
-  const decoder = new TextDecoder(options.encoding ?? 'utf-8', {
+  const decoder = new TextDecoder(options.encoding, {
     __proto__: null,
     fatal: true,
   });
@@ -312,7 +321,10 @@ async function text(source, options = kNullPrototype) {
  * @returns {Promise<ArrayBuffer>}
  */
 async function arrayBuffer(source, options = kNullPrototype) {
-  validateConsumerOptions(options);
+  options = converters.ConsumeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const chunks = await collectAsync(source, options.signal, options.limit);
   return toArrayBuffer(concatBytes(chunks));
 }
@@ -324,7 +336,10 @@ async function arrayBuffer(source, options = kNullPrototype) {
  * @returns {Promise<Uint8Array[]>}
  */
 async function array(source, options = kNullPrototype) {
-  validateConsumerOptions(options);
+  options = converters.ConsumeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   return collectAsync(source, options.signal, options.limit);
 }
 
@@ -390,6 +405,8 @@ function ondrain(drainable) {
 // Merge Utility
 // =============================================================================
 
+const kNoMergeError = Symbol('kNoMergeError');
+
 /**
  * Merge multiple async iterables by yielding values in temporal order.
  * @param {...(AsyncIterable<Uint8Array[]>|object)} args
@@ -406,9 +423,10 @@ function merge(...args) {
     sources = args;
   }
 
-  if (options?.signal !== undefined) {
-    validateAbortSignal(options.signal, 'options.signal');
-  }
+  options = converters.MergeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
 
   // Normalize each source via from()
   const normalized = ArrayPrototypeMap(sources, (source) => from(source));
@@ -416,7 +434,7 @@ function merge(...args) {
   return {
     __proto__: null,
     async *[SymbolAsyncIterator]() {
-      const signal = options?.signal;
+      const { signal } = options;
 
       signal?.throwIfAborted();
 
@@ -437,9 +455,11 @@ function merge(...args) {
       // async tick per batch. Each source has at most one pending .next()
       // at a time. Every batch from every source is preserved.
       const ready = [];
+      const pendingPulls = new SafeSet();
       let activeCount = normalized.length;
       let waitResolve = null;
       let onAbort;
+      let stopped = false;
 
       if (signal) {
         onAbort = () => {
@@ -457,11 +477,14 @@ function merge(...args) {
       // Called when a source's .next() settles. Pushes the result into
       // the ready queue and wakes the consumer if it's waiting.
       const onSettled = (iterator, result) => {
+        pendingPulls.delete(iterator);
+        if (stopped) return;
         if (result.done) {
           activeCount--;
         } else {
           ArrayPrototypePush(ready, {
             __proto__: null,
+            kind: 'value',
             iterator,
             value: result.value,
           });
@@ -472,25 +495,34 @@ function merge(...args) {
         }
       };
 
+      const onRejected = (iterator, reason) => {
+        pendingPulls.delete(iterator);
+        if (stopped) return;
+        ArrayPrototypePush(ready, {
+          __proto__: null,
+          kind: 'error',
+          reason,
+        });
+        if (waitResolve) {
+          waitResolve();
+          waitResolve = null;
+        }
+      };
+
       // Start one .next() per source
       const iterators = [];
       for (let i = 0; i < normalized.length; i++) {
         const iterator = normalized[i][SymbolAsyncIterator]();
         ArrayPrototypePush(iterators, iterator);
+        pendingPulls.add(iterator);
         PromisePrototypeThen(
           iterator.next(),
           (r) => onSettled(iterator, r),
-          (err) => {
-            ArrayPrototypePush(ready, { __proto__: null, error: err });
-            if (waitResolve) {
-              waitResolve();
-              waitResolve = null;
-            }
-          },
+          (reason) => onRejected(iterator, reason),
         );
       }
 
-      let primaryError;
+      let primaryError = kNoMergeError;
       try {
         while (activeCount > 0 || ready.length > 0) {
           signal?.throwIfAborted();
@@ -498,20 +530,15 @@ function merge(...args) {
           // Drain ready queue synchronously
           while (ready.length > 0) {
             const item = ArrayPrototypeShift(ready);
-            if (item?.error) {
-              throw item.error;
+            if (item.kind === 'error') {
+              throw item.reason;
             }
             yield item.value;
+            pendingPulls.add(item.iterator);
             PromisePrototypeThen(
               item.iterator.next(),
               (r) => onSettled(item.iterator, r),
-              (err) => {
-                ArrayPrototypePush(ready, { __proto__: null, error: err });
-                if (waitResolve) {
-                  waitResolve();
-                  waitResolve = null;
-                }
-              },
+              (reason) => onRejected(item.iterator, reason),
             );
           }
 
@@ -529,6 +556,7 @@ function merge(...args) {
       } catch (err) {
         primaryError = err;
       } finally {
+        stopped = true;
         if (onAbort !== undefined) {
           signal.removeEventListener('abort', onAbort);
         }
@@ -538,32 +566,32 @@ function merge(...args) {
         await cleanupIterators(
           iterators,
           primaryError,
-          signal?.aborted && primaryError === signal.reason,
+          pendingPulls,
         );
       }
     },
   };
 }
 
-async function cleanupIterators(iterators, primaryError, skipAwaitCleanup) {
-  let cleanupError;
+async function cleanupIterators(iterators, primaryError, pendingPulls) {
+  let cleanupError = kNoMergeError;
   await SafePromiseAllReturnVoid(iterators, async (iterator) => {
     if (iterator.return) {
       try {
         const result = iterator.return();
-        if (skipAwaitCleanup) {
+        if (pendingPulls.has(iterator)) {
           markPromiseAsHandled(result);
         } else {
           await result;
         }
       } catch (err) {
         // Keep the first cleanup error encountered.
-        cleanupError ??= err;
+        if (cleanupError === kNoMergeError) cleanupError = err;
       }
     }
   });
-  if (cleanupError !== undefined) {
-    if (primaryError !== undefined) {
+  if (cleanupError !== kNoMergeError) {
+    if (primaryError !== kNoMergeError) {
       // Both a primary error and a cleanup error occurred.
       // Wrap in SuppressedError so neither is lost:
       // .error = primaryError, .suppressed = cleanupError.
@@ -573,7 +601,7 @@ async function cleanupIterators(iterators, primaryError, skipAwaitCleanup) {
     // No primary error - the cleanup error is the only error.
     throw cleanupError;
   }
-  if (primaryError !== undefined) {
+  if (primaryError !== kNoMergeError) {
     throw primaryError;
   }
 }
diff --git a/lib/internal/streams/iter/duplex.js b/lib/internal/streams/iter/duplex.js
index b37b91279232..674ef81a53c9 100644
--- a/lib/internal/streams/iter/duplex.js
+++ b/lib/internal/streams/iter/duplex.js
@@ -6,17 +6,18 @@
 // channel's writer appears in the other channel's readable.
 
 const {
+  SafePromiseAllReturnVoid,
   SymbolAsyncDispose,
   SymbolAsyncIterator,
 } = primordials;
 
 const {
+  isConsumerReturnError,
   push,
 } = require('internal/streams/iter/push');
 const {
-  validateAbortSignal,
-  validateObject,
-} = require('internal/validators');
+  converters,
+} = require('internal/streams/iter/webidl');
 
 /**
  * Create a pair of connected duplex channels for bidirectional communication.
@@ -25,17 +26,11 @@ const {
  * @returns {[DuplexChannel, DuplexChannel]}
  */
 function duplex(options = { __proto__: null }) {
-  validateObject(options, 'options');
+  options = converters.DuplexOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const { budget, backpressure, signal, a, b } = options;
-  if (a !== undefined) {
-    validateObject(a, 'options.a');
-  }
-  if (b !== undefined) {
-    validateObject(b, 'options.b');
-  }
-  if (signal !== undefined) {
-    validateAbortSignal(signal, 'options.signal');
-  }
 
   // Channel A writes to B's readable (A->B direction).
   // Signal is NOT passed to push() -- we handle abort via close() below.
@@ -50,68 +45,8 @@ function duplex(options = { __proto__: null }) {
     backpressure: b?.backpressure ?? backpressure,
   });
 
-  let aClosed = false;
-  let bClosed = false;
-  // Track active iterators so close() can call .return() on them
-  let aReadableIterator = null;
-  let bReadableIterator = null;
-
-  const channelA = {
-    __proto__: null,
-    get writer() { return aWriter; },
-    // Wrap readable to track the iterator for cleanup on close()
-    get readable() {
-      return {
-        __proto__: null,
-        [SymbolAsyncIterator]() {
-          const iter = aReadable[SymbolAsyncIterator]();
-          aReadableIterator = iter;
-          return iter;
-        },
-      };
-    },
-    async close() {
-      if (aClosed) return;
-      aClosed = true;
-      // End the writer (signals end-of-stream to B's readable)
-      aWriter.endSync();
-      // Stop iteration of this channel's readable
-      if (aReadableIterator?.return) {
-        await aReadableIterator.return();
-        aReadableIterator = null;
-      }
-    },
-    [SymbolAsyncDispose]() {
-      return this.close();
-    },
-  };
-
-  const channelB = {
-    __proto__: null,
-    get writer() { return bWriter; },
-    get readable() {
-      return {
-        __proto__: null,
-        [SymbolAsyncIterator]() {
-          const iter = bReadable[SymbolAsyncIterator]();
-          bReadableIterator = iter;
-          return iter;
-        },
-      };
-    },
-    async close() {
-      if (bClosed) return;
-      bClosed = true;
-      bWriter.endSync();
-      if (bReadableIterator?.return) {
-        await bReadableIterator.return();
-        bReadableIterator = null;
-      }
-    },
-    [SymbolAsyncDispose]() {
-      return this.close();
-    },
-  };
+  const channelA = createDuplexChannel(aWriter, aReadable);
+  const channelB = createDuplexChannel(bWriter, bReadable);
 
   // Signal handler: fail both writers with the abort reason so consumers
   // see the error. This is an error-path shutdown, not a clean close.
@@ -132,6 +67,42 @@ function duplex(options = { __proto__: null }) {
   return [channelA, channelB];
 }
 
+function createDuplexChannel(writer, readable) {
+  // A push readable has one shared consumer state. Keeping an iterator from
+  // creation lets close() terminate that state even if no caller has iterated.
+  const closeIterator = readable[SymbolAsyncIterator]();
+  let closePromise;
+
+  return {
+    __proto__: null,
+    get writer() { return writer; },
+    get readable() { return readable; },
+    close() {
+      closePromise ??= closeDuplexChannel(writer, closeIterator);
+      return closePromise;
+    },
+    [SymbolAsyncDispose]() {
+      return this.close();
+    },
+  };
+}
+
+async function closeDuplexChannel(writer, closeIterator) {
+  const result = writer.endSync();
+  const endPromise = result < 0 ? writer.end() : undefined;
+  const returnPromise = closeIterator.return();
+
+  if (endPromise !== undefined) {
+    try {
+      await SafePromiseAllReturnVoid([endPromise, returnPromise]);
+    } catch (error) {
+      if (!isConsumerReturnError(error)) throw error;
+    }
+  } else {
+    await returnPromise;
+  }
+}
+
 module.exports = {
   duplex,
 };
diff --git a/lib/internal/streams/iter/from.js b/lib/internal/streams/iter/from.js
index 59ac6a15775b..7fe03511861f 100644
--- a/lib/internal/streams/iter/from.js
+++ b/lib/internal/streams/iter/from.js
@@ -15,6 +15,7 @@ const {
   DataViewPrototypeGetByteLength,
   DataViewPrototypeGetByteOffset,
   FunctionPrototypeCall,
+  PromisePrototypeThen,
   SymbolAsyncIterator,
   SymbolIterator,
   TypedArrayPrototypeGetBuffer,
@@ -23,6 +24,8 @@ const {
   Uint8Array,
 } = primordials;
 
+const { markPromiseAsHandled } = internalBinding('util');
+
 const {
   codes: {
     ERR_INVALID_ARG_TYPE,
@@ -360,9 +363,13 @@ async function* normalizeAsyncSource(source) {
         continue;
       }
       // Slow path: normalize the value
-      const batch = [];
+      let batch = [];
       for await (const chunk of normalizeAsyncValue(value)) {
         ArrayPrototypePush(batch, chunk);
+        if (batch.length === FROM_BATCH_SIZE) {
+          yield batch;
+          batch = [];
+        }
       }
       if (batch.length > 0) {
         yield batch;
@@ -594,7 +601,11 @@ function from(input) {
   // Check toAsyncStreamable protocol (takes precedence over toStreamable and
   // iteration protocols)
   if (typeof input[toAsyncStreamable] === 'function') {
-    const result = input[toAsyncStreamable]();
+    let result = input[toAsyncStreamable]();
+    if (isPromise(result)) {
+      result = PromisePrototypeThen(result, undefined, undefined);
+      markPromiseAsHandled(result);
+    }
     // Synchronous validated source (e.g. Readable batched iterator)
     if (result?.[kValidatedSource]) {
       return result;
diff --git a/lib/internal/streams/iter/pull.js b/lib/internal/streams/iter/pull.js
index b6c2d9849c42..6b44f5c5e431 100644
--- a/lib/internal/streams/iter/pull.js
+++ b/lib/internal/streams/iter/pull.js
@@ -8,15 +8,13 @@
 
 const {
   ArrayBufferIsView,
-  ArrayFromAsync,
-  ArrayIsArray,
   ArrayPrototypePush,
   ArrayPrototypeSlice,
+  FunctionPrototypeCall,
   PromisePrototypeThen,
   PromiseResolve,
   SymbolAsyncIterator,
   SymbolIterator,
-  TypedArrayPrototypeGetByteLength,
   Uint8Array,
 } = primordials;
 
@@ -24,17 +22,20 @@ const {
   codes: {
     ERR_INVALID_ARG_TYPE,
     ERR_INVALID_ARG_VALUE,
+    ERR_INVALID_STATE,
     ERR_OUT_OF_RANGE,
   },
 } = require('internal/errors');
 const { lazyDOMException } = require('internal/util');
-const { validateAbortSignal } = require('internal/validators');
 const {
   isAnyArrayBuffer,
   isPromise,
   isUint8Array,
 } = require('internal/util/types');
-const { AbortController } = require('internal/abort_controller');
+const {
+  AbortController,
+  AbortSignal,
+} = require('internal/abort_controller');
 
 const {
   arrayBufferViewToUint8Array,
@@ -42,26 +43,26 @@ const {
   fromSync,
   isSyncIterable,
   isAsyncIterable,
-  isPrimitiveChunk,
   isUint8ArrayBatch,
-  normalizeAsyncValue,
 } = require('internal/streams/iter/from');
 
 const {
-  isPullOptions,
+  createBatchEntry,
   isTransform,
   isTransformObject,
   parsePullArgs,
   toUint8Array,
+  validateBatchEntry,
+  validateByteView,
   wrapError,
   yieldAbortable,
 } = require('internal/streams/iter/utils');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
-  kValidatedSource,
   kValidatedTransform,
-  toAsyncStreamable,
-  toStreamable,
 } = require('internal/streams/iter/types');
 
 // =============================================================================
@@ -80,7 +81,7 @@ function hasMethod(value, name) {
  * Parse pipeTo/pipeToSync arguments: [...transforms, writer, options?]
  * @param {Array} args
  * @param {string} requiredMethod - 'write' for pipeTo, 'writeSync' for pipeToSync
- * @returns {{ transforms: Array, writer: object, options: object }}
+ * @returns {{ transforms: Array, writer: object, options: unknown }}
  */
 function parsePipeToArgs(args, requiredMethod) {
   if (args.length === 0) {
@@ -92,7 +93,7 @@ function parsePipeToArgs(args, requiredMethod) {
 
   // Check if last arg is options
   const last = args[args.length - 1];
-  if (isPullOptions(last) && !hasMethod(last, requiredMethod)) {
+  if (!isTransform(last) && !hasMethod(last, requiredMethod)) {
     options = last;
     writerIndex = args.length - 2;
   }
@@ -124,22 +125,6 @@ function parsePipeToArgs(args, requiredMethod) {
   };
 }
 
-function canUseSyncIterablePipeToFastPath(source, transforms, signal) {
-  if (signal !== undefined ||
-      transforms.length !== 0 ||
-      isPrimitiveChunk(source) ||
-      ArrayIsArray(source) ||
-      source?.[kValidatedSource] ||
-      !isSyncIterable(source) ||
-      isAsyncIterable(source)) {
-    return false;
-  }
-
-  // Preserve from()'s top-level protocol precedence for custom iterables.
-  return typeof source[toAsyncStreamable] !== 'function' &&
-    typeof source[toStreamable] !== 'function';
-}
-
 // =============================================================================
 // Transform Output Flattening
 // =============================================================================
@@ -521,8 +506,9 @@ function* withFlushSync(source) {
   yield null;
 }
 
-function* applyStatefulSyncTransform(source, transform) {
-  const output = transform(withFlushSync(source));
+function* applyStatefulSyncTransform(source, transform, receiver) {
+  const output = FunctionPrototypeCall(
+    transform, receiver, withFlushSync(source));
   for (const item of output) {
     if (item === null) continue;
     const batch = [];
@@ -553,7 +539,8 @@ function* createSyncPipeline(source, transforms) {
         current = applyFusedStatelessSyncTransforms(current, statelessRun);
         statelessRun = [];
       }
-      current = applyStatefulSyncTransform(current, transform.transform);
+      current = applyStatefulSyncTransform(
+        current, transform.transform, transform);
     } else {
       ArrayPrototypePush(statelessRun, transform);
     }
@@ -664,8 +651,10 @@ async function* withFlushAsync(source) {
   yield null;
 }
 
-async function* applyStatefulAsyncTransform(source, transform, options) {
-  const output = transform(withFlushAsync(source), options);
+async function* applyStatefulAsyncTransform(
+  source, transform, receiver, options) {
+  const output = FunctionPrototypeCall(
+    transform, receiver, withFlushAsync(source), options);
   for await (const item of output) {
     if (item === null) continue;
     // Fast path: item is already a Uint8Array[] batch (e.g. compression transforms)
@@ -697,8 +686,10 @@ async function* applyStatefulAsyncTransform(source, transform, options) {
  * skips isUint8ArrayBatch validation (transform guarantees valid output).
  * @yields {Uint8Array[]}
  */
-async function* applyValidatedStatefulAsyncTransform(source, transform, options) {
-  const output = transform(source, options);
+async function* applyValidatedStatefulAsyncTransform(
+  source, transform, receiver, options) {
+  const output = FunctionPrototypeCall(
+    transform, receiver, source, options);
   for await (const batch of output) {
     if (batch.length > 0) {
       yield batch;
@@ -766,10 +757,10 @@ async function* createAsyncPipeline(source, transforms, signal) {
       const opts = { __proto__: null, signal: transformSignal };
       if (transform[kValidatedTransform]) {
         current = applyValidatedStatefulAsyncTransform(
-          current, transform.transform, opts);
+          current, transform.transform, transform, opts);
       } else {
         current = applyStatefulAsyncTransform(
-          current, transform.transform, opts);
+          current, transform.transform, transform, opts);
       }
     } else {
       ArrayPrototypePush(statelessRun, transform);
@@ -821,6 +812,7 @@ async function* createAsyncPipeline(source, transforms, signal) {
  * @returns {Iterable<Uint8Array[]>}
  */
 function pullSync(source, ...transforms) {
+  const normalized = fromSync(source);
   for (let i = 0; i < transforms.length; i++) {
     if (!isTransform(transforms[i])) {
       throw new ERR_INVALID_ARG_TYPE(
@@ -831,7 +823,7 @@ function pullSync(source, ...transforms) {
   return {
     __proto__: null,
     *[SymbolIterator]() {
-      yield* createSyncPipeline(fromSync(source), transforms);
+      yield* createSyncPipeline(normalized, transforms);
     },
   };
 }
@@ -844,26 +836,127 @@ function pullSync(source, ...transforms) {
  * @returns {AsyncIterable<Uint8Array[]>}
  */
 function pull(source, ...args) {
-  const { transforms, options } = parsePullArgs(args);
-  const signal = options?.signal;
-  if (signal !== undefined) {
-    validateAbortSignal(signal, 'options.signal');
-    // Eagerly check abort at call time per spec
-    if (signal.aborted) {
+  const parsed = parsePullArgs(args);
+  const { transforms } = parsed;
+  const options = converters.PullOptions(parsed.options, {
+    __proto__: null,
+    context: 'options',
+  });
+  const { signal } = options;
+  const normalized = from(source);
+  signal?.throwIfAborted();
+
+  return {
+    __proto__: null,
+    [SymbolAsyncIterator]() {
+      const controller = new AbortController();
+      const iteratorSignal = signal === undefined ?
+        controller.signal : AbortSignal.any([signal, controller.signal]);
+
+      async function* pipeline() {
+        yield* createAsyncPipeline(normalized, transforms, iteratorSignal);
+      }
+      const iterator = pipeline();
+
       return {
         __proto__: null,
-        // eslint-disable-next-line require-yield
-        async *[SymbolAsyncIterator]() {
-          throw signal.reason;
+        next(value) {
+          return iterator.next(value);
+        },
+        return(value) {
+          controller.abort(lazyDOMException('Aborted', 'AbortError'));
+          return iterator.return(value);
+        },
+        throw(error) {
+          controller.abort(error);
+          return iterator.throw(error);
+        },
+        [SymbolAsyncIterator]() {
+          return this;
         },
       };
+    },
+  };
+}
+
+// Keep ownership of a bonded consumer outside the transform pipeline so it can
+// be detached even when the pipeline never starts or terminates early.
+function pullWithConsumerCleanup(source, transforms, signal) {
+  const sourceIterator = source[SymbolAsyncIterator]();
+  const pipelineSource = {
+    __proto__: null,
+    [SymbolAsyncIterator]() {
+      return sourceIterator;
+    },
+  };
+  let sourceClosed = false;
+  let abortHandler;
+
+  function closeSource(method, value) {
+    if (sourceClosed) return;
+    sourceClosed = true;
+    if (abortHandler !== undefined) {
+      signal.removeEventListener('abort', abortHandler);
+    }
+    const close = sourceIterator[method] ?? sourceIterator.return;
+    if (typeof close === 'function') {
+      const result = FunctionPrototypeCall(close, sourceIterator, value);
+      PromisePrototypeThen(PromiseResolve(result), undefined, () => {});
     }
   }
 
+  if (signal?.aborted) {
+    closeSource('throw', signal.reason);
+    return {
+      __proto__: null,
+      // eslint-disable-next-line require-yield
+      async *[SymbolAsyncIterator]() {
+        throw signal.reason;
+      },
+    };
+  }
+
+  const pipeline = signal === undefined ?
+    pull(pipelineSource, ...transforms) :
+    pull(pipelineSource, ...transforms, { __proto__: null, signal });
+
+  if (signal !== undefined) {
+    abortHandler = () => closeSource('throw', signal.reason);
+    signal.addEventListener('abort', abortHandler,
+                            { __proto__: null, once: true });
+    if (signal.aborted) abortHandler();
+  }
+
   return {
     __proto__: null,
-    async *[SymbolAsyncIterator]() {
-      yield* createAsyncPipeline(from(source), transforms, signal);
+    [SymbolAsyncIterator]() {
+      const iterator = pipeline[SymbolAsyncIterator]();
+      return {
+        __proto__: null,
+        next(value) {
+          return PromisePrototypeThen(
+            iterator.next(value),
+            (result) => {
+              if (result.done) closeSource('return');
+              return result;
+            },
+            (error) => {
+              closeSource('throw', error);
+              throw error;
+            });
+        },
+        return(value) {
+          closeSource('return', value);
+          return iterator.return(value);
+        },
+        throw(error) {
+          closeSource('throw', error);
+          return iterator.throw(error);
+        },
+        [SymbolAsyncIterator]() {
+          return this;
+        },
+      };
     },
   };
 }
@@ -879,7 +972,19 @@ function pull(source, ...args) {
  * @returns {number} Total bytes written
  */
 function pipeToSync(source, ...args) {
-  const { transforms, writer, options } = parsePipeToArgs(args, 'writeSync');
+  const parsed = parsePipeToArgs(args, 'writeSync');
+  const { transforms, writer } = parsed;
+  const options = converters.PipeToSyncOptions(parsed.options, {
+    __proto__: null,
+    context: 'options',
+  });
+  const hasWritevSync = typeof writer.writevSync === 'function';
+  const endSync = writer.endSync;
+
+  if (!options.preventClose && typeof endSync !== 'function') {
+    throw new ERR_INVALID_ARG_TYPE(
+      'writer.endSync', 'Function', endSync);
+  }
 
   // Normalize source and create pipeline
   const normalized = fromSync(source);
@@ -888,38 +993,41 @@ function pipeToSync(source, ...args) {
     normalized;
 
   let totalBytes = 0;
-  const hasWritevSync = typeof writer.writevSync === 'function';
-  const hasEndSync = typeof writer.endSync === 'function';
 
   try {
     for (const batch of pipeline) {
+      const entry = createBatchEntry(batch);
       if (hasWritevSync && batch.length > 1) {
-        if (writer.writevSync(batch) === false) {
+        const accepted = writer.writevSync(validateBatchEntry(entry));
+        validateBatchEntry(entry);
+        if (accepted === false) {
           throw new ERR_OUT_OF_RANGE(
             'write', 'within byte budget', 'budget exhausted');
         }
-        for (let i = 0; i < batch.length; i++) {
-          totalBytes += TypedArrayPrototypeGetByteLength(batch[i]);
-        }
+        totalBytes += entry.byteLength;
       } else {
-        for (let i = 0; i < batch.length; i++) {
-          const chunk = batch[i];
-          if (writer.writeSync(chunk) === false) {
+        for (let i = 0; i < entry.views.length; i++) {
+          const view = entry.views[i];
+          const chunk = validateByteView(view);
+          const accepted = writer.writeSync(chunk);
+          validateByteView(view);
+          if (accepted === false) {
             throw new ERR_OUT_OF_RANGE(
               'write', 'within byte budget', 'budget exhausted');
           }
-          totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+          totalBytes += view.byteLength;
         }
       }
     }
 
-    if (!options?.preventClose) {
-      if (!hasEndSync || writer.endSync() < 0) {
-        writer.end?.();
+    if (!options.preventClose) {
+      if (FunctionPrototypeCall(endSync, writer) < 0) {
+        throw new ERR_INVALID_STATE(
+          'Writer could not be closed synchronously');
       }
     }
   } catch (error) {
-    if (!options?.preventFail) {
+    if (!options.preventFail) {
       writer.fail?.(wrapError(error));
     }
     throw error;
@@ -935,20 +1043,29 @@ function pipeToSync(source, ...args) {
  * @returns {Promise<number>} Total bytes written
  */
 async function pipeTo(source, ...args) {
-  const { transforms, writer, options } = parsePipeToArgs(args, 'write');
-  if (options?.signal !== undefined) {
-    validateAbortSignal(options.signal, 'options.signal');
-  }
+  const parsed = parsePipeToArgs(args, 'write');
+  const { transforms, writer } = parsed;
+  const options = converters.PipeToOptions(parsed.options, {
+    __proto__: null,
+    context: 'options',
+  });
+  const { signal } = options;
 
-  const signal = options?.signal;
+  function failWriter(error) {
+    if (!options.preventFail) {
+      writer.fail?.(wrapError(error));
+    }
+  }
 
-  // Check for abort
-  signal?.throwIfAborted();
+  try {
+    signal?.throwIfAborted();
+  } catch (error) {
+    failWriter(error);
+    throw error;
+  }
 
   const hasWriteSync = typeof writer.writeSync === 'function';
-  const useSyncIterableFastPath =
-    hasWriteSync && canUseSyncIterablePipeToFastPath(source, transforms, signal);
-  const normalized = useSyncIterableFastPath ? undefined : from(source);
+  const normalized = from(source);
 
   let totalBytes = 0;
   const hasWritev = typeof writer.writev === 'function';
@@ -957,19 +1074,26 @@ async function pipeTo(source, ...args) {
 
   // Async fallback for writeBatch when sync write fails partway through.
   // Continues writing from batch[startIndex] using async write().
-  async function writeBatchAsyncFallback(batch, startIndex) {
-    for (let i = startIndex; i < batch.length; i++) {
-      const chunk = batch[i];
-      if (hasWriteSync && writer.writeSync(chunk)) {
-        // Sync retry succeeded
-      } else {
-        const result = writer.write(
-          chunk, signal ? { __proto__: null, signal } : undefined);
-        if (result !== undefined) {
-          await result;
+  async function writeBatchAsyncFallback(entry, startIndex) {
+    for (let i = startIndex; i < entry.views.length; i++) {
+      const view = entry.views[i];
+      if (hasWriteSync) {
+        const chunk = validateByteView(view);
+        if (writer.writeSync(chunk)) {
+          validateByteView(view);
+          totalBytes += view.byteLength;
+          continue;
         }
+        validateByteView(view);
       }
-      totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+      const result = writer.write(
+        validateByteView(view),
+        signal ? { __proto__: null, signal } : undefined);
+      if (result !== undefined) {
+        await result;
+      }
+      validateByteView(view);
+      totalBytes += view.byteLength;
     }
   }
 
@@ -977,63 +1101,42 @@ async function pipeTo(source, ...args) {
   // Returns undefined on sync success, or a Promise when async fallback
   // is required. Callers must check: const p = writeBatch(b); if (p) await p;
   function writeBatch(batch) {
+    const entry = createBatchEntry(batch);
     if (hasWritev && batch.length > 1) {
-      if (!hasWritevSync || !writer.writevSync(batch)) {
+      if (!hasWritevSync ||
+          !writer.writevSync(validateBatchEntry(entry))) {
+        validateBatchEntry(entry);
         const opts = signal ? { __proto__: null, signal } : undefined;
-        const writevResult = writer.writev(batch, opts);
+        const writevResult = writer.writev(validateBatchEntry(entry), opts);
         if (writevResult === undefined) {
-          for (let i = 0; i < batch.length; i++) {
-            totalBytes += TypedArrayPrototypeGetByteLength(batch[i]);
-          }
+          validateBatchEntry(entry);
+          totalBytes += entry.byteLength;
           return;
         }
         return PromisePrototypeThen(PromiseResolve(writevResult), () => {
-          for (let i = 0; i < batch.length; i++) {
-            totalBytes += TypedArrayPrototypeGetByteLength(batch[i]);
-          }
+          validateBatchEntry(entry);
+          totalBytes += entry.byteLength;
         });
       }
-      for (let i = 0; i < batch.length; i++) {
-        totalBytes += TypedArrayPrototypeGetByteLength(batch[i]);
-      }
+      validateBatchEntry(entry);
+      totalBytes += entry.byteLength;
       return;
     }
-    for (let i = 0; i < batch.length; i++) {
-      const chunk = batch[i];
+    for (let i = 0; i < entry.views.length; i++) {
+      const view = entry.views[i];
+      const chunk = validateByteView(view);
       if (!hasWriteSync || !writer.writeSync(chunk)) {
+        if (hasWriteSync) validateByteView(view);
         // Sync path failed at index i - fall back to async for the rest.
-        return writeBatchAsyncFallback(batch, i);
+        return writeBatchAsyncFallback(entry, i);
       }
-      totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+      validateByteView(view);
+      totalBytes += view.byteLength;
     }
   }
 
   try {
-    if (useSyncIterableFastPath) {
-      // Avoid from()'s async sync-iterable batching path. This keeps writes
-      // incremental for synchronous sources while preserving async
-      // normalization for non-primitive yielded values.
-      for (const value of source) {
-        if (isUint8ArrayBatch(value)) {
-          if (value.length > 0) {
-            const p = writeBatch(value);
-            if (p) await p;
-          }
-          continue;
-        }
-        if (isUint8Array(value)) {
-          const p = writeBatch([value]);
-          if (p) await p;
-          continue;
-        }
-
-        const batch = await ArrayFromAsync(normalizeAsyncValue(value));
-        if (batch.length > 0) {
-          const p = writeBatch(batch);
-          if (p) await p;
-        }
-      }
-    } else if (transforms.length === 0) {
+    if (transforms.length === 0) {
       // Fast path: no transforms - iterate normalized source directly
       if (signal) {
         for await (const batch of yieldAbortable(normalized, signal)) {
@@ -1064,15 +1167,13 @@ async function pipeTo(source, ...args) {
       }
     }
 
-    if (!options?.preventClose) {
+    if (!options.preventClose) {
       if (!hasEndSync || writer.endSync() < 0) {
         await writer.end?.(signal ? { __proto__: null, signal } : undefined);
       }
     }
   } catch (error) {
-    if (!options?.preventFail) {
-      writer.fail?.(wrapError(error));
-    }
+    failWriter(error);
     throw error;
   }
 
@@ -1084,4 +1185,5 @@ module.exports = {
   pipeToSync,
   pull,
   pullSync,
+  pullWithConsumerCleanup,
 };
diff --git a/lib/internal/streams/iter/push.js b/lib/internal/streams/iter/push.js
index cc7bfc900cec..0536d8212c2a 100644
--- a/lib/internal/streams/iter/push.js
+++ b/lib/internal/streams/iter/push.js
@@ -11,11 +11,11 @@ const {
   PromiseReject,
   PromiseResolve,
   PromiseWithResolvers,
+  SafeWeakSet,
   Symbol,
   SymbolAsyncDispose,
   SymbolAsyncIterator,
   SymbolDispose,
-  TypedArrayPrototypeGetByteLength,
 } = primordials;
 
 const {
@@ -25,8 +25,6 @@ const {
 } = require('internal/errors');
 const { lazyDOMException } = require('internal/util');
 const {
-  validateAbortSignal,
-  validateArray,
   validateInteger,
 } = require('internal/validators');
 
@@ -37,16 +35,20 @@ const {
 const {
   kPushDefaultBudget,
   kResolvedPromise,
+  createBatchEntry,
   onSignalAbort,
-  toUint8Array,
+  toWriterUint8Array,
   convertChunks,
   getWriterSignal,
   parsePullArgs,
-  validateBackpressure,
+  validateBatchEntry,
 } = require('internal/streams/iter/utils');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
-  pull: pullWithTransforms,
+  pullWithConsumerCleanup,
 } = require('internal/streams/iter/pull');
 
 const {
@@ -54,6 +56,11 @@ const {
 } = require('internal/streams/iter/ringbuffer');
 
 const kNoFailReason = Symbol('kNoFailReason');
+const consumerReturnErrors = new SafeWeakSet();
+
+function isConsumerReturnError(error) {
+  return consumerReturnErrors.has(error);
+}
 
 function raceEndWithSignal(promise, signal) {
   if (!signal) return promise;
@@ -117,16 +124,16 @@ class PushQueue {
   #bufferedBytes = 0;
 
   constructor(options = { __proto__: null }) {
+    options = converters.PushStreamOptions(options, {
+      __proto__: null,
+      context: 'options',
+    });
     const {
       budget = kPushDefaultBudget,
       backpressure = 'strict',
       signal,
     } = options;
     validateInteger(budget, 'options.budget', 16384);
-    validateBackpressure(backpressure);
-    if (signal !== undefined) {
-      validateAbortSignal(signal, 'options.signal');
-    }
     this.#budget = budget;
     this.#backpressure = backpressure;
     this.#signal = signal;
@@ -145,7 +152,7 @@ class PushQueue {
   // ===========================================================================
 
   /**
-   * Check if the next write is likely to be accepted.
+   * Check whether the slots buffer has capacity.
    * Returns null if writer is closed/errored or consumer has terminated.
    * @returns {boolean | null}
    */
@@ -153,14 +160,16 @@ class PushQueue {
     if (this.#writerState !== 'open' || this.#consumerState !== 'active') {
       return null;
     }
-    if ((this.#backpressure === 'strict' ||
-          this.#backpressure === 'unbounded') &&
-        this.#bufferedBytes >= this.#budget) {
+    if (this.#bufferedBytes >= this.#budget) {
       return false;
     }
     return true;
   }
 
+  get signal() {
+    return this.#signal;
+  }
+
   /**
    * Check if a sync write would be accepted.
    * @returns {boolean}
@@ -185,7 +194,11 @@ class PushQueue {
     if (this.#writerState !== 'open') return false;
     if (this.#consumerState !== 'active') return false;
 
-    const batchSize = this.#batchByteSize(chunks);
+    return this.#writeEntry(createBatchEntry(chunks));
+  }
+
+  #writeEntry(entry) {
+    const batchSize = entry.byteLength;
 
     // Skip empty chunks -- zero-byte writes would accumulate infinitely
     // without ever triggering backpressure under a byte-budget model.
@@ -201,7 +214,7 @@ class PushQueue {
           while (this.#bufferedBytes >= this.#budget &&
                  this.#slots.length > 0) {
             const evicted = this.#slots.shift();
-            this.#bufferedBytes -= this.#batchByteSize(evicted);
+            this.#bufferedBytes -= evicted.byteLength;
           }
           break;
         case 'drop-newest':
@@ -211,7 +224,7 @@ class PushQueue {
       }
     }
 
-    this.#slots.push(chunks);
+    this.#slots.push(entry);
     this.#bufferedBytes += batchSize;
     this.#bytesWritten += batchSize;
 
@@ -253,8 +266,8 @@ class PushQueue {
     // Check for pre-aborted signal (after state checks per spec)
     signal?.throwIfAborted();
 
-    // Try sync first
-    if (this.writeSync(chunks)) {
+    const entry = createBatchEntry(chunks);
+    if (this.#writeEntry(entry)) {
       return;
     }
 
@@ -266,9 +279,9 @@ class PushQueue {
             'Backpressure violation: too many pending writes. ' +
             'Await each write() call to respect backpressure.');
         }
-        return this.#createPendingWrite(chunks, signal);
+        return this.#createPendingWrite(entry, signal);
       case 'unbounded':
-        return this.#createPendingWrite(chunks, signal);
+        return this.#createPendingWrite(entry, signal);
       default:
         throw new ERR_INVALID_STATE(
           'Unexpected: writeSync should have handled non-strict policy');
@@ -281,16 +294,19 @@ class PushQueue {
    * promise rejects. Signal listeners are cleaned up on normal resolution.
    * @returns {Promise<void>}
    */
-  #createPendingWrite(chunks, signal) {
+  #createPendingWrite(batch, signal) {
     const { promise, resolve, reject } = PromiseWithResolvers();
-    const entry = { __proto__: null, chunks, resolve, reject };
+    const entry = { __proto__: null, batch, resolve, reject };
     this.#pendingWrites.push(entry);
 
     if (signal) {
       const onAbort = () => {
         // Remove from queue so it doesn't occupy a slot
         const idx = this.#pendingWrites.indexOf(entry);
-        if (idx !== -1) this.#pendingWrites.removeAt(idx);
+        if (idx !== -1) {
+          this.#pendingWrites.removeAt(idx);
+          this.#resolvePendingReads();
+        }
         reject(signal.reason ?? lazyDOMException('Aborted', 'AbortError'));
       };
 
@@ -325,31 +341,33 @@ class PushQueue {
       return this.#bytesWritten; // Idempotent
     }
 
-    this.#cleanup();
-    this.#rejectPendingWrites(
-      new ERR_INVALID_STATE.TypeError('Writer closed'));
     this.#resolvePendingDrains(false);
 
-    // If buffer is empty, close immediately
-    if (this.#slots.length === 0) {
+    // If there is no accepted work to drain, close immediately.
+    if (this.#slots.length === 0 && this.#pendingWrites.length === 0) {
       this.#writerState = 'closed';
+      this.#cleanup();
       this.#resolvePendingReads();
       return this.#bytesWritten;
     }
 
-    // Buffer has data: transition to closing, defer completion until drained
+    // Accepted work remains: close after it drains and the consumer pulls EOF.
     this.#writerState = 'closing';
     return -3; // Signal to PushWriter: create deferred end promise
   }
 
   /**
-   * Called by the read path when the consumer has drained all data while
-   * the writer is in the 'closing' state. Transitions to 'closed' and
-   * resolves the pending end promise.
+   * Called when the consumer pulls past all accepted data while the writer is
+   * closing. Transitions to 'closed' and resolves the pending end promise.
    */
   endDrained() {
-    if (this.#writerState !== 'closing') return;
+    if (this.#writerState !== 'closing' ||
+        this.#slots.length > 0 ||
+        this.#pendingWrites.length > 0) {
+      return;
+    }
     this.#writerState = 'closed';
+    this.#cleanup();
     if (this.#pendingEnd) {
       this.#pendingEnd.resolve(this.#bytesWritten);
       this.#pendingEnd = null;
@@ -374,6 +392,7 @@ class PushQueue {
     this.#cleanup();
     this.#rejectPendingReads(this.#error);
     this.#rejectPendingDrains(this.#error);
+    this.#rejectPendingWrites(this.#error);
 
     if (wasClosing) {
       // Short-circuit the graceful drain: reject the pending end promise
@@ -381,8 +400,6 @@ class PushQueue {
         this.#pendingEnd.reject(this.#error);
         this.#pendingEnd = null;
       }
-    } else {
-      this.#rejectPendingWrites(this.#error);
     }
   }
 
@@ -402,12 +419,12 @@ class PushQueue {
     return this.#writerState;
   }
 
-  get pendingEndPromise() {
-    return this.#pendingEnd?.promise ?? null;
-  }
-
-  setPendingEnd(pending) {
-    this.#pendingEnd = pending;
+  getPendingEndPromise() {
+    if (this.#pendingEnd === null) {
+      const { promise, resolve, reject } = PromiseWithResolvers();
+      this.#pendingEnd = { __proto__: null, promise, resolve, reject };
+    }
+    return this.#pendingEnd.promise;
   }
 
   /**
@@ -425,14 +442,17 @@ class PushQueue {
   // ===========================================================================
 
   async read() {
+    if (this.#consumerState === 'returned') {
+      return { __proto__: null, done: true, value: undefined };
+    }
+    if (this.#consumerState === 'thrown') {
+      throw this.#error;
+    }
+
     // If there's data in the buffer, return it immediately
     if (this.#slots.length > 0) {
       const result = this.#drain();
       this.#resolvePendingWrites();
-      // After draining, check if writer was closing and buffer is now empty
-      if (this.#writerState === 'closing' && this.#slots.length === 0) {
-        this.endDrained();
-      }
       return { __proto__: null, done: false, value: result };
     }
 
@@ -458,16 +478,10 @@ class PushQueue {
   consumerReturn() {
     if (this.#consumerState !== 'active') return;
     this.#consumerState = 'returned';
-    this.#cleanup();
+    const error = new ERR_INVALID_STATE.TypeError('Stream closed by consumer');
+    consumerReturnErrors.add(error);
+    this.#terminateWriterFromConsumer(error);
     this.#resolvePendingReads();
-    this.#rejectPendingWrites(
-      new ERR_INVALID_STATE.TypeError('Stream closed by consumer'));
-    // If closing, reject the pending end promise
-    if (this.#writerState === 'closing' && this.#pendingEnd) {
-      this.#pendingEnd.reject(
-        new ERR_INVALID_STATE.TypeError('Stream closed by consumer'));
-      this.#pendingEnd = null;
-    }
     // Resolve pending drains with false - no more data will be consumed
     this.#resolvePendingDrains(false);
   }
@@ -476,13 +490,8 @@ class PushQueue {
     if (this.#consumerState !== 'active') return;
     this.#consumerState = 'thrown';
     this.#error = error;
-    this.#cleanup();
+    this.#terminateWriterFromConsumer(error);
     this.#rejectPendingReads(error);
-    this.#rejectPendingWrites(error);
-    if (this.#writerState === 'closing' && this.#pendingEnd) {
-      this.#pendingEnd.reject(error);
-      this.#pendingEnd = null;
-    }
     // Reject pending drains - the consumer errored
     this.#rejectPendingDrains(error);
   }
@@ -492,38 +501,66 @@ class PushQueue {
   // ===========================================================================
 
   #drain() {
-    this.#bufferedBytes = 0;
-    if (this.#slots.length === 1) {
-      return this.#slots.shift();
-    }
+    try {
+      if (this.#slots.length === 1) {
+        const result = validateBatchEntry(this.#slots.shift());
+        this.#bufferedBytes = 0;
+        return result;
+      }
 
-    const result = [];
-    for (let i = 0; i < this.#slots.length; i++) {
-      const slot = this.#slots.get(i);
-      for (let j = 0; j < slot.length; j++) {
-        ArrayPrototypePush(result, slot[j]);
+      const result = [];
+      for (let i = 0; i < this.#slots.length; i++) {
+        const batch = validateBatchEntry(this.#slots.get(i));
+        for (let j = 0; j < batch.length; j++) {
+          ArrayPrototypePush(result, batch[j]);
+        }
       }
+      this.#slots.clear();
+      this.#bufferedBytes = 0;
+      return result;
+    } catch (error) {
+      this.#slots.clear();
+      this.#bufferedBytes = 0;
+      this.fail(error);
+      throw error;
     }
-    this.#slots.clear();
-    return result;
   }
 
-  #batchByteSize(batch) {
-    let size = 0;
-    for (let i = 0; i < batch.length; i++) {
-      size += TypedArrayPrototypeGetByteLength(batch[i]);
+  #terminateWriterFromConsumer(error) {
+    this.#slots.clear();
+    this.#bufferedBytes = 0;
+    if (this.#writerState === 'open' || this.#writerState === 'closing') {
+      this.#writerState = 'errored';
+      this.#error = error;
+    }
+    this.#cleanup();
+    this.#rejectPendingWrites(error);
+    if (this.#pendingEnd) {
+      this.#pendingEnd.reject(error);
+      this.#pendingEnd = null;
     }
-    return size;
   }
 
   #resolvePendingReads() {
     while (this.#pendingReads.length > 0) {
-      if (this.#slots.length > 0) {
+      if (this.#consumerState === 'returned') {
+        const pending = this.#pendingReads.shift();
+        pending.resolve({ __proto__: null, done: true, value: undefined });
+      } else if (this.#consumerState === 'thrown') {
         const pending = this.#pendingReads.shift();
-        const result = this.#drain();
-        this.#resolvePendingWrites();
-        pending.resolve({ __proto__: null, done: false, value: result });
-      } else if (this.#writerState === 'closing' && this.#slots.length === 0) {
+        pending.reject(this.#error);
+      } else if (this.#slots.length > 0) {
+        const pending = this.#pendingReads.shift();
+        try {
+          const result = this.#drain();
+          this.#resolvePendingWrites();
+          pending.resolve({ __proto__: null, done: false, value: result });
+        } catch (error) {
+          pending.reject(error);
+        }
+      } else if (this.#writerState === 'closing' &&
+                 this.#slots.length === 0 &&
+                 this.#pendingWrites.length === 0) {
         this.endDrained();
         const pending = this.#pendingReads.shift();
         pending.resolve({ __proto__: null, done: true, value: undefined });
@@ -533,9 +570,6 @@ class PushQueue {
       } else if (this.#writerState === 'errored') {
         const pending = this.#pendingReads.shift();
         pending.reject(this.#error);
-      } else if (this.#consumerState === 'returned') {
-        const pending = this.#pendingReads.shift();
-        pending.resolve({ __proto__: null, done: true, value: undefined });
       } else {
         break;
       }
@@ -546,11 +580,15 @@ class PushQueue {
     while (this.#pendingWrites.length > 0 &&
           this.#bufferedBytes < this.#budget) {
       const pending = this.#pendingWrites.shift();
-      const batchSize = this.#batchByteSize(pending.chunks);
-      this.#slots.push(pending.chunks);
-      this.#bufferedBytes += batchSize;
-      this.#bytesWritten += batchSize;
-      pending.resolve();
+      try {
+        validateBatchEntry(pending.batch);
+        this.#slots.push(pending.batch);
+        this.#bufferedBytes += pending.batch.byteLength;
+        this.#bytesWritten += pending.batch.byteLength;
+        pending.resolve();
+      } catch (error) {
+        pending.reject(error);
+      }
     }
 
     if (this.#bufferedBytes < this.#budget) {
@@ -617,35 +655,30 @@ class PushWriter {
   }
 
   write(chunk, options) {
+    const bytes = toWriterUint8Array(chunk);
     const signal = getWriterSignal(options);
     if (!signal && this.#queue.canWriteSync()) {
-      const bytes = toUint8Array(chunk);
       this.#queue.writeSync([bytes]);
       return kResolvedPromise;
     }
-    const bytes = toUint8Array(chunk);
     return this.#queue.writeAsync([bytes], signal);
   }
 
   writev(chunks, options) {
-    validateArray(chunks, 'chunks');
+    const bytes = convertChunks(chunks);
     const signal = getWriterSignal(options);
-    if (!signal && this.#queue.canWriteSync()) {
-      const bytes = convertChunks(chunks);
-      this.#queue.writeSync(bytes);
+    if (!signal && this.#queue.writeSync(bytes)) {
       return kResolvedPromise;
     }
-    const bytes = convertChunks(chunks);
     return this.#queue.writeAsync(bytes, signal);
   }
 
   writeSync(chunk) {
-    const bytes = toUint8Array(chunk);
+    const bytes = toWriterUint8Array(chunk);
     return this.#queue.writeSync([bytes]);
   }
 
   writevSync(chunks) {
-    validateArray(chunks, 'chunks');
     const bytes = convertChunks(chunks);
     return this.#queue.writeSync(bytes);
   }
@@ -660,15 +693,7 @@ class PushWriter {
       return PromiseReject(this.#queue.error);
     }
     if (result === -3) {
-      // Closing: buffer has data, create deferred promise that resolves
-      // when consumer drains past the end sentinel
-      const pendingEndPromise = this.#queue.pendingEndPromise;
-      if (pendingEndPromise !== null) {
-        return raceEndWithSignal(pendingEndPromise, signal);
-      }
-      const { promise, resolve, reject } = PromiseWithResolvers();
-      this.#queue.setPendingEnd({ __proto__: null, promise, resolve, reject });
-      return raceEndWithSignal(promise, signal);
+      return raceEndWithSignal(this.#queue.getPendingEndPromise(), signal);
     }
     // >= 0: byte count (immediate close or idempotent)
     return PromiseResolve(result);
@@ -688,8 +713,7 @@ class PushWriter {
   [SymbolAsyncDispose]() {
     const state = this.#queue.writerState;
     if (state === 'closing') {
-      // Wait for graceful drain
-      return this.#queue.pendingEndPromise ?? PromiseResolve();
+      return this.#queue.getPendingEndPromise();
     }
     if (state === 'open') {
       this.fail();
@@ -756,12 +780,8 @@ function push(...args) {
   // Apply transforms lazily if provided
   let readable;
   if (transforms.length > 0) {
-    if (options.signal) {
-      readable = pullWithTransforms(
-        rawReadable, ...transforms, { __proto__: null, signal: options.signal });
-    } else {
-      readable = pullWithTransforms(rawReadable, ...transforms);
-    }
+    readable = pullWithConsumerCleanup(
+      rawReadable, transforms, queue.signal);
   } else {
     readable = rawReadable;
   }
@@ -770,5 +790,6 @@ function push(...args) {
 }
 
 module.exports = {
+  isConsumerReturnError,
   push,
 };
diff --git a/lib/internal/streams/iter/share.js b/lib/internal/streams/iter/share.js
index 711abeb21b9a..70179dffd3c1 100644
--- a/lib/internal/streams/iter/share.js
+++ b/lib/internal/streams/iter/share.js
@@ -10,11 +10,12 @@ const {
   PromisePrototypeThen,
   PromiseResolve,
   PromiseWithResolvers,
+  SafePromiseRace,
   SafeSet,
+  Symbol,
   SymbolAsyncIterator,
   SymbolDispose,
   SymbolIterator,
-  TypedArrayPrototypeGetByteLength,
 } = primordials;
 
 const {
@@ -30,19 +31,23 @@ const {
 } = require('internal/streams/iter/from');
 
 const {
-  pull: pullWithTransforms,
   pullSync: pullSyncWithTransforms,
+  pullWithConsumerCleanup,
 } = require('internal/streams/iter/pull');
 
 const {
   kMultiConsumerDefaultBudget,
+  createBatchEntry,
   getMinCursor,
   hasProtocol,
   onSignalAbort,
   wrapError,
   parsePullArgs,
-  validateBackpressure,
+  validateBatchEntry,
 } = require('internal/streams/iter/utils');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
   RingBuffer,
@@ -56,15 +61,16 @@ const {
   },
 } = require('internal/errors');
 const {
-  validateAbortSignal,
   validateInteger,
-  validateObject,
 } = require('internal/validators');
 
 // =============================================================================
 // Async Share Implementation
 // =============================================================================
 
+const kNoShareError = Symbol('kNoShareError');
+const kShareCancelled = Symbol('kShareCancelled');
+
 class ShareImpl {
   #source;
   #options;
@@ -77,6 +83,9 @@ class ShareImpl {
   #cancelled = false;
   #pulling = false;
   #pullWaiters = [];
+  #cancelPromise;
+  #resolveCancel;
+  #cancelError = kNoShareError;
   #cachedMinCursor = 0;
   #cachedMinCursorConsumers = 0;
   /** Cumulative byte size of buffered entries */
@@ -85,6 +94,9 @@ class ShareImpl {
   constructor(source, options) {
     this.#source = source;
     this.#options = options;
+    const { promise, resolve } = PromiseWithResolvers();
+    this.#cancelPromise = promise;
+    this.#resolveCancel = resolve;
   }
 
   get consumerCount() {
@@ -92,9 +104,13 @@ class ShareImpl {
   }
 
   pull(...args) {
-    const { transforms, options } = parsePullArgs(args);
-    const signal = options?.signal;
-    validateAbortSignal(signal, 'options.signal');
+    const parsed = parsePullArgs(args);
+    const { transforms } = parsed;
+    const options = converters.PullOptions(parsed.options, {
+      __proto__: null,
+      context: 'options',
+    });
+    const { signal } = options;
 
     // Avoid registering a consumer that the pre-aborted pipeline will never
     // read or detach.
@@ -111,13 +127,7 @@ class ShareImpl {
     const rawConsumer = this.#createRawConsumer();
 
     if (transforms.length > 0 || signal) {
-      if (signal) {
-        return pullWithTransforms(
-          rawConsumer,
-          ...transforms,
-          { __proto__: null, signal });
-      }
-      return pullWithTransforms(rawConsumer, ...transforms);
+      return pullWithConsumerCleanup(rawConsumer, transforms, signal);
     }
     return rawConsumer;
   }
@@ -129,6 +139,7 @@ class ShareImpl {
       resolve: null,
       reject: null,
       detached: false,
+      error: kNoShareError,
       pendingNext: PromiseResolve(),
     };
 
@@ -147,32 +158,28 @@ class ShareImpl {
       __proto__: null,
       [SymbolAsyncIterator]() {
         const getNext = async () => {
-          if (self.#sourceError !== undefined) {
-            state.detached = true;
-            self.#consumers.delete(state);
-            throw self.#sourceError;
-          }
-
           // Loop until we get data, source is exhausted, or
           // consumer is detached. Multiple consumers may be woken
           // after a single pull - those that find no data at their
           // cursor must re-pull rather than terminating prematurely.
           for (;;) {
             if (state.detached) {
-              if (self.#sourceError !== undefined) throw self.#sourceError;
+              if (state.error !== kNoShareError) throw state.error;
               return { __proto__: null, done: true, value: undefined };
             }
 
             if (self.#cancelled) {
               state.detached = true;
+              state.error = self.#cancelError;
               self.#deleteConsumer(state);
+              if (state.error !== kNoShareError) throw state.error;
               return { __proto__: null, done: true, value: undefined };
             }
 
             // Check if data is available in buffer
             const bufferIndex = state.cursor - self.#bufferStart;
             if (bufferIndex < self.#buffer.length) {
-              const chunk = self.#buffer.get(bufferIndex);
+              const chunk = self.#readEntry(self.#buffer.get(bufferIndex));
               const cursor = state.cursor;
               state.cursor++;
               if (cursor === self.#cachedMinCursor &&
@@ -185,7 +192,10 @@ class ShareImpl {
             if (self.#sourceExhausted) {
               state.detached = true;
               self.#deleteConsumer(state);
-              if (self.#sourceError !== undefined) throw self.#sourceError;
+              if (self.#sourceError !== undefined) {
+                state.error = self.#sourceError;
+                throw state.error;
+              }
               return { __proto__: null, done: true, value: undefined };
             }
 
@@ -193,8 +203,9 @@ class ShareImpl {
             const shouldBuffer = await self.#waitForBufferSpace();
             if (shouldBuffer === null) {
               state.detached = true;
+              state.error = self.#cancelError;
               self.#deleteConsumer(state);
-              if (self.#sourceError !== undefined) throw self.#sourceError;
+              if (state.error !== kNoShareError) throw state.error;
               return { __proto__: null, done: true, value: undefined };
             }
 
@@ -246,14 +257,23 @@ class ShareImpl {
     this.#cancelled = true;
 
     if (reason !== undefined) {
-      this.#sourceError = reason;
+      this.#cancelError = reason;
     }
 
+    this.#resolveCancel(kShareCancelled);
+    this.#resolveCancel = null;
+
     if (this.#sourceIterator?.return) {
-      PromisePrototypeThen(this.#sourceIterator.return(), undefined, () => {});
+      try {
+        PromisePrototypeThen(
+          PromiseResolve(this.#sourceIterator.return()), undefined, () => {});
+      } catch {
+        // Cancellation has precedence over source cleanup errors.
+      }
     }
 
     for (const consumer of this.#consumers) {
+      consumer.error = this.#cancelError;
       if (consumer.resolve) {
         if (reason !== undefined) {
           consumer.reject?.(reason);
@@ -266,6 +286,8 @@ class ShareImpl {
       consumer.detached = true;
     }
     this.#consumers.clear();
+    this.#buffer.clear();
+    this.#bufferedBytes = 0;
 
     for (let i = 0; i < this.#pullWaiters.length; i++) {
       this.#pullWaiters[i]();
@@ -302,7 +324,7 @@ class ShareImpl {
           while (this.#bufferedBytes >= this.#options.budget &&
                  this.#buffer.length > 0) {
             const evicted = this.#buffer.shift();
-            this.#bufferedBytes -= this.#batchByteSize(evicted);
+            this.#bufferedBytes -= evicted.byteLength;
             this.#bufferStart++;
           }
           for (const consumer of this.#consumers) {
@@ -369,13 +391,19 @@ class ShareImpl {
           }
         }
 
-        const result = await this.#sourceIterator.next();
+        const result = await SafePromiseRace([
+          this.#sourceIterator.next(),
+          this.#cancelPromise,
+        ]);
+
+        if (this.#cancelled || result === kShareCancelled) return;
 
         if (result.done) {
           this.#sourceExhausted = true;
         } else if (!discard) {
-          this.#buffer.push(result.value);
-          this.#bufferedBytes += this.#batchByteSize(result.value);
+          const entry = createBatchEntry(result.value);
+          this.#buffer.push(entry);
+          this.#bufferedBytes += entry.byteLength;
         }
       } catch (error) {
         this.#sourceError = wrapError(error);
@@ -398,7 +426,7 @@ class ShareImpl {
     if (trimCount > 0) {
       for (let i = 0; i < trimCount; i++) {
         const evicted = this.#buffer.get(i);
-        this.#bufferedBytes -= this.#batchByteSize(evicted);
+        this.#bufferedBytes -= evicted.byteLength;
       }
       this.#buffer.trimFront(trimCount);
       this.#bufferStart = this.#cachedMinCursor;
@@ -409,12 +437,15 @@ class ShareImpl {
     }
   }
 
-  #batchByteSize(batch) {
-    let size = 0;
-    for (let i = 0; i < batch.length; i++) {
-      size += TypedArrayPrototypeGetByteLength(batch[i]);
+  #readEntry(entry) {
+    try {
+      return validateBatchEntry(entry);
+    } catch (error) {
+      this.cancel(error);
+      this.#buffer.clear();
+      this.#bufferedBytes = 0;
+      throw error;
     }
-    return size;
   }
 
   #recomputeMinCursor() {
@@ -517,7 +548,7 @@ class SyncShareImpl {
 
             const bufferIndex = state.cursor - self.#bufferStart;
             if (bufferIndex < self.#buffer.length) {
-              const chunk = self.#buffer.get(bufferIndex);
+              const chunk = self.#readEntry(self.#buffer.get(bufferIndex));
               const cursor = state.cursor;
               state.cursor++;
               if (cursor === self.#cachedMinCursor &&
@@ -549,7 +580,7 @@ class SyncShareImpl {
                   while (self.#bufferedBytes >= self.#options.budget &&
                          self.#buffer.length > 0) {
                     const evicted = self.#buffer.shift();
-                    self.#bufferedBytes -= self.#batchByteSize(evicted);
+                    self.#bufferedBytes -= evicted.byteLength;
                     self.#bufferStart++;
                   }
                   for (const consumer of self.#consumers) {
@@ -577,7 +608,7 @@ class SyncShareImpl {
 
             const newBufferIndex = state.cursor - self.#bufferStart;
             if (newBufferIndex < self.#buffer.length) {
-              const chunk = self.#buffer.get(newBufferIndex);
+              const chunk = self.#readEntry(self.#buffer.get(newBufferIndex));
               const cursor = state.cursor;
               state.cursor++;
               if (cursor === self.#cachedMinCursor &&
@@ -649,8 +680,9 @@ class SyncShareImpl {
       if (result.done) {
         this.#sourceExhausted = true;
       } else {
-        this.#buffer.push(result.value);
-        this.#bufferedBytes += this.#batchByteSize(result.value);
+        const entry = createBatchEntry(result.value);
+        this.#buffer.push(entry);
+        this.#bufferedBytes += entry.byteLength;
       }
     } catch (error) {
       this.#sourceError = wrapError(error);
@@ -666,19 +698,22 @@ class SyncShareImpl {
     if (trimCount > 0) {
       for (let i = 0; i < trimCount; i++) {
         const evicted = this.#buffer.get(i);
-        this.#bufferedBytes -= this.#batchByteSize(evicted);
+        this.#bufferedBytes -= evicted.byteLength;
       }
       this.#buffer.trimFront(trimCount);
       this.#bufferStart = this.#cachedMinCursor;
     }
   }
 
-  #batchByteSize(batch) {
-    let size = 0;
-    for (let i = 0; i < batch.length; i++) {
-      size += TypedArrayPrototypeGetByteLength(batch[i]);
+  #readEntry(entry) {
+    try {
+      return validateBatchEntry(entry);
+    } catch (error) {
+      this.cancel(error);
+      this.#buffer.clear();
+      this.#bufferedBytes = 0;
+      throw error;
     }
-    return size;
   }
 
   #recomputeMinCursor() {
@@ -715,17 +750,16 @@ function onShareCancel(shareImpl, signal) {
 function share(source, options = { __proto__: null }) {
   // Normalize source via from() - accepts strings, ArrayBuffers, protocols, etc.
   const normalized = from(source);
-  validateObject(options, 'options');
+  options = converters.ShareOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const {
     budget = kMultiConsumerDefaultBudget,
     backpressure = 'strict',
     signal,
   } = options;
   validateInteger(budget, 'options.budget', 16384);
-  validateBackpressure(backpressure);
-  if (signal !== undefined) {
-    validateAbortSignal(signal, 'options.signal');
-  }
 
   const opts = {
     __proto__: null,
@@ -746,13 +780,15 @@ function share(source, options = { __proto__: null }) {
 function shareSync(source, options = { __proto__: null }) {
   // Normalize source via fromSync() - accepts strings, ArrayBuffers, protocols, etc.
   const normalized = fromSync(source);
-  validateObject(options, 'options');
+  options = converters.ShareSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const {
     budget = kMultiConsumerDefaultBudget,
     backpressure = 'strict',
   } = options;
   validateInteger(budget, 'options.budget', 16384);
-  validateBackpressure(backpressure);
 
   const opts = {
     __proto__: null,
diff --git a/lib/internal/streams/iter/utils.js b/lib/internal/streams/iter/utils.js
index 9966f351b9d5..08337a5536f2 100644
--- a/lib/internal/streams/iter/utils.js
+++ b/lib/internal/streams/iter/utils.js
@@ -3,6 +3,7 @@
 const {
   Array,
   ArrayBufferPrototypeGetByteLength,
+  ArrayBufferPrototypeGetDetached,
   ArrayPrototypeSlice,
   PromiseResolve,
   PromiseWithResolvers,
@@ -25,6 +26,7 @@ const { TextEncoder } = require('internal/encoding');
 const {
   codes: {
     ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_STATE,
     ERR_OPERATION_FAILED,
   },
 } = require('internal/errors');
@@ -33,9 +35,11 @@ const { isError } = require('internal/util');
 const { isSharedArrayBuffer, isUint8Array } = require('internal/util/types');
 
 const {
-  validateAbortSignal,
   validateOneOf,
 } = require('internal/validators');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 // Cached resolved promise to avoid allocating a new one on every sync fast-path.
 const kResolvedPromise = PromiseResolve();
@@ -183,17 +187,69 @@ function toUint8Array(chunk) {
   return chunk;
 }
 
-/**
- * Check if all chunks in an array are already Uint8Array.
- * Short-circuits on the first non-Uint8Array chunk found.
- * @param {Array<Uint8Array|string>} chunks
- * @returns {boolean}
- */
-function allUint8Array(chunks) {
+function snapshotByteView(value) {
+  const buffer = TypedArrayPrototypeGetBuffer(value);
+  const sharedBufferView = isSharedArrayBuffer(buffer) ?
+    new Uint8Array(buffer) : undefined;
+  return {
+    __proto__: null,
+    value,
+    buffer,
+    bufferByteLength: sharedBufferView === undefined ?
+      ArrayBufferPrototypeGetByteLength(buffer) :
+      TypedArrayPrototypeGetByteLength(sharedBufferView),
+    byteLength: TypedArrayPrototypeGetByteLength(value),
+    byteOffset: TypedArrayPrototypeGetByteOffset(value),
+    detached: sharedBufferView === undefined &&
+      ArrayBufferPrototypeGetDetached(buffer),
+    sharedBufferView,
+  };
+}
+
+function validateByteView(snapshot) {
+  const {
+    value,
+    buffer,
+    bufferByteLength,
+    byteLength,
+    byteOffset,
+    detached,
+    sharedBufferView,
+  } = snapshot;
+  const currentBufferByteLength = sharedBufferView === undefined ?
+    ArrayBufferPrototypeGetByteLength(buffer) :
+    TypedArrayPrototypeGetByteLength(sharedBufferView);
+  const currentDetached = sharedBufferView === undefined &&
+    ArrayBufferPrototypeGetDetached(buffer);
+
+  if (TypedArrayPrototypeGetBuffer(value) !== buffer ||
+      currentBufferByteLength !== bufferByteLength ||
+      TypedArrayPrototypeGetByteLength(value) !== byteLength ||
+      TypedArrayPrototypeGetByteOffset(value) !== byteOffset ||
+      currentDetached !== detached) {
+    throw new ERR_INVALID_STATE.TypeError(
+      'Byte view was resized or detached after being accepted');
+  }
+  return value;
+}
+
+function createBatchEntry(chunks) {
+  const views = new Array(chunks.length);
+  let byteLength = 0;
   for (let i = 0; i < chunks.length; i++) {
-    if (!isUint8Array(chunks[i])) return false;
+    const view = snapshotByteView(chunks[i]);
+    views[i] = view;
+    byteLength += view.byteLength;
   }
-  return true;
+  return { __proto__: null, views, byteLength };
+}
+
+function validateBatchEntry(entry) {
+  const chunks = new Array(entry.views.length);
+  for (let i = 0; i < entry.views.length; i++) {
+    chunks[i] = validateByteView(entry.views[i]);
+  }
+  return chunks;
 }
 
 function copyBytes(chunk) {
@@ -250,9 +306,10 @@ function concatBytes(chunks) {
  * @returns {Uint8Array[]}
  */
 function convertChunks(chunks) {
-  if (allUint8Array(chunks)) {
-    return ArrayPrototypeSlice(chunks);
-  }
+  chunks = converters.WriterChunkSequence(chunks, {
+    __proto__: null,
+    context: 'chunks',
+  });
   const len = chunks.length;
   const result = new Array(len);
   for (let i = 0; i < len; i++) {
@@ -267,9 +324,17 @@ function convertChunks(chunks) {
  * @returns {AbortSignal|undefined}
  */
 function getWriterSignal(options) {
-  const signal = options?.signal;
-  validateAbortSignal(signal, 'options.signal');
-  return signal;
+  return converters.WriteOptions(options, {
+    __proto__: null,
+    context: 'options',
+  }).signal;
+}
+
+function toWriterUint8Array(chunk) {
+  return toUint8Array(converters.WriterChunk(chunk, {
+    __proto__: null,
+    context: 'chunk',
+  }));
 }
 
 /**
@@ -297,20 +362,6 @@ function hasProtocol(value, symbol) {
   );
 }
 
-/**
- * Check if a value is PullOptions (object without transform or write property).
- * @param {unknown} value
- * @returns {boolean}
- */
-function isPullOptions(value) {
-  return (
-    value !== null &&
-    typeof value === 'object' &&
-    !('transform' in value) &&
-    !('write' in value)
-  );
-}
-
 /**
  * Check if a value is a stateful transform object (has a transform method).
  * @param {unknown} value
@@ -333,7 +384,7 @@ function isTransform(value) {
  * Parse variadic arguments for pull/pullSync.
  * Returns { transforms, options }
  * @param {Array} args
- * @returns {{ transforms: Array, options: object|undefined }}
+ * @returns {{ transforms: Array, options: unknown }}
  */
 function parsePullArgs(args) {
   if (args.length === 0) {
@@ -343,7 +394,7 @@ function parsePullArgs(args) {
   let transforms;
   let options;
   const last = args[args.length - 1];
-  if (isPullOptions(last)) {
+  if (!isTransform(last)) {
     transforms = ArrayPrototypeSlice(args, 0, -1);
     options = last;
   } else {
@@ -379,19 +430,21 @@ module.exports = {
   kMultiConsumerDefaultBudget,
   kPushDefaultBudget,
   kResolvedPromise,
-  allUint8Array,
   concatBytes,
   convertChunks,
+  createBatchEntry,
   getWriterSignal,
   getMinCursor,
   hasProtocol,
-  isPullOptions,
   isTransform,
   isTransformObject,
   onSignalAbort,
   parsePullArgs,
   toUint8Array,
+  toWriterUint8Array,
   validateBackpressure,
+  validateBatchEntry,
+  validateByteView,
   wrapError,
   yieldAbortable,
 };
diff --git a/lib/internal/streams/iter/webidl.js b/lib/internal/streams/iter/webidl.js
new file mode 100644
index 000000000000..b971fa95071b
--- /dev/null
+++ b/lib/internal/streams/iter/webidl.js
@@ -0,0 +1,177 @@
+'use strict';
+
+const {
+  converters: baseConverters,
+  convertToInt,
+  createDictionaryConverter,
+  createEnumConverter,
+  createInterfaceConverter,
+  createSequenceConverter,
+} = require('internal/webidl');
+const { AbortSignal } = require('internal/abort_controller');
+const { isUint8Array } = require('internal/util/types');
+
+const converters = { __proto__: null };
+
+function unsignedLongLong(value, options) {
+  return convertToInt(value, 64, 'unsigned', options);
+}
+
+function enforceRangeUnsignedLongLong(value, options = { __proto__: null }) {
+  return convertToInt(value, 64, 'unsigned', {
+    __proto__: null,
+    prefix: options.prefix,
+    context: options.context,
+    code: options.code,
+    enforceRange: true,
+  });
+}
+
+function allowStreamBufferOptions(options) {
+  return {
+    __proto__: null,
+    prefix: options.prefix,
+    context: options.context,
+    code: options.code,
+    allowShared: true,
+    allowResizable: true,
+  };
+}
+
+converters.AbortSignal = createInterfaceConverter(
+  'AbortSignal', AbortSignal.prototype);
+converters.BackpressurePolicy = createEnumConverter('BackpressurePolicy', [
+  'strict',
+  'unbounded',
+  'drop-oldest',
+  'drop-newest',
+]);
+converters.unsignedLongLong = unsignedLongLong;
+converters.enforceRangeUnsignedLongLong = enforceRangeUnsignedLongLong;
+converters.WriterChunk = (value, options = { __proto__: null }) => {
+  if (isUint8Array(value)) {
+    return baseConverters.Uint8Array(
+      value, allowStreamBufferOptions(options));
+  }
+  return baseConverters.USVString(value, options);
+};
+converters.WriterChunkSequence = createSequenceConverter(
+  converters.WriterChunk);
+
+const signalMember = {
+  __proto__: null,
+  key: 'signal',
+  converter: converters.AbortSignal,
+};
+const budgetMember = {
+  __proto__: null,
+  key: 'budget',
+  converter: converters.unsignedLongLong,
+};
+const backpressureMember = {
+  __proto__: null,
+  key: 'backpressure',
+  converter: converters.BackpressurePolicy,
+  defaultValue: () => 'strict',
+};
+const limitMember = {
+  __proto__: null,
+  key: 'limit',
+  converter: converters.enforceRangeUnsignedLongLong,
+};
+
+converters.WriteOptions = createDictionaryConverter('WriteOptions', [
+  signalMember,
+]);
+converters.PushStreamOptions = createDictionaryConverter(
+  'PushStreamOptions', [budgetMember, backpressureMember, signalMember]);
+converters.PullOptions = createDictionaryConverter('PullOptions', [
+  signalMember,
+]);
+converters.PipeToOptions = createDictionaryConverter('PipeToOptions', [
+  {
+    __proto__: null,
+    key: 'preventClose',
+    converter: baseConverters.boolean,
+    defaultValue: () => false,
+  },
+  {
+    __proto__: null,
+    key: 'preventFail',
+    converter: baseConverters.boolean,
+    defaultValue: () => false,
+  },
+  signalMember,
+]);
+converters.PipeToSyncOptions = createDictionaryConverter(
+  'PipeToSyncOptions', [
+    {
+      __proto__: null,
+      key: 'preventClose',
+      converter: baseConverters.boolean,
+      defaultValue: () => false,
+    },
+    {
+      __proto__: null,
+      key: 'preventFail',
+      converter: baseConverters.boolean,
+      defaultValue: () => false,
+    },
+  ]);
+converters.ConsumeOptions = createDictionaryConverter('ConsumeOptions', [
+  limitMember,
+  signalMember,
+]);
+converters.ConsumeSyncOptions = createDictionaryConverter(
+  'ConsumeSyncOptions', [limitMember]);
+const encodingMember = {
+  __proto__: null,
+  key: 'encoding',
+  converter: baseConverters.DOMString,
+  defaultValue: () => 'utf-8',
+};
+converters.TextConsumeOptions = createDictionaryConverter(
+  'TextConsumeOptions', [
+    [limitMember, signalMember],
+    [encodingMember],
+  ]);
+converters.TextConsumeSyncOptions = createDictionaryConverter(
+  'TextConsumeSyncOptions', [
+    [limitMember],
+    [encodingMember],
+  ]);
+converters.MergeOptions = createDictionaryConverter('MergeOptions', [
+  signalMember,
+]);
+converters.BroadcastOptions = createDictionaryConverter(
+  'BroadcastOptions', [budgetMember, backpressureMember, signalMember]);
+converters.ShareOptions = createDictionaryConverter(
+  'ShareOptions', [budgetMember, backpressureMember, signalMember]);
+converters.ShareSyncOptions = createDictionaryConverter(
+  'ShareSyncOptions', [budgetMember, backpressureMember]);
+converters.DuplexDirectionOptions = createDictionaryConverter(
+  'DuplexDirectionOptions', [
+    budgetMember,
+    {
+      __proto__: null,
+      key: 'backpressure',
+      converter: converters.BackpressurePolicy,
+    },
+  ]);
+converters.DuplexOptions = createDictionaryConverter('DuplexOptions', [
+  {
+    __proto__: null,
+    key: 'a',
+    converter: converters.DuplexDirectionOptions,
+  },
+  {
+    __proto__: null,
+    key: 'b',
+    converter: converters.DuplexDirectionOptions,
+  },
+  budgetMember,
+  backpressureMember,
+  signalMember,
+]);
+
+module.exports = { converters };
diff --git a/lib/internal/streams/readable.js b/lib/internal/streams/readable.js
index 56b819abac4f..847b3837af4c 100644
--- a/lib/internal/streams/readable.js
+++ b/lib/internal/streams/readable.js
@@ -138,6 +138,7 @@ const kHasPaused = 1 << 25;
 const kPaused = 1 << 26;
 const kDataListening = 1 << 27;
 const kEndScheduled = 1 << 28;
+const kEofReadablePending = 1 << 29;
 
 // TODO(benjamingr) it is likely slower to do it this way than with free functions
 function makeBitMapDescriptor(bit) {
@@ -682,7 +683,7 @@ Readable.prototype.read = function(n) {
     state.highWaterMark = computeNewHighWaterMark(n);
 
   if (n !== 0)
-    state[kState] &= ~kEmittedReadable;
+    state[kState] &= ~(kEmittedReadable | kEofReadablePending);
 
   // If we're doing read(0) to trigger a readable event, but we
   // already have a bunch of data in the buffer, then just trigger
@@ -825,7 +826,16 @@ function onEofChunk(stream, state) {
     // If we are sync, wait until next tick to emit the data.
     // Otherwise we risk emitting data in the flow()
     // the readable code triggers during a read() call.
-    emitReadable(stream);
+    if ((state[kState] & (kFlowing | kNeedReadable)) !== 0 ||
+        stream.listenerCount('readable') > 0) {
+      emitReadable(stream);
+    } else {
+      // Nobody is observing the stream: do not schedule the 'readable'
+      // emission at all. A 'readable' listener attached later redeems it
+      // (see Readable.prototype.on), and read() and resume() reach the
+      // end of the stream on their own.
+      state[kState] |= kEofReadablePending;
+    }
   } else {
     // Emit 'readable' now to make sure it gets picked up.
     state[kState] &= ~kNeedReadable;
@@ -1178,8 +1188,17 @@ Readable.prototype.on = function(ev, fn) {
       debug('on readable');
       if (state.length) {
         emitReadable(this);
-      } else if ((state[kState] & kReading) === 0) {
-        process.nextTick(nReadingNextTick, this);
+      } else {
+        if ((state[kState] & kEofReadablePending) !== 0) {
+          // The end-of-stream 'readable' emission was skipped because
+          // nobody was listening when the stream ended (see onEofChunk):
+          // emit it now.
+          state[kState] &= ~kEofReadablePending;
+          emitReadable(this);
+        }
+        if ((state[kState] & kReading) === 0) {
+          process.nextTick(nReadingNextTick, this);
+        }
       }
     }
   }
diff --git a/lib/internal/tls/wrap.js b/lib/internal/tls/wrap.js
index 1c6e0577ce3d..37fa7845843f 100644
--- a/lib/internal/tls/wrap.js
+++ b/lib/internal/tls/wrap.js
@@ -1322,7 +1322,7 @@ function onServerSocketSecure() {
 
       if (this._rejectUnauthorized)
         this.destroy();
-    } else if (!this._handle.getPeerX509Certificate()) {
+    } else if (!this._handle.hasPeerCertificate()) {
       // Ncrypto reports X509_V_OK for TLS 1.3 resumption without a peer
       // certificate, as it uses PSKs. Require one to authorize the socket.
       this.authorizationError = 'UNABLE_TO_GET_ISSUER_CERT';
diff --git a/lib/internal/util/comparisons.js b/lib/internal/util/comparisons.js
index 6b608a66733a..92594e8994fb 100644
--- a/lib/internal/util/comparisons.js
+++ b/lib/internal/util/comparisons.js
@@ -15,6 +15,7 @@ const {
   Date,
   DatePrototypeGetTime,
   Error,
+  Float16Array,
   Float32Array,
   Float64Array,
   Function,
@@ -50,7 +51,6 @@ const {
   Uint8ClampedArray,
   WeakMap,
   WeakSet,
-  globalThis: { Float16Array },
 } = primordials;
 
 const { compare } = internalBinding('buffer');
@@ -70,6 +70,7 @@ const wellKnownConstructors = new SafeSet()
   .add(DataView)
   .add(Date)
   .add(Error)
+  .add(Float16Array)
   .add(Float32Array)
   .add(Float64Array)
   .add(Function)
@@ -91,10 +92,6 @@ const wellKnownConstructors = new SafeSet()
   .add(WeakMap)
   .add(WeakSet);
 
-if (Float16Array) { // TODO(BridgeAR): Remove when Flag got removed from V8
-  wellKnownConstructors.add(Float16Array);
-}
-
 const types = require('internal/util/types');
 const {
   isAnyArrayBuffer,
diff --git a/lib/internal/util/inspect.js b/lib/internal/util/inspect.js
index 1a029c7cf761..2e6c564cd3c4 100644
--- a/lib/internal/util/inspect.js
+++ b/lib/internal/util/inspect.js
@@ -1029,20 +1029,15 @@ function getPrefix(constructor, tag, fallback, size = '') {
     return `[${fallback}${size}: null prototype] `;
   }
 
-  let result = `${constructor}${size} `;
   if (tag !== '') {
-    const position = constructor.indexOf(tag);
-    if (position === -1) {
-      result += `[${tag}] `;
-    } else {
-      const endPos = position + tag.length;
-      if (endPos !== constructor.length &&
-        constructor[endPos] === constructor[endPos].toLowerCase()) {
-        result += `[${tag}] `;
-      }
+    const dot = StringPrototypeLastIndexOf(tag, '.');
+    if (constructor === (dot >= 1 ? StringPrototypeSlice(tag, dot + 1) : tag)) {
+      return `${tag}${size} `;
     }
+    return `${constructor}${size} [${tag}] `;
   }
-  return result;
+
+  return `${constructor}${size} `;
 }
 
 // Look up the keys of the object.
diff --git a/lib/internal/vfs/file_system.js b/lib/internal/vfs/file_system.js
index e47ed4c61080..574c076c426d 100644
--- a/lib/internal/vfs/file_system.js
+++ b/lib/internal/vfs/file_system.js
@@ -3,6 +3,7 @@
 const {
   MathRandom,
   ObjectFreeze,
+  StringPrototypeStartsWith,
   Symbol,
   SymbolDispose,
 } = primordials;
@@ -15,10 +16,10 @@ const {
 const { validateBoolean } = require('internal/validators');
 const { MemoryProvider } = require('internal/vfs/providers/memory');
 const path = require('path');
-const { posix: pathPosix, isAbsolute, resolve: resolvePath } = path;
+const { posix: pathPosix, resolve: resolvePath, sep, toNamespacedPath } = path;
 const { join: joinPath } = pathPosix;
 const {
-  isUnderMountPoint,
+  getLayerRoot,
   getRelativePath,
 } = require('internal/vfs/router');
 const {
@@ -38,13 +39,30 @@ let debug = require('internal/util/debuglog').debuglog('vfs', (fn) => {
   debug = fn;
 });
 
-// Private symbols
 const kProvider = Symbol('kProvider');
 const kMountPoint = Symbol('kMountPoint');
+// Cached normalizeMountedPath(kMountPoint) so the hot dispatch path
+// does not recompute toNamespacedPath(resolve(...)) on every fs call.
+const kNormalizedMountPoint = Symbol('kNormalizedMountPoint');
 const kMounted = Symbol('kMounted');
 const kPromises = Symbol('kPromises');
+const kLayerId = Symbol('kLayerId');
+
+let nextLayerId = 0;
+
+/**
+ * Normalizes paths for mount-point comparisons. On Windows, `path.resolve('/x')`
+ * yields `C:\x`, while loader internals often pass namespaced paths like
+ * `\\?\C:\x`. Compare using a single canonical representation so POSIX-style
+ * rooted test paths, drive-absolute paths, and namespaced paths all route to the
+ * same VFS mount.
+ * @param {string} inputPath
+ * @returns {string}
+ */
+function normalizeMountedPath(inputPath) {
+  return toNamespacedPath(resolvePath(inputPath));
+}
 
-// Lazy-loaded VFS setup
 let registerVFS;
 let deregisterVFS;
 
@@ -68,15 +86,11 @@ class VirtualFileSystem {
    * @param {boolean} [options.emitExperimentalWarning] Emit the experimental warning (default: true)
    */
   constructor(providerOrOptions, options = kEmptyObject) {
-
-    // Handle case where first arg is options object (no provider)
     let provider = null;
     if (providerOrOptions !== undefined && providerOrOptions !== null) {
       if (typeof providerOrOptions.openSync === 'function') {
-        // It's a provider
         provider = providerOrOptions;
       } else if (typeof providerOrOptions === 'object') {
-        // It's options (no provider specified)
         options = providerOrOptions;
         provider = null;
       }
@@ -92,8 +106,10 @@ class VirtualFileSystem {
 
     this[kProvider] = provider ?? new MemoryProvider();
     this[kMountPoint] = null;
+    this[kNormalizedMountPoint] = null;
     this[kMounted] = false;
-    this[kPromises] = null; // Lazy-initialized
+    this[kPromises] = null;
+    this[kLayerId] = nextLayerId++;
   }
 
   /**
@@ -112,6 +128,17 @@ class VirtualFileSystem {
     return this[kMountPoint];
   }
 
+  /**
+   * Gets the mount point as a `file:` URL string, or null if not
+   * mounted.
+   * @returns {string|null}
+   */
+  get mountPointURL() {
+    if (this[kMountPoint] === null) return null;
+    const { pathToFileURL } = require('internal/url');
+    return pathToFileURL(this[kMountPoint]).href;
+  }
+
   /**
    * Returns true if VFS is mounted.
    * @returns {boolean}
@@ -128,23 +155,28 @@ class VirtualFileSystem {
     return this[kProvider].readonly;
   }
 
-  // ==================== Mount ====================
-
   /**
-   * Mounts the VFS at a specific path prefix.
-   * @param {string} prefix The mount point path
-   * @returns {VirtualFileSystem} The VFS instance for chaining
+   * Mounts the VFS at its reserved mount point and returns that
+   * mount point. The mount point is `${os.devNull}/vfs/<layerId>` -
+   * a location that cannot exist on the real file system (`os.devNull`
+   * is a character device on POSIX and a device-namespace path on
+   * Windows; neither can have child filesystem entries) - so virtual
+   * paths never conflate with real paths, and the owning layer of any
+   * path is decidable from the path alone.
+   * @returns {string} The absolute mount point
    */
-  mount(prefix) {
+  mount() {
     if (this[kMounted]) {
       throw new ERR_INVALID_STATE('VFS is already mounted');
     }
-    this[kMountPoint] = resolvePath(prefix);
+    const mountPoint = getLayerRoot(this[kLayerId]);
+    this[kMountPoint] = mountPoint;
+    this[kNormalizedMountPoint] = normalizeMountedPath(mountPoint);
     this[kMounted] = true;
-    debug('mount %s', this[kMountPoint]);
+    debug('mount %s', mountPoint);
     loadVfsSetup();
     registerVFS(this);
-    return this;
+    return mountPoint;
   }
 
   /**
@@ -155,6 +187,7 @@ class VirtualFileSystem {
     loadVfsSetup();
     deregisterVFS(this);
     this[kMountPoint] = null;
+    this[kNormalizedMountPoint] = null;
     this[kMounted] = false;
   }
 
@@ -169,20 +202,21 @@ class VirtualFileSystem {
   }
 
   /**
-   * Checks if a path should be handled by this VFS.
-   * @param {string} inputPath The path to check (must be absolute & normalized)
+   * Returns true when `normalizedInput` falls inside this VFS's
+   * reserved mount point. The caller must have already passed the
+   * input through `normalizeMountedPath`; the dispatch loop in
+   * `internal/vfs/setup.js` normalizes once and hands the same value
+   * to every candidate layer.
+   * @param {string} normalizedInput
    * @returns {boolean}
    */
-  shouldHandle(inputPath) {
-    if (!this[kMounted] || !this[kMountPoint]) {
-      return false;
-    }
-    const normalized = isAbsolute(inputPath) ? inputPath : resolvePath(inputPath);
-    return isUnderMountPoint(normalized, this[kMountPoint]);
+  shouldHandleNormalized(normalizedInput) {
+    const mountPoint = this[kNormalizedMountPoint];
+    if (mountPoint === null) return false;
+    if (normalizedInput === mountPoint) return true;
+    return StringPrototypeStartsWith(normalizedInput, mountPoint + sep);
   }
 
-  // ==================== Path Resolution ====================
-
   /**
    * Converts an absolute mounted path to a provider-relative POSIX path.
    * If not mounted, treats the path as already provider-relative.
@@ -190,12 +224,13 @@ class VirtualFileSystem {
    * @returns {string}
    */
   #toProviderPath(inputPath) {
-    if (this[kMounted] && this[kMountPoint]) {
-      const resolved = isAbsolute(inputPath) ? inputPath : resolvePath(inputPath);
-      if (!isUnderMountPoint(resolved, this[kMountPoint])) {
+    const mountPoint = this[kNormalizedMountPoint];
+    if (mountPoint !== null) {
+      const resolved = normalizeMountedPath(inputPath);
+      if (!this.shouldHandleNormalized(resolved)) {
         throw createENOENT('open', inputPath);
       }
-      return getRelativePath(resolved, this[kMountPoint]);
+      return getRelativePath(resolved, mountPoint);
     }
     return pathPosix.normalize(inputPath);
   }
@@ -213,8 +248,6 @@ class VirtualFileSystem {
     return providerPath;
   }
 
-  // ==================== FS Operations (Sync) ====================
-
   /**
    * Checks if a path exists synchronously.
    * @param {string} filePath The path to check
@@ -294,14 +327,13 @@ class VirtualFileSystem {
     const providerPath = this.#toProviderPath(dirPath);
     const result = this[kProvider].readdirSync(providerPath, options);
 
-    // Fix Dirent parentPath from provider-relative to actual VFS path
+    // Rewrite Dirent parentPath from provider-relative to VFS path.
     if (options?.withFileTypes === true) {
       const recursive = options?.recursive === true;
       for (let i = 0; i < result.length; i++) {
         const dirent = result[i];
         if (recursive) {
           // In recursive mode, name may contain slashes (e.g. 'a/b.txt').
-          // Fix to basename only and set correct parentPath.
           const slashIdx = dirent.name.lastIndexOf('/');
           if (slashIdx !== -1) {
             const subdir = dirent.name.slice(0, slashIdx);
@@ -454,8 +486,6 @@ class VirtualFileSystem {
     }
   }
 
-  // ==================== Additional Sync Operations ====================
-
   /**
    * Truncates a file synchronously.
    * @param {string} filePath The file path
@@ -528,7 +558,6 @@ class VirtualFileSystem {
    */
   mkdtempSync(prefix) {
     const providerPrefix = this.#toProviderPath(prefix);
-    // Generate random 6-character suffix like Node does
     const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
     let suffix = '';
     for (let i = 0; i < 6; i++) {
@@ -567,8 +596,6 @@ class VirtualFileSystem {
     return new Blob([content], { type });
   }
 
-  // ==================== File Descriptor Operations ====================
-
   /**
    * Opens a file synchronously and returns a file descriptor.
    * @param {string} filePath The path to open
@@ -643,8 +670,6 @@ class VirtualFileSystem {
     return vfd.entry.statSync(options);
   }
 
-  // ==================== FS Operations (Async with Callbacks) ====================
-
   /**
    * Reads a file asynchronously.
    * @param {string} filePath The path to read
@@ -991,8 +1016,6 @@ class VirtualFileSystem {
     }
   }
 
-  // ==================== Stream Operations ====================
-
   /**
    * Creates a readable stream for a virtual file.
    * @param {string} filePath The path to the file
@@ -1013,8 +1036,6 @@ class VirtualFileSystem {
     return new VirtualWriteStream(this, filePath, options);
   }
 
-  // ==================== Watch Operations ====================
-
   /**
    * Watches a file or directory for changes.
    * @param {string} filePath The path to watch
@@ -1065,8 +1086,6 @@ class VirtualFileSystem {
     this[kProvider].unwatchFile(providerPath, listener);
   }
 
-  // ==================== Promise API ====================
-
   /**
    * Gets the promises API for this VFS instance.
    * @returns {object} Promise-based fs methods
@@ -1085,7 +1104,7 @@ class VirtualFileSystem {
   #createPromisesAPI() {
     const provider = this[kProvider];
 
-    // Use arrow function to capture `this` for private method access
+    // Arrow functions capture `this` for private method access.
     const toProviderPath = (p) => this.#toProviderPath(p);
     const toMountedPath = (p) => this.#toMountedPath(p);
 
@@ -1273,4 +1292,6 @@ class VirtualFileSystem {
 
 module.exports = {
   VirtualFileSystem,
+  kLayerId,
+  normalizeMountedPath,
 };
diff --git a/lib/internal/vfs/providers/memory.js b/lib/internal/vfs/providers/memory.js
index acec5b4166b2..ce59a0611616 100644
--- a/lib/internal/vfs/providers/memory.js
+++ b/lib/internal/vfs/providers/memory.js
@@ -840,6 +840,10 @@ class MemoryProvider extends VirtualProvider {
 
     // Check if destination exists
     const existingDest = newParent.children.get(newName);
+    if (existingDest === entry) {
+      // Both names resolve to the same entry: rename does nothing
+      return;
+    }
     if (existingDest) {
       // Cannot overwrite a directory with a non-directory
       if (existingDest.isDirectory() && !entry.isDirectory()) {
@@ -849,6 +853,15 @@ class MemoryProvider extends VirtualProvider {
       if (!existingDest.isDirectory() && entry.isDirectory()) {
         throw createENOTDIR('rename', newPath);
       }
+      if (existingDest.isDirectory()) {
+        this.#ensurePopulated(existingDest, normalizedNew);
+        // Cannot overwrite a non-empty directory
+        if (existingDest.children.size > 0) {
+          throw createENOTEMPTY('rename', newPath);
+        }
+      } else {
+        existingDest.nlink--;
+      }
     }
 
     // Remove from old location (after destination validation)
diff --git a/lib/internal/vfs/providers/sea.js b/lib/internal/vfs/providers/sea.js
new file mode 100644
index 000000000000..4a03246c271b
--- /dev/null
+++ b/lib/internal/vfs/providers/sea.js
@@ -0,0 +1,349 @@
+'use strict';
+
+const {
+  ArrayFrom,
+  ArrayPrototypeFilter,
+  ArrayPrototypePop,
+  ArrayPrototypePush,
+  Boolean,
+  ObjectKeys,
+  SafeMap,
+  SafeSet,
+  StringPrototypeReplaceAll,
+  StringPrototypeSplit,
+  StringPrototypeStartsWith,
+  Symbol,
+  Uint8Array,
+} = primordials;
+
+const { Buffer } = require('buffer');
+const { posix: pathPosix } = require('path');
+const { VirtualProvider } = require('internal/vfs/provider');
+const { MemoryFileHandle } = require('internal/vfs/file_handle');
+const {
+  codes: {
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+const {
+  createENOENT,
+  createENOTDIR,
+  createEISDIR,
+  createEROFS,
+} = require('internal/vfs/errors');
+const {
+  createFileStats,
+  createDirectoryStats,
+} = require('internal/vfs/stats');
+const { Dirent } = require('internal/fs/utils');
+const { kEmptyObject } = require('internal/util');
+const {
+  fs: {
+    UV_DIRENT_FILE,
+    UV_DIRENT_DIR,
+  },
+} = internalBinding('constants');
+
+// Private symbols
+const kAssets = Symbol('kAssets');
+const kExtraFiles = Symbol('kExtraFiles');
+const kDirectories = Symbol('kDirectories');
+const kGetAsset = Symbol('kGetAsset');
+const kSizes = Symbol('kSizes');
+
+/* c8 ignore start -- the SEA provider requires an actual SEA binary to run */
+
+/**
+ * Read-only provider serving the assets bundled into a Single Executable
+ * Application. Asset content stays in the executable's SEA blob and is
+ * copied into JS memory only when a file is opened.
+ */
+class SEAProvider extends VirtualProvider {
+  /**
+   * @param {object} [options] Options
+   * @param {Record<string, string|Buffer>} [options.extraFiles] Additional
+   *   files to serve alongside the assets, keyed by path (used for the SEA
+   *   main script, whose source lives in the SEA blob but not in the assets)
+   */
+  constructor(options = kEmptyObject) {
+    super();
+
+    const { isSea, getAsset, getAssetKeys } = internalBinding('sea');
+
+    if (!isSea()) {
+      throw new ERR_INVALID_STATE(
+        'SEAProvider can only be used in a Single Executable Application');
+    }
+
+    this[kGetAsset] = getAsset;
+    // Map of normalized path -> asset key
+    this[kAssets] = new SafeMap();
+    // Map of normalized path -> Buffer content
+    this[kExtraFiles] = new SafeMap();
+    // Map of directory path -> SafeSet of child names
+    this[kDirectories] = new SafeMap();
+    // Cache of file sizes so stat does not have to copy asset content
+    this[kSizes] = new SafeMap();
+
+    // Root directory always exists
+    this[kDirectories].set('/', new SafeSet());
+
+    const keys = getAssetKeys() || [];
+    for (let i = 0; i < keys.length; i++) {
+      const key = keys[i];
+      this[kAssets].set(this.#normalizePath(key), key);
+    }
+    const extraFiles = options.extraFiles;
+    if (extraFiles !== undefined) {
+      const paths = ObjectKeys(extraFiles);
+      for (let i = 0; i < paths.length; i++) {
+        const path = paths[i];
+        const content = extraFiles[path];
+        const buffer = typeof content === 'string' ?
+          Buffer.from(content) : content;
+        const normalized = this.#normalizePath(path);
+        this[kExtraFiles].set(normalized, buffer);
+        this[kSizes].set(normalized, buffer.length);
+      }
+    }
+
+    // Derive the directory tree from the file paths
+    for (const path of this.#filePaths()) {
+      const parts = ArrayPrototypeFilter(
+        StringPrototypeSplit(path, '/'), Boolean);
+      let currentPath = '/';
+      for (let i = 0; i < parts.length - 1; i++) {
+        const parentPath = currentPath;
+        currentPath = pathPosix.join(currentPath, parts[i]);
+        if (!this[kDirectories].has(currentPath)) {
+          this[kDirectories].set(currentPath, new SafeSet());
+        }
+        this[kDirectories].get(parentPath).add(parts[i]);
+      }
+      if (parts.length > 0) {
+        this[kDirectories].get(pathPosix.dirname(path)).add(
+          pathPosix.basename(path));
+      }
+    }
+  }
+
+  get readonly() {
+    return true;
+  }
+
+  get supportsSymlinks() {
+    return false;
+  }
+
+  /**
+   * Iterates over the normalized paths of all files.
+   * @yields {string} The normalized path of each file
+   */
+  * #filePaths() {
+    yield* this[kAssets].keys();
+    yield* this[kExtraFiles].keys();
+  }
+
+  /**
+   * Normalizes a path to an absolute posix-style path.
+   * @param {string} path The path
+   * @returns {string} Normalized path
+   */
+  #normalizePath(path) {
+    let normalized = StringPrototypeReplaceAll(path, '\\', '/');
+    if (!StringPrototypeStartsWith(normalized, '/')) {
+      normalized = '/' + normalized;
+    }
+    return pathPosix.normalize(normalized);
+  }
+
+  /**
+   * Checks if a normalized path is a file.
+   * @param {string} path Normalized path
+   * @returns {boolean}
+   */
+  #isFile(path) {
+    return this[kAssets].has(path) || this[kExtraFiles].has(path);
+  }
+
+  /**
+   * Checks if a normalized path is a directory.
+   * @param {string} path Normalized path
+   * @returns {boolean}
+   */
+  #isDirectory(path) {
+    return this[kDirectories].has(path);
+  }
+
+  /**
+   * Gets the file content as an independently mutable Buffer.
+   * @param {string} path Normalized path
+   * @returns {Buffer}
+   */
+  #getContent(path) {
+    const extra = this[kExtraFiles].get(path);
+    if (extra !== undefined) {
+      return Buffer.from(extra);
+    }
+    const key = this[kAssets].get(path);
+    if (key === undefined) {
+      throw createENOENT('open', path);
+    }
+    // getAsset returns a zero-copy ArrayBuffer over the (possibly read-only)
+    // SEA blob in the executable; copy it so the handle owns mutable memory.
+    const content = Buffer.from(new Uint8Array(this[kGetAsset](key)));
+    this[kSizes].set(path, content.length);
+    return content;
+  }
+
+  /**
+   * Gets the size of a file, loading the content only on first access.
+   * @param {string} path Normalized path
+   * @returns {number}
+   */
+  #getSize(path) {
+    let size = this[kSizes].get(path);
+    if (size === undefined) {
+      size = this.#getContent(path).length;
+    }
+    return size;
+  }
+
+  openSync(path, flags, mode) {
+    // Normalize numeric flags (O_RDONLY === 0) to a string
+    const normalizedFlags = typeof flags === 'number' ?
+      (flags === 0 ? 'r' : null) : flags;
+    if (normalizedFlags !== 'r') {
+      throw createEROFS('open', path);
+    }
+
+    const normalized = this.#normalizePath(path);
+
+    if (this.#isDirectory(normalized)) {
+      throw createEISDIR('open', path);
+    }
+    if (!this.#isFile(normalized)) {
+      throw createENOENT('open', path);
+    }
+
+    const content = this.#getContent(normalized);
+    const getStats = () => createFileStats(content.length, { mode: 0o444 });
+    return new MemoryFileHandle(normalized, 'r', 0o444, content, null,
+                                getStats);
+  }
+
+  async open(path, flags, mode) {
+    return this.openSync(path, flags, mode);
+  }
+
+  statSync(path, options) {
+    const normalized = this.#normalizePath(path);
+
+    if (this.#isDirectory(normalized)) {
+      return createDirectoryStats({ mode: 0o555, bigint: options?.bigint });
+    }
+    if (this.#isFile(normalized)) {
+      return createFileStats(this.#getSize(normalized),
+                             { mode: 0o444, bigint: options?.bigint });
+    }
+    throw createENOENT('stat', path);
+  }
+
+  async stat(path, options) {
+    return this.statSync(path, options);
+  }
+
+  readdirSync(path, options) {
+    const normalized = this.#normalizePath(path);
+
+    if (!this.#isDirectory(normalized)) {
+      if (this.#isFile(normalized)) {
+        throw createENOTDIR('scandir', path);
+      }
+      throw createENOENT('scandir', path);
+    }
+
+    const withFileTypes = options?.withFileTypes === true;
+    const recursive = options?.recursive === true;
+
+    if (recursive) {
+      return this.#readdirRecursive(normalized, withFileTypes);
+    }
+
+    const names = ArrayFrom(this[kDirectories].get(normalized));
+    if (!withFileTypes) {
+      return names;
+    }
+
+    const dirents = [];
+    for (let i = 0; i < names.length; i++) {
+      const childPath = pathPosix.join(normalized, names[i]);
+      const type = this.#isDirectory(childPath) ?
+        UV_DIRENT_DIR : UV_DIRENT_FILE;
+      ArrayPrototypePush(dirents, new Dirent(names[i], type, normalized));
+    }
+    return dirents;
+  }
+
+  /**
+   * Recursively reads directory contents.
+   * @param {string} dirPath The normalized directory path
+   * @param {boolean} withFileTypes Whether to return Dirent objects
+   * @returns {string[]|Dirent[]}
+   */
+  #readdirRecursive(dirPath, withFileTypes) {
+    const results = [];
+
+    // Traverse depth-first in preorder with an explicit frame stack, so a
+    // deeply nested asset tree cannot exhaust the call stack.
+    const stack = [{
+      path: dirPath,
+      relative: '',
+      children: ArrayFrom(this[kDirectories].get(dirPath)),
+      index: 0,
+    }];
+
+    while (stack.length > 0) {
+      const frame = stack[stack.length - 1];
+      if (frame.index >= frame.children.length) {
+        ArrayPrototypePop(stack);
+        continue;
+      }
+
+      const name = frame.children[frame.index++];
+      const childPath = pathPosix.join(frame.path, name);
+      const childRelative = frame.relative ?
+        `${frame.relative}/${name}` : name;
+      const isDir = this.#isDirectory(childPath);
+
+      if (withFileTypes) {
+        const type = isDir ? UV_DIRENT_DIR : UV_DIRENT_FILE;
+        ArrayPrototypePush(results,
+                           new Dirent(childRelative, type, dirPath));
+      } else {
+        ArrayPrototypePush(results, childRelative);
+      }
+
+      if (isDir) {
+        ArrayPrototypePush(stack, {
+          path: childPath,
+          relative: childRelative,
+          children: ArrayFrom(this[kDirectories].get(childPath)),
+          index: 0,
+        });
+      }
+    }
+
+    return results;
+  }
+
+  async readdir(path, options) {
+    return this.readdirSync(path, options);
+  }
+}
+
+/* c8 ignore stop */
+
+module.exports = {
+  SEAProvider,
+};
diff --git a/lib/internal/vfs/providers/ziparchive.js b/lib/internal/vfs/providers/ziparchive.js
new file mode 100644
index 000000000000..f369cdd22f76
--- /dev/null
+++ b/lib/internal/vfs/providers/ziparchive.js
@@ -0,0 +1,580 @@
+'use strict';
+
+const {
+  ArrayPrototypeIndexOf,
+  ArrayPrototypePush,
+  MathMax,
+  MathMin,
+  StringPrototypeIndexOf,
+  StringPrototypeSlice,
+  StringPrototypeStartsWith,
+  SymbolAsyncDispose,
+  SymbolDispose,
+} = primordials;
+
+const { Buffer } = require('buffer');
+const {
+  codes: {
+    ERR_INVALID_ARG_TYPE,
+    ERR_METHOD_NOT_IMPLEMENTED,
+  },
+} = require('internal/errors');
+const { VirtualProvider } = require('internal/vfs/provider');
+const { VirtualFileHandle } = require('internal/vfs/file_handle');
+const {
+  createEEXIST,
+  createEISDIR,
+  createENOENT,
+  createENOTDIR,
+  createENOTEMPTY,
+  createEROFS,
+} = require('internal/vfs/errors');
+const { createFileStats, createDirectoryStats } = require('internal/vfs/stats');
+const { Dirent } = require('internal/fs/utils');
+const {
+  fs: {
+    O_APPEND,
+    O_CREAT,
+    O_EXCL,
+    O_RDWR,
+    O_TRUNC,
+    O_WRONLY,
+    UV_DIRENT_DIR,
+    UV_DIRENT_FILE,
+  },
+} = internalBinding('constants');
+const { ZipBuffer, ZipFile } = require('internal/zip');
+
+const EMPTY_BUFFER = Buffer.alloc(0);
+
+function normalize(vfsPath) {
+  return StringPrototypeStartsWith(vfsPath, '/') ? StringPrototypeSlice(vfsPath, 1) : vfsPath;
+}
+
+// Converts numeric open flags (e.g. `fs.constants.O_RDWR`) to the flag strings
+// the helpers below understand, so a caller passing `node:fs`-style numeric
+// flags through the VFS is handled the same way `fs` would. Strings pass
+// through unchanged; anything else falls back to 'r'.
+function normalizeFlags(flags) {
+  if (typeof flags === 'string') return flags;
+  if (typeof flags !== 'number') return 'r';
+  const rdwr = (flags & O_RDWR) !== 0;
+  const append = (flags & O_APPEND) !== 0;
+  const excl = (flags & O_EXCL) !== 0;
+  const write = (flags & O_WRONLY) !== 0 || (flags & O_CREAT) !== 0 || (flags & O_TRUNC) !== 0;
+  if (append) return 'a' + (excl ? 'x' : '') + (rdwr ? '+' : '');
+  if (write) return 'w' + (excl ? 'x' : '') + (rdwr ? '+' : '');
+  if (rdwr) return 'r+';
+  return 'r';
+}
+
+function isCurrentPosition(position) {
+  return position === null || position === undefined || position === -1;
+}
+
+function isWriteTruncate(flags) {
+  return flags === 'w' || flags === 'w+' || flags === 'wx' || flags === 'wx+';
+}
+
+function isAppend(flags) {
+  return flags === 'a' || flags === 'a+' || flags === 'ax' || flags === 'ax+';
+}
+
+function isReadableFlag(flags) {
+  return flags !== 'w' && flags !== 'a' && flags !== 'wx' && flags !== 'ax';
+}
+
+function isWritableFlag(flags) {
+  return flags !== 'r';
+}
+
+/**
+ * The `options.method` value that reproduces `method` (a `zipEntry.method`
+ * raw compression method number) on `add()`/`addSync()`, so `rename()`
+ * doesn't silently recompress an entry with a different method than the one
+ * it already had (e.g. turning a zstd-compressed entry into a stored one).
+ * @param {number} method
+ * @returns {'store' | 'zstd' | 'deflate'}
+ */
+function methodOption(method) {
+  if (method === 0) return 'store';
+  if (method === 93) return 'zstd';
+  return 'deflate';
+}
+
+/**
+ * A file handle over one ZIP entry. ZIP members can't be edited in place
+ * (they're a single compressed blob), so writes accumulate in memory and are
+ * only committed - as a brand-new entry - when the handle is closed. Since
+ * this is all in-memory buffer manipulation with no real I/O, every method
+ * and its `*Sync` counterpart share one private implementation.
+ */
+class ZipFileHandle extends VirtualFileHandle {
+  #source;
+  #name;
+  #buffer;
+  #size;
+  #dirty = false;
+
+  /**
+   * @param {string} path
+   * @param {string} flags
+   * @param {number} mode
+   * @param {ZipBuffer | ZipFile} source
+   * @param {string} name The archive-relative entry name
+   * @param {Buffer} initial The entry's current decompressed content, or an
+   *   empty buffer for a new/truncated file
+   */
+  constructor(path, flags, mode, source, name, initial) {
+    super(path, flags, mode);
+    this.#source = source;
+    this.#name = name;
+    this.#buffer = initial;
+    this.#size = initial.length;
+    if (isAppend(flags)) this.position = this.#size;
+  }
+
+  #checkReadable() {
+    if (!isReadableFlag(this.flags)) throw createEISDIR('read', this.path);
+  }
+  #checkWritable() {
+    if (!isWritableFlag(this.flags)) throw createEISDIR('write', this.path);
+  }
+  #ensureCapacity(size) {
+    if (size <= this.#buffer.length) return;
+    const capacity = MathMax(size, this.#buffer.length * 2);
+    const grown = Buffer.alloc(capacity);
+    this.#buffer.copy(grown, 0, 0, this.#size);
+    this.#buffer = grown;
+  }
+
+  #doRead(buffer, offset, length, position) {
+    this.#checkReadable();
+    const useCurrent = isCurrentPosition(position);
+    const pos = useCurrent ? this.position : position;
+    const available = MathMax(0, this.#size - pos);
+    const bytesRead = MathMin(length, available);
+    if (bytesRead > 0) this.#buffer.copy(buffer, offset, pos, pos + bytesRead);
+    if (useCurrent) this.position = pos + bytesRead;
+    return { __proto__: null, bytesRead, buffer };
+  }
+  async read(buffer, offset, length, position) {
+    return this.#doRead(buffer, offset, length, position);
+  }
+  readSync(buffer, offset, length, position) {
+    return this.#doRead(buffer, offset, length, position);
+  }
+
+  #doWrite(buffer, offset, length, position) {
+    this.#checkWritable();
+    const useCurrent = isCurrentPosition(position);
+    const pos = isAppend(this.flags) ? this.#size : (useCurrent ? this.position : position);
+    this.#ensureCapacity(pos + length);
+    buffer.copy(this.#buffer, pos, offset, offset + length);
+    if (pos + length > this.#size) this.#size = pos + length;
+    this.#dirty = true;
+    if (useCurrent) this.position = pos + length;
+    return { __proto__: null, bytesWritten: length, buffer };
+  }
+  async write(buffer, offset, length, position) {
+    return this.#doWrite(buffer, offset, length, position);
+  }
+  writeSync(buffer, offset, length, position) {
+    return this.#doWrite(buffer, offset, length, position);
+  }
+
+  #doReadFile(options) {
+    this.#checkReadable();
+    const encoding = typeof options === 'string' ? options : options?.encoding;
+    const content = this.#buffer.subarray(0, this.#size);
+    return encoding && encoding !== 'buffer' ? content.toString(encoding) : Buffer.from(content);
+  }
+  async readFile(options) {
+    return this.#doReadFile(options);
+  }
+  readFileSync(options) {
+    return this.#doReadFile(options);
+  }
+
+  // Replaces content, except in append mode ('a'/'a+'/'ax'/'ax+'), where it
+  // appends to the existing content instead - matching MemoryFileHandle and
+  // what makes `appendFile()`/`appendFileSync()` (built on this, by
+  // VirtualProvider's defaults) actually append.
+  #doWriteFile(data, options) {
+    this.#checkWritable();
+    const content = typeof data === 'string' ? Buffer.from(data, options?.encoding) : Buffer.from(data);
+    if (isAppend(this.flags)) {
+      this.#ensureCapacity(this.#size + content.length);
+      content.copy(this.#buffer, this.#size);
+      this.#size += content.length;
+    } else {
+      this.#buffer = content;
+      this.#size = content.length;
+    }
+    this.#dirty = true;
+  }
+  async writeFile(data, options) {
+    this.#doWriteFile(data, options);
+  }
+  writeFileSync(data, options) {
+    this.#doWriteFile(data, options);
+  }
+
+  #doStat() {
+    return createFileStats(this.#size, { mode: this.mode });
+  }
+  async stat(options) {
+    return this.#doStat();
+  }
+  statSync(options) {
+    return this.#doStat();
+  }
+
+  #doTruncate(len) {
+    this.#checkWritable();
+    this.#ensureCapacity(len);
+    this.#size = len;
+    this.#dirty = true;
+  }
+  async truncate(len = 0) {
+    this.#doTruncate(len);
+  }
+  truncateSync(len = 0) {
+    this.#doTruncate(len);
+  }
+
+  async close() {
+    if (this.#dirty && isWritableFlag(this.flags)) {
+      await this.#source.add(this.#name, this.#buffer.subarray(0, this.#size), { mode: this.mode });
+    }
+    await super.close();
+  }
+  closeSync() {
+    if (this.#dirty && isWritableFlag(this.flags)) {
+      this.#source.addSync(this.#name, this.#buffer.subarray(0, this.#size), { mode: this.mode });
+    }
+    super.closeSync();
+  }
+}
+
+/**
+ * A `node:vfs` provider backed by a ZIP archive: either a [`ZipBuffer`][] (in
+ * memory) or a [`ZipFile`][] (on disk). Read-only unless the underlying
+ * archive is writable (a `ZipBuffer`, or a `ZipFile` opened with
+ * `{ writable: true }`). Every method has a synchronous counterpart, backed
+ * by the equally complete synchronous surface `ZipBuffer`/`ZipFile` expose;
+ * as with those, the synchronous methods here block the Node.js event loop
+ * and further JavaScript execution until the operation (including any
+ * deflate/inflate pass) completes.
+ */
+class ZipProvider extends VirtualProvider {
+  #source;
+
+  /**
+   * @param {ZipBuffer | ZipFile} source
+   */
+  constructor(source) {
+    super();
+    if (!(source instanceof ZipBuffer) && !(source instanceof ZipFile)) {
+      throw new ERR_INVALID_ARG_TYPE('source', ['ZipBuffer', 'ZipFile'], source);
+    }
+    this.#source = source;
+  }
+
+  get readonly() { return !this.#source.writable; }
+
+  /**
+   * @param {string} name
+   * @returns {Promise<import('internal/zip').ZipEntry | null>}
+   */
+  async #getEntry(name) {
+    return this.#source.has(name) ? this.#source.get(name) : null;
+  }
+  /**
+   * @param {string} name
+   * @returns {import('internal/zip').ZipEntry | null}
+   */
+  #getEntrySync(name) {
+    if (!this.#source.has(name)) return null;
+    // `ZipBuffer.prototype.get` is already synchronous (it has no `getSync`
+    // of its own); `ZipFile.prototype.get` is asynchronous, so its `getSync`
+    // is used instead when present.
+    return typeof this.#source.getSync === 'function' ?
+      this.#source.getSync(name) : this.#source.get(name);
+  }
+  /**
+   * @param {string} name
+   * @returns {boolean}
+   */
+  #deleteEntrySync(name) {
+    // Same reasoning as `#getEntrySync`: `ZipBuffer.prototype.delete` is
+    // already synchronous; `ZipFile.prototype.delete` is not, so its
+    // `deleteSync` is used instead when present.
+    return typeof this.#source.deleteSync === 'function' ?
+      this.#source.deleteSync(name) : this.#source.delete(name);
+  }
+
+  /**
+   * Whether `name` (no trailing slash) is a directory: either explicitly
+   * (a `"name/"` entry) or implicitly (some entry starts with `"name/"`).
+   * @param {string} name
+   * @returns {boolean}
+   */
+  #isDirectory(name) {
+    const prefix = `${name}/`;
+    if (this.#source.has(prefix)) return true;
+    for (const key of this.#source.keys()) {
+      if (StringPrototypeStartsWith(key, prefix)) return true;
+    }
+    return false;
+  }
+
+  async open(path, flags, mode) {
+    flags = normalizeFlags(flags);
+    const name = normalize(path);
+    const fileEntry = await this.#getEntry(name);
+    if (fileEntry === null && this.#isDirectory(name)) {
+      throw createEISDIR('open', path);
+    }
+    const exists = fileEntry !== null;
+    if (isWritableFlag(flags) && this.readonly) {
+      throw createEROFS('open', path);
+    }
+    if ((flags === 'wx' || flags === 'wx+' || flags === 'ax' || flags === 'ax+') && exists) {
+      throw createEEXIST('open', path);
+    }
+    if (!exists && (flags === 'r' || flags === 'r+')) {
+      throw createENOENT('open', path);
+    }
+    let initial = EMPTY_BUFFER;
+    if (exists && !isWriteTruncate(flags)) {
+      initial = await fileEntry.content();
+    }
+    return new ZipFileHandle(path, flags, mode, this.#source, name, initial);
+  }
+  openSync(path, flags, mode) {
+    flags = normalizeFlags(flags);
+    const name = normalize(path);
+    const fileEntry = this.#getEntrySync(name);
+    if (fileEntry === null && this.#isDirectory(name)) {
+      throw createEISDIR('open', path);
+    }
+    const exists = fileEntry !== null;
+    if (isWritableFlag(flags) && this.readonly) {
+      throw createEROFS('open', path);
+    }
+    if ((flags === 'wx' || flags === 'wx+' || flags === 'ax' || flags === 'ax+') && exists) {
+      throw createEEXIST('open', path);
+    }
+    if (!exists && (flags === 'r' || flags === 'r+')) {
+      throw createENOENT('open', path);
+    }
+    let initial = EMPTY_BUFFER;
+    if (exists && !isWriteTruncate(flags)) {
+      initial = fileEntry.contentSync();
+    }
+    return new ZipFileHandle(path, flags, mode, this.#source, name, initial);
+  }
+
+  async stat(path, options) {
+    const name = normalize(path);
+    if (name === '') return createDirectoryStats({ mode: 0o755 });
+    const entry = await this.#getEntry(name) ?? await this.#getEntry(`${name}/`);
+    if (entry !== null) {
+      return entry.isDirectory ?
+        createDirectoryStats({ mode: entry.mode || 0o755, mtimeMs: entry.modified.getTime() }) :
+        createFileStats(entry.size, { mode: entry.mode || 0o644, mtimeMs: entry.modified.getTime() });
+    }
+    if (this.#isDirectory(name)) return createDirectoryStats({ mode: 0o755 });
+    throw createENOENT('stat', path);
+  }
+  statSync(path, options) {
+    const name = normalize(path);
+    if (name === '') return createDirectoryStats({ mode: 0o755 });
+    const entry = this.#getEntrySync(name) ?? this.#getEntrySync(`${name}/`);
+    if (entry !== null) {
+      return entry.isDirectory ?
+        createDirectoryStats({ mode: entry.mode || 0o755, mtimeMs: entry.modified.getTime() }) :
+        createFileStats(entry.size, { mode: entry.mode || 0o644, mtimeMs: entry.modified.getTime() });
+    }
+    if (this.#isDirectory(name)) return createDirectoryStats({ mode: 0o755 });
+    throw createENOENT('stat', path);
+  }
+
+  #readdirEntries(path, name, options, stats) {
+    if (!stats.isDirectory()) throw createENOTDIR('scandir', path);
+    const prefix = name === '' ? '' : `${name}/`;
+    const withFileTypes = options?.withFileTypes === true;
+    const names = [];
+    const isDir = [];
+    for (const key of this.#source.keys()) {
+      if (!StringPrototypeStartsWith(key, prefix)) continue;
+      const rest = StringPrototypeSlice(key, prefix.length);
+      if (rest === '') continue; // The directory's own explicit entry
+      const slash = StringPrototypeIndexOf(rest, '/');
+      const childName = slash === -1 ? rest : StringPrototypeSlice(rest, 0, slash);
+      const childIsDir = slash !== -1;
+      const existingIndex = ArrayPrototypeIndexOf(names, childName);
+      if (existingIndex !== -1) {
+        if (childIsDir) isDir[existingIndex] = true;
+        continue;
+      }
+      ArrayPrototypePush(names, childName);
+      ArrayPrototypePush(isDir, childIsDir);
+    }
+    const result = [];
+    for (let i = 0; i < names.length; i++) {
+      if (withFileTypes) {
+        ArrayPrototypePush(result, new Dirent(names[i], isDir[i] ? UV_DIRENT_DIR : UV_DIRENT_FILE, name));
+      } else {
+        ArrayPrototypePush(result, names[i]);
+      }
+    }
+    return result;
+  }
+  async readdir(path, options) {
+    if (options?.recursive) {
+      throw new ERR_METHOD_NOT_IMPLEMENTED('readdir with { recursive: true } on a ZipProvider');
+    }
+    const name = normalize(path);
+    return this.#readdirEntries(path, name, options, await this.stat(path));
+  }
+  readdirSync(path, options) {
+    if (options?.recursive) {
+      throw new ERR_METHOD_NOT_IMPLEMENTED('readdirSync with { recursive: true } on a ZipProvider');
+    }
+    const name = normalize(path);
+    return this.#readdirEntries(path, name, options, this.statSync(path));
+  }
+
+  async mkdir(path, options) {
+    if (this.readonly) throw createEROFS('mkdir', path);
+    const name = normalize(path);
+    if (await this.exists(path)) {
+      // `{ recursive: true }` only tolerates an existing *directory*; an
+      // existing file (or any non-directory) still collides with EEXIST.
+      if (options?.recursive && this.#isDirectory(name)) return undefined;
+      throw createEEXIST('mkdir', path);
+    }
+    await this.#source.add(`${name}/`, EMPTY_BUFFER, { mode: options?.mode });
+    return undefined;
+  }
+  mkdirSync(path, options) {
+    if (this.readonly) throw createEROFS('mkdir', path);
+    const name = normalize(path);
+    if (this.existsSync(path)) {
+      // `{ recursive: true }` only tolerates an existing *directory*; an
+      // existing file (or any non-directory) still collides with EEXIST.
+      if (options?.recursive && this.#isDirectory(name)) return undefined;
+      throw createEEXIST('mkdir', path);
+    }
+    this.#source.addSync(`${name}/`, EMPTY_BUFFER, { mode: options?.mode });
+    return undefined;
+  }
+
+  async rmdir(path) {
+    if (this.readonly) throw createEROFS('rmdir', path);
+    const name = normalize(path);
+    const stats = await this.stat(path);
+    if (!stats.isDirectory()) throw createENOTDIR('rmdir', path);
+    const prefix = `${name}/`;
+    for (const key of this.#source.keys()) {
+      if (key !== prefix && StringPrototypeStartsWith(key, prefix)) {
+        throw createENOTEMPTY('rmdir', path);
+      }
+    }
+    if (!this.#source.has(prefix)) {
+      // An implicit-only directory can never be empty (something has to be
+      // under it for it to exist at all), so getting here means `path` is
+      // not a directory this provider can remove.
+      throw createENOENT('rmdir', path);
+    }
+    await this.#source.delete(prefix);
+  }
+  rmdirSync(path) {
+    if (this.readonly) throw createEROFS('rmdir', path);
+    const name = normalize(path);
+    const stats = this.statSync(path);
+    if (!stats.isDirectory()) throw createENOTDIR('rmdir', path);
+    const prefix = `${name}/`;
+    for (const key of this.#source.keys()) {
+      if (key !== prefix && StringPrototypeStartsWith(key, prefix)) {
+        throw createENOTEMPTY('rmdir', path);
+      }
+    }
+    if (!this.#source.has(prefix)) {
+      throw createENOENT('rmdir', path);
+    }
+    this.#deleteEntrySync(prefix);
+  }
+
+  async unlink(path) {
+    if (this.readonly) throw createEROFS('unlink', path);
+    const name = normalize(path);
+    if (!this.#source.has(name)) {
+      throw this.#isDirectory(name) ? createEISDIR('unlink', path) : createENOENT('unlink', path);
+    }
+    await this.#source.delete(name);
+  }
+  unlinkSync(path) {
+    if (this.readonly) throw createEROFS('unlink', path);
+    const name = normalize(path);
+    if (!this.#source.has(name)) {
+      throw this.#isDirectory(name) ? createEISDIR('unlink', path) : createENOENT('unlink', path);
+    }
+    this.#deleteEntrySync(name);
+  }
+
+  async rename(oldPath, newPath) {
+    if (this.readonly) throw createEROFS('rename', oldPath);
+    const oldName = normalize(oldPath);
+    const newName = normalize(newPath);
+    const entry = await this.#getEntry(oldName);
+    if (entry === null) throw createENOENT('rename', oldPath);
+    const content = await entry.content();
+    await this.#source.add(newName, content, {
+      mode: entry.mode || undefined,
+      modified: entry.modified,
+      method: methodOption(entry.method),
+    });
+    await this.#source.delete(oldName);
+  }
+  renameSync(oldPath, newPath) {
+    if (this.readonly) throw createEROFS('rename', oldPath);
+    const oldName = normalize(oldPath);
+    const newName = normalize(newPath);
+    const entry = this.#getEntrySync(oldName);
+    if (entry === null) throw createENOENT('rename', oldPath);
+    const content = entry.contentSync();
+    this.#source.addSync(newName, content, {
+      mode: entry.mode || undefined,
+      modified: entry.modified,
+      method: methodOption(entry.method),
+    });
+    this.#deleteEntrySync(oldName);
+  }
+
+  /**
+   * Closes the backing archive. A `ZipFile` releases its file descriptor; a
+   * `ZipBuffer` is purely in-memory and has nothing to close, so this is a
+   * no-op for it. Aliased as `Symbol.asyncDispose` so a provider can be used
+   * with `await using`.
+   */
+  async close() {
+    if (typeof this.#source.close === 'function') await this.#source.close();
+  }
+  /**
+   * Synchronous counterpart of `close()`, aliased as `Symbol.dispose` for
+   * `using`.
+   */
+  closeSync() {
+    if (typeof this.#source.closeSync === 'function') this.#source.closeSync();
+  }
+}
+
+ZipProvider.prototype[SymbolAsyncDispose] = ZipProvider.prototype.close;
+ZipProvider.prototype[SymbolDispose] = ZipProvider.prototype.closeSync;
+
+module.exports = {
+  ZipProvider,
+};
diff --git a/lib/internal/vfs/router.js b/lib/internal/vfs/router.js
index b610b271695a..53247cbc6706 100644
--- a/lib/internal/vfs/router.js
+++ b/lib/internal/vfs/router.js
@@ -2,45 +2,78 @@
 
 const {
   ArrayPrototypeJoin,
+  StringPrototypeCharCodeAt,
   StringPrototypeSplit,
-  StringPrototypeStartsWith,
 } = primordials;
 
-const { isAbsolute, relative, sep } = require('path');
+const { relative, resolve, sep, toNamespacedPath } = require('path');
 
-// `path.sep` is required here because on Windows `path.resolve('/virtual')`
-// produces 'C:\virtual' and all resolved paths use backslashes - a hardcoded
-// '/' check would never match. The trailing-separator guard handles root
-// mount points like 'C:\' so we don't end up with 'C:\\'.
-function isUnderMountPoint(normalizedPath, mountPoint) {
-  if (normalizedPath === mountPoint) {
-    return true;
-  }
-  if (mountPoint === '/') {
-    return StringPrototypeStartsWith(normalizedPath, '/');
+// All VFS mount points live under `${os.devNull}/vfs/<id>/`. os.devNull
+// is a character device on POSIX (`/dev/null`) and a device-namespace
+// path on Windows (`\\.\NUL`); neither can have children, so no real
+// file-system path can exist under this root and path ownership is
+// decidable from the path alone.
+let vfsRoot;
+let normalizedVfsRoot;
+
+function getVfsRoot() {
+  vfsRoot ??= require('os').devNull + sep + 'vfs';
+  return vfsRoot;
+}
+
+function getNormalizedVfsRoot() {
+  normalizedVfsRoot ??= toNamespacedPath(resolve(getVfsRoot()));
+  return normalizedVfsRoot;
+}
+
+/**
+ * Returns the reserved mount point for a VFS layer:
+ * `${os.devNull}/vfs/<id>`.
+ * @param {number} layerId
+ * @returns {string}
+ */
+function getLayerRoot(layerId) {
+  return getVfsRoot() + sep + layerId;
+}
+
+/**
+ * Extracts the layer id from a normalized path under the VFS root, or
+ * returns -1 when the path does not carry a well-formed `.../vfs/<id>`
+ * segment. The caller must have verified that `normalizedPath` starts
+ * with the normalized VFS root plus a separator.
+ * @param {string} normalizedPath
+ * @returns {number}
+ */
+function getLayerIdFromPath(normalizedPath) {
+  const start = getNormalizedVfsRoot().length + 1;
+  let id = 0;
+  let i = start;
+  const len = normalizedPath.length;
+  if (i >= len) return -1;
+  for (; i < len; i++) {
+    const c = StringPrototypeCharCodeAt(normalizedPath, i);
+    if (c === 47 || c === 92) break; // '/' or '\\'
+    if (c < 48 || c > 57) return -1; // not a digit
+    id = id * 10 + (c - 48);
   }
-  const prefix = mountPoint[mountPoint.length - 1] === sep ?
-    mountPoint : mountPoint + sep;
-  return StringPrototypeStartsWith(normalizedPath, prefix);
+  if (i === start) return -1;
+  return id;
 }
 
-// Returns a POSIX-style relative path the provider can consume. Uses
-// `path.relative()` so Windows backslash paths are handled correctly, then
-// re-joins with forward slashes for the provider's internal POSIX format.
+// POSIX-style relative path for the provider. `path.relative()` handles
+// Windows backslashes; we re-join with forward slashes.
 function getRelativePath(normalizedPath, mountPoint) {
   if (normalizedPath === mountPoint) {
     return '/';
   }
-  if (mountPoint === '/') {
-    return normalizedPath;
-  }
   const rel = relative(mountPoint, normalizedPath);
   const segments = StringPrototypeSplit(rel, sep);
   return '/' + ArrayPrototypeJoin(segments, '/');
 }
 
 module.exports = {
-  isUnderMountPoint,
+  getLayerIdFromPath,
+  getLayerRoot,
+  getNormalizedVfsRoot,
   getRelativePath,
-  isAbsolutePath: isAbsolute,
 };
diff --git a/lib/internal/vfs/sea.js b/lib/internal/vfs/sea.js
new file mode 100644
index 000000000000..f08bc71bd91b
--- /dev/null
+++ b/lib/internal/vfs/sea.js
@@ -0,0 +1,58 @@
+'use strict';
+
+const { isSea, isVfsEnabled } = internalBinding('sea');
+const { kEmptyObject } = require('internal/util');
+const {
+  codes: {
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+
+let initialized = false;
+
+/* c8 ignore start -- SEA VFS initialization requires an actual SEA binary */
+
+/**
+ * Initializes the SEA virtual file system: a read-only VFS serving the
+ * assets bundled into the executable, mounted at its reserved mount point.
+ * Because a VFS never shadows the real file system, the assets live under
+ * the mount point returned by `vfs.mountPoint`, not at a fixed path; the
+ * SEA main script is placed at the mount point root so bundled code can
+ * reach the assets through `__dirname`-relative paths and relative
+ * `require()` calls.
+ * @param {object} [options] Configuration options
+ * @param {Record<string, string|Buffer>} [options.extraFiles] Additional
+ *   files to serve alongside the assets (used for the SEA main script)
+ * @returns {VirtualFileSystem|null} The mounted VFS, or null if not running
+ *   as a SEA or VFS is not enabled in the SEA configuration
+ * @throws {ERR_INVALID_STATE} If already initialized
+ */
+function initSeaVfs(options = kEmptyObject) {
+  if (initialized) {
+    throw new ERR_INVALID_STATE('SEA VFS is already initialized');
+  }
+  initialized = true;
+
+  if (!isSea() || !isVfsEnabled()) {
+    return null;
+  }
+
+  const { VirtualFileSystem } = require('internal/vfs/file_system');
+  const { SEAProvider } = require('internal/vfs/providers/sea');
+
+  const provider = new SEAProvider({ extraFiles: options.extraFiles });
+  // The SEA warning already covers the feature; don't emit the
+  // VirtualFileSystem experimental warning for the implicit SEA mount.
+  const vfs = new VirtualFileSystem(provider, {
+    emitExperimentalWarning: false,
+  });
+  vfs.mount();
+
+  return vfs;
+}
+
+/* c8 ignore stop */
+
+module.exports = {
+  initSeaVfs,
+};
diff --git a/lib/internal/vfs/setup.js b/lib/internal/vfs/setup.js
index b063c31a0a32..a45cd47a9bf4 100644
--- a/lib/internal/vfs/setup.js
+++ b/lib/internal/vfs/setup.js
@@ -1,30 +1,40 @@
 'use strict';
 
 const {
-  ArrayPrototypeIndexOf,
-  ArrayPrototypePush,
-  ArrayPrototypeSplice,
+  ArrayPrototypeForEach,
+  MapPrototypeForEach,
+  ObjectKeys,
   PromiseResolve,
+  SafeMap,
+  String,
+  StringPrototypeEndsWith,
   StringPrototypeStartsWith,
 } = primordials;
 
 const { Buffer } = require('buffer');
 const { isArrayBufferView } = require('internal/util/types');
-const { resolve, sep } = require('path');
-const { fileURLToPath, URL } = require('internal/url');
+const { dirname, join, sep } = require('path');
+const { fileURLToPath, pathToFileURL, URL } = require('internal/url');
 const { kEmptyObject } = require('internal/util');
 const { validateObject } = require('internal/validators');
 const {
   codes: {
     ERR_INVALID_ARG_TYPE,
     ERR_INVALID_STATE,
+    ERR_MODULE_NOT_FOUND,
   },
 } = require('internal/errors');
 const { createENOENT, createEXDEV } = require('internal/vfs/errors');
+const { kLayerId, normalizeMountedPath } = require('internal/vfs/file_system');
+const {
+  getLayerIdFromPath,
+  getNormalizedVfsRoot,
+} = require('internal/vfs/router');
 const { getVirtualFd, closeVirtualFd } = require('internal/vfs/fd');
-const { assertEncoding, vfsState, setVfsHandlers } = require('internal/fs/utils');
+const { assertEncoding, setVfsHandlers } = require('internal/fs/utils');
 const permission = require('internal/process/permission');
 const { getOptionValue } = require('internal/options');
+const nativeModulesBinding = internalBinding('modules');
 let debug = require('internal/util/debuglog').debuglog('vfs', (fn) => {
   debug = fn;
 });
@@ -72,11 +82,12 @@ function writeFileSyncFd(fd, data, options) {
   return true;
 }
 
-// Registry of active VFS instances.
-const activeVFSList = [];
+const activeVFSLayers = new SafeMap();
 
 let hooksInstalled = false;
 let vfsHandlerObj;
+// Lazy: os.devNull may not be available at snapshot time.
+let normalizedVfsRootPrefix = null;
 
 function registerVFS(vfs) {
   if (permission.isEnabled() && !getOptionValue('--allow-fs-vfs')) {
@@ -85,82 +96,211 @@ function registerVFS(vfs) {
       'Use --allow-fs-vfs to allow it.',
     );
   }
-  if (ArrayPrototypeIndexOf(activeVFSList, vfs) !== -1) return;
-
-  const newMount = vfs.mountPoint;
-  if (newMount != null) {
-    for (let i = 0; i < activeVFSList.length; i++) {
-      const existingMount = activeVFSList[i].mountPoint;
-      if (existingMount == null) continue;
-      // Use path.sep so the trailing-separator guard works on Windows where
-      // mountPoint values are resolved to drive-letter / backslash paths.
-      const newPrefix = newMount === sep ? sep : newMount + sep;
-      const existingPrefix = existingMount === sep ? sep : existingMount + sep;
-      if (newMount === existingMount ||
-          StringPrototypeStartsWith(newMount, existingPrefix) ||
-          StringPrototypeStartsWith(existingMount, newPrefix)) {
-        throw new ERR_INVALID_STATE(
-          `VFS mount '${newMount}' overlaps with existing mount '${existingMount}'`,
-        );
-      }
-    }
-  }
-  ArrayPrototypePush(activeVFSList, vfs);
-  debug('register mount=%s active=%d', newMount, activeVFSList.length);
+  if (activeVFSLayers.has(vfs[kLayerId])) return;
+  activeVFSLayers.set(vfs[kLayerId], vfs);
+  debug('register layer=%d mount=%s active=%d',
+        vfs[kLayerId], vfs.mountPoint, activeVFSLayers.size);
   if (!hooksInstalled) {
-    vfsHandlerObj = createVfsHandlers();
-    setVfsHandlers(vfsHandlerObj);
-    hooksInstalled = true;
-  } else if (vfsState.handlers === null) {
-    setVfsHandlers(vfsHandlerObj);
+    installHooks();
   }
 }
 
 function deregisterVFS(vfs) {
-  const index = ArrayPrototypeIndexOf(activeVFSList, vfs);
-  if (index === -1) return;
-  ArrayPrototypeSplice(activeVFSList, index, 1);
-  debug('deregister active=%d', activeVFSList.length);
-  if (activeVFSList.length === 0) {
-    setVfsHandlers(null);
+  if (!activeVFSLayers.delete(vfs[kLayerId])) return;
+  debug('deregister layer=%d active=%d', vfs[kLayerId], activeVFSLayers.size);
+  purgeLoaderCachesForVFS(vfs);
+  if (activeVFSLayers.size === 0) {
+    uninstallHooks();
   }
 }
 
-function findVFSForExists(filename) {
-  const normalized = resolve(filename);
-  for (let i = 0; i < activeVFSList.length; i++) {
-    const vfs = activeVFSList[i];
-    if (vfs.shouldHandle(normalized)) {
-      return { vfs, exists: vfs.existsSync(normalized) };
+/**
+ * Resolves a path string to the active VFS that owns it, or null.
+ * Ownership is decidable from the path alone: all mount points live
+ * under the reserved `${os.devNull}/vfs/<id>` namespace, so a single
+ * prefix comparison rejects every real-file-system path and a map
+ * lookup finds the owning layer. The normalized path is returned
+ * alongside the layer so downstream helpers can skip renormalization.
+ * @param {string} inputPath
+ * @returns {{ vfs: object, normalized: string }|null}
+ */
+function findVFS(inputPath) {
+  const normalized = normalizeMountedPath(inputPath);
+  if (!StringPrototypeStartsWith(normalized, normalizedVfsRootPrefix)) {
+    return null;
+  }
+  const layerId = getLayerIdFromPath(normalized);
+  if (layerId === -1) return null;
+  const vfs = activeVFSLayers.get(layerId);
+  if (vfs === undefined || !vfs.shouldHandleNormalized(normalized)) {
+    return null;
+  }
+  return { vfs, normalized };
+}
+
+/**
+ * Drop the cache entries under `vfs`'s mount point from the
+ * JS-reachable loader caches. Real-fs entries and other-VFS entries
+ * are left in place. Because mount points cannot collide with real
+ * paths - and symlink resolution inside a VFS always yields paths
+ * under the same mount point - a prefix scan is exact.
+ * @param {object} vfs The VFS being deregistered
+ */
+function purgeLoaderCachesForVFS(vfs) {
+  const mountPoint = vfs.mountPoint;
+
+  const cjsLoader = require('internal/modules/cjs/loader');
+  cjsLoader.purgeModuleCachesForPrefix(mountPoint);
+
+  const helpers = require('internal/modules/helpers');
+  helpers.purgeRealpathCacheForPrefix(mountPoint);
+
+  const pkgReader = require('internal/modules/package_json_reader');
+  pkgReader.purgePackageJSONCacheForPrefix(mountPoint);
+
+  const esmLoader = require('internal/modules/esm/loader');
+  if (esmLoader.isCascadedLoaderInitialized()) {
+    const loader = esmLoader.getOrInitializeCascadedLoader();
+    const loadCache = loader.loadCache;
+    const mountURL = pathToFileURL(mountPoint).href;
+    const mountURLPrefix = mountURL + '/';
+    // Iterate via MapPrototypeForEach (not for-of map.keys()) so a
+    // polluted Map iterator can't break the cleanup path.
+    if (loadCache && typeof loadCache.delete === 'function') {
+      MapPrototypeForEach(loadCache, (variants, url) => {
+        if (typeof url === 'string' &&
+            (url === mountURL ||
+             StringPrototypeStartsWith(url, mountURLPrefix)) &&
+            variants) {
+          ArrayPrototypeForEach(ObjectKeys(variants), (type) => {
+            loadCache.delete(url, type);
+          });
+        }
+      });
     }
   }
-  return null;
 }
 
-function findVFSForPath(filename) {
-  const normalized = resolve(filename);
-  for (let i = 0; i < activeVFSList.length; i++) {
-    const vfs = activeVFSList[i];
-    if (vfs.shouldHandle(normalized)) {
-      return { vfs, normalized };
+/**
+ * Returns the stat result code for a VFS path.
+ * @param {object} vfs The VFS instance
+ * @param {string} filePath The path to check
+ * @returns {number} 0 for file, 1 for directory, -2 for not found
+ */
+function vfsStat(vfs, filePath) {
+  try {
+    const stats = vfs.statSync(filePath);
+    if (stats.isDirectory()) return 1;
+    return 0;
+  } catch (err) {
+    if (typeof err?.errno === 'number') return err.errno;
+    throw err;
+  }
+}
+
+/**
+ * Finds the VFS owning `filename` and stats it.
+ * @param {string} filename The absolute path to check
+ * @returns {{ vfs: object, result: number }|null}
+ */
+function findVFSForStat(filename) {
+  const r = findVFS(filename);
+  if (r === null) return null;
+  return { vfs: r.vfs, result: vfsStat(r.vfs, filename) };
+}
+
+/**
+ * Finds the VFS owning `filename` and reads it.
+ * @param {string} filename The absolute path to read
+ * @param {string|object} options Read options
+ * @returns {{ vfs: object, content: Buffer|string }|null}
+ */
+function findVFSForRead(filename, options) {
+  const r = findVFS(filename);
+  if (r === null) return null;
+  try {
+    return { vfs: r.vfs, content: r.vfs.readFileSync(filename, options) };
+  } catch (e) {
+    const code = e?.code;
+    if (code === 'ENOENT' || code === 'EISDIR') {
+      throw createENOENT('open', filename);
     }
+    throw e;
   }
-  return null;
 }
 
-// Sync read: check exists first, fall through to ENOENT for mounted VFS.
-function findVFSWith(filename, syscall, fn) {
-  const normalized = resolve(filename);
-  for (let i = 0; i < activeVFSList.length; i++) {
-    const vfs = activeVFSList[i];
-    if (vfs.shouldHandle(normalized)) {
-      if (vfs.existsSync(normalized)) {
-        return fn(vfs, normalized);
+/**
+ * Walk up directories inside `vfs`'s mount looking for package.json.
+ * Always returns an object. When a package.json is found `.tuple` is
+ * populated with the C++ binding's serialized shape
+ * (`[name, main, type, imports, exports, filePath]`); otherwise
+ * `.sentinel` is the last candidate path checked - matches the "not
+ * found" marker the C++ binding returns for getPackageScopeConfig.
+ * Syntactically malformed package.json aborts the walk with
+ * ERR_INVALID_PACKAGE_CONFIG (thrown by the native parser), matching
+ * native GetPackageJSON.
+ * @param {object} vfs The VFS that owns startPath
+ * @param {string} startPath Absolute path to start from
+ * @param {string} normalizedStart Same as startPath but passed through
+ *   `normalizeMountedPath`. Used to walk the directory chain so the
+ *   containment check is a plain string prefix rather than a fresh
+ *   `toNamespacedPath(resolve(...))` on every iteration.
+ * @returns {{ vfs?: object, pjsonPath?: string, tuple?: Array, sentinel: string }}
+ */
+function findVFSPackageJSON(vfs, startPath, normalizedStart) {
+  let currentDir = dirname(startPath);
+  let currentNorm = dirname(normalizedStart);
+  let lastDir;
+  let sentinel = join(currentDir, 'package.json');
+  while (currentDir !== lastDir) {
+    if (StringPrototypeEndsWith(currentDir, '/node_modules') ||
+        StringPrototypeEndsWith(currentDir, '\\node_modules')) {
+      break;
+    }
+    if (!vfs.shouldHandleNormalized(currentNorm)) {
+      break;
+    }
+    const pjsonPath = join(currentDir, 'package.json');
+    sentinel = pjsonPath;
+    if (vfsStat(vfs, pjsonPath) === 0) {
+      let content;
+      try {
+        content = vfs.readFileSync(pjsonPath);
+      } catch {
+        content = null;
+      }
+      if (content !== null) {
+        const tuple = nativeModulesBinding.parsePackageJSON(
+          content, pjsonPath);
+        return { vfs, pjsonPath, tuple, sentinel: pjsonPath };
       }
-      throw createENOENT(syscall, filename);
     }
+    lastDir = currentDir;
+    currentDir = dirname(currentDir);
+    currentNorm = dirname(currentNorm);
   }
-  return undefined;
+  return { sentinel };
+}
+
+function findVFSForExists(filename) {
+  const r = findVFS(filename);
+  if (r === null) return null;
+  return { vfs: r.vfs, exists: r.vfs.existsSync(filename) };
+}
+
+function findVFSForPath(filename) {
+  const r = findVFS(filename);
+  if (r === null) return null;
+  return { vfs: r.vfs, path: filename };
+}
+
+function findVFSWith(filename, syscall, fn) {
+  const r = findVFS(filename);
+  if (r === null) return undefined;
+  if (r.vfs.existsSync(filename)) {
+    return fn(r.vfs, filename);
+  }
+  throw createENOENT(syscall, filename);
 }
 
 function vfsRead(path, syscall, fn) {
@@ -173,7 +313,7 @@ function vfsOp(path, fn) {
   const pathStr = toPathStr(path);
   if (pathStr !== null) {
     const r = findVFSForPath(pathStr);
-    if (r !== null) return fn(r.vfs, r.normalized);
+    if (r !== null) return fn(r.vfs, r.path);
   }
   return undefined;
 }
@@ -182,31 +322,21 @@ function vfsOpVoid(path, fn) {
   const pathStr = toPathStr(path);
   if (pathStr !== null) {
     const r = findVFSForPath(pathStr);
-    if (r !== null) { fn(r.vfs, r.normalized); return true; }
+    if (r !== null) { fn(r.vfs, r.path); return true; }
   }
   return undefined;
 }
 
 function checkSameVFS(srcPath, destPath, syscall, srcVfs) {
-  const destNormalized = resolve(destPath);
-  for (let i = 0; i < activeVFSList.length; i++) {
-    const vfs = activeVFSList[i];
-    if (vfs.shouldHandle(destNormalized)) {
-      if (vfs !== srcVfs) {
-        throw createEXDEV(syscall, srcPath);
-      }
-      return;
-    }
+  if (findVFS(destPath)?.vfs !== srcVfs) {
+    throw createEXDEV(syscall, srcPath);
   }
-  throw createEXDEV(syscall, srcPath);
 }
 
 function createVfsHandlers() {
   return {
     __proto__: null,
 
-    // ==================== Sync path-based read ops ====================
-
     existsSync(path) {
       const pathStr = toPathStr(path);
       if (pathStr === null) return undefined;
@@ -241,27 +371,12 @@ function createVfsHandlers() {
     lstatSync(path, options) {
       const pathStr = toPathStr(path);
       if (pathStr === null) return undefined;
-      const normalized = resolve(pathStr);
-      for (let i = 0; i < activeVFSList.length; i++) {
-        const vfs = activeVFSList[i];
-        if (vfs.shouldHandle(normalized)) {
-          try {
-            return vfs.lstatSync(normalized, options);
-          } catch (e) {
-            if (e?.code === 'ENOENT' && options?.throwIfNoEntry === false) return undefined;
-            throw e;
-          }
-        }
-      }
-      return undefined;
+      const r = findVFS(pathStr);
+      if (r === null) return undefined;
+      return r.vfs.lstatSync(pathStr, options);
     },
     statSync(path, options) {
-      try {
-        return vfsRead(path, 'stat', (vfs, n) => vfs.statSync(n, options));
-      } catch (err) {
-        if (err?.code === 'ENOENT' && options?.throwIfNoEntry === false) return undefined;
-        throw err;
-      }
+      return vfsRead(path, 'stat', (vfs, n) => vfs.statSync(n, options));
     },
     realpathSync(path, options) {
       const result = vfsRead(path, 'realpath', (vfs, n) => vfs.realpathSync(n));
@@ -278,7 +393,7 @@ function createVfsHandlers() {
           if (mode != null && typeof mode !== 'number') {
             throw new ERR_INVALID_ARG_TYPE('mode', 'integer', mode);
           }
-          r.vfs.accessSync(r.normalized, mode);
+          r.vfs.accessSync(r.path, mode);
           return true;
         }
       }
@@ -287,16 +402,11 @@ function createVfsHandlers() {
     readlinkSync(path, options) {
       const pathStr = toPathStr(path);
       if (pathStr === null) return undefined;
-      const normalized = resolve(pathStr);
-      for (let i = 0; i < activeVFSList.length; i++) {
-        const vfs = activeVFSList[i];
-        if (vfs.shouldHandle(normalized)) {
-          const result = vfs.readlinkSync(normalized, options);
-          if (options?.encoding === 'buffer') return Buffer.from(result);
-          return result;
-        }
-      }
-      return undefined;
+      const r = findVFS(pathStr);
+      if (r === null) return undefined;
+      const result = r.vfs.readlinkSync(pathStr, options);
+      if (options?.encoding === 'buffer') return Buffer.from(result);
+      return result;
     },
     statfsSync(path, options) {
       const pathStr = toPathStr(path);
@@ -312,8 +422,6 @@ function createVfsHandlers() {
       return undefined;
     },
 
-    // ==================== Sync path-based write ops ====================
-
     writeFileSync(path, data, options) {
       if (typeof path === 'number') return writeFileSyncFd(path, data, options);
       return vfsOpVoid(path, (vfs, n) => vfs.writeFileSync(n, data, options));
@@ -329,14 +437,16 @@ function createVfsHandlers() {
     unlinkSync: (path) => vfsOpVoid(path, (vfs, n) => vfs.unlinkSync(n)),
     renameSync(oldPath, newPath) {
       return vfsOpVoid(oldPath, (vfs, n) => {
-        checkSameVFS(n, toPathStr(newPath), 'rename', vfs);
-        vfs.renameSync(n, resolve(toPathStr(newPath)));
+        const destStr = toPathStr(newPath);
+        checkSameVFS(n, destStr, 'rename', vfs);
+        vfs.renameSync(n, destStr);
       });
     },
     copyFileSync(src, dest, mode) {
       return vfsOpVoid(src, (vfs, n) => {
-        checkSameVFS(n, toPathStr(dest), 'copyfile', vfs);
-        vfs.copyFileSync(n, resolve(toPathStr(dest)), mode);
+        const destStr = toPathStr(dest);
+        checkSameVFS(n, destStr, 'copyfile', vfs);
+        vfs.copyFileSync(n, destStr, mode);
       });
     },
     symlinkSync: (target, path, type) =>
@@ -351,8 +461,9 @@ function createVfsHandlers() {
     truncateSync: (path, len) => vfsOpVoid(path, (vfs, n) => vfs.truncateSync(n, len)),
     linkSync(existingPath, newPath) {
       return vfsOpVoid(existingPath, (vfs, n) => {
-        checkSameVFS(n, toPathStr(newPath), 'link', vfs);
-        vfs.linkSync(n, resolve(toPathStr(newPath)));
+        const destStr = toPathStr(newPath);
+        checkSameVFS(n, destStr, 'link', vfs);
+        vfs.linkSync(n, destStr);
       });
     },
     mkdtempSync(prefix, options) {
@@ -366,19 +477,14 @@ function createVfsHandlers() {
     openAsBlob(path, options) {
       const pathStr = toPathStr(path);
       if (pathStr !== null) {
-        const normalized = resolve(pathStr);
-        for (let i = 0; i < activeVFSList.length; i++) {
-          const vfs = activeVFSList[i];
-          if (vfs.shouldHandle(normalized) && vfs.existsSync(normalized)) {
-            return vfs.openAsBlob(normalized, options);
-          }
+        const r = findVFS(pathStr);
+        if (r !== null && r.vfs.existsSync(pathStr)) {
+          return r.vfs.openAsBlob(pathStr, options);
         }
       }
       return undefined;
     },
 
-    // ==================== Sync FD-based ops ====================
-
     openSync: (path, flags, mode) => vfsOp(path, (vfs, n) => vfs.openSync(n, flags, mode)),
     closeSync(fd) {
       const vfd = getVirtualFd(fd);
@@ -437,8 +543,6 @@ function createVfsHandlers() {
       return totalWritten;
     },
 
-    // ==================== Async FD-based ops ====================
-
     close(fd) {
       const vfd = getVirtualFd(fd);
       if (!vfd) return undefined;
@@ -472,13 +576,11 @@ function createVfsHandlers() {
     fdatasync: noopFd,
     fsync: noopFd,
 
-    // ==================== Stream ops ====================
-
     createReadStream(path, options) {
       const pathStr = toPathStr(path);
       if (pathStr !== null) {
         const r = findVFSForPath(pathStr);
-        if (r !== null) return r.vfs.createReadStream(r.normalized, options);
+        if (r !== null) return r.vfs.createReadStream(r.path, options);
       }
       return undefined;
     },
@@ -486,13 +588,11 @@ function createVfsHandlers() {
       const pathStr = toPathStr(path);
       if (pathStr !== null) {
         const r = findVFSForPath(pathStr);
-        if (r !== null) return r.vfs.createWriteStream(r.normalized, options);
+        if (r !== null) return r.vfs.createWriteStream(r.path, options);
       }
       return undefined;
     },
 
-    // ==================== Watch ops ====================
-
     watch(filename, options, listener) {
       if (typeof options === 'function') {
         listener = options;
@@ -510,8 +610,6 @@ function createVfsHandlers() {
       return undefined;
     },
 
-    // ==================== Async path-based ops ====================
-
     readdir(path, options) {
       const promise = vfsOp(path, (vfs, n) => vfs.promises.readdir(n, options));
       if (promise !== undefined && options?.encoding === 'buffer' && !options?.withFileTypes) {
@@ -527,14 +625,9 @@ function createVfsHandlers() {
     lstat(path, options) {
       const pathStr = toPathStr(path);
       if (pathStr === null) return undefined;
-      const normalized = resolve(pathStr);
-      for (let i = 0; i < activeVFSList.length; i++) {
-        const vfs = activeVFSList[i];
-        if (vfs.shouldHandle(normalized)) {
-          return vfs.promises.lstat(normalized, options);
-        }
-      }
-      return undefined;
+      const r = findVFS(pathStr);
+      if (r === null) return undefined;
+      return r.vfs.promises.lstat(pathStr, options);
     },
     stat(path, options) {
       const promise = vfsOp(path, (vfs, n) => vfs.promises.stat(n, options));
@@ -578,18 +671,13 @@ function createVfsHandlers() {
     readlink(path, options) {
       const pathStr = toPathStr(path);
       if (pathStr === null) return undefined;
-      const normalized = resolve(pathStr);
-      for (let i = 0; i < activeVFSList.length; i++) {
-        const vfs = activeVFSList[i];
-        if (vfs.shouldHandle(normalized)) {
-          const promise = vfs.promises.readlink(normalized, options);
-          if (options?.encoding === 'buffer') {
-            return promise.then((result) => Buffer.from(result));
-          }
-          return promise;
-        }
+      const r = findVFS(pathStr);
+      if (r === null) return undefined;
+      const promise = r.vfs.promises.readlink(pathStr, options);
+      if (options?.encoding === 'buffer') {
+        return promise.then((result) => Buffer.from(result));
       }
-      return undefined;
+      return promise;
     },
     chown: (path, uid, gid) =>
       vfsOp(path, (vfs, n) => vfs.promises.chown(n, uid, gid).then(() => true)),
@@ -630,14 +718,16 @@ function createVfsHandlers() {
     unlink: (path) => vfsOp(path, (vfs, n) => vfs.promises.unlink(n).then(() => true)),
     rename(oldPath, newPath) {
       return vfsOp(oldPath, (vfs, n) => {
-        checkSameVFS(n, toPathStr(newPath), 'rename', vfs);
-        return vfs.promises.rename(n, resolve(toPathStr(newPath))).then(() => true);
+        const destStr = toPathStr(newPath);
+        checkSameVFS(n, destStr, 'rename', vfs);
+        return vfs.promises.rename(n, destStr).then(() => true);
       });
     },
     copyFile(src, dest, mode) {
       return vfsOp(src, (vfs, n) => {
-        checkSameVFS(n, toPathStr(dest), 'copyfile', vfs);
-        return vfs.promises.copyFile(n, resolve(toPathStr(dest)), mode).then(() => true);
+        const destStr = toPathStr(dest);
+        checkSameVFS(n, destStr, 'copyfile', vfs);
+        return vfs.promises.copyFile(n, destStr, mode).then(() => true);
       });
     },
     symlink(target, path, type) {
@@ -647,8 +737,9 @@ function createVfsHandlers() {
       vfsOp(path, (vfs, n) => vfs.promises.truncate(n, len).then(() => true)),
     link(existingPath, newPath) {
       return vfsOp(existingPath, (vfs, n) => {
-        checkSameVFS(n, toPathStr(newPath), 'link', vfs);
-        return vfs.promises.link(n, resolve(toPathStr(newPath))).then(() => true);
+        const destStr = toPathStr(newPath);
+        checkSameVFS(n, destStr, 'link', vfs);
+        return vfs.promises.link(n, destStr).then(() => true);
       });
     },
     mkdtemp(prefix, options) {
@@ -663,9 +754,8 @@ function createVfsHandlers() {
     utimes: (path, atime, mtime) =>
       vfsOp(path, (vfs, n) => vfs.promises.utimes(n, atime, mtime).then(() => true)),
     open(path, flags, mode) {
-      // openSync is synchronous, so an error thrown by the provider would
-      // escape via fs.open's caller (instead of going through the callback).
-      // Catch it here and surface as a rejected promise.
+      // Wrap openSync in an async fn so provider throws become rejections
+      // instead of escaping past fs.open's callback.
       return vfsOp(path, async (vfs, n) => vfs.openSync(n, flags, mode));
     },
     promisesOpen(path, flags, mode) {
@@ -673,7 +763,7 @@ function createVfsHandlers() {
       if (pathStr !== null) {
         const r = findVFSForPath(pathStr);
         if (r !== null) {
-          const fd = r.vfs.openSync(r.normalized, flags, mode);
+          const fd = r.vfs.openSync(r.path, flags, mode);
           const vfd = getVirtualFd(fd);
           return PromiseResolve(vfd.entry);
         }
@@ -685,6 +775,195 @@ function createVfsHandlers() {
   };
 }
 
+/**
+ * Install toggleable loader overrides so that the module loader's
+ * internal fs operations (stat, readFile, realpath) are redirected
+ * to VFS when appropriate.
+ */
+function installModuleLoaderOverrides() {
+  const {
+    legacyMainResolveExtensions,
+    legacyMainResolveExtensionsIndexes,
+    kLoaderOverrideNoResult,
+    setLoaderOverrides,
+  } = require('internal/modules/helpers');
+  const { kResolvedByMainIndexNode } = legacyMainResolveExtensionsIndexes;
+  const { internal: internalConstants } = internalBinding('constants');
+
+  // Overrides return `undefined` for paths the VFS does not own;
+  // wrapLoaderMethod then falls through to the native binding.
+  setLoaderOverrides({
+    internalModuleStat(filename) {
+      const result = findVFSForStat(filename);
+      return result !== null ? result.result : undefined;
+    },
+    readFileSync(filename, options) {
+      const pathStr = typeof filename === 'string' ? filename :
+        (filename instanceof URL ? fileURLToPath(filename) : String(filename));
+      const result = findVFSForRead(pathStr, options);
+      return result !== null ? result.content : undefined;
+    },
+    realpathSync(filename) {
+      return findVFSWith(filename, 'realpath', (vfs, n) => vfs.realpathSync(n));
+    },
+    getResolutionRoot(pathStr) {
+      const r = findVFS(pathStr);
+      if (r === null) return undefined;
+      const mountPoint = r.vfs.mountPoint;
+      // The boundary is compared as a plain string prefix by the
+      // callers, so only report it when the input carries the mount
+      // point verbatim.
+      return StringPrototypeStartsWith(pathStr, mountPoint) ?
+        mountPoint : undefined;
+    },
+    legacyMainResolve(pkgPath, main, base) {
+      if (findVFS(pkgPath) === null) return undefined;
+
+      for (let i = 0; i < legacyMainResolveExtensions.length; i++) {
+        const byMain = i <= kResolvedByMainIndexNode;
+        if (byMain && !main) continue;
+        const prefix = byMain ? main : '';
+        const candidate = join(pkgPath, prefix + legacyMainResolveExtensions[i]);
+        if (findVFSForStat(candidate)?.result === 0) return i;
+      }
+
+      // Third arg `exactUrl` must be undefined (not a string) so the
+      // message uses the "package" word and err.url is not overwritten.
+      // ERR_MODULE_NOT_FOUND enforces strict arity in getMessage(), so
+      // the undefined has to be passed explicitly.
+      const initial = main ? join(pkgPath, main) : join(pkgPath, 'index.js');
+      throw new ERR_MODULE_NOT_FOUND(initial, base, undefined);
+    },
+    getFormatOfExtensionlessFile(filePath) {
+      let result;
+      try {
+        result = findVFSForRead(filePath, null);
+      } catch {
+        return internalConstants.EXTENSIONLESS_FORMAT_JAVASCRIPT;
+      }
+      if (result === null) return undefined;
+      const content = result.content;
+      // Wasm magic bytes: 0x00 0x61 0x73 0x6d
+      if (content && content.length >= 4 &&
+          content[0] === 0x00 && content[1] === 0x61 &&
+          content[2] === 0x73 && content[3] === 0x6d) {
+        return internalConstants.EXTENSIONLESS_FORMAT_WASM;
+      }
+      return internalConstants.EXTENSIONLESS_FORMAT_JAVASCRIPT;
+    },
+    readPackageJSON(jsonPath, isESM, base, specifier) {
+      const r = findVFS(jsonPath);
+      if (r === null) return undefined;
+      const { vfs } = r;
+      if (vfsStat(vfs, jsonPath) !== 0) return kLoaderOverrideNoResult;
+      let content;
+      try {
+        content = vfs.readFileSync(jsonPath);
+      } catch {
+        return kLoaderOverrideNoResult;
+      }
+      // Both CJS and ESM raise ERR_INVALID_PACKAGE_CONFIG since
+      // nodejs/node#48606.
+      return nativeModulesBinding.parsePackageJSON(
+        content, jsonPath, isESM, base, specifier);
+    },
+    getNearestParentPackageJSON(checkPath) {
+      const r = findVFS(checkPath);
+      if (r === null) return undefined;
+      const found = findVFSPackageJSON(r.vfs, checkPath, r.normalized);
+      return found.tuple ?? kLoaderOverrideNoResult;
+    },
+    getPackageScopeConfig(resolved) {
+      let filePath;
+      if (StringPrototypeStartsWith(resolved, 'file:')) {
+        try {
+          filePath = fileURLToPath(resolved);
+        } catch {
+          return undefined;
+        }
+      } else {
+        filePath = resolved;
+      }
+      const r = findVFS(filePath);
+      if (r === null) return undefined;
+      const found = findVFSPackageJSON(r.vfs, filePath, r.normalized);
+      if (found.tuple !== undefined) return found.tuple;
+      return found.sentinel;
+    },
+    getPackageType(url) {
+      let filePath;
+      if (StringPrototypeStartsWith(url, 'file:')) {
+        try {
+          filePath = fileURLToPath(url);
+        } catch {
+          return undefined;
+        }
+      } else {
+        filePath = url;
+      }
+      const r = findVFS(filePath);
+      if (r === null) return undefined;
+      const found = findVFSPackageJSON(r.vfs, filePath, r.normalized);
+      if (found.tuple !== undefined) {
+        // Tuple shape: [name, main, type, imports, exports, filePath].
+        const type = found.tuple[2];
+        if (type === 'module' || type === 'commonjs') return type;
+      }
+      return kLoaderOverrideNoResult;
+    },
+  });
+}
+
+let originalDlopen;
+
+function installAddonLoader() {
+  originalDlopen = process.dlopen;
+  process.dlopen = function(module, filename, flags) {
+    // dlopen(2) cannot open a native addon that lives in a VFS by path (it has
+    // no real inode). Read its bytes and hand them to the internal
+    // dlopenBinary(), which writes them to a private, self-cleaning temporary
+    // image - an in-memory memfd on Linux - and loads that. Only VFS paths take
+    // this route; everything else loads straight from disk through the
+    // unchanged process.dlopen().
+    if (StringPrototypeStartsWith(filename, normalizedVfsRootPrefix)) {
+      const { readFileSync } = require('fs');
+      const { dlopenBinary } = internalBinding('process_methods');
+      return dlopenBinary(module, filename, flags, readFileSync(filename));
+    }
+    return originalDlopen(module, filename, flags);
+  };
+}
+
+/**
+ * Install all VFS hooks: module loader overrides and fs handlers.
+ */
+function installHooks() {
+  if (hooksInstalled) return;
+  debug('install hooks');
+  normalizedVfsRootPrefix = getNormalizedVfsRoot() + sep;
+  installModuleLoaderOverrides();
+  installAddonLoader();
+  vfsHandlerObj = createVfsHandlers();
+  setVfsHandlers(vfsHandlerObj);
+  hooksInstalled = true;
+}
+
+/**
+ * Tear down all VFS hooks when the last instance is deregistered. The
+ * fast path in the loader wrappers is restored so subsequent require/
+ * import calls pay zero overhead until another VFS is mounted.
+ */
+function uninstallHooks() {
+  if (!hooksInstalled) return;
+  debug('uninstall hooks');
+  const { setLoaderOverrides } = require('internal/modules/helpers');
+  setLoaderOverrides();
+  setVfsHandlers(null);
+  vfsHandlerObj = undefined;
+  process.dlopen = originalDlopen;
+  hooksInstalled = false;
+}
+
 module.exports = {
   registerVFS,
   deregisterVFS,
diff --git a/lib/internal/webidl.js b/lib/internal/webidl.js
index 7f61bae8c21f..71513bbe86f4 100644
--- a/lib/internal/webidl.js
+++ b/lib/internal/webidl.js
@@ -25,6 +25,7 @@ const {
   SafeArrayIterator,
   SafeSet,
   String,
+  StringPrototypeToWellFormed,
   SymbolIterator,
   TypeError,
   TypedArrayPrototypeGetBuffer,
@@ -603,6 +604,17 @@ converters.DOMString = function DOMString(V, options = kEmptyObject) {
   return toString(V, options);
 };
 
+/**
+ * Converts a JavaScript value to the IDL USVString type.
+ * @see https://webidl.spec.whatwg.org/#es-USVString
+ * @param {any} V JavaScript value.
+ * @param {ConversionOptions} [options] Conversion options.
+ * @returns {string}
+ */
+converters.USVString = function USVString(V, options = kEmptyObject) {
+  return StringPrototypeToWellFormed(converters.DOMString(V, options));
+};
+
 /**
  * Throws when a Web IDL operation receives too few arguments.
  * @param {number} length Actual argument count.
@@ -1109,6 +1121,22 @@ converters['sequence<DOMString>'] =
 converters['sequence<object>'] =
   createSequenceConverter(converters.object);
 
+// https://html.spec.whatwg.org/multipage/web-messaging.html#structuredserializeoptions
+//
+// dictionary StructuredSerializeOptions {
+//   sequence<object> transfer = [];
+// };
+converters.StructuredSerializeOptions = createDictionaryConverter(
+  'StructuredSerializeOptions',
+  [
+    {
+      key: 'transfer',
+      converter: converters['sequence<object>'],
+      defaultValue: () => [],
+    },
+  ],
+);
+
 module.exports = {
   converters,
   convertToInt,
diff --git a/lib/internal/webstreams/adapters.js b/lib/internal/webstreams/adapters.js
index 42e1221bb307..c00cc38ceef8 100644
--- a/lib/internal/webstreams/adapters.js
+++ b/lib/internal/webstreams/adapters.js
@@ -23,11 +23,16 @@ const { TextEncoder } = require('internal/encoding');
 const {
   ReadableStream,
   isReadableStream,
+  readableStreamDefaultReaderRead,
+  kChunk,
+  kClose,
+  kError,
 } = require('internal/webstreams/readablestream');
 
 const {
   WritableStream,
   isWritableStream,
+  writableStreamDefaultWriterWriteWithRequest,
 } = require('internal/webstreams/writablestream');
 
 const {
@@ -53,6 +58,10 @@ const {
   Buffer,
 } = require('buffer');
 
+const {
+  kResolvedPromise,
+} = require('internal/webstreams/util');
+
 const {
   isAnyArrayBuffer,
 } = require('internal/util/types');
@@ -141,6 +150,96 @@ function handleKnownInternalErrors(cause) {
 
 const noop = () => {};
 
+// A single shared write request tracks every chunk written to the
+// destination WritableStream, replacing the per-write promise pair that
+// writer.ready + writer.write() would allocate. Only one write/writev
+// batch is in flight at a time, so one callback slot is enough.
+// `promise` is non-undefined so writable-stream queue entries are
+// discriminated from kNilRequest by `promise === undefined`;
+// `failed`/`failure` latch a write that could not proceed.
+function createWriteTracker(getDestination) {
+  return {
+    promise: null,
+    pending: 0,
+    failed: false,
+    failure: undefined,
+    callback: undefined,
+    error: undefined,
+    hasError: false,
+    dispatching: false,
+    resolve() {
+      this.pending--;
+      if (!this.dispatching && this.pending === 0 &&
+          this.callback !== undefined) {
+        this.settle();
+      }
+    },
+    reject(error) {
+      this.pending--;
+      if (!this.hasError) {
+        this.hasError = true;
+        this.error = error;
+      }
+      if (!this.dispatching && this.pending === 0 &&
+          this.callback !== undefined) {
+        this.settle();
+      }
+    },
+    settle() {
+      const callback = this.callback;
+      this.callback = undefined;
+      let error;
+      if (this.hasError) {
+        error = this.error;
+        this.hasError = false;
+        this.error = undefined;
+      } else if (this.failed) {
+        error = this.failure;
+      }
+      this.failed = false;
+      this.failure = undefined;
+      if (error !== undefined) {
+        // Deliver failures in a microtask: this can run while the
+        // writable-stream machinery is mid-transition (e.g. inside
+        // writableStreamFinishErroring), and the callback typically
+        // destroys the stream, which re-enters the machinery.
+        PromisePrototypeThen(kResolvedPromise, () => {
+          try {
+            callback(error);
+          } catch (err) {
+            process.nextTick(() => destroy(getDestination(), err));
+          }
+        });
+        return;
+      }
+      try {
+        callback(error);
+      } catch (err) {
+        // In a next tick because this can run within a promise context,
+        // and any error thrown must not become an unhandled rejection.
+        process.nextTick(() => destroy(getDestination(), err));
+      }
+    },
+  };
+}
+
+function dispatchWrite(writer, chunk, tracker) {
+  tracker.dispatching = true;
+  writableStreamDefaultWriterWriteWithRequest(writer, chunk, tracker);
+  tracker.dispatching = false;
+  if (tracker.pending === 0)
+    tracker.settle();
+}
+
+function dispatchWritev(writer, chunks, tracker) {
+  tracker.dispatching = true;
+  for (let i = 0; i < chunks.length; i++)
+    writableStreamDefaultWriterWriteWithRequest(writer, chunks[i].chunk, tracker);
+  tracker.dispatching = false;
+  if (tracker.pending === 0)
+    tracker.settle();
+}
+
 /**
  * @typedef {import('../../stream').Writable} Writable
  * @typedef {import('../../stream').Readable} Readable
@@ -313,6 +412,7 @@ function newStreamWritableFromWritableStream(writableStream, options = kEmptyObj
 
   const writer = writableStream.getWriter();
   let closed = false;
+  const writeTracker = createWriteTracker(() => writable);
 
   const writable = new Writable({
     highWaterMark,
@@ -321,27 +421,8 @@ function newStreamWritableFromWritableStream(writableStream, options = kEmptyObj
     signal,
 
     writev(chunks, callback) {
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          // In a next tick because this is happening within
-          // a promise context, and if there are any errors
-          // thrown we don't want those to cause an unhandled
-          // rejection. Let's just escape the promise and
-          // handle it separately.
-          process.nextTick(() => destroy(writable, error));
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(
-          writer.ready,
-          () => SafePromiseAllReturnVoid(
-            chunks,
-            (data) => writer.write(data.chunk))),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWritev(writer, chunks, writeTracker);
     },
 
     write(chunk, encoding, callback) {
@@ -360,18 +441,8 @@ function newStreamWritableFromWritableStream(writableStream, options = kEmptyObj
         }
       }
 
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          destroy(writable, error);
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(writer.ready, () => writer.write(chunk)),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWrite(writer, chunk, writeTracker);
     },
 
     destroy(error, callback) {
@@ -585,6 +656,14 @@ function newStreamReadableFromReadableStream(readableStream, options = kEmptyObj
 
   const reader = readableStream.getReader();
   let closed = false;
+  let readRequest;
+  let pendingChunk;
+
+  function forwardChunk() {
+    const chunk = pendingChunk;
+    pendingChunk = undefined;
+    readable.push(chunk);
+  }
 
   const readable = new Readable({
     objectMode,
@@ -593,17 +672,25 @@ function newStreamReadableFromReadableStream(readableStream, options = kEmptyObj
     signal,
 
     read() {
-      PromisePrototypeThen(
-        reader.read(),
-        (chunk) => {
-          if (chunk.done) {
-            // Value should always be undefined here.
-            readable.push(null);
-          } else {
-            readable.push(chunk.value);
-          }
+      // At most one read is in flight (Readable does not call read()
+      // again before push()), so a single reused read request replaces
+      // the promise, read-result object, and reaction closures that
+      // reader.read() would allocate per chunk. The chunk is forwarded
+      // in a microtask to keep the old reaction position: a sync push
+      // could deliver a chunk that an error or destroy should beat.
+      readRequest ??= {
+        [kChunk](chunk) {
+          pendingChunk = chunk;
+          PromisePrototypeThen(kResolvedPromise, forwardChunk);
+        },
+        [kClose]() {
+          readable.push(null);
         },
-        (error) => destroy(readable, error));
+        [kError](error) {
+          destroy(readable, error);
+        },
+      };
+      readableStreamDefaultReaderRead(reader, readRequest);
     },
 
     destroy(error, callback) {
@@ -769,6 +856,15 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
   const reader = readableStream.getReader();
   let writableClosed = false;
   let readableClosed = false;
+  let readRequest;
+  let pendingChunk;
+  const writeTracker = createWriteTracker(() => duplex);
+
+  function forwardChunk() {
+    const chunk = pendingChunk;
+    pendingChunk = undefined;
+    duplex.push(chunk);
+  }
 
   const duplex = new Duplex({
     allowHalfOpen,
@@ -779,27 +875,8 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
     signal,
 
     writev(chunks, callback) {
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          // In a next tick because this is happening within
-          // a promise context, and if there are any errors
-          // thrown we don't want those to cause an unhandled
-          // rejection. Let's just escape the promise and
-          // handle it separately.
-          process.nextTick(() => destroy(duplex, error));
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(
-          writer.ready,
-          () => SafePromiseAllReturnVoid(
-            chunks,
-            (data) => writer.write(data.chunk))),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWritev(writer, chunks, writeTracker);
     },
 
     write(chunk, encoding, callback) {
@@ -818,18 +895,8 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
         }
       }
 
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          destroy(duplex, error);
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(writer.ready, () => writer.write(chunk)),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWrite(writer, chunk, writeTracker);
     },
 
     final(callback) {
@@ -855,16 +922,21 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
     },
 
     read() {
-      PromisePrototypeThen(
-        reader.read(),
-        (chunk) => {
-          if (chunk.done) {
-            duplex.push(null);
-          } else {
-            duplex.push(chunk.value);
-          }
+      // Same single-in-flight reused read request as
+      // newStreamReadableFromReadableStream().
+      readRequest ??= {
+        [kChunk](chunk) {
+          pendingChunk = chunk;
+          PromisePrototypeThen(kResolvedPromise, forwardChunk);
         },
-        (error) => destroy(duplex, error));
+        [kClose]() {
+          duplex.push(null);
+        },
+        [kError](error) {
+          destroy(duplex, error);
+        },
+      };
+      readableStreamDefaultReaderRead(reader, readRequest);
     },
 
     destroy(error, callback) {
diff --git a/lib/internal/webstreams/readablestream.js b/lib/internal/webstreams/readablestream.js
index 78313bd03c1a..5402bb487be5 100644
--- a/lib/internal/webstreams/readablestream.js
+++ b/lib/internal/webstreams/readablestream.js
@@ -3870,6 +3870,9 @@ module.exports = {
   readableStreamReaderGenericRelease,
   readableStreamBYOBReaderRead,
   readableStreamDefaultReaderRead,
+  kChunk,
+  kClose,
+  kError,
   setupReadableStreamBYOBReader,
   setupReadableStreamDefaultReader,
   readableStreamDefaultControllerClose,
diff --git a/lib/internal/webworker.js b/lib/internal/webworker.js
new file mode 100644
index 000000000000..e2a2086f9039
--- /dev/null
+++ b/lib/internal/webworker.js
@@ -0,0 +1,986 @@
+'use strict';
+
+// The Web IDL and specification prose quoted below is reproduced verbatim
+// from the specification, including its original (lowercase) casing.
+// Refs: https://html.spec.whatwg.org/multipage/workers.html
+/* eslint-disable capitalized-comments */
+
+const {
+  ArrayPrototypePush,
+  FunctionPrototypeBind,
+  ObjectDefineProperties,
+  ObjectDefineProperty,
+  ObjectGetPrototypeOf,
+  ObjectSetPrototypeOf,
+  ReflectDeleteProperty,
+  RegExpPrototypeExec,
+  SafeSet,
+  StringPrototypeSlice,
+  Symbol,
+  SymbolFor,
+  SymbolIterator,
+  SymbolToStringTag,
+  TypedArrayPrototypeGetLength,
+  Uint8Array,
+  globalThis,
+} = primordials;
+
+const {
+  ERR_ILLEGAL_CONSTRUCTOR,
+  ERR_INVALID_STATE,
+  ERR_NO_CRYPTO,
+} = require('internal/errors').codes;
+
+const {
+  EventTarget,
+  defineEventHandler,
+  initEventTarget,
+} = require('internal/event_target');
+
+const {
+  assignFunctionName,
+  defineOperation,
+  exposeInterface,
+  getCWDURL,
+  getLazy,
+  kEmptyObject,
+  kEnumerableProperty,
+  lazyDOMException,
+} = require('internal/util');
+
+const {
+  validateThisInternalField,
+} = require('internal/validators');
+
+const {
+  converters,
+  createDictionaryConverter,
+  createEnumConverter,
+  requiredArguments,
+} = require('internal/webidl');
+
+const {
+  Worker: NodeWorker,
+  kPublicPort,
+  kWebWorkerData,
+} = require('internal/worker');
+
+const {
+  lazyMessageEvent,
+} = require('internal/worker/io');
+
+const {
+  vm_dynamic_import_default_internal,
+} = internalBinding('symbols');
+
+const {
+  base64Slice,
+} = internalBinding('buffer');
+
+const {
+  hasOpenSSL,
+} = internalBinding('config');
+
+const {
+  Navigator,
+  kInitialize: kInitializeNavigator,
+} = require('internal/navigator');
+
+const {
+  URL,
+  URLParse,
+} = require('internal/url');
+
+const {
+  kType: kBlobType,
+  getBlobDataSync,
+  resolveObjectURL,
+} = require('internal/blob');
+
+const kCurrentlyReceivingPorts =
+  SymbolFor('nodejs.internal.kCurrentlyReceivingPorts');
+const kRef = SymbolFor('nodejs.ref');
+const kUnref = SymbolFor('nodejs.unref');
+
+const kCreate = Symbol('kCreate');
+const kInsidePort = Symbol('kInsidePort');
+const kLocation = Symbol('kLocation');
+const kName = Symbol('kName');
+const kNavigator = Symbol('kNavigator');
+const kNavigatorBrand = Symbol('kNavigatorBrand');
+const kType = Symbol('kType');
+const kURL = Symbol('kURL');
+const kWorker = Symbol('kWorker');
+
+let scopeBaseURL = null;
+
+const lazyErrorEvent =
+  getLazy(() => require('internal/deps/undici/undici').ErrorEvent);
+
+function createErrorEvent(init) {
+  const ErrorEvent = lazyErrorEvent();
+  return new ErrorEvent('error', init);
+}
+
+// "Fire an event named message at messageEventTarget, using MessageEvent,
+// with the data attribute initialized to messageClone and the ports
+// attribute initialized to newPorts."
+//
+// "If this throws an exception, catch it, fire an event named messageerror
+// at messageEventTarget, using MessageEvent, and then return."
+function forwardMessageEvents(port, target) {
+  port.on('message', (data) =>
+    target.dispatchEvent(lazyMessageEvent('message', {
+      data,
+      ports: port[kCurrentlyReceivingPorts],
+    })));
+  port.on('messageerror', (data) =>
+    target.dispatchEvent(lazyMessageEvent('messageerror', {
+      data,
+    })));
+}
+
+// Web IDL [Replaceable]: the setter replaces the accessor with an own
+// data property on the receiver.
+// Refs: https://webidl.spec.whatwg.org/#Replaceable
+function replaceAttribute(receiver, key, value) {
+  ObjectDefineProperty(receiver, key, {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    writable: true,
+    value,
+  });
+}
+
+// https://mimesniff.spec.whatwg.org/#javascript-mime-type
+const kJavaScriptMIMETypes = new SafeSet([
+  'application/ecmascript',
+  'application/javascript',
+  'application/x-ecmascript',
+  'application/x-javascript',
+  'text/ecmascript',
+  'text/javascript',
+  'text/javascript1.0',
+  'text/javascript1.1',
+  'text/javascript1.2',
+  'text/javascript1.3',
+  'text/javascript1.4',
+  'text/javascript1.5',
+  'text/jscript',
+  'text/livescript',
+  'text/x-ecmascript',
+  'text/x-javascript',
+]);
+
+function isJavaScriptMIMEType(essence) {
+  return kJavaScriptMIMETypes.has(essence);
+}
+
+// Extracts the essence ("type/subtype") of a raw MIME type string, or
+// returns undefined if the string is not a parsable MIME type.
+function mimeTypeEssence(type) {
+  const { MIMEType } = require('internal/mime');
+  try {
+    return new MIMEType(type).essence;
+  } catch {
+    return undefined;
+  }
+}
+
+function utf8Decode(bytes) {
+  return require('internal/encoding').getUtf8Decoder().decode(bytes);
+}
+
+// Reads and decodes the source text of a JavaScript data: URL, or returns
+// undefined if the URL fails to parse as a data: URL or its MIME type is
+// not a JavaScript MIME type.
+function readDataURLScript(url) {
+  const { dataURLProcessor } = require('internal/data_url');
+  const data = dataURLProcessor(url);
+  if (data === 'failure' || !isJavaScriptMIMEType(data.mimeType.essence)) {
+    return undefined;
+  }
+  return utf8Decode(data.body);
+}
+
+// Reads the data of a blob whose contents are to be run as a script, or
+// returns undefined if the blob's MIME type is not a JavaScript MIME type
+// or its data is not synchronously available.
+function getScriptBlobData(blob, allowEmptyType = false) {
+  if (blob === undefined ||
+      (!(allowEmptyType && blob[kBlobType] === '') &&
+       !isJavaScriptMIMEType(mimeTypeEssence(blob[kBlobType])))) {
+    return undefined;
+  }
+  return getBlobDataSync(blob);
+}
+
+/**
+ * Runs the source text of a classic script in the current global scope,
+ * emulating "run a classic script". Dynamic import() from the script is
+ * resolved by the ESM loader relative to the script's URL.
+ * @param {string} source The source text of the script.
+ * @param {string} url The URL of the script, used as its filename and as
+ *   the base URL for dynamic imports.
+ * @returns {any}
+ */
+function runClassicScriptSource(source, url) {
+  const {
+    makeContextifyScript,
+    runScriptInThisContext,
+  } = require('internal/vm');
+  const script = makeContextifyScript(
+    source,                             // code
+    url,                                // filename
+    0,                                  // lineOffset
+    0,                                  // columnOffset
+    undefined,                          // cachedData
+    false,                              // produceCachedData
+    undefined,                          // parsingContext
+    vm_dynamic_import_default_internal, // hostDefinedOptionId
+    vm_dynamic_import_default_internal, // importModuleDynamically
+  );
+  // "Run the classic script script, with rethrow errors set to true."
+  return runScriptInThisContext(script, true, false);
+}
+
+/**
+ * Runs the source text of a module script in the current global scope.
+ * @param {string} source The source text of the script.
+ * @param {string} url The URL of the script, used as its identifier and as
+ *   the base URL for imports.
+ * @returns {Promise}
+ */
+function runModuleScriptSource(source, url) {
+  // Necessary to reset RegExp statics before user code runs.
+  RegExpPrototypeExec(/^/, '');
+  return require('internal/modules/run_main').runEntryPointWithESMLoader(
+    (loader) => loader.eval(source, url, true),
+  );
+}
+
+/**
+ * Synchronously obtains the source text of a classic script, emulating
+ * "fetch a classic worker-imported script" for locally resolvable URLs.
+ * @param {URL} url The parsed URL of the script.
+ * @param {Blob|undefined} blob The blob URL entry captured when url was
+ *   parsed, for blob: URLs.
+ * @returns {string}
+ */
+function fetchClassicScriptSourceSync(url, blob) {
+  switch (url.protocol) {
+    case 'file:':
+      try {
+        return require('fs').readFileSync(url, 'utf8');
+      } catch {
+        break;
+      }
+    case 'data:': {
+      const source = readDataURLScript(url);
+      if (source !== undefined) {
+        return source;
+      }
+      break;
+    }
+    case 'blob:': {
+      const data = getScriptBlobData(blob);
+      if (data !== undefined) {
+        return utf8Decode(data);
+      }
+      break;
+    }
+  }
+  // "If response's ... or its Content-Type metadata is not a JavaScript
+  // MIME type, then throw a "NetworkError" DOMException."
+  throw lazyDOMException(`Failed to load script: ${url.href}`, 'NetworkError');
+}
+
+// Web IDL overload resolution for the postMessage(message, transfer) /
+// postMessage(message, options) overload pair: iterable objects select the
+// sequence<object> overload, everything else is converted as a
+// StructuredSerializeOptions dictionary.
+function normalizeTransfer(transferOrOptions, options) {
+  if (typeof transferOrOptions === 'object' && transferOrOptions !== null &&
+      transferOrOptions[SymbolIterator] !== undefined) {
+    return converters['sequence<object>'](transferOrOptions, options);
+  }
+  return converters.StructuredSerializeOptions(transferOrOptions, options)
+    .transfer;
+}
+
+const kScopePostMessageOptions = {
+  __proto__: null,
+  prefix: "Failed to execute 'postMessage' on 'DedicatedWorkerGlobalScope'",
+  context: 'Argument 2',
+};
+
+const kWorkerPostMessageOptions = {
+  __proto__: null,
+  prefix: "Failed to execute 'postMessage' on 'Worker'",
+  context: 'Argument 2',
+};
+
+// https://html.spec.whatwg.org/multipage/workers.html#the-workernavigator-interface
+//
+// [Exposed=Worker]
+// interface WorkerNavigator {};
+//
+// The NavigatorLanguage, NavigatorConcurrentHardware and NavigatorLocks
+// mixins, as well as userAgent and platform of NavigatorID, are inherited
+// from the Node.js Navigator implementation; the members below are the
+// remainder of the mixins WorkerNavigator includes.
+class WorkerNavigator extends Navigator {
+  constructor(guard = undefined) {
+    if (guard !== kCreate)
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    super(kInitializeNavigator);
+    this[kNavigatorBrand] = true;
+  }
+
+  // WorkerNavigator includes NavigatorID;
+  // Refs: https://html.spec.whatwg.org/multipage/system-state.html#navigatorid
+  //
+  // interface mixin NavigatorID {
+  // readonly attribute DOMString appVersion;
+  get appVersion() {
+    validateThisInternalField(this, kNavigatorBrand, 'WorkerNavigator');
+    return StringPrototypeSlice(process.version, 1);
+  }
+  // };
+
+  // WorkerNavigator includes NavigatorLocks;
+  get locks() {
+    return super.locks;
+  }
+}
+
+// Refs: https://html.spec.whatwg.org/multipage/system-state.html#navigatoronline
+//
+// interface mixin NavigatorOnLine {
+// readonly attribute boolean onLine;
+//   "Returns false if the user agent is definitely offline. Returns true
+//   if the user agent might be online."
+// };
+const kNavigatorConstants = [
+  ['appCodeName', 'Mozilla'],
+  ['appName', 'Netscape'],
+  ['product', 'Gecko'],
+  ['onLine', true],
+];
+for (let i = 0; i < kNavigatorConstants.length; i++) {
+  const { 0: key, 1: value } = kNavigatorConstants[i];
+  ObjectDefineProperty(WorkerNavigator.prototype, key, {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    get: assignFunctionName(`get ${key}`, function() {
+      validateThisInternalField(this, kNavigatorBrand, 'WorkerNavigator');
+      return value;
+    }),
+  });
+}
+
+ObjectDefineProperties(WorkerNavigator.prototype, {
+  appVersion: kEnumerableProperty,
+  locks: kEnumerableProperty,
+  [SymbolToStringTag]: {
+    __proto__: null,
+    configurable: true,
+    value: 'WorkerNavigator',
+  },
+});
+
+// https://html.spec.whatwg.org/multipage/workers.html#worker-locations
+//
+// [Exposed=Worker]
+// interface WorkerLocation {
+class WorkerLocation {
+  constructor(guard = undefined, url = undefined) {
+    if (guard !== kCreate)
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    // "A WorkerLocation object has an associated WorkerGlobalScope object
+    // (a WorkerGlobalScope object)."
+    this[kURL] = url;
+  }
+
+  // "stringifier", for the href attribute defined below
+  toString() {
+    validateThisInternalField(this, kURL, 'WorkerLocation');
+    return this[kURL].href;
+  }
+}
+// };
+
+// stringifier readonly attribute USVString href;
+// readonly attribute USVString origin;
+// readonly attribute USVString protocol;
+// readonly attribute USVString host;
+// readonly attribute USVString hostname;
+// readonly attribute USVString port;
+// readonly attribute USVString pathname;
+// readonly attribute USVString search;
+// readonly attribute USVString hash;
+const kWorkerLocationAttributes = [
+  'href', 'origin', 'protocol', 'host', 'hostname', 'port', 'pathname',
+  'search', 'hash',
+];
+for (let i = 0; i < kWorkerLocationAttributes.length; i++) {
+  const key = kWorkerLocationAttributes[i];
+  ObjectDefineProperty(WorkerLocation.prototype, key, {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    get: assignFunctionName(`get ${key}`, function() {
+      validateThisInternalField(this, kURL, 'WorkerLocation');
+      return this[kURL][key];
+    }),
+  });
+}
+
+ObjectDefineProperties(WorkerLocation.prototype, {
+  toString: kEnumerableProperty,
+  [SymbolToStringTag]: {
+    __proto__: null,
+    configurable: true,
+    value: 'WorkerLocation',
+  },
+});
+
+// https://html.spec.whatwg.org/multipage/workers.html#the-workerglobalscope-common-interface
+//
+// [Exposed=Worker]
+// interface WorkerGlobalScope : EventTarget {
+class WorkerGlobalScope extends EventTarget {
+  constructor(guard = undefined) {
+    if (guard !== kCreate)
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    super();
+  }
+
+  // readonly attribute WorkerGlobalScope self;
+  get self() {
+    validateThisInternalField(this, kLocation, 'WorkerGlobalScope');
+    // "The self attribute must return the WorkerGlobalScope object itself."
+    return this;
+  }
+
+  // readonly attribute WorkerLocation location;
+  get location() {
+    validateThisInternalField(this, kLocation, 'WorkerGlobalScope');
+    // "The location attribute must return the WorkerLocation object whose
+    // associated WorkerGlobalScope object is the WorkerGlobalScope object."
+    return this[kLocation];
+  }
+
+  // readonly attribute WorkerNavigator navigator;
+  get navigator() {
+    validateThisInternalField(this, kLocation, 'WorkerGlobalScope');
+    // "The navigator attribute of the WorkerGlobalScope interface must
+    // return an instance of the WorkerNavigator interface, which represents
+    // the identity and state of the user agent (the client)."
+    return this[kNavigator] ??= new WorkerNavigator(kCreate);
+  }
+
+  // undefined importScripts((TrustedScriptURL or USVString)... urls);
+  importScripts(...urls) {
+    validateThisInternalField(this, kLocation, 'WorkerGlobalScope');
+    const prefix = "Failed to execute 'importScripts' on 'WorkerGlobalScope'";
+    // "To import scripts into worker global scope, given a
+    // WorkerGlobalScope object worker global scope, a list of scalar value
+    // strings urls, and an optional perform the fetch hook performFetch:"
+    //
+    // "If worker global scope's type is "module", throw a TypeError
+    // exception."
+    if (this[kType] === 'module') {
+      throw new ERR_INVALID_STATE.TypeError(
+        'importScripts() cannot be used in a module worker');
+    }
+    // "If urls is empty, return."
+    if (urls.length === 0)
+      return;
+
+    // "Let urlRecords be [an empty list]"
+    const urlRecords = [];
+    // "For each url of urls:"
+    for (let i = 0; i < urls.length; i++) {
+      const url = converters.USVString(
+        urls[i], { prefix, context: `Argument ${i + 1}` });
+      // "Let urlRecord be the result of encoding-parsing a URL given url,
+      // relative to settings object."
+      const urlRecord = URLParse(url, this[kLocation].href);
+
+      if (urlRecord === null) {
+        // "If urlRecord is failure, then throw a "SyntaxError"
+        // DOMException."
+        throw lazyDOMException(`Failed to parse URL: ${url}`, 'SyntaxError');
+      }
+      // Refs: https://url.spec.whatwg.org/#concept-url-parser
+      const blob = urlRecord.protocol === 'blob:' ?
+        resolveObjectURL(urlRecord.href) : undefined;
+      // "Append urlRecord to urlRecords."
+      ArrayPrototypePush(urlRecords, { url: urlRecord, blob });
+    }
+    // "For each urlRecord of urlRecords:"
+    for (let i = 0; i < urlRecords.length; i++) {
+      // "Fetch a classic worker-imported script given urlRecord and
+      // settings object, passing along performFetch if provided. If this
+      // succeeds, let script be the result. Otherwise, rethrow the
+      // exception."
+      const { url, blob } = urlRecords[i];
+      const script = fetchClassicScriptSourceSync(url, blob);
+      // "Run the classic script script, with rethrow errors set to true."
+      runClassicScriptSource(script, url.href);
+    }
+  }
+}
+
+ObjectDefineProperties(WorkerGlobalScope.prototype, {
+  self: kEnumerableProperty,
+  location: kEnumerableProperty,
+  navigator: kEnumerableProperty,
+  importScripts: kEnumerableProperty,
+  [SymbolToStringTag]: {
+    __proto__: null,
+    configurable: true,
+    value: 'WorkerGlobalScope',
+  },
+});
+
+// attribute OnErrorEventHandler onerror;
+defineEventHandler(WorkerGlobalScope.prototype, 'error');
+// attribute EventHandler onlanguagechange;
+defineEventHandler(WorkerGlobalScope.prototype, 'languagechange');
+// attribute EventHandler onoffline;
+defineEventHandler(WorkerGlobalScope.prototype, 'offline');
+// attribute EventHandler ononline;
+defineEventHandler(WorkerGlobalScope.prototype, 'online');
+// attribute EventHandler onrejectionhandled;
+defineEventHandler(WorkerGlobalScope.prototype, 'rejectionhandled');
+// attribute EventHandler onunhandledrejection;
+defineEventHandler(WorkerGlobalScope.prototype, 'unhandledrejection');
+// };
+
+// https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope
+//
+// WorkerGlobalScope includes WindowOrWorkerGlobalScope;
+
+// https://w3c.github.io/webcrypto/#crypto-interface
+//
+// partial interface mixin WindowOrWorkerGlobalScope {
+//   [SameObject] readonly attribute Crypto crypto;
+// };
+const lazyCrypto = getLazy(() => require('internal/crypto/webcrypto').crypto);
+ObjectDefineProperty(WorkerGlobalScope.prototype, 'crypto', {
+  __proto__: null,
+  configurable: true,
+  enumerable: true,
+  get: assignFunctionName('get crypto', function() {
+    validateThisInternalField(this, kLocation, 'WorkerGlobalScope');
+    if (!hasOpenSSL)
+      throw new ERR_NO_CRYPTO();
+    return lazyCrypto();
+  }),
+});
+
+// https://w3c.github.io/hr-time/#the-performance-attribute
+//
+// partial interface mixin WindowOrWorkerGlobalScope {
+//   [Replaceable] readonly attribute Performance performance;
+// };
+const lazyPerformance = getLazy(() => require('perf_hooks').performance);
+ObjectDefineProperty(WorkerGlobalScope.prototype, 'performance', {
+  __proto__: null,
+  configurable: true,
+  enumerable: true,
+  get: assignFunctionName('get performance', function() {
+    validateThisInternalField(this, kLocation, 'WorkerGlobalScope');
+    return lazyPerformance();
+  }),
+  set: assignFunctionName('set performance', function(value) {
+    validateThisInternalField(this, kLocation, 'WorkerGlobalScope');
+    replaceAttribute(this, 'performance', value);
+  }),
+});
+
+// Refs: https://html.spec.whatwg.org/multipage/web-messaging.html#messageeventtarget
+//
+// interface mixin MessageEventTarget {
+function includeMessageEventTarget(prototype) {
+  // attribute EventHandler onmessage;
+  defineEventHandler(prototype, 'message');
+  // attribute EventHandler onmessageerror;
+  defineEventHandler(prototype, 'messageerror');
+}
+// };
+
+// https://html.spec.whatwg.org/multipage/workers.html#dedicated-workers-and-the-dedicatedworkerglobalscope-interface
+//
+// [Global=(Worker,DedicatedWorker),Exposed=DedicatedWorker]
+// interface DedicatedWorkerGlobalScope : WorkerGlobalScope {
+class DedicatedWorkerGlobalScope extends WorkerGlobalScope {
+  // [Replaceable] readonly attribute DOMString name;
+  get name() {
+    validateThisInternalField(this, kInsidePort, 'DedicatedWorkerGlobalScope');
+    // "The name getter steps are to return this's name. Its value
+    // represents the name given to the worker using the Worker constructor,
+    // used primarily for debugging purposes."
+    return this[kName];
+  }
+
+  set name(value) {
+    validateThisInternalField(this, kInsidePort, 'DedicatedWorkerGlobalScope');
+    replaceAttribute(this, 'name', value);
+  }
+
+  // undefined postMessage(any message, sequence<object> transfer);
+  // undefined postMessage(any message, optional StructuredSerializeOptions options = {});
+  postMessage(message, transferOrOptions = kEmptyObject) {
+    validateThisInternalField(this, kInsidePort, 'DedicatedWorkerGlobalScope');
+    requiredArguments(arguments.length, 1, kScopePostMessageOptions);
+    // When the second argument was omitted there is nothing to convert.
+    const transfer = transferOrOptions === kEmptyObject ? undefined :
+      normalizeTransfer(transferOrOptions, kScopePostMessageOptions);
+    // "The postMessage(message, transfer) and postMessage(message, options)
+    // methods on DedicatedWorkerGlobalScope objects act as if, when
+    // invoked, it immediately invoked the respective postMessage(message,
+    // transfer) and postMessage(message, options) on the port, with the
+    // same arguments, and returned the same return value."
+    this[kInsidePort]?.postMessage(message, transfer);
+  }
+
+  // undefined close();
+  close() {
+    validateThisInternalField(this, kInsidePort, 'DedicatedWorkerGlobalScope');
+    // "The close() method steps are to close a worker given this."
+    //
+    // "To close a worker, given a workerGlobal, run these steps:
+    //  1. Discard any tasks that have been added to workerGlobal's relevant
+    //   agent's event loop's task queues.
+    //  2. Set workerGlobal's closing flag to true. (This prevents any
+    //   further tasks from being queued.)"
+    process.exit();
+  }
+}
+
+ObjectDefineProperties(DedicatedWorkerGlobalScope.prototype, {
+  name: kEnumerableProperty,
+  postMessage: kEnumerableProperty,
+  close: kEnumerableProperty,
+  [SymbolToStringTag]: {
+    __proto__: null,
+    configurable: true,
+    value: 'DedicatedWorkerGlobalScope',
+  },
+});
+// };
+
+// DedicatedWorkerGlobalScope includes MessageEventTarget;
+includeMessageEventTarget(DedicatedWorkerGlobalScope.prototype);
+
+// https://html.spec.whatwg.org/multipage/workers.html#abstractworker
+//
+// interface mixin AbstractWorker {
+function includeAbstractWorker(prototype) {
+  // attribute EventHandler onerror;
+  defineEventHandler(prototype, 'error');
+}
+// };
+
+// https://html.spec.whatwg.org/multipage/workers.html#worker-options
+//
+// enum WorkerType { "classic", "module" };
+const convertWorkerType = createEnumConverter('WorkerType', [
+  'classic',
+  'module',
+]);
+
+// RequestCredentials is defined by the Fetch Standard.
+// Refs: https://fetch.spec.whatwg.org/#requestcredentials
+//
+// enum RequestCredentials { "omit", "same-origin", "include" };
+const convertRequestCredentials = createEnumConverter('RequestCredentials', [
+  'omit',
+  'same-origin',
+  'include',
+]);
+
+// dictionary WorkerOptions {
+const convertWorkerOptions = createDictionaryConverter(
+  'WorkerOptions', [
+    {
+      // DOMString name = "";
+      key: 'name',
+      converter: converters.DOMString,
+      defaultValue: () => '',
+    },
+    {
+      // WorkerType type = "classic";
+      key: 'type',
+      converter: convertWorkerType,
+      defaultValue: () => 'classic',
+    },
+    {
+      // RequestCredentials credentials = "same-origin"; // credentials is only used if type is "module"
+      // (We don't actually use this, but parity with the spec is good, right?)
+      key: 'credentials',
+      converter: convertRequestCredentials,
+      defaultValue: () => 'same-origin',
+    },
+  ]);
+// };
+
+/**
+ * @param {URL} workerURL The parsed URL of the worker script.
+ * @param {'classic'|'module'} type The worker's type.
+ * @returns {{ value?: URL, source?: string }|null}
+ */
+function resolveWorkerEntry(workerURL, type) {
+  switch (workerURL.protocol) {
+    case 'file:':
+      return { value: workerURL };
+    case 'data:': {
+      const source = readDataURLScript(workerURL);
+      if (source === undefined) {
+        return null;
+      }
+      return { source };
+    }
+    case 'blob:': {
+      const blob = resolveObjectURL(workerURL.href);
+      // Blobs are commonly created without an explicit content type, so an
+      // empty type is accepted in addition to JavaScript MIME types.
+      const data = getScriptBlobData(blob, true);
+      if (data === undefined) {
+        return null;
+      }
+      if (type === 'module') {
+        // The blob's contents are re-wrapped as a data: URL so that the
+        // module loader evaluates them as a module script.
+        // TODO(@avivkeller): What if we update the ESM loader to accept blob:
+        // urls?
+        const bytes = new Uint8Array(data);
+        return {
+          value: new URL('data:text/javascript;base64,' + base64Slice(
+            bytes, 0, TypedArrayPrototypeGetLength(bytes))),
+        };
+      }
+      return { source: utf8Decode(data) };
+    }
+    default:
+      throw lazyDOMException(
+        `Worker scripts must be file:, data: or blob: URLs: ${workerURL.href}`,
+        'NotSupportedError');
+  }
+}
+
+// https://html.spec.whatwg.org/multipage/workers.html#dedicated-workers-and-the-worker-interface
+//
+// [Exposed=(Window,DedicatedWorker,SharedWorker)]
+// interface Worker : EventTarget {
+class Worker extends EventTarget {
+  // constructor((TrustedScriptURL or USVString) scriptURL, optional WorkerOptions options = {});
+  constructor(scriptURL, options = kEmptyObject) {
+    const prefix = "Failed to construct 'Worker'";
+    requiredArguments(arguments.length, 1, { prefix });
+    super();
+    scriptURL = converters.USVString(
+      scriptURL, { prefix, context: 'Argument 1' });
+    options = convertWorkerOptions(options, { prefix, context: 'Argument 2' });
+
+    // "Let workerURL be the result of encoding-parsing a URL given
+    // compliantScriptURL, relative to outsideSettings."
+    const workerURL = URLParse(scriptURL, scopeBaseURL ?? getCWDURL());
+
+    if (workerURL === null) {
+      // "If workerURL is failure, then throw a "SyntaxError" DOMException."
+      throw lazyDOMException(
+        `Failed to parse URL: ${scriptURL}`, 'SyntaxError');
+    }
+
+    this[kWorker] = null;
+    const entry = resolveWorkerEntry(workerURL, options.type);
+    if (entry === null) {
+      // "If the algorithm asynchronously completes with null or with a
+      // script whose error to rethrow is non-null, then: Queue a global
+      // task on the DOM manipulation task source given worker's relevant
+      // global object to fire an event named error at worker."
+      const { setImmediate } = require('timers');
+      setImmediate(() => {
+        this.dispatchEvent(createErrorEvent({
+          message: `Failed to fetch the worker script: ${workerURL.href}`,
+          cancelable: true,
+        }));
+      });
+      return;
+    }
+
+    // "Run this step in parallel:"
+    //
+    // "Run a worker given worker, workerURL, outsideSettings, outsidePort,
+    // and options."
+    this[kWorker] = new NodeWorker(entry.value ?? '', {
+      name: options.name,
+      eval: entry.source !== undefined,
+      [kWebWorkerData]: {
+        url: workerURL.href,
+        name: options.name,
+        type: options.type,
+        source: entry.source,
+      },
+    });
+
+    forwardMessageEvents(this[kWorker][kPublicPort], this);
+
+    // "Set notHandled to the result of firing an event named error at
+    // workerObject, using ErrorEvent, with the cancelable attribute
+    // initialized to true, and additional attributes initialized according
+    // to errorInfo."
+    this[kWorker].on('error', (error) =>
+      this.dispatchEvent(createErrorEvent({
+        message: `${error?.message ?? error}`,
+        error,
+        cancelable: true,
+      })));
+  }
+
+  // undefined terminate();
+  terminate() {
+    validateThisInternalField(this, kWorker, 'Worker');
+    // "The terminate() method steps are to terminate a worker given this's
+    // worker."
+    this[kWorker]?.terminate();
+  }
+
+  // undefined postMessage(any message, sequence<object> transfer);
+  // undefined postMessage(any message, optional StructuredSerializeOptions options = {});
+  postMessage(message, transferOrOptions = kEmptyObject) {
+    validateThisInternalField(this, kWorker, 'Worker');
+    requiredArguments(arguments.length, 1, kWorkerPostMessageOptions);
+    // When the second argument was omitted there is nothing to convert.
+    const transfer = transferOrOptions === kEmptyObject ? undefined :
+      normalizeTransfer(transferOrOptions, kWorkerPostMessageOptions);
+    // "The postMessage(message, transfer) and postMessage(message, options)
+    // methods on Worker objects act as if, when invoked, they immediately
+    // invoked the respective postMessage(message, transfer) and
+    // postMessage(message, options) on this's outside port, with the same
+    // arguments, and returned the same return value."
+    this[kWorker]?.postMessage(message, transfer);
+  }
+
+  // The following properties are non-standard, Node.js extensions
+  [kRef]() {
+    validateThisInternalField(this, kWorker, 'Worker');
+    this[kWorker]?.ref();
+  }
+
+  [kUnref]() {
+    validateThisInternalField(this, kWorker, 'Worker');
+    this[kWorker]?.unref();
+  }
+}
+
+ObjectDefineProperties(Worker.prototype, {
+  terminate: kEnumerableProperty,
+  postMessage: kEnumerableProperty,
+  [SymbolToStringTag]: {
+    __proto__: null,
+    configurable: true,
+    value: 'Worker',
+  },
+});
+// };
+
+// Worker includes AbstractWorker;
+includeAbstractWorker(Worker.prototype);
+// Worker includes MessageEventTarget;
+includeMessageEventTarget(Worker.prototype);
+
+// Operations of the worker global scope that are additionally exposed as
+// own properties of the global object
+const kScopeOperations = [
+  // EventTarget
+  'addEventListener', 'dispatchEvent', 'removeEventListener',
+  // WorkerGlobalScope
+  'importScripts',
+  // DedicatedWorkerGlobalScope
+  'postMessage', 'close',
+];
+
+/**
+ * @param {URL | string} url The worker's script URL.
+ * @param {{ name?: string, type?: string, port?: MessagePort }} [options]
+ * @returns {DedicatedWorkerGlobalScope} globalThis
+ */
+function installDedicatedWorkerGlobalScope(url, {
+  name = '',
+  type = 'classic',
+  port = require('worker_threads').parentPort,
+} = kEmptyObject) {
+  const locationURL = new URL(url);
+
+  if (type === 'classic' && locationURL.protocol === 'file:') {
+    const { Module } = require('internal/modules/cjs/loader');
+    ObjectDefineProperty(globalThis, 'require', {
+      __proto__: null,
+      configurable: true,
+      writable: true,
+      value: Module.createRequire(locationURL),
+    });
+  }
+
+  const globalProto = ObjectGetPrototypeOf(globalThis);
+  ObjectSetPrototypeOf(globalProto, DedicatedWorkerGlobalScope.prototype);
+  ObjectDefineProperty(globalProto, 'constructor', {
+    __proto__: null,
+    configurable: true,
+    writable: true,
+    value: DedicatedWorkerGlobalScope,
+  });
+
+  initEventTarget(globalThis);
+
+  // "Create a new WorkerLocation object and associate it with worker global
+  // scope."
+  globalThis[kLocation] = new WorkerLocation(kCreate, locationURL);
+  globalThis[kName] = `${name}`;
+  globalThis[kType] = type;
+  // "DedicatedWorkerGlobalScope objects have an associated inside port (a
+  // MessagePort)."
+  // "Set worker global scope's inside port to inside port."
+  globalThis[kInsidePort] = port;
+  scopeBaseURL = locationURL;
+
+  if (port !== null) {
+    // "Set inside port's message event target to worker global scope."
+    forwardMessageEvents(port, globalThis);
+  }
+
+  // We install our own navigator, crypto and performance, see
+  // WorkerGlobalScope
+  ReflectDeleteProperty(globalThis, 'navigator');
+  ReflectDeleteProperty(globalThis, 'Navigator');
+  ReflectDeleteProperty(globalThis, 'crypto');
+  ReflectDeleteProperty(globalThis, 'performance');
+
+  for (let i = 0; i < kScopeOperations.length; i++) {
+    const key = kScopeOperations[i];
+    defineOperation(globalThis, key, assignFunctionName(
+      key, FunctionPrototypeBind(globalThis[key], globalThis)));
+  }
+
+  // [Exposed=Worker] and [Exposed=DedicatedWorker]
+  exposeInterface(globalThis, 'WorkerGlobalScope', WorkerGlobalScope);
+  exposeInterface(
+    globalThis, 'DedicatedWorkerGlobalScope', DedicatedWorkerGlobalScope);
+  exposeInterface(globalThis, 'WorkerNavigator', WorkerNavigator);
+  exposeInterface(globalThis, 'WorkerLocation', WorkerLocation);
+  return globalThis;
+}
+
+module.exports = {
+  Worker,
+  installDedicatedWorkerGlobalScope,
+  runClassicScriptSource,
+  runModuleScriptSource,
+};
diff --git a/lib/internal/worker.js b/lib/internal/worker.js
index 39eb59ef8f67..f3f3c23a5abe 100644
--- a/lib/internal/worker.js
+++ b/lib/internal/worker.js
@@ -96,6 +96,7 @@ const kParentSideStdio = Symbol('kParentSideStdio');
 const kLoopStartTime = Symbol('kLoopStartTime');
 const kIsInternal = Symbol('kIsInternal');
 const kIsOnline = Symbol('kIsOnline');
+const kWebWorkerData = Symbol('kWebWorkerData');
 
 const SHARE_ENV = SymbolFor('nodejs.worker_threads.SHARE_ENV');
 let debug = require('internal/util/debuglog').debuglog('worker', (fn) => {
@@ -363,6 +364,7 @@ class Worker extends EventEmitter {
       isInternal,
       cwdCounter: cwdCounter || workerIo.sharedCwdCounter,
       workerData: options.workerData,
+      webWorkerData: options[kWebWorkerData],
       environmentData,
       hasStdin: !!options.stdin,
       publicPort: publicPortToWorker,
@@ -732,4 +734,6 @@ module.exports = {
   threadName,
   InternalWorker,
   Worker,
+  kPublicPort,
+  kWebWorkerData,
 };
diff --git a/lib/internal/worker/io.js b/lib/internal/worker/io.js
index b73256734079..011c00b0149c 100644
--- a/lib/internal/worker/io.js
+++ b/lib/internal/worker/io.js
@@ -478,6 +478,7 @@ function markAsUncloneable(obj) {
 
 module.exports = {
   drainMessagePort,
+  lazyMessageEvent,
   messageTypes,
   kPort,
   kIncrementsPortRef,
diff --git a/lib/internal/worker/js_transferable.js b/lib/internal/worker/js_transferable.js
index 0ae80d9a7287..bdd0d648996d 100644
--- a/lib/internal/worker/js_transferable.js
+++ b/lib/internal/worker/js_transferable.js
@@ -98,18 +98,6 @@ function markTransferMode(obj, cloneable = false, transferable = false) {
 }
 
 
-webidl.converters.StructuredSerializeOptions = webidl
-  .createDictionaryConverter(
-    'StructuredSerializeOptions',
-    [
-      {
-        key: 'transfer',
-        converter: webidl.converters['sequence<object>'],
-        defaultValue: () => [],
-      },
-    ],
-  );
-
 function structuredClone(value, options) {
   if (arguments.length === 0) {
     throw new ERR_MISSING_ARGS('The value argument must be specified');
diff --git a/lib/internal/zip/entry.js b/lib/internal/zip/entry.js
index 566f5ba58a51..cfe54903a126 100644
--- a/lib/internal/zip/entry.js
+++ b/lib/internal/zip/entry.js
@@ -501,15 +501,14 @@ class ZipEntry {
   // The entry's raw compressed bytes as a bounded-memory chunk stream, read
   // straight from disk (file-backed entries only). Nothing is retained.
   async *#rawChunks() {
-    // Count the whole stream as one in-flight read so a concurrent close()
-    // waits for it (the finally runs when the consumer stops iterating); a
-    // stream begun after close() was requested is rejected up front.
+    // Count active reads, but not time paused at a yield.
     const handle = this.#fd;
     if (handle.closing) {
       throw new ERR_INVALID_STATE(
         'cannot read a ZipEntry after its backing ZipFile has been closed');
     }
     handle.reads++;
+    let reading = true;
     try {
       this.#liveDescriptor();
       let pos = await this.#resolveContentOffset();
@@ -521,10 +520,18 @@ class ZipEntry {
         await readFdFully(this.#liveDescriptor(), chunk, pos);
         pos += take;
         remaining -= take;
+        reading = false;
+        endHandleRead(handle);
         yield chunk;
+        if (handle.closing) {
+          throw new ERR_INVALID_STATE(
+            'cannot read a ZipEntry after its backing ZipFile has been closed');
+        }
+        handle.reads++;
+        reading = true;
       }
     } finally {
-      endHandleRead(handle);
+      if (reading) endHandleRead(handle);
     }
   }
   // Sync counterpart of #rawChunks().
diff --git a/lib/perf_hooks.js b/lib/perf_hooks.js
index 18e979630e0e..cc158e5c7625 100644
--- a/lib/perf_hooks.js
+++ b/lib/perf_hooks.js
@@ -25,6 +25,7 @@ const {
 
 const {
   createHistogram,
+  importHistogram,
 } = require('internal/histogram');
 
 const monitorEventLoopDelay = require('internal/perf/event_loop_delay');
@@ -43,6 +44,7 @@ module.exports = {
   eventLoopUtilization,
   timerify,
   createHistogram,
+  importHistogram,
   performance,
 };
 
diff --git a/lib/v8.js b/lib/v8.js
index bb174f8d5243..ea3366bb9617 100644
--- a/lib/v8.js
+++ b/lib/v8.js
@@ -20,6 +20,7 @@ const {
   BigUint64Array,
   DataView,
   Error,
+  Float16Array,
   Float32Array,
   Float64Array,
   Int16Array,
@@ -32,9 +33,6 @@ const {
   Uint32Array,
   Uint8Array,
   Uint8ClampedArray,
-  globalThis: {
-    Float16Array,
-  },
 } = primordials;
 
 const { Buffer } = require('buffer');
@@ -128,6 +126,7 @@ const {
   updateHeapSpaceStatisticsBuffer,
   updateHeapCodeStatisticsBuffer,
   setHeapSnapshotNearHeapLimit: _setHeapSnapshotNearHeapLimit,
+  setHeapProfileNearHeapLimit: _setHeapProfileNearHeapLimit,
 
   // Properties for heap statistics buffer extraction.
   kTotalHeapSizeIndex,
@@ -360,6 +359,16 @@ function setHeapSnapshotNearHeapLimit(limit) {
   _setHeapSnapshotNearHeapLimit(limit);
 }
 
+let heapProfileNearHeapLimitAdded = false;
+function setHeapProfileNearHeapLimit(limit) {
+  validateUint32(limit, 'limit', true);
+  if (heapProfileNearHeapLimitAdded) {
+    return;
+  }
+  _setHeapProfileNearHeapLimit(limit);
+  heapProfileNearHeapLimitAdded = true;
+}
+
 const detailLevelDict = {
   __proto__: null,
   detailed: detailLevel.DETAILED,
@@ -563,6 +572,7 @@ module.exports = {
   queryObjects,
   startupSnapshot,
   setHeapSnapshotNearHeapLimit,
+  setHeapProfileNearHeapLimit,
   GCProfiler,
   isStringOneByteRepresentation,
   startCpuProfile,
diff --git a/lib/vfs.js b/lib/vfs.js
index 0d12229aca72..e6ff5e06dcc7 100644
--- a/lib/vfs.js
+++ b/lib/vfs.js
@@ -8,6 +8,7 @@ const { VirtualFileSystem } = require('internal/vfs/file_system');
 const { VirtualProvider } = require('internal/vfs/provider');
 const { MemoryProvider } = require('internal/vfs/providers/memory');
 const { RealFSProvider } = require('internal/vfs/providers/real');
+const { ZipProvider } = require('internal/vfs/providers/ziparchive');
 
 /**
  * Creates a new VirtualFileSystem instance.
@@ -34,4 +35,5 @@ module.exports = {
   VirtualProvider,
   MemoryProvider,
   RealFSProvider,
+  ZipProvider,
 };
diff --git a/node.gni b/node.gni
index 21c8de1b2afb..fa4668a543e2 100644
--- a/node.gni
+++ b/node.gni
@@ -82,5 +82,19 @@ declare_args() {
   node_use_amaro = true
 }
 
+# Link against shared copies of the bundled dependencies instead of building
+# them, like configure's --shared-* options. The libraries are looked up with
+# pkg-config, so these are meant for Linux distribution builds.
+declare_args() {
+  node_shared_brotli = false
+  node_shared_cares = false
+  node_shared_hdr_histogram = false
+  node_shared_http_parser = false
+  node_shared_libuv = false
+  node_shared_nghttp2 = false
+  node_shared_sqlite = false
+  node_shared_zstd = false
+}
+
 assert(!node_enable_inspector || node_use_openssl,
        "node_enable_inspector requires node_use_openssl")
diff --git a/node.gyp b/node.gyp
index 66196b411062..52f421f3181c 100644
--- a/node.gyp
+++ b/node.gyp
@@ -15,10 +15,12 @@
     'node_lib_target_name%': 'libnode',
     'node_module_version%': '',
     'node_no_browser_globals%': 'false',
+    'node_shared_abseil%': 'false',
     'node_shared_brotli%': 'false',
     'node_shared_cares%': 'false',
     'node_shared_gtest%': 'false',
     'node_shared_hdr_histogram%': 'false',
+    'node_shared_highway%': 'false',
     'node_shared_http_parser%': 'false',
     'node_shared_libuv%': 'false',
     'node_shared_lief%': 'false',
@@ -26,6 +28,7 @@
     'node_shared_nbytes%': 'false',
     'node_shared_nghttp2%': 'false',
     'node_shared_openssl%': 'false',
+    'node_shared_perfetto%': 'false',
     'node_shared_sqlite%': 'false',
     'node_shared_ffi%': 'false',
     'node_shared_temporal_capi%': 'false',
@@ -40,6 +43,7 @@
     'node_use_node_snapshot%': 'false',
     'node_use_openssl%': 'true',
     'node_use_quic%': 'false',
+    'node_use_dtls%': 'false',
     'node_use_sqlite%': 'true',
     'node_use_ffi%': 'false',
     'node_use_v8_platform%': 'true',
@@ -234,8 +238,6 @@
       'src/histogram-inl.h',
       'src/js_stream.h',
       'src/json_utils.h',
-      'src/large_pages/node_large_page.cc',
-      'src/large_pages/node_large_page.h',
       'src/memory_tracker.h',
       'src/memory_tracker-inl.h',
       'src/module_wrap.h',
@@ -370,6 +372,16 @@
       'src/quic/tlscontext.h',
       'src/quic/guard.h',
     ],
+    'node_dtls_sources': [
+      'src/dtls/dtls.cc',
+      'src/dtls/dtls_context.cc',
+      'src/dtls/dtls_endpoint.cc',
+      'src/dtls/dtls_session.cc',
+      'src/dtls/dtls.h',
+      'src/dtls/dtls_context.h',
+      'src/dtls/dtls_endpoint.h',
+      'src/dtls/dtls_session.h',
+    ],
     'node_crypto_sources': [
       'src/crypto/crypto_aes.cc',
       'src/crypto/crypto_argon2.cc',
@@ -382,12 +394,15 @@
       'src/crypto/crypto_sig.cc',
       'src/crypto/crypto_timing.cc',
       'src/crypto/crypto_cipher.cc',
+      'src/crypto/crypto_client_hello.cc',
       'src/crypto/crypto_context.cc',
+      'src/crypto/crypto_tls_certificates.cc',
       'src/crypto/crypto_ec.cc',
       'src/crypto/crypto_pqc.cc',
       'src/crypto/crypto_kem.cc',
       'src/crypto/crypto_hmac.cc',
       'src/crypto/crypto_kmac.cc',
+      'src/crypto/crypto_mac.cc',
       'src/crypto/crypto_turboshake.cc',
       'src/crypto/crypto_random.cc',
       'src/crypto/crypto_rsa.cc',
@@ -405,11 +420,13 @@
       'src/crypto/crypto_dh.h',
       'src/crypto/crypto_hmac.h',
       'src/crypto/crypto_kmac.h',
+      'src/crypto/crypto_mac.h',
       'src/crypto/crypto_turboshake.h',
       'src/crypto/crypto_rsa.h',
       'src/crypto/crypto_spkac.h',
       'src/crypto/crypto_util.h',
       'src/crypto/crypto_cipher.h',
+      'src/crypto/crypto_client_hello.h',
       'src/crypto/crypto_common.h',
       'src/crypto/crypto_dsa.h',
       'src/crypto/crypto_hash.h',
@@ -418,6 +435,7 @@
       'src/crypto/crypto_scrypt.h',
       'src/crypto/crypto_tls.h',
       'src/crypto/crypto_context.h',
+      'src/crypto/crypto_tls_certificates.h',
       'src/crypto/crypto_ec.h',
       'src/crypto/crypto_pqc.h',
       'src/crypto/crypto_hkdf.h',
@@ -490,11 +508,6 @@
     'node_mksnapshot_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)node_mksnapshot<(EXECUTABLE_SUFFIX)',
     'node_js2c_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)node_js2c<(EXECUTABLE_SUFFIX)',
     'conditions': [
-      ['GENERATOR == "ninja"', {
-        'node_text_start_object_path': 'src/large_pages/node_text_start.node_text_start.o'
-      }, {
-        'node_text_start_object_path': 'node_text_start/src/large_pages/node_text_start.o'
-      }],
       [ 'node_shared=="true"', {
         'node_target_type%': 'shared_library',
         'node_lib_type': 'shared_library',
@@ -572,19 +585,6 @@
   },
 
   'targets': [
-    {
-      'target_name': 'node_text_start',
-      'type': 'none',
-      'conditions': [
-        [ 'OS in "linux freebsd solaris openharmony" and '
-          'target_arch=="x64"', {
-          'type': 'static_library',
-          'sources': [
-            'src/large_pages/node_text_start.S'
-          ]
-        }],
-      ]
-    },
     {
       'target_name': '<(node_core_target_name)',
       'type': 'executable',
@@ -756,14 +756,6 @@
             },
           },
         }],
-        [ 'OS in "linux freebsd openharmony" and '
-          'target_arch=="x64"', {
-          'dependencies': [ 'node_text_start' ],
-          'ldflags+': [
-            '<(obj_dir)/<(node_text_start_object_path)'
-          ]
-        }],
-
         ['node_fipsinstall=="true"', {
           'variables': {
             'openssl-cli': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)openssl-cli<(EXECUTABLE_SUFFIX)',
@@ -912,7 +904,7 @@
         [ 'node_builtin_modules_path!=""', {
           'defines': [ 'NODE_BUILTIN_MODULES_PATH="<(node_builtin_modules_path)"' ],
         }],
-        [ 'node_use_bundled_v8!="false"', {
+        [ 'node_use_bundled_v8!="false" and node_shared_abseil=="false"', {
           'dependencies': [ 'tools/v8_gypfiles/abseil.gyp:abseil' ],
         }],
         [ 'node_shared_gtest=="false"', {
@@ -951,8 +943,12 @@
           'sources': [
             '<@(node_tracing_perfetto_sources)',
           ],
-          'dependencies': [
-            'deps/perfetto/perfetto.gyp:perfetto_sdk',
+          'conditions': [
+            ['node_shared_perfetto=="false"', {
+              'dependencies': [
+                'deps/perfetto/perfetto.gyp:perfetto_sdk',
+              ],
+            }],
           ],
         }, {
           'sources': [
@@ -992,10 +988,13 @@
             '<@(node_quic_sources)',
           ],
         }],
-        [ 'OS in "linux freebsd mac solaris openharmony" and '
-          'target_arch=="x64" and '
-          'node_target_type=="executable"', {
-          'defines': [ 'NODE_ENABLE_LARGE_CODE_PAGES=1' ],
+        [ 'node_use_dtls=="true"', {
+          'sources': [
+            '<@(node_dtls_sources)',
+          ],
+          'defines': [
+            'HAVE_DTLS=1',
+          ],
         }],
         [ 'use_openssl_def==1', {
           # TODO(bnoordhuis) Make all platforms export the same list of symbols.
@@ -1377,7 +1376,7 @@
         [ 'node_shared_gtest=="true"', {
           'libraries': [ '-lgtest_main' ],
         }],
-        [ 'node_use_bundled_v8!="false"', {
+        [ 'node_use_bundled_v8!="false" and node_shared_abseil=="false"', {
           'dependencies': [ 'tools/v8_gypfiles/abseil.gyp:abseil' ],
         }],
         [ 'node_shared_hdr_histogram=="false"', {
@@ -1407,7 +1406,7 @@
         }, {
           'sources!': [ '<@(node_cctest_quic_sources)' ],
         }],
-        [ 'v8_use_perfetto==1', {
+        [ 'v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             'deps/perfetto/perfetto.gyp:perfetto_sdk',
           ],
@@ -1737,7 +1736,7 @@
             'NODE_USE_NODE_CODE_CACHE=1',
           ],
         }],
-        [ 'v8_use_perfetto==1', {
+        [ 'v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             'deps/perfetto/perfetto.gyp:perfetto_sdk',
           ],
diff --git a/node.gypi b/node.gypi
index 104e884e6614..bfe2d00ad929 100644
--- a/node.gypi
+++ b/node.gypi
@@ -99,6 +99,9 @@
     [ 'node_enable_v8windbg=="true"', {
       'dependencies': [ 'tools/v8_gypfiles/v8windbg.gyp:build_v8windbg' ],
     }],
+    [ 'node_enable_v8debughelper=="true"', {
+      'dependencies': [ 'tools/v8_gypfiles/v8_debug_helper.gyp:build_v8_debug_helper' ],
+    }],
     [ 'node_use_bundled_v8=="true"', {
       'dependencies': [
         'tools/v8_gypfiles/v8.gyp:v8_snapshot',
diff --git a/shell.nix b/shell.nix
index d146361b5c09..1829c1efd21b 100644
--- a/shell.nix
+++ b/shell.nix
@@ -29,6 +29,7 @@
         withSQLite
         withFFI
         withSSL
+        withPerfetto
         withTemporal
         ;
     }
@@ -52,6 +53,7 @@ let
   useSharedAda = builtins.hasAttr "ada" sharedLibDeps;
   useSharedOpenSSL = builtins.hasAttr "openssl" sharedLibDeps;
 
+  useSharedPerfetto = builtins.hasAttr "perfetto" sharedLibDeps;
   useSharedTemporal = builtins.hasAttr "temporal_capi" sharedLibDeps;
   needsRustCompiler = withTemporal && !useSharedTemporal;
 
@@ -63,6 +65,9 @@ let
     ];
   buildInputs =
     pkgs.lib.optional useSharedICU icu
+    ++ pkgs.lib.optional (builtins.hasAttr "abseil" sharedLibDeps) sharedLibDeps.abseil
+    ++ pkgs.lib.optional (builtins.hasAttr "highway" sharedLibDeps) sharedLibDeps.highway
+    ++ pkgs.lib.optional (withPerfetto && useSharedPerfetto) sharedLibDeps.perfetto
     ++ pkgs.lib.optional (withTemporal && useSharedTemporal) sharedLibDeps.temporal_capi;
 
   # Put here only the configure flags that affect the V8 build
@@ -75,6 +80,9 @@ let
     )
     "--v8-${if withTemporal then "enable" else "disable"}-temporal-support"
   ]
+  ++ pkgs.lib.optional (builtins.hasAttr "abseil" sharedLibDeps) "--shared-abseil"
+  ++ pkgs.lib.optional (builtins.hasAttr "highway" sharedLibDeps) "--shared-highway"
+  ++ pkgs.lib.optional (withPerfetto && useSharedPerfetto) "--shared-perfetto"
   ++ pkgs.lib.optional (withTemporal && useSharedTemporal) "--shared-temporal_capi"
   ++ pkgs.lib.optional withPerfetto "--with-perfetto";
 in
@@ -132,6 +140,8 @@ pkgs.mkShell {
             builtins.attrNames (
               if (useSeparateDerivationForV8 != false) then
                 builtins.removeAttrs sharedLibDeps [
+                  "abseil"
+                  "highway"
                   "simdutf"
                   "temporal_capi"
                 ]
diff --git a/src/api/environment.cc b/src/api/environment.cc
index c3fd1e583735..67a92f1cdc05 100644
--- a/src/api/environment.cc
+++ b/src/api/environment.cc
@@ -225,7 +225,8 @@ void SetIsolateCreateParamsForNode(Isolate::CreateParams* params) {
 #endif
 }
 
-void SetIsolateErrorHandlers(v8::Isolate* isolate, const IsolateSettings& s) {
+static void SetIsolateErrorHandlers(v8::Isolate* isolate,
+                                    const IsolateSettings& s) {
   if (s.flags & MESSAGE_LISTENER_WITH_ERROR_LEVEL)
     isolate->AddMessageListenerWithErrorLevel(
             errors::PerIsolateMessageListener,
@@ -350,16 +351,7 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
 
   SetIsolateCreateParamsForNode(params);
   Isolate::Initialize(isolate, *params);
-
-  Isolate::Scope isolate_scope(isolate);
-
-  if (snapshot_data == nullptr) {
-    // If in deserialize mode, delay until after the deserialization is
-    // complete.
-    SetIsolateUpForNode(isolate, settings);
-  } else {
-    SetIsolateMiscHandlers(isolate, settings);
-  }
+  SetIsolateUpForNode(isolate, settings);
 
   return isolate;
 }
@@ -451,6 +443,11 @@ Environment* CreateEnvironment(
 
   const bool use_snapshot = context.IsEmpty();
   const EnvSerializeInfo* env_snapshot_info = nullptr;
+  // A worker thread (its IsolateData knows its Worker) deserializes the same
+  // bootstrapped principal context the main thread uses and then has the
+  // worker-side bootstrap switches applied on top of it (they are written as
+  // overrides of the main-thread setup).
+  const bool for_worker = isolate_data->worker_context() != nullptr;
   if (use_snapshot) {
     CHECK_NOT_NULL(isolate_data->snapshot_data());
     env_snapshot_info = &isolate_data->snapshot_data()->env_info;
@@ -487,12 +484,30 @@ Environment* CreateEnvironment(
       FreeEnvironment(env);
       return nullptr;
     }
-    SetIsolateErrorHandlers(isolate, {});
   }
 
   Context::Scope context_scope(context);
   env->InitializeMainContext(context, env_snapshot_info);
 
+  if (use_snapshot && for_worker) {
+    // The deserialized context went through is_main_thread /
+    // does_own_process_state when the snapshot was built; the worker-side
+    // switches redefine exactly those pieces (stdio getters, signal wiring,
+    // process.abort/chdir/umask/..., debug helpers).
+    if (env->principal_realm()
+            ->ExecuteBootstrapper(
+                "internal/bootstrap/switches/is_not_main_thread")
+            .IsEmpty() ||
+        (!env->owns_process_state() &&
+         env->principal_realm()
+             ->ExecuteBootstrapper(
+                 "internal/bootstrap/switches/does_not_own_process_state")
+             .IsEmpty())) {
+      FreeEnvironment(env);
+      return nullptr;
+    }
+  }
+
 #if HAVE_INSPECTOR
   if (env->should_create_inspector()) {
     if (inspector_parent_handle) {
diff --git a/src/api/exceptions.cc b/src/api/exceptions.cc
index 871fe78de951..4396dc19d842 100644
--- a/src/api/exceptions.cc
+++ b/src/api/exceptions.cc
@@ -8,6 +8,8 @@
 #include "v8.h"
 
 #include <cstring>
+#include <string>
+#include <string_view>
 
 namespace node {
 
@@ -20,6 +22,40 @@ using v8::Object;
 using v8::String;
 using v8::Value;
 
+static Local<String> StringFromPath(Isolate* isolate, std::string_view path) {
+#ifdef _WIN32
+  constexpr std::string_view kUncPrefix = "\\\\?\\UNC\\";
+  constexpr std::string_view kLongPrefix = "\\\\?\\";
+
+  if (path.starts_with(kUncPrefix)) {
+    std::string s;
+    s.reserve(2 + (path.size() - kUncPrefix.size()));
+    s.append("\\\\");
+    s.append(path.substr(kUncPrefix.size()));
+    return String::NewFromUtf8(isolate,
+                               s.data(),
+                               v8::NewStringType::kNormal,
+                               static_cast<int>(s.size()))
+        .ToLocalChecked();
+  }
+
+  if (path.starts_with(kLongPrefix)) {
+    auto rest = path.substr(kLongPrefix.size());
+    return String::NewFromUtf8(isolate,
+                               rest.data(),
+                               v8::NewStringType::kNormal,
+                               static_cast<int>(rest.size()))
+        .ToLocalChecked();
+  }
+#endif
+
+  return String::NewFromUtf8(isolate,
+                             path.data(),
+                             v8::NewStringType::kNormal,
+                             static_cast<int>(path.size()))
+      .ToLocalChecked();
+}
+
 Local<Value> ErrnoException(Isolate* isolate,
                             int errorno,
                             const char* syscall,
@@ -42,7 +78,7 @@ Local<Value> ErrnoException(Isolate* isolate,
   Local<String> path_string;
   if (path != nullptr) {
     // FIXME(bnoordhuis) It's questionable to interpret the file path as UTF-8.
-    path_string = String::NewFromUtf8(isolate, path).ToLocalChecked();
+    path_string = StringFromPath(isolate, std::string_view(path));
   }
 
   if (path_string.IsEmpty() == false) {
@@ -72,22 +108,6 @@ Local<Value> ErrnoException(Isolate* isolate,
   return e;
 }
 
-static Local<String> StringFromPath(Isolate* isolate, const char* path) {
-#ifdef _WIN32
-  if (strncmp(path, "\\\\?\\UNC\\", 8) == 0) {
-    return String::Concat(
-        isolate,
-        FIXED_ONE_BYTE_STRING(isolate, "\\\\"),
-        String::NewFromUtf8(isolate, path + 8).ToLocalChecked());
-  } else if (strncmp(path, "\\\\?\\", 4) == 0) {
-    return String::NewFromUtf8(isolate, path + 4).ToLocalChecked();
-  }
-#endif
-
-  return String::NewFromUtf8(isolate, path).ToLocalChecked();
-}
-
-
 Local<Value> UVException(Isolate* isolate,
                          int errorno,
                          const char* syscall,
@@ -114,7 +134,7 @@ Local<Value> UVException(Isolate* isolate,
   js_msg = String::Concat(isolate, js_msg, js_syscall);
 
   if (path != nullptr) {
-    js_path = StringFromPath(isolate, path);
+    js_path = StringFromPath(isolate, std::string_view(path));
 
     js_msg =
         String::Concat(isolate, js_msg, FIXED_ONE_BYTE_STRING(isolate, " '"));
@@ -124,7 +144,7 @@ Local<Value> UVException(Isolate* isolate,
   }
 
   if (dest != nullptr) {
-    js_dest = StringFromPath(isolate, dest);
+    js_dest = StringFromPath(isolate, std::string_view(dest));
 
     js_msg = String::Concat(
         isolate, js_msg, FIXED_ONE_BYTE_STRING(isolate, " -> '"));
diff --git a/src/api/hooks.cc b/src/api/hooks.cc
index 09a79fb9da81..b46073b6b7cf 100644
--- a/src/api/hooks.cc
+++ b/src/api/hooks.cc
@@ -145,8 +145,15 @@ static ExclusiveAccess<CleanupHookRegistry> cleanup_hook_registry;
 
 static void CleanupHookThunkRun(void* arg) {
   const CleanupHookThunk* thunk = static_cast<CleanupHookThunk*>(arg);
-  thunk->fun(thunk->arg);
-  RemoveEnvironmentCleanupHook(thunk->isolate, thunk->fun, thunk->arg);
+  // `thunk->fun` may itself remove and free this CleanupHookThunk (e.g. via
+  // ~ObjectWrap(), which calls RemoveEnvironmentCleanupHook()), so cache the
+  // fields we still need before invoking it rather than reading them from
+  // `thunk` afterwards.
+  Isolate* isolate = thunk->isolate;
+  CleanupHook fun = thunk->fun;
+  void* fun_arg = thunk->arg;
+  fun(fun_arg);
+  RemoveEnvironmentCleanupHook(isolate, fun, fun_arg);
 }
 
 void AddEnvironmentCleanupHook(Isolate* isolate,
diff --git a/src/async_wrap.h b/src/async_wrap.h
index bf9267545477..8c8f1e59de36 100644
--- a/src/async_wrap.h
+++ b/src/async_wrap.h
@@ -52,6 +52,8 @@ namespace node {
   V(HTTPINCOMINGMESSAGE)                                                       \
   V(HTTPCLIENTREQUEST)                                                         \
   V(LOCKS)                                                                     \
+  V(DTLS_ENDPOINT)                                                             \
+  V(DTLS_SESSION)                                                              \
   V(JSSTREAM)                                                                  \
   V(JSUDPWRAP)                                                                 \
   V(MESSAGEPORT)                                                               \
diff --git a/src/cares_wrap.cc b/src/cares_wrap.cc
index f1382b040362..801ada532c70 100644
--- a/src/cares_wrap.cc
+++ b/src/cares_wrap.cc
@@ -888,7 +888,7 @@ void NodeAresTask::MemoryInfo(MemoryTracker* tracker) const {
 
 /* Allocates and returns a new NodeAresTask */
 NodeAresTask* NodeAresTask::Create(ChannelWrap* channel, ares_socket_t sock) {
-  auto task = new NodeAresTask();
+  auto task = std::make_unique<NodeAresTask>();
 
   task->channel = channel;
   task->sock = sock;
@@ -896,11 +896,10 @@ NodeAresTask* NodeAresTask::Create(ChannelWrap* channel, ares_socket_t sock) {
   if (uv_poll_init_socket(channel->env()->event_loop(),
                           &task->poll_watcher, sock) < 0) {
     /* This should never happen. */
-    delete task;
     return nullptr;
   }
 
-  return task;
+  return task.release();
 }
 
 void ChannelWrap::Setup() {
diff --git a/src/compile_cache.cc b/src/compile_cache.cc
index 8efd7b68856c..6e891619f42b 100644
--- a/src/compile_cache.cc
+++ b/src/compile_cache.cc
@@ -177,7 +177,7 @@ void CompileCacheHandler::ReadCacheFile(CompileCacheEntry* entry) {
   size_t offset = headers_buf.len;
   size_t capacity = 4096;  // Initial buffer capacity
   size_t total_read = 0;
-  uint8_t* buffer = new uint8_t[capacity];
+  auto buffer = std::make_unique<uint8_t[]>(capacity);
 
   while (true) {
     // If there is not enough space to read more data, do a simple
@@ -185,20 +185,19 @@ void CompileCacheHandler::ReadCacheFile(CompileCacheEntry* entry) {
     // the underlying buffer to be delete[]-able).
     if (total_read == capacity) {
       size_t new_capacity = capacity * 2;
-      auto* new_buffer = new uint8_t[new_capacity];
-      memcpy(new_buffer, buffer, capacity);
-      delete[] buffer;
-      buffer = new_buffer;
+      auto new_buffer = std::make_unique<uint8_t[]>(new_capacity);
+      memcpy(new_buffer.get(), buffer.get(), capacity);
+      buffer = std::move(new_buffer);
       capacity = new_capacity;
     }
 
-    uv_buf_t iov = uv_buf_init(reinterpret_cast<char*>(buffer + total_read),
-                               capacity - total_read);
+    uv_buf_t iov =
+        uv_buf_init(reinterpret_cast<char*>(buffer.get() + total_read),
+                    capacity - total_read);
     int bytes_read =
         uv_fs_read(nullptr, &req, file, &iov, 1, offset + total_read, nullptr);
     if (req.result < 0) {  // Error.
       // req will be cleaned up by scope leave.
-      delete[] buffer;
       Debug(" %s\n", uv_strerror(req.result));
       return;
     }
@@ -216,7 +215,8 @@ void CompileCacheHandler::ReadCacheFile(CompileCacheEntry* entry) {
           total_read);
     return;
   }
-  uint32_t cache_hash = GetHash(reinterpret_cast<char*>(buffer), total_read);
+  uint32_t cache_hash =
+      GetHash(reinterpret_cast<char*>(buffer.get()), total_read);
   if (headers[kCacheHashOffset] != cache_hash) {
     Debug("cache hash mismatch: expected %d, actual %d\n",
           headers[kCacheHashOffset],
@@ -225,7 +225,7 @@ void CompileCacheHandler::ReadCacheFile(CompileCacheEntry* entry) {
   }
 
   entry->cache.reset(new ScriptCompiler::CachedData(
-      buffer, total_read, ScriptCompiler::CachedData::BufferOwned));
+      buffer.release(), total_read, ScriptCompiler::CachedData::BufferOwned));
   Debug(" success, size=%d\n", total_read);
 }
 
diff --git a/src/crypto/README.md b/src/crypto/README.md
index ad06cf989276..d3c1016e94a5 100644
--- a/src/crypto/README.md
+++ b/src/crypto/README.md
@@ -43,6 +43,7 @@ following table:
 | `crypto_hkdf`     | HKDF (Key derivation) implementation.                                |
 | `crypto_hmac`     | HMAC implementations.                                                |
 | `crypto_keys`     | Utilities for using and generating secret, private, and public keys. |
+| `crypto_mac`      | Provider-generic MAC implementations.                                |
 | `crypto_pbkdf2`   | PBKDF2 key / bit generation implementation.                          |
 | `crypto_rsa`      | RSA Key Generation functions.                                        |
 | `crypto_scrypt`   | Scrypt key / bit generation implementation.                          |
@@ -50,6 +51,7 @@ following table:
 | `crypto_spkac`    | Netscape SPKAC certificate utilities.                                |
 | `crypto_ssl`      | Implementation of the `SSLWrap` object.                              |
 | `crypto_timing`   | Implementation of the TimingSafeEqual.                               |
+| `crypto_x509`     | X.509 certificate parsing and validation.                            |
 
 When new crypto protocols are added, they will be added into their own
 `crypto_` `*.h` and `*.cc` files.
@@ -171,11 +173,12 @@ JavaScript needs access to those operations and is kept out of user-visible
 
 A `KeyObject` is the public Node.js-specific API for keys. It extends a
 native `NativeKeyObject`, which stores `KeyObjectData` for structured
-cloning. The JavaScript API surface reads its key type and a
-`KeyObjectHandle` through a hidden native-backed slot tuple, caching that
-tuple in a private field outside user-visible own properties. Derived
-metadata, such as symmetric key size and asymmetric key details, is read
-from the cached handle and appended lazily to the same private-field cache.
+cloning. The JavaScript constructor caches the known key type in a private
+field outside user-visible own properties. When a `KeyObjectHandle` is first
+needed, JavaScript replaces that value with a hidden native-backed slot tuple.
+Derived metadata, such as symmetric key size and asymmetric key details, is
+read from the cached handle and appended lazily to the same private-field
+cache.
 
 #### `CryptoKey`
 
@@ -183,7 +186,18 @@ A `CryptoKey` is the Web Crypto API key type. In the Node.js implementation,
 public `CryptoKey` instances are backed by a native `NativeCryptoKey`, not by
 a `KeyObject`. `NativeCryptoKey` stores the same `KeyObjectData`
 representation as `KeyObject`, plus the Web Crypto internal slots
-(`[[extractable]]`, `[[algorithm]]`, and `[[usages]]`).
+(`[[extractable]]`, `[[algorithm]]`, and `[[usages]]`). Normal construction
+primes a private JavaScript slot cache from the constructor arguments.
+Partially initialized transferred keys populate that cache from the native
+slots on first access.
+
+### X.509 certificates
+
+The public `X509Certificate` is backed directly by the native
+`X509Certificate` object. JavaScript caches derived certificate properties in
+a private array whose final entry is a bitmask of populated slots. Certificates
+from another realm use the same cache layout through a private `WeakMap` after
+passing the native brand check.
 
 ### `CryptoJob`
 
diff --git a/src/crypto/crypto_aes.h b/src/crypto/crypto_aes.h
index 76359f14e7df..6b18b1e29e24 100644
--- a/src/crypto/crypto_aes.h
+++ b/src/crypto/crypto_aes.h
@@ -13,15 +13,15 @@ namespace node::crypto {
 constexpr unsigned kNoAuthTagLength = static_cast<unsigned>(-1);
 
 #define VARIANTS_COMMON(V)                                                     \
-  V(CTR_128, AES_CTR_Cipher, ncrypto::Cipher::AES_128_CTR)                     \
-  V(CTR_192, AES_CTR_Cipher, ncrypto::Cipher::AES_192_CTR)                     \
-  V(CTR_256, AES_CTR_Cipher, ncrypto::Cipher::AES_256_CTR)                     \
-  V(CBC_128, AES_Cipher, ncrypto::Cipher::AES_128_CBC)                         \
-  V(CBC_192, AES_Cipher, ncrypto::Cipher::AES_192_CBC)                         \
-  V(CBC_256, AES_Cipher, ncrypto::Cipher::AES_256_CBC)                         \
-  V(GCM_128, AES_Cipher, ncrypto::Cipher::AES_128_GCM)                         \
-  V(GCM_192, AES_Cipher, ncrypto::Cipher::AES_192_GCM)                         \
-  V(GCM_256, AES_Cipher, ncrypto::Cipher::AES_256_GCM)                         \
+  V(CTR_128, AES_CTR_Cipher, ncrypto::Cipher::AES_128_CTR())                   \
+  V(CTR_192, AES_CTR_Cipher, ncrypto::Cipher::AES_192_CTR())                   \
+  V(CTR_256, AES_CTR_Cipher, ncrypto::Cipher::AES_256_CTR())                   \
+  V(CBC_128, AES_Cipher, ncrypto::Cipher::AES_128_CBC())                       \
+  V(CBC_192, AES_Cipher, ncrypto::Cipher::AES_192_CBC())                       \
+  V(CBC_256, AES_Cipher, ncrypto::Cipher::AES_256_CBC())                       \
+  V(GCM_128, AES_Cipher, ncrypto::Cipher::AES_128_GCM())                       \
+  V(GCM_192, AES_Cipher, ncrypto::Cipher::AES_192_GCM())                       \
+  V(GCM_256, AES_Cipher, ncrypto::Cipher::AES_256_GCM())                       \
   VARIANTS_KW(V)
 
 #ifdef OPENSSL_IS_BORINGSSL
@@ -33,16 +33,16 @@ constexpr unsigned kNoAuthTagLength = static_cast<unsigned>(-1);
   V(KW_256, AES_KW_Cipher, static_cast<const EVP_CIPHER*>(nullptr))
 #else
 #define VARIANTS_KW(V)                                                         \
-  V(KW_128, AES_Cipher, ncrypto::Cipher::AES_128_KW)                           \
-  V(KW_192, AES_Cipher, ncrypto::Cipher::AES_192_KW)                           \
-  V(KW_256, AES_Cipher, ncrypto::Cipher::AES_256_KW)
+  V(KW_128, AES_Cipher, ncrypto::Cipher::AES_128_KW())                         \
+  V(KW_192, AES_Cipher, ncrypto::Cipher::AES_192_KW())                         \
+  V(KW_256, AES_Cipher, ncrypto::Cipher::AES_256_KW())
 #endif
 
 #if OPENSSL_WITH_AES_OCB
 #define VARIANTS_OCB(V)                                                        \
-  V(OCB_128, AES_Cipher, ncrypto::Cipher::AES_128_OCB)                         \
-  V(OCB_192, AES_Cipher, ncrypto::Cipher::AES_192_OCB)                         \
-  V(OCB_256, AES_Cipher, ncrypto::Cipher::AES_256_OCB)
+  V(OCB_128, AES_Cipher, ncrypto::Cipher::AES_128_OCB())                       \
+  V(OCB_192, AES_Cipher, ncrypto::Cipher::AES_192_OCB())                       \
+  V(OCB_256, AES_Cipher, ncrypto::Cipher::AES_256_OCB())
 #else
 #define VARIANTS_OCB(V)
 #endif
diff --git a/src/crypto/crypto_bio.cc b/src/crypto/crypto_bio.cc
index cdf87c322afd..9d2bd8e06e06 100644
--- a/src/crypto/crypto_bio.cc
+++ b/src/crypto/crypto_bio.cc
@@ -99,7 +99,7 @@ int NodeBIO::Read(BIO* bio, char* out, int len) {
 
 char* NodeBIO::Peek(size_t* size) {
   *size = read_head_->write_pos_ - read_head_->read_pos_;
-  return read_head_->data_ + read_head_->read_pos_;
+  return read_head_->data_.get() + read_head_->read_pos_;
 }
 
 
@@ -112,7 +112,7 @@ size_t NodeBIO::PeekMultiple(char** out, size_t* size, size_t* count) {
   for (i = 0; i < max; i++) {
     size[i] = pos->write_pos_ - pos->read_pos_;
     total += size[i];
-    out[i] = pos->data_ + pos->read_pos_;
+    out[i] = pos->data_.get() + pos->read_pos_;
 
     /* Don't get past write head */
     if (pos == write_head_)
@@ -274,7 +274,8 @@ size_t NodeBIO::Read(char* out, size_t size) {
 
     // Copy data
     if (out != nullptr)
-      memcpy(out + offset, read_head_->data_ + read_head_->read_pos_, avail);
+      memcpy(
+          out + offset, read_head_->data_.get() + read_head_->read_pos_, avail);
     read_head_->read_pos_ += avail;
 
     // Move pointers
@@ -330,7 +331,7 @@ size_t NodeBIO::IndexOf(char delim, size_t limit) {
       avail = left;
 
     // Walk through data
-    char* tmp = current->data_ + current->read_pos_;
+    char* tmp = current->data_.get() + current->read_pos_;
     size_t off = 0;
     while (off < avail && *tmp != delim) {
       off++;
@@ -373,7 +374,7 @@ void NodeBIO::Write(const char* data, size_t size) {
       to_write = avail;
 
     // Copy data
-    memcpy(write_head_->data_ + write_head_->write_pos_,
+    memcpy(write_head_->data_.get() + write_head_->write_pos_,
            data + offset,
            to_write);
 
@@ -406,7 +407,7 @@ char* NodeBIO::PeekWritable(size_t* size) {
   if (*size == 0 || available <= *size)
     *size = available;
 
-  return write_head_->data_ + write_head_->write_pos_;
+  return write_head_->data_.get() + write_head_->write_pos_;
 }
 
 
diff --git a/src/crypto/crypto_bio.h b/src/crypto/crypto_bio.h
index 616fc1eed7e0..01aa11c2207e 100644
--- a/src/crypto/crypto_bio.h
+++ b/src/crypto/crypto_bio.h
@@ -150,19 +150,19 @@ class NodeBIO : public MemoryRetainer {
 
   class Buffer {
    public:
-    Buffer(Environment* env, size_t len) : env_(env),
-                                           read_pos_(0),
-                                           write_pos_(0),
-                                           len_(len),
-                                           next_(nullptr) {
-      data_ = new char[len];
+    Buffer(Environment* env, size_t len)
+        : env_(env),
+          read_pos_(0),
+          write_pos_(0),
+          len_(len),
+          next_(nullptr),
+          data_(new char[len]) {
       if (env_ != nullptr) {
         env_->external_memory_accounter()->Increase(env_->isolate(), len);
       }
     }
 
     ~Buffer() {
-      delete[] data_;
       if (env_ != nullptr) {
         env_->external_memory_accounter()->Decrease(env_->isolate(), len_);
       }
@@ -173,7 +173,7 @@ class NodeBIO : public MemoryRetainer {
     size_t write_pos_;
     size_t len_;
     Buffer* next_;
-    char* data_;
+    std::unique_ptr<char[]> data_;
   };
 
   Environment* env_ = nullptr;
diff --git a/src/crypto/crypto_chacha20_poly1305.cc b/src/crypto/crypto_chacha20_poly1305.cc
index 1cdb933c65d4..56ba78be7ccd 100644
--- a/src/crypto/crypto_chacha20_poly1305.cc
+++ b/src/crypto/crypto_chacha20_poly1305.cc
@@ -105,7 +105,7 @@ Maybe<void> ChaCha20Poly1305CipherTraits::AdditionalConfig(
     ChaCha20Poly1305CipherConfig* params) {
   Environment* env = Environment::GetCurrent(args);
 
-  params->cipher = ncrypto::Cipher::CHACHA20_POLY1305;
+  params->cipher = ncrypto::Cipher::CHACHA20_POLY1305();
 
 #ifndef OPENSSL_IS_BORINGSSL
   // On BoringSSL, ChaCha20-Poly1305 is not exposed via the EVP_CIPHER registry
diff --git a/src/crypto/crypto_cipher.cc b/src/crypto/crypto_cipher.cc
index 720eb656b89d..348d96e60435 100644
--- a/src/crypto/crypto_cipher.cc
+++ b/src/crypto/crypto_cipher.cc
@@ -75,10 +75,10 @@ void GetCipherInfo(const FunctionCallbackInfo<Value>& args) {
   const auto cipher = ([&] {
     if (args[0]->IsString()) {
       Utf8Value name(env->isolate(), args[0]);
-      return Cipher::FromName(*name);
+      return Cipher::FromName(*name, env->provider_cipher_cache.get());
     } else {
       int nid = args[0].As<Int32>()->Value();
-      return Cipher::FromNid(nid);
+      return Cipher::FromNid(nid, env->provider_cipher_cache.get());
     }
   })();
 
@@ -227,7 +227,7 @@ CipherBase::CipherBase(Environment* env, Local<Object> wrap, CipherKind kind)
       auth_tag_state_(kAuthTagUnknown),
       auth_tag_len_(kNoAuthTagLength),
       pending_auth_failed_(false),
-      has_siv_update_(false),
+      has_one_shot_update_(false),
       siv_aad_components_(0) {
   MakeWeak();
 }
@@ -311,7 +311,7 @@ void CipherBase::RegisterExternalReferences(
 void CipherBase::New(const FunctionCallbackInfo<Value>& args) {
   CHECK(args.IsConstructCall());
   Environment* env = Environment::GetCurrent(args);
-  CHECK_EQ(args.Length(), 5);
+  CHECK(args.Length() == 5 || args.Length() == 7);
 
   CipherBase* cipher =
       new CipherBase(env, args.This(), args[0]->IsTrue() ? kCipher : kDecipher);
@@ -343,7 +343,25 @@ void CipherBase::New(const FunctionCallbackInfo<Value>& args) {
     auth_tag_len = kNoAuthTagLength;
   }
 
-  cipher->InitIv(*cipher_type, key_buf, iv_buf, auth_tag_len);
+  if (args.Length() == 5) {
+    cipher->InitIv(
+        *cipher_type, key_buf, iv_buf, auth_tag_len, nullptr, nullptr);
+    return;
+  }
+
+  CHECK(args[5]->IsString() || args[5]->IsUndefined());
+  CHECK(args[6]->IsString() || args[6]->IsUndefined());
+  const Utf8Value cts_mode(env->isolate(),
+                           args[5]->IsString() ? args[5] : Local<Value>());
+  const Utf8Value xts_standard(env->isolate(),
+                               args[6]->IsString() ? args[6] : Local<Value>());
+
+  cipher->InitIv(*cipher_type,
+                 key_buf,
+                 iv_buf,
+                 auth_tag_len,
+                 args[5]->IsString() ? *cts_mode : nullptr,
+                 args[6]->IsString() ? *xts_standard : nullptr);
 }
 
 void CipherBase::CommonInit(const char* cipher_type,
@@ -352,7 +370,9 @@ void CipherBase::CommonInit(const char* cipher_type,
                             int key_len,
                             const unsigned char* iv,
                             int iv_len,
-                            unsigned int auth_tag_len) {
+                            unsigned int auth_tag_len,
+                            const char* cts_mode,
+                            const char* xts_standard) {
   MarkPopErrorOnReturn mark_pop_error_on_return;
   CHECK(!ctx_);
   ctx_ = CipherCtxPointer::New();
@@ -372,6 +392,18 @@ void CipherBase::CommonInit(const char* cipher_type,
                             "Failed to initialize cipher");
   }
 
+  if (cts_mode != nullptr && !ctx_.setCtsMode(cts_mode)) {
+    ctx_.reset();
+    return THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(
+        env(), "%s does not support the ctsMode option", cipher_type);
+  }
+
+  if (xts_standard != nullptr && !ctx_.setXtsStandard(xts_standard)) {
+    ctx_.reset();
+    return THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(
+        env(), "%s does not support the xtsStandard option", cipher_type);
+  }
+
   if (cipher.isSupportedAuthenticatedMode()) {
     CHECK_GE(iv_len, 0);
     if (!InitAuthenticated(cipher_type, iv_len, auth_tag_len)) {
@@ -394,11 +426,14 @@ void CipherBase::CommonInit(const char* cipher_type,
 void CipherBase::InitIv(const char* cipher_type,
                         const ByteSource& key_buf,
                         const ArrayBufferOrViewContents<unsigned char>& iv_buf,
-                        unsigned int auth_tag_len) {
+                        unsigned int auth_tag_len,
+                        const char* cts_mode,
+                        const char* xts_standard) {
   HandleScope scope(env()->isolate());
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
-  auto cipher = Cipher::FromName(cipher_type);
+  auto cipher =
+      Cipher::FromName(cipher_type, env()->provider_cipher_cache.get());
   if (!cipher) return THROW_ERR_CRYPTO_UNKNOWN_CIPHER(env());
 
   const int expected_iv_len = cipher.getIvLength();
@@ -436,14 +471,15 @@ void CipherBase::InitIv(const char* cipher_type,
     return THROW_ERR_CRYPTO_INVALID_IV(env());
   }
 
-  CommonInit(
-      cipher_type,
-      cipher,
-      key_buf.data<unsigned char>(),
-      key_buf.size(),
-      iv_buf.data(),
-      iv_buf.size(),
-      auth_tag_len);
+  CommonInit(cipher_type,
+             cipher,
+             key_buf.data<unsigned char>(),
+             key_buf.size(),
+             iv_buf.data(),
+             iv_buf.size(),
+             auth_tag_len,
+             cts_mode,
+             xts_standard);
 }
 
 bool CipherBase::InitAuthenticated(const char* cipher_type,
@@ -463,7 +499,7 @@ bool CipherBase::InitAuthenticated(const char* cipher_type,
     // TODO(tniessen) Support CCM decryption in FIPS mode
     if (kind_ == kDecipher && ncrypto::isFipsEnabled()) {
       THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(
-          env(), "CCM encryption not supported in FIPS mode");
+          env(), "CCM decryption not supported in FIPS mode");
       return false;
     }
 
@@ -563,7 +599,7 @@ void CipherBase::SetAuthTag(const FunctionCallbackInfo<Value>& args) {
   }
 
   if ((cipher->ctx_.isSivMode() || cipher->ctx_.isGcmSivMode()) &&
-      cipher->has_siv_update_) {
+      cipher->has_one_shot_update_) {
     return args.GetReturnValue().Set(false);
   }
 
@@ -598,7 +634,7 @@ bool CipherBase::SetAAD(
   if (!ctx_ || !IsAuthenticatedMode())
     return false;
   const bool is_siv = ctx_.isSivMode();
-  if ((is_siv || ctx_.isGcmSivMode()) && has_siv_update_) return false;
+  if ((is_siv || ctx_.isGcmSivMode()) && has_one_shot_update_) return false;
   if (is_siv && siv_aad_components_ >= kMaxSivAADComponents) return false;
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
@@ -659,12 +695,20 @@ CipherBase::UpdateResult CipherBase::Update(
   if (!ctx_ || len > INT_MAX) return kErrorState;
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
-  if (ctx_.isCcmMode() && !CheckCCMMessageLength(len)) {
+  const bool is_ccm_mode = ctx_.isCcmMode();
+  const bool is_ccm_decipher = kind_ == kDecipher && is_ccm_mode;
+
+  if (is_ccm_mode && !CheckCCMMessageLength(len)) {
     return kErrorMessageSize;
   }
 
   const bool is_siv = ctx_.isSivMode() || ctx_.isGcmSivMode();
-  if (is_siv && has_siv_update_) {
+  const bool is_cts = ctx_.isCtsMode();
+  const bool is_xts = ctx_.isXtsMode();
+  const bool is_wrap = ctx_.isWrapMode();
+  const bool is_one_shot =
+      is_ccm_decipher || is_siv || is_cts || is_xts || is_wrap;
+  if (is_one_shot && has_one_shot_update_) {
     return kErrorState;
   }
 
@@ -694,8 +738,8 @@ CipherBase::UpdateResult CipherBase::Update(
 
   bool r = ctx_.update(
       buffer, static_cast<unsigned char*>((*out)->Data()), &buf_len);
-  if (is_siv) {
-    has_siv_update_ = true;
+  if (is_ccm_decipher || is_siv || ((is_cts || is_xts || is_wrap) && r)) {
+    has_one_shot_update_ = true;
   }
 
   // When in CCM mode, EVP_CipherUpdate will fail if the authentication tag is
@@ -773,7 +817,10 @@ void CipherBase::SetAutoPadding(const FunctionCallbackInfo<Value>& args) {
 
 bool CipherBase::Final(std::unique_ptr<BackingStore>* out) {
   if (!ctx_) return false;
-  if ((ctx_.isSivMode() || ctx_.isGcmSivMode()) && !has_siv_update_) {
+  const bool is_one_shot = ctx_.isSivMode() || ctx_.isGcmSivMode() ||
+                           ctx_.isCtsMode() || ctx_.isXtsMode() ||
+                           ctx_.isWrapMode();
+  if (is_one_shot && !has_one_shot_update_) {
     ctx_.reset();
     return false;
   }
@@ -796,7 +843,8 @@ bool CipherBase::Final(std::unique_ptr<BackingStore>* out) {
   // EVP_CipherFinal_ex must not be called and will fail.
   bool ok;
   if (kind_ == kDecipher && ctx_.isCcmMode()) {
-    ok = !pending_auth_failed_;
+    ok = auth_tag_state_ == kAuthTagSetByUser && has_one_shot_update_ &&
+         !pending_auth_failed_;
     *out = ArrayBuffer::NewBackingStore(env()->isolate(), 0);
   } else {
     int out_len = (*out)->ByteLength();
diff --git a/src/crypto/crypto_cipher.h b/src/crypto/crypto_cipher.h
index b751173d5591..f6deb774ea36 100644
--- a/src/crypto/crypto_cipher.h
+++ b/src/crypto/crypto_cipher.h
@@ -51,11 +51,15 @@ class CipherBase : public BaseObject {
                   int key_len,
                   const unsigned char* iv,
                   int iv_len,
-                  unsigned int auth_tag_len);
+                  unsigned int auth_tag_len,
+                  const char* cts_mode,
+                  const char* xts_standard);
   void InitIv(const char* cipher_type,
               const ByteSource& key_buf,
               const ArrayBufferOrViewContents<unsigned char>& iv_buf,
-              unsigned int auth_tag_len);
+              unsigned int auth_tag_len,
+              const char* cts_mode,
+              const char* xts_standard);
   bool InitAuthenticated(const char* cipher_type,
                          int iv_len,
                          unsigned int auth_tag_len);
@@ -87,7 +91,7 @@ class CipherBase : public BaseObject {
   unsigned int auth_tag_len_;
   char auth_tag_[ncrypto::Cipher::MAX_AUTH_TAG_LENGTH];
   bool pending_auth_failed_;
-  bool has_siv_update_;
+  bool has_one_shot_update_;
   unsigned int siv_aad_components_;
   int max_message_size_;
 };
diff --git a/src/crypto/crypto_client_hello.cc b/src/crypto/crypto_client_hello.cc
new file mode 100644
index 000000000000..75ecc3cc8748
--- /dev/null
+++ b/src/crypto/crypto_client_hello.cc
@@ -0,0 +1,142 @@
+#include "crypto/crypto_client_hello.h"
+
+#include <algorithm>
+
+namespace node::crypto {
+
+SSL* ClientHelloContext::ssl() const {
+#ifdef OPENSSL_IS_BORINGSSL
+  return handle_->ssl;
+#else
+  return handle_;
+#endif
+}
+
+std::span<const uint8_t> ClientHelloContext::session_id() const {
+#ifdef OPENSSL_IS_BORINGSSL
+  return {handle_->session_id, handle_->session_id_len};
+#else
+  const uint8_t* id = nullptr;
+  size_t len = SSL_client_hello_get0_session_id(handle_, &id);
+  if (id == nullptr) return {};
+  return {id, len};
+#endif
+}
+
+bool ClientHelloContext::has_session_ticket() const {
+  auto ext = extension(TLSEXT_TYPE_session_ticket);
+  return ext.has_value() && !ext->empty();
+}
+
+std::optional<std::string_view> ClientHelloContext::servername() const {
+  auto ext = extension(TLSEXT_TYPE_server_name);
+  if (!ext.has_value()) return std::string_view();
+  // RFC 6066: a 16-bit list length, then one entry of an 8-bit name type,
+  // a 16-bit name length and that many name bytes. The constraints applied
+  // here are the ones the TLS stack's own parser applies: exactly one
+  // entry, of type host_name, of a sane length and free of NULs.
+  auto list = ReadVector16(*ext);
+  if (!list.has_value() || list->size() < 3) return std::nullopt;
+  if ((*list)[0] != TLSEXT_NAMETYPE_host_name) return std::nullopt;
+  auto name = ReadVector16(list->subspan(1));
+  if (!name.has_value()) return std::nullopt;
+  if (name->size() + 3 != list->size()) return std::nullopt;
+  if (name->empty() || name->size() > TLSEXT_MAXLEN_host_name) {
+    return std::nullopt;
+  }
+  if (std::find(name->begin(), name->end(), 0) != name->end()) {
+    return std::nullopt;
+  }
+  return std::string_view(reinterpret_cast<const char*>(name->data()),
+                          name->size());
+}
+
+std::span<const uint8_t> ClientHelloContext::alpn_protocols() const {
+  auto ext = extension(TLSEXT_TYPE_application_layer_protocol_negotiation);
+  if (!ext.has_value()) return {};
+  // RFC 7301: a 16-bit list length, then the protocol names.
+  return ReadVector16(*ext).value_or(std::span<const uint8_t>());
+}
+
+std::optional<std::span<const uint8_t>> ClientHelloContext::extension(
+    unsigned int type) const {
+  const uint8_t* data = nullptr;
+  size_t len = 0;
+#ifdef OPENSSL_IS_BORINGSSL
+  if (!SSL_early_callback_ctx_extension_get(handle_, type, &data, &len)) {
+    return std::nullopt;
+  }
+#else
+  if (SSL_client_hello_get0_ext(handle_, type, &data, &len) != 1) {
+    return std::nullopt;
+  }
+#endif
+  return std::span<const uint8_t>(data, len);
+}
+
+void ClientHelloContext::set_alert(int alert) const {
+  if (alert_ != nullptr) *alert_ = alert;
+}
+
+ClientHelloContext::Result ClientHelloContext::Encode(
+    ClientHelloResult result) {
+  switch (result) {
+    case ClientHelloResult::kContinue:
+      return kContinueResult;
+    case ClientHelloResult::kRetry:
+      return kRetryResult;
+    case ClientHelloResult::kFail:
+      break;
+  }
+  return kFailResult;
+}
+
+std::optional<std::span<const uint8_t>> ClientHelloContext::ReadVector16(
+    std::span<const uint8_t> data) {
+  if (data.size() < 2) return std::nullopt;
+  const size_t len = (static_cast<size_t>(data[0]) << 8) | data[1];
+  if (data.size() < 2 + len) return std::nullopt;
+  return data.subspan(2, len);
+}
+
+bool AlpnListContains(std::span<const uint8_t> protocols,
+                      std::string_view protocol) {
+  for (size_t n = 0; n < protocols.size();) {
+    const size_t len = protocols[n];
+    if (len == 0 || n + 1 + len > protocols.size()) return false;
+    if (std::string_view(
+            reinterpret_cast<const char*>(protocols.data() + n + 1), len) ==
+        protocol) {
+      return true;
+    }
+    n += 1 + len;
+  }
+  return false;
+}
+
+void SetSelectedProtocol(const unsigned char** out,
+                         unsigned char* outlen,
+                         std::string_view protocol) {
+  *out = reinterpret_cast<const unsigned char*>(protocol.data());
+  *outlen = static_cast<unsigned char>(protocol.size());
+}
+
+std::optional<std::string_view> SelectNextProtocol(
+    std::span<const uint8_t> supported, std::span<const uint8_t> offered) {
+  if (supported.empty() || offered.empty()) return std::nullopt;
+  uint8_t* selected = nullptr;
+  uint8_t selected_len = 0;
+  if (SSL_select_next_proto(&selected,
+                            &selected_len,
+                            supported.data(),
+                            static_cast<unsigned int>(supported.size()),
+                            offered.data(),
+                            static_cast<unsigned int>(offered.size())) !=
+      OPENSSL_NPN_NEGOTIATED) {
+    return std::nullopt;
+  }
+  return std::string_view(reinterpret_cast<const char*>(selected),
+                          selected_len);
+}
+
+}  // namespace node::crypto
diff --git a/src/crypto/crypto_client_hello.h b/src/crypto/crypto_client_hello.h
new file mode 100644
index 000000000000..37b8124e8cc7
--- /dev/null
+++ b/src/crypto/crypto_client_hello.h
@@ -0,0 +1,125 @@
+#ifndef SRC_CRYPTO_CRYPTO_CLIENT_HELLO_H_
+#define SRC_CRYPTO_CRYPTO_CLIENT_HELLO_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <openssl/ssl.h>
+#include <openssl/tls1.h>
+#include <cstdint>
+#include <optional>
+#include <span>
+#include <string_view>
+
+namespace node::crypto {
+
+// Support for the early ClientHello callback, which the TLS library invokes
+// once a complete ClientHello has been received but before version
+// negotiation and before any session or ticket resumption.
+
+enum class ClientHelloResult {
+  kContinue,
+  // Unwind out of the TLS library, leaving the handshake suspended. The
+  // callback runs again from the start when the handshake is resumed.
+  kRetry,
+  // Abort the handshake.
+  kFail,
+};
+
+// The ClientHello being processed, and the inputs from it that are usable
+// this early. Instances are only valid for the duration of the callback.
+class ClientHelloContext final {
+ public:
+#ifdef OPENSSL_IS_BORINGSSL
+  using Handle = const SSL_CLIENT_HELLO*;
+  using Result = ssl_select_cert_result_t;
+  static constexpr Result kContinueResult = ssl_select_cert_success;
+  static constexpr Result kRetryResult = ssl_select_cert_retry;
+  static constexpr Result kFailResult = ssl_select_cert_error;
+#else
+  using Handle = SSL*;
+  using Result = int;
+  static constexpr Result kContinueResult = SSL_CLIENT_HELLO_SUCCESS;
+  static constexpr Result kRetryResult = SSL_CLIENT_HELLO_RETRY;
+  static constexpr Result kFailResult = SSL_CLIENT_HELLO_ERROR;
+#endif
+
+  explicit ClientHelloContext(Handle handle, int* alert = nullptr)
+      : handle_(handle), alert_(alert) {}
+
+  SSL* ssl() const;
+
+  // The legacy_session_id. Note that a TLS 1.3 ClientHello carries a fake
+  // one for middlebox compatibility, so a non-empty value here does not
+  // mean the client is attempting session-id resumption.
+  std::span<const uint8_t> session_id() const;
+
+  bool has_session_ticket() const;
+
+  // The host name to select an identity for, empty if the client sent no
+  // server_name. Nothing at all if it sent one that cannot be used, in which
+  // case the handshake should fail. SSL_get_servername() does not work this
+  // early as the servername callback has not run yet.
+  std::optional<std::string_view> servername() const;
+
+  // ALPN protocols in wire format: each entry is a length byte followed by
+  // that many name bytes.
+  std::span<const uint8_t> alpn_protocols() const;
+
+  std::optional<std::span<const uint8_t>> extension(unsigned int type) const;
+
+  // Ignored by TLS libraries that choose the alert themselves.
+  void set_alert(int alert) const;
+
+  static Result Encode(ClientHelloResult result);
+
+ private:
+  // Reads a 16-bit length prefixed vector from the front of data. Returns
+  // nothing if the length does not fit within data.
+  static std::optional<std::span<const uint8_t>> ReadVector16(
+      std::span<const uint8_t> data);
+
+  Handle handle_;
+  int* alert_;
+};
+
+// Adapts a portable callback into the one the linked TLS library expects.
+template <ClientHelloResult (*Fn)(const ClientHelloContext&)>
+struct ClientHelloCallback final {
+#ifdef OPENSSL_IS_BORINGSSL
+  static ssl_select_cert_result_t Invoke(const SSL_CLIENT_HELLO* hello) {
+    return ClientHelloContext::Encode(Fn(ClientHelloContext(hello)));
+  }
+#else
+  static int Invoke(SSL* ssl, int* alert, void* arg) {
+    return ClientHelloContext::Encode(Fn(ClientHelloContext(ssl, alert)));
+  }
+#endif
+};
+
+// Registers Fn as the early ClientHello callback on ctx.
+template <ClientHelloResult (*Fn)(const ClientHelloContext&)>
+inline void SetClientHelloCallback(SSL_CTX* ctx) {
+#ifdef OPENSSL_IS_BORINGSSL
+  SSL_CTX_set_select_certificate_cb(ctx, ClientHelloCallback<Fn>::Invoke);
+#else
+  SSL_CTX_set_client_hello_cb(ctx, ClientHelloCallback<Fn>::Invoke, nullptr);
+#endif
+}
+
+bool AlpnListContains(std::span<const uint8_t> protocols,
+                      std::string_view protocol);
+
+void SetSelectedProtocol(const unsigned char** out,
+                         unsigned char* outlen,
+                         std::string_view protocol);
+
+// Selects the protocol to use from the offered and supported lists, both in
+// ALPN wire format. Returns nothing when the two lists do not overlap.
+std::optional<std::string_view> SelectNextProtocol(
+    std::span<const uint8_t> supported, std::span<const uint8_t> offered);
+
+}  // namespace node::crypto
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#endif  // SRC_CRYPTO_CRYPTO_CLIENT_HELLO_H_
diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
index 0f61767cdbbe..9dc68f4d9d2d 100644
--- a/src/crypto/crypto_context.cc
+++ b/src/crypto/crypto_context.cc
@@ -2,6 +2,7 @@
 #include "base_object-inl.h"
 #include "crypto/crypto_bio.h"
 #include "crypto/crypto_common.h"
+#include "crypto/crypto_tls_certificates.h"
 #include "crypto/crypto_util.h"
 #include "env-inl.h"
 #include "memory_tracker-inl.h"
@@ -86,14 +87,15 @@ static std::atomic<bool> has_cached_extra_root_certs{false};
 
 // Used for sets of X509.
 struct X509Less {
-  bool operator()(const X509* lhs, const X509* rhs) const noexcept {
-    return X509_cmp(const_cast<X509*>(lhs), const_cast<X509*>(rhs)) < 0;
+  bool operator()(const ncrypto::X509Pointer& lhs,
+                  const ncrypto::X509Pointer& rhs) const noexcept {
+    return X509_cmp(lhs.get(), rhs.get()) < 0;
   }
 };
-using X509Set = std::set<X509*, X509Less>;
+using X509Set = std::set<ncrypto::X509Pointer, X509Less>;
 
 // Per-thread root cert store. See NewRootCertStore() on what it contains.
-static thread_local X509_STORE* root_cert_store = nullptr;
+static thread_local DeleteFnPtr<X509_STORE, X509_STORE_free> root_cert_store;
 // If the user calls tls.setDefaultCACertificates() this will be used
 // to hold the user-provided certificates, the root_cert_store and any new
 // copy generated by NewRootCertStore() will then contain the certificates
@@ -102,18 +104,8 @@ static thread_local std::unique_ptr<X509Set> root_certs_from_users;
 static thread_local bool has_cleanup_hook = false;
 
 static void CleanupRootCertStore(void*) {
-  if (root_cert_store != nullptr) {
-    X509_STORE_free(root_cert_store);
-    root_cert_store = nullptr;
-  }
-
-  if (root_certs_from_users != nullptr) {
-    for (X509* cert : *root_certs_from_users) {
-      X509_free(cert);
-    }
-    root_certs_from_users.reset();
-  }
-
+  root_cert_store.reset();
+  root_certs_from_users.reset();
   has_cleanup_hook = false;
 }
 
@@ -129,10 +121,10 @@ static void EnsureRootCertStoreCleanupHook(Environment* env) {
 X509_STORE* GetOrCreateRootCertStore(Environment* env) {
   EnsureRootCertStoreCleanupHook(env);
   if (root_cert_store != nullptr) {
-    return root_cert_store;
+    return root_cert_store.get();
   }
-  root_cert_store = NewRootCertStore(env);
-  return root_cert_store;
+  root_cert_store.reset(NewRootCertStore(env));
+  return root_cert_store.get();
 }
 
 // Takes a string or buffer and loads it into a BIO.
@@ -274,13 +266,13 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
 }
 
 static unsigned long LoadCertsFromBIO(  // NOLINT(runtime/int)
-    std::vector<X509*>* certs,
+    std::vector<ncrypto::X509Pointer>* certs,
     BIOPointer bio) {
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
   while (X509* x509 = PEM_read_bio_X509(
              bio.get(), nullptr, NoPasswordCallback, nullptr)) {
-    certs->push_back(x509);
+    certs->emplace_back(x509);
   }
 
   unsigned long err = ERR_peek_last_error();  // NOLINT(runtime/int)
@@ -294,7 +286,7 @@ static unsigned long LoadCertsFromBIO(  // NOLINT(runtime/int)
 }
 
 static unsigned long LoadCertsFromFile(  // NOLINT(runtime/int)
-    std::vector<X509*>* certs,
+    std::vector<ncrypto::X509Pointer>* certs,
     const char* file) {
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
@@ -554,7 +546,7 @@ static bool IsCertificateExpired(X509* cert) {
 }
 
 void ReadMacOSKeychainCertificates(
-    std::vector<X509*>* system_root_certificates_X509) {
+    std::vector<ncrypto::X509Pointer>* system_root_certificates_X509) {
   CFTypeRef search_keys[] = {kSecClass, kSecMatchLimit, kSecReturnRef};
   CFTypeRef search_values[] = {
       kSecClassCertificate, kSecMatchLimitAll, kCFBooleanTrue};
@@ -581,8 +573,11 @@ void ReadMacOSKeychainCertificates(
   CFIndex count = CFArrayGetCount(curr_anchors);
 
   // Track seen certificates to detect duplicates (same cert in multiple
-  // keychains).
-  std::set<X509*, X509Less> seen_certs;
+  // keychains). Non-owning set -- the vector owns the certs.
+  auto x509_raw_less = [](const X509* a, const X509* b) {
+    return X509_cmp(const_cast<X509*>(a), const_cast<X509*>(b)) < 0;
+  };
+  std::set<X509*, decltype(x509_raw_less)> seen_certs(x509_raw_less);
 
   for (int i = 0; i < count; ++i) {
     SecCertificateRef cert_ref = reinterpret_cast<SecCertificateRef>(
@@ -597,40 +592,37 @@ void ReadMacOSKeychainCertificates(
     }
     auto data_buffer_pointer = CFDataGetBytePtr(der_data);
 
-    X509* cert =
-        d2i_X509(nullptr, &data_buffer_pointer, CFDataGetLength(der_data));
+    ncrypto::X509Pointer cert(
+        d2i_X509(nullptr, &data_buffer_pointer, CFDataGetLength(der_data)));
     CFRelease(der_data);
 
-    if (cert == nullptr) {
+    if (!cert) {
       per_process::Debug(DebugCategory::CRYPTO,
                          "Skipping read of a system certificate "
                          "because decoding failed\n");
       continue;
     }
 
-    bool is_valid = IsCertificateTrustedForPolicy(cert, cert_ref);
+    bool is_valid = IsCertificateTrustedForPolicy(cert.get(), cert_ref);
     if (!is_valid) {
-      X509_free(cert);
       continue;
     }
 
     // Skip duplicate certificates.
-    auto [it, inserted] = seen_certs.insert(cert);
+    auto [it, inserted] = seen_certs.insert(cert.get());
     if (!inserted) {
-      X509_free(cert);
       continue;
     }
 
     // Skip expired certificates.
-    if (IsCertificateExpired(cert)) {
+    if (IsCertificateExpired(cert.get())) {
       per_process::Debug(DebugCategory::CRYPTO,
                          "Skipping expired system certificate\n");
       seen_certs.erase(it);
-      X509_free(cert);
       continue;
     }
 
-    system_root_certificates_X509->emplace_back(cert);
+    system_root_certificates_X509->emplace_back(std::move(cert));
   }
   CFRelease(curr_anchors);
 }
@@ -701,7 +693,7 @@ bool IsCertTrustedForServerAuth(PCCERT_CONTEXT cert) {
   return false;
 }
 
-void GatherCertsForLocation(std::vector<X509*>* vector,
+void GatherCertsForLocation(std::vector<ncrypto::X509Pointer>* vector,
                             DWORD location,
                             LPCWSTR store_name) {
   if (!(location == CERT_SYSTEM_STORE_LOCAL_MACHINE ||
@@ -739,19 +731,19 @@ void GatherCertsForLocation(std::vector<X509*>* vector,
         reinterpret_cast<const unsigned char*>(cert_from_store->pbCertEncoded);
     const size_t cert_size = cert_from_store->cbCertEncoded;
 
-    X509* x509 = d2i_X509(nullptr, &cert_data, cert_size);
-    if (x509 == nullptr) {
+    ncrypto::X509Pointer x509(d2i_X509(nullptr, &cert_data, cert_size));
+    if (!x509) {
       per_process::Debug(DebugCategory::CRYPTO,
                          "Skipping read of a system certificate "
                          "because decoding failed\n");
     } else {
-      vector->emplace_back(x509);
+      vector->emplace_back(std::move(x509));
     }
   }
 }
 
 void ReadWindowsCertificates(
-    std::vector<X509*>* system_root_certificates_X509) {
+    std::vector<ncrypto::X509Pointer>* system_root_certificates_X509) {
   // TODO(joyeecheung): match Chromium's policy, collect more certificates
   // from user-added CAs and support disallowed (revoked) certificates.
 
@@ -800,7 +792,7 @@ void ReadWindowsCertificates(
 }
 #endif
 
-static void LoadCertsFromDir(std::vector<X509*>* certs,
+static void LoadCertsFromDir(std::vector<ncrypto::X509Pointer>* certs,
                              std::string_view cert_dir) {
   uv_fs_t dir_req;
   auto cleanup = OnScopeLeave([&dir_req]() { uv_fs_req_cleanup(&dir_req); });
@@ -841,7 +833,8 @@ static void LoadCertsFromDir(std::vector<X509*>* certs,
 
 // Loads CA certificates from the default certificate paths respected by
 // OpenSSL.
-void GetOpenSSLSystemCertificates(std::vector<X509*>* system_store_certs) {
+void GetOpenSSLSystemCertificates(
+    std::vector<ncrypto::X509Pointer>* system_store_certs) {
   std::string cert_file;
   // While configurable when OpenSSL is built, this is usually SSL_CERT_FILE.
   if (!credentials::SafeGetenv(X509_get_default_cert_file_env(), &cert_file)) {
@@ -867,23 +860,23 @@ void GetOpenSSLSystemCertificates(std::vector<X509*>* system_store_certs) {
   }
 }
 
-static std::vector<X509*> InitializeBundledRootCertificates() {
+static std::vector<ncrypto::X509Pointer> InitializeBundledRootCertificates() {
   // Read the bundled certificates in node_root_certs.h into
   // bundled_root_certs_vector.
-  std::vector<X509*> bundled_root_certs;
+  std::vector<ncrypto::X509Pointer> bundled_root_certs;
   size_t bundled_root_cert_count = arraysize(root_certs);
   bundled_root_certs.reserve(bundled_root_cert_count);
   for (size_t i = 0; i < bundled_root_cert_count; i++) {
-    X509* x509 = PEM_read_bio_X509(
+    ncrypto::X509Pointer x509(PEM_read_bio_X509(
         NodeBIO::NewFixed(root_certs[i], strlen(root_certs[i])).get(),
         nullptr,  // no re-use of X509 structure
         NoPasswordCallback,
-        nullptr);  // no callback data
+        nullptr));  // no callback data
 
     // Parse errors from the built-in roots are fatal.
-    CHECK_NOT_NULL(x509);
+    CHECK(x509);
 
-    bundled_root_certs.push_back(x509);
+    bundled_root_certs.emplace_back(std::move(x509));
   }
   return bundled_root_certs;
 }
@@ -892,16 +885,16 @@ static std::vector<X509*> InitializeBundledRootCertificates() {
 // dance when we could've just pass everything around in binary. Change the
 // root_certs to be embedded as DER so that we can save the serialization
 // and deserialization.
-static std::vector<X509*>& GetBundledRootCertificates() {
+static std::vector<ncrypto::X509Pointer>& GetBundledRootCertificates() {
   // Use function-local static to guarantee thread safety.
-  static std::vector<X509*> bundled_root_certs =
+  static std::vector<ncrypto::X509Pointer> bundled_root_certs =
       InitializeBundledRootCertificates();
   has_cached_bundled_root_certs.store(true);
   return bundled_root_certs;
 }
 
-static std::vector<X509*> InitializeSystemStoreCertificates() {
-  std::vector<X509*> system_store_certs;
+static std::vector<ncrypto::X509Pointer> InitializeSystemStoreCertificates() {
+  std::vector<ncrypto::X509Pointer> system_store_certs;
 #ifdef __APPLE__
   ReadMacOSKeychainCertificates(&system_store_certs);
 #endif
@@ -914,16 +907,16 @@ static std::vector<X509*> InitializeSystemStoreCertificates() {
   return system_store_certs;
 }
 
-static std::vector<X509*>& GetSystemStoreCACertificates() {
+static std::vector<ncrypto::X509Pointer>& GetSystemStoreCACertificates() {
   // Use function-local static to guarantee thread safety.
-  static std::vector<X509*> system_store_certs =
+  static std::vector<ncrypto::X509Pointer> system_store_certs =
       InitializeSystemStoreCertificates();
   has_cached_system_root_certs.store(true);
   return system_store_certs;
 }
 
-static std::vector<X509*> InitializeExtraCACertificates() {
-  std::vector<X509*> extra_certs;
+static std::vector<ncrypto::X509Pointer> InitializeExtraCACertificates() {
+  std::vector<ncrypto::X509Pointer> extra_certs;
   unsigned long err = LoadCertsFromFile(  // NOLINT(runtime/int)
       &extra_certs,
       extra_root_certs_file.c_str());
@@ -938,9 +931,10 @@ static std::vector<X509*> InitializeExtraCACertificates() {
   return extra_certs;
 }
 
-static std::vector<X509*>& GetExtraCACertificates() {
+static std::vector<ncrypto::X509Pointer>& GetExtraCACertificates() {
   // Use function-local static to guarantee thread safety.
-  static std::vector<X509*> extra_certs = InitializeExtraCACertificates();
+  static std::vector<ncrypto::X509Pointer> extra_certs =
+      InitializeExtraCACertificates();
   has_cached_extra_root_certs.store(true);
   return extra_certs;
 }
@@ -1068,8 +1062,8 @@ X509_STORE* NewRootCertStore(Environment* env) {
   // tls.setDefaultCACertificates(), just create a copy from the
   // user-provided certificates.
   if (root_certs_from_users != nullptr) {
-    for (X509* cert : *root_certs_from_users) {
-      CHECK_EQ(1, X509_STORE_add_cert(store, cert));
+    for (const auto& cert : *root_certs_from_users) {
+      CHECK_EQ(1, X509_STORE_add_cert(store, cert.get()));
     }
     return store;
   }
@@ -1098,19 +1092,19 @@ X509_STORE* NewRootCertStore(Environment* env) {
   if (ssl_openssl_cert_store) {
     CHECK_EQ(1, X509_STORE_set_default_paths(store));
   } else {
-    for (X509* cert : GetBundledRootCertificates()) {
-      CHECK_EQ(1, X509_STORE_add_cert(store, cert));
+    for (const auto& cert : GetBundledRootCertificates()) {
+      CHECK_EQ(1, X509_STORE_add_cert(store, cert.get()));
     }
     if (use_system_ca) {
-      for (X509* cert : GetSystemStoreCACertificates()) {
-        CHECK_EQ(1, X509_STORE_add_cert(store, cert));
+      for (const auto& cert : GetSystemStoreCACertificates()) {
+        CHECK_EQ(1, X509_STORE_add_cert(store, cert.get()));
       }
     }
   }
 
   if (!extra_root_certs_file.empty()) {
-    for (X509* cert : GetExtraCACertificates()) {
-      CHECK_EQ(1, X509_STORE_add_cert(store, cert));
+    for (const auto& cert : GetExtraCACertificates()) {
+      CHECK_EQ(1, X509_STORE_add_cert(store, cert.get()));
     }
   }
 
@@ -1135,20 +1129,13 @@ void CleanupCachedRootCertificates() {
   }
 
   if (has_cached_bundled_root_certs.load()) {
-    for (X509* cert : GetBundledRootCertificates()) {
-      X509_free(cert);
-    }
+    GetBundledRootCertificates().clear();
   }
   if (has_cached_system_root_certs.load()) {
-    for (X509* cert : GetSystemStoreCACertificates()) {
-      X509_free(cert);
-    }
+    GetSystemStoreCACertificates().clear();
   }
-
   if (has_cached_extra_root_certs.load()) {
-    for (X509* cert : GetExtraCACertificates()) {
-      X509_free(cert);
-    }
+    GetExtraCACertificates().clear();
   }
 }
 
@@ -1171,7 +1158,7 @@ void GetBundledRootCertificates(const FunctionCallbackInfo<Value>& args) {
 
 bool ArrayOfStringsToX509s(Local<Context> context,
                            Local<Array> cert_array,
-                           std::vector<X509*>* certs) {
+                           std::vector<ncrypto::X509Pointer>* certs) {
   ClearErrorOnReturn clear_error_on_return;
   Isolate* isolate = Isolate::GetCurrent();
   Environment* env = Environment::GetCurrent(context);
@@ -1195,11 +1182,7 @@ bool ArrayOfStringsToX509s(Local<Context> context,
     size_t start = certs->size();
     auto err = LoadCertsFromBIO(certs, std::move(bio));
     if (err != 0) {
-      size_t end = certs->size();
-      // Clean up any certificates we've already parsed upon failure.
-      for (size_t j = start; j < end; ++j) {
-        X509_free((*certs)[j]);
-      }
+      certs->erase(certs->begin() + start, certs->end());
       ThrowCryptoError(env, err, "Failed to parse certificate");
       return false;
     }
@@ -1219,7 +1202,7 @@ MaybeLocal<Array> X509sToArrayOfStrings(Environment* env,
   LocalVector<Value> result(env->isolate(), size);
   size_t i = 0;
   for (It cur = first; cur != last; ++cur, ++i) {
-    X509View view(*cur);
+    X509View view(cur->get());
     auto pem_bio = view.toPEM();
     if (!pem_bio) {
       ThrowCryptoError(env, ERR_get_error(), "X509 to PEM conversion");
@@ -1266,24 +1249,13 @@ void ResetRootCertStore(const FunctionCallbackInfo<Value>& args) {
 
   if (cert_array->Length() == 0) {
     // If the array is empty, just clear the user certs and reset the store.
-    if (root_cert_store != nullptr) {
-      X509_STORE_free(root_cert_store);
-      root_cert_store = nullptr;
-    }
-
-    // Free any existing certificates in the old set.
-    if (root_certs_from_users != nullptr) {
-      for (X509* cert : *root_certs_from_users) {
-        X509_free(cert);
-      }
-    }
+    root_cert_store.reset();
     root_certs_from_users = std::make_unique<X509Set>();
     return;
   }
 
   // Parse certificates from the array
-  std::unique_ptr<std::vector<X509*>> certs =
-      std::make_unique<std::vector<X509*>>();
+  auto certs = std::make_unique<std::vector<ncrypto::X509Pointer>>();
   if (!ArrayOfStringsToX509s(context, cert_array, certs.get())) {
     // Error already thrown by ArrayOfStringsToX509s
     return;
@@ -1296,34 +1268,23 @@ void ResetRootCertStore(const FunctionCallbackInfo<Value>& args) {
   }
 
   auto new_set = std::make_unique<X509Set>();
-  for (X509* cert : *certs) {
-    auto [it, inserted] = new_set->insert(cert);
-    if (!inserted) {  // Free duplicate certificates from the vector.
-      X509_free(cert);
-    }
-  }
-
-  // Free any existing certificates in the old set.
-  if (root_certs_from_users != nullptr) {
-    for (X509* cert : *root_certs_from_users) {
-      X509_free(cert);
-    }
+  for (auto& cert : *certs) {
+    new_set->insert(std::move(cert));
+    // Duplicates are freed automatically when the moved-from pointer
+    // is not consumed by insert (element already exists).
   }
-  std::swap(root_certs_from_users, new_set);
 
-  // Reset the global root cert store and create a new one with the
-  // certificates.
-  if (root_cert_store != nullptr) {
-    X509_STORE_free(root_cert_store);
-  }
+  root_certs_from_users = std::move(new_set);
 
-  root_cert_store = nullptr;
+  // Reset the global root cert store so it will be recreated with the
+  // new certificates.
+  root_cert_store.reset();
 }
 
 void GetSystemCACertificates(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   Local<Array> results;
-  std::vector<X509*>& certs = GetSystemStoreCACertificates();
+  auto& certs = GetSystemStoreCACertificates();
   if (X509sToArrayOfStrings(env, certs.begin(), certs.end(), certs.size())
           .ToLocal(&results)) {
     args.GetReturnValue().Set(results);
@@ -1336,7 +1297,7 @@ void GetExtraCACertificates(const FunctionCallbackInfo<Value>& args) {
     return args.GetReturnValue().Set(Array::New(env->isolate()));
   }
   Local<Array> results;
-  std::vector<X509*>& certs = GetExtraCACertificates();
+  auto& certs = GetExtraCACertificates();
   if (X509sToArrayOfStrings(env, certs.begin(), certs.end(), certs.size())
           .ToLocal(&results)) {
     args.GetReturnValue().Set(results);
@@ -1689,14 +1650,6 @@ void SecureContext::SetNewSessionCallback(NewSessionCb cb) {
   SSL_CTX_sess_set_new_cb(ctx_.get(), cb);
 }
 
-void SecureContext::SetClientHelloCallback(ClientHelloCb cb) {
-#ifdef OPENSSL_IS_BORINGSSL
-  SSL_CTX_set_select_certificate_cb(ctx_.get(), cb);
-#else
-  SSL_CTX_set_client_hello_cb(ctx_.get(), cb, nullptr);
-#endif
-}
-
 void SecureContext::SetGetSessionCallback(GetSessionCb cb) {
   SSL_CTX_sess_set_get_cb(ctx_.get(), cb);
 }
@@ -1739,22 +1692,14 @@ void SecureContext::SetKey(const FunctionCallbackInfo<Value>& args) {
   ByteSource passphrase;
   if (args[1]->IsString())
     passphrase = ByteSource::FromString(env, args[1].As<String>());
-  // This redirection is necessary because the PasswordCallback expects a
-  // pointer to a pointer to the passphrase ByteSource to allow passing in
-  // const ByteSources.
-  const ByteSource* pass_ptr = &passphrase;
-
-  EVPKeyPointer key(
-      PEM_read_bio_PrivateKey(bio.get(),
-                              nullptr,
-                              PasswordCallback,
-                              &pass_ptr));
-
-  if (!key)
-    return ThrowCryptoError(env, ERR_get_error(), "PEM_read_bio_PrivateKey");
-
-  if (!SSL_CTX_use_PrivateKey(sc->ctx_.get(), key.get()))
-    return ThrowCryptoError(env, ERR_get_error(), "SSL_CTX_use_PrivateKey");
+  switch (UsePrivateKey(sc->ctx_.get(), bio, &passphrase)) {
+    case PrivateKeyResult::kSuccess:
+      break;
+    case PrivateKeyResult::kParseError:
+      return ThrowCryptoError(env, ERR_get_error(), "PEM_read_bio_PrivateKey");
+    case PrivateKeyResult::kApplyError:
+      return ThrowCryptoError(env, ERR_get_error(), "SSL_CTX_use_PrivateKey");
+  }
 }
 
 void SecureContext::SetSigalgs(const FunctionCallbackInfo<Value>& args) {
@@ -1857,16 +1802,7 @@ void SecureContext::SetX509StoreFlag(unsigned long flags) {
 }
 
 X509_STORE* SecureContext::GetCertStoreOwnedByThisSecureContext() {
-  Environment* env = this->env();
-  if (own_cert_store_cache_ != nullptr) return own_cert_store_cache_;
-
-  X509_STORE* cert_store = SSL_CTX_get_cert_store(ctx_.get());
-  if (cert_store == GetOrCreateRootCertStore(env)) {
-    cert_store = NewRootCertStore(env);
-    SSL_CTX_set_cert_store(ctx_.get(), cert_store);
-  }
-
-  return own_cert_store_cache_ = cert_store;
+  return GetOrCreateOwnedCertStore(env(), ctx_.get(), &own_cert_store_cache_);
 }
 
 void SecureContext::SetAllowPartialTrustChain(
@@ -1878,13 +1814,7 @@ void SecureContext::SetAllowPartialTrustChain(
 
 void SecureContext::SetCACert(const BIOPointer& bio) {
   ClearErrorOnReturn clear_error_on_return;
-  if (!bio) return;
-  while (X509Pointer x509 = X509Pointer(PEM_read_bio_X509_AUX(
-             bio.get(), nullptr, NoPasswordCallback, nullptr))) {
-    CHECK_EQ(1,
-             X509_STORE_add_cert(GetCertStoreOwnedByThisSecureContext(), x509));
-    CHECK_EQ(1, SSL_CTX_add_client_CA(ctx_.get(), x509));
-  }
+  AddCACertificates(env(), ctx_.get(), bio, &own_cert_store_cache_);
 }
 
 void SecureContext::AddCACert(const FunctionCallbackInfo<Value>& args) {
@@ -1904,20 +1834,11 @@ Maybe<void> SecureContext::SetCRL(Environment* env, const BIOPointer& bio) {
   // TODO(tniessen): this should be checked by the caller and not treated as ok
   if (!bio) return JustVoid();
 
-  DeleteFnPtr<X509_CRL, X509_CRL_free> crl(
-      PEM_read_bio_X509_CRL(bio.get(), nullptr, NoPasswordCallback, nullptr));
-
-  if (!crl) {
+  if (!crypto::AddCRL(env, ctx_.get(), bio, &own_cert_store_cache_)) {
     THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to parse CRL");
     return Nothing<void>();
   }
 
-  X509_STORE* cert_store = GetCertStoreOwnedByThisSecureContext();
-
-  CHECK_EQ(1, X509_STORE_add_crl(cert_store, crl.get()));
-  CHECK_EQ(1,
-           X509_STORE_set_flags(
-               cert_store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL));
   return JustVoid();
 }
 
@@ -1935,12 +1856,7 @@ void SecureContext::AddCRL(const FunctionCallbackInfo<Value>& args) {
 
 void SecureContext::SetRootCerts() {
   ClearErrorOnReturn clear_error_on_return;
-  Environment* env = this->env();
-  auto store = GetOrCreateRootCertStore(env);
-
-  // Increment reference count so global store is not deleted along with CTX.
-  X509_STORE_up_ref(store);
-  SSL_CTX_set_cert_store(ctx_.get(), store);
+  UseDefaultRootCertStore(env(), ctx_.get());
 }
 
 void SecureContext::AddRootCerts(const FunctionCallbackInfo<Value>& args) {
@@ -2583,9 +2499,11 @@ int SecureContext::TicketKeyCallback(SSL* ssl,
 
   ArrayBufferViewContents<unsigned char> aes_key(aes.As<ArrayBufferView>());
   if (enc) {
-    EVP_EncryptInit_ex(ectx, Cipher::AES_128_CBC, nullptr, aes_key.data(), iv);
+    EVP_EncryptInit_ex(
+        ectx, Cipher::AES_128_CBC(), nullptr, aes_key.data(), iv);
   } else {
-    EVP_DecryptInit_ex(ectx, Cipher::AES_128_CBC, nullptr, aes_key.data(), iv);
+    EVP_DecryptInit_ex(
+        ectx, Cipher::AES_128_CBC(), nullptr, aes_key.data(), iv);
   }
 
   return r;
@@ -2608,7 +2526,8 @@ int SecureContext::TicketCompatibilityCallback(SSL* ssl,
     memcpy(name, sc->ticket_key_name_, sizeof(sc->ticket_key_name_));
     if (!ncrypto::CSPRNG(iv, 16) ||
         EVP_EncryptInit_ex(
-            ectx, Cipher::AES_128_CBC, nullptr, sc->ticket_key_aes_, iv) <= 0 ||
+            ectx, Cipher::AES_128_CBC(), nullptr, sc->ticket_key_aes_, iv) <=
+            0 ||
         !InitTicketHmac(
             hctx, sc->ticket_key_hmac_, sizeof(sc->ticket_key_hmac_))) {
       return -1;
@@ -2622,7 +2541,7 @@ int SecureContext::TicketCompatibilityCallback(SSL* ssl,
   }
 
   if (EVP_DecryptInit_ex(
-          ectx, Cipher::AES_128_CBC, nullptr, sc->ticket_key_aes_, iv) <= 0 ||
+          ectx, Cipher::AES_128_CBC(), nullptr, sc->ticket_key_aes_, iv) <= 0 ||
       !InitTicketHmac(
           hctx, sc->ticket_key_hmac_, sizeof(sc->ticket_key_hmac_))) {
     return -1;
diff --git a/src/crypto/crypto_context.h b/src/crypto/crypto_context.h
index c65f553e40fd..73aff5b628a1 100644
--- a/src/crypto/crypto_context.h
+++ b/src/crypto/crypto_context.h
@@ -35,11 +35,6 @@ class SecureContext final : public BaseObject {
   using KeylogCb = void (*)(const SSL*, const char*);
   using NewSessionCb = int (*)(SSL*, SSL_SESSION*);
   using SelectSNIContextCb = int (*)(SSL*, int*, void*);
-#ifdef OPENSSL_IS_BORINGSSL
-  using ClientHelloCb = ssl_select_cert_result_t (*)(const SSL_CLIENT_HELLO*);
-#else
-  using ClientHelloCb = int (*)(SSL*, int*, void*);
-#endif
 
   ~SecureContext() override;
 
@@ -79,7 +74,6 @@ class SecureContext final : public BaseObject {
 
   ncrypto::SSLPointer CreateSSL();
 
-  void SetClientHelloCallback(ClientHelloCb cb);
   void SetGetSessionCallback(GetSessionCb cb);
   void SetKeylogCallback(KeylogCb cb);
   void SetNewSessionCallback(NewSessionCb cb);
@@ -207,11 +201,6 @@ class SecureContext final : public BaseObject {
 #endif
 };
 
-int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
-                                  ncrypto::BIOPointer&& in,
-                                  ncrypto::X509Pointer* cert,
-                                  ncrypto::X509Pointer* issuer);
-
 }  // namespace crypto
 }  // namespace node
 
diff --git a/src/crypto/crypto_ec.cc b/src/crypto/crypto_ec.cc
index b08d4b7a9106..d6920c8b30e2 100644
--- a/src/crypto/crypto_ec.cc
+++ b/src/crypto/crypto_ec.cc
@@ -134,9 +134,12 @@ void ECDH::GenerateKeys(const FunctionCallbackInfo<Value>& args) {
   ECDH* ecdh;
   ASSIGN_OR_RETURN_UNWRAP(&ecdh, args.This());
 
+  const uint64_t generation = ncrypto::getFipsStateGeneration();
+  ecdh->has_valid_key_pair_ = false;
   if (!ecdh->key_.generate()) {
     return THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to generate key");
   }
+  ecdh->MaybeCacheValidKeyPair(generation);
 }
 
 ECPointPointer ECDH::BufferToPoint(Environment* env,
@@ -307,6 +310,7 @@ void ECDH::SetPrivateKey(const FunctionCallbackInfo<Value>& args) {
 
   ecdh->key_ = std::move(new_key);
   ecdh->group_ = ecdh->key_.getGroup();
+  ecdh->has_valid_key_pair_ = false;
 }
 
 void ECDH::SetPublicKey(const FunctionCallbackInfo<Value>& args) {
@@ -325,6 +329,7 @@ void ECDH::SetPublicKey(const FunctionCallbackInfo<Value>& args) {
         "Failed to convert Buffer to EC_POINT");
   }
 
+  ecdh->has_valid_key_pair_ = false;
   if (!ecdh->key_.setPublicKey(pub)) {
     return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
         "Failed to set EC_POINT as the public key");
@@ -345,9 +350,22 @@ bool ECDH::IsKeyValidForCurve(const BignumPointer& private_key) {
          private_key < order;
 }
 
+void ECDH::MaybeCacheValidKeyPair(uint64_t generation) {
+  has_valid_key_pair_ = generation == ncrypto::getFipsStateGeneration();
+  if (has_valid_key_pair_) valid_key_pair_generation_ = generation;
+}
+
 bool ECDH::IsKeyPairValid() {
+  const uint64_t generation = ncrypto::getFipsStateGeneration();
+  if (has_valid_key_pair_ && valid_key_pair_generation_ == generation) {
+    return true;
+  }
+  has_valid_key_pair_ = false;
+
   MarkPopErrorOnReturn mark_pop_error_on_return;
-  return key_.checkKey();
+  const bool is_valid = key_.checkKey();
+  if (is_valid) MaybeCacheValidKeyPair(generation);
+  return is_valid;
 }
 
 // Convert the input public key to compressed, uncompressed, or hybrid formats.
diff --git a/src/crypto/crypto_ec.h b/src/crypto/crypto_ec.h
index 9bc817f3d7f5..3e83d541d7ae 100644
--- a/src/crypto/crypto_ec.h
+++ b/src/crypto/crypto_ec.h
@@ -48,11 +48,14 @@ class ECDH final : public BaseObject {
   static void GetPublicKey(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetPublicKey(const v8::FunctionCallbackInfo<v8::Value>& args);
 
+  void MaybeCacheValidKeyPair(uint64_t generation);
   bool IsKeyPairValid();
   bool IsKeyValidForCurve(const ncrypto::BignumPointer& private_key);
 
   ncrypto::ECKeyPointer key_;
   const EC_GROUP* group_;
+  bool has_valid_key_pair_ = false;
+  uint64_t valid_key_pair_generation_ = 0;
 };
 
 struct EcKeyPairParams final : public MemoryRetainer {
diff --git a/src/crypto/crypto_hash.cc b/src/crypto/crypto_hash.cc
index a932b0755a0a..185c354db711 100644
--- a/src/crypto/crypto_hash.cc
+++ b/src/crypto/crypto_hash.cc
@@ -79,59 +79,100 @@ constexpr BoringSSLDigest kBoringSSLDigests[] = {
 };
 #endif
 
-#if OPENSSL_VERSION_MAJOR >= 3
-void PushAliases(const char* name, void* data) {
-  static_cast<std::vector<std::string>*>(data)->push_back(name);
+void ResetHashCache(Environment* env,
+                    uint64_t generation,
+                    Local<Object> algorithm_cache = Local<Object>()) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  ncrypto::DigestCache* cache = env->provider_digest_cache.get();
+  CHECK_NOT_NULL(cache);
+  if (!algorithm_cache.IsEmpty()) {
+    Isolate* isolate = env->isolate();
+    Local<Context> context = isolate->GetCurrentContext();
+    for (const auto& entry : cache->aliases()) {
+      if (algorithm_cache
+              ->Set(context,
+                    OneByteString(isolate, entry.first),
+                    Int32::New(isolate, -1))
+              .IsNothing()) {
+        return;
+      }
+    }
+  }
+  cache->reset(generation);
+#endif
+  env->supported_hash_algorithms.clear();
+  env->hash_cache_generation = generation;
 }
 
-EVP_MD* GetCachedMDByID(Environment* env, size_t id) {
-  CHECK_LT(id, env->evp_md_cache.size());
-  EVP_MD* result = env->evp_md_cache[id].get();
-  CHECK_NOT_NULL(result);
-  return result;
+bool SynchronizeHashCache(Environment* env,
+                          Local<Object> algorithm_cache = Local<Object>()) {
+  const uint64_t generation = ncrypto::getFipsStateGeneration();
+  if (env->hash_cache_generation == generation) return false;
+
+  ResetHashCache(env, generation, algorithm_cache);
+  return true;
+}
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+const EVP_MD* GetCachedMDByID(Environment* env,
+                              int32_t id,
+                              Local<Object> algorithm_cache = Local<Object>()) {
+  if (SynchronizeHashCache(env, algorithm_cache) ||
+      env->provider_digest_cache == nullptr) {
+    return nullptr;
+  }
+  return env->provider_digest_cache->lookup(id, env->hash_cache_generation)
+      .digest;
 }
 
 struct MaybeCachedMD {
-  EVP_MD* explicit_md = nullptr;
-  const EVP_MD* implicit_md = nullptr;
+  const EVP_MD* cached_md = nullptr;
+  ncrypto::Digest digest;
   int32_t cache_id = -1;
 };
 
-MaybeCachedMD FetchAndMaybeCacheMD(Environment* env, const char* search_name) {
-  const EVP_MD* implicit_md = ncrypto::getDigestByName(search_name);
-  if (!implicit_md) return {nullptr, nullptr, -1};
-
-  const char* real_name = EVP_MD_get0_name(implicit_md);
-  if (!real_name) return {nullptr, implicit_md, -1};
-
-  auto it = env->alias_to_md_id_map.find(real_name);
-  if (it != env->alias_to_md_id_map.end()) {
-    size_t id = it->second;
-    return {GetCachedMDByID(env, id), implicit_md, static_cast<int32_t>(id)};
+MaybeCachedMD FetchAndMaybeCacheMD(
+    Environment* env,
+    const char* search_name,
+    Local<Object> algorithm_cache = Local<Object>(),
+    const char* fetch_name = nullptr) {
+  SynchronizeHashCache(env, algorithm_cache);
+  if (env->isolate()->HasPendingException()) return {};
+  ncrypto::DigestCache* cache = env->provider_digest_cache.get();
+  CHECK_NOT_NULL(cache);
+  const uint64_t generation = env->hash_cache_generation;
+  const EVP_MD* legacy = nullptr;
+
+  if (auto cached = cache->lookup(search_name, generation);
+      cached.digest != nullptr) {
+    return {cached.digest, cached.digest, cached.id};
   }
 
-  // EVP_*_fetch() does not support alias names, so we need to pass it the
-  // real/original algorithm name.
-  // We use EVP_*_fetch() as a filter here because it will only return an
-  // instance if the algorithm is supported by the public OpenSSL APIs (some
-  // algorithms are used internally by OpenSSL and are also passed to this
-  // callback).
-  EVP_MD* explicit_md = EVP_MD_fetch(nullptr, real_name, nullptr);
-  if (!explicit_md) return {nullptr, implicit_md, -1};
+  if (fetch_name == nullptr) {
+    legacy = ncrypto::getDigestByName(search_name);
+    if (legacy != nullptr) {
+      if (legacy == EVP_md_null()) return {};
+      fetch_name = EVP_MD_get0_name(legacy);
+      if (fetch_name == nullptr) return {nullptr, legacy, -1};
+    } else {
+      fetch_name = search_name;
+    }
+  }
 
-  // Cache the EVP_MD* fetched.
-  env->evp_md_cache.emplace_back(explicit_md);
-  size_t id = env->evp_md_cache.size() - 1;
+  const ncrypto::Digest digest = ncrypto::Digest::Fetch(fetch_name);
+  if (!digest) {
+    return legacy == nullptr ? MaybeCachedMD{}
+                             : MaybeCachedMD{nullptr, legacy, -1};
+  }
 
-  // Add all the aliases to the map to speed up next lookup.
-  std::vector<std::string> aliases;
-  EVP_MD_names_do_all(explicit_md, PushAliases, &aliases);
-  for (const auto& alias : aliases) {
-    env->alias_to_md_id_map.emplace(alias, id);
+  if (generation == ncrypto::getFipsStateGeneration()) {
+    auto cached = cache->insert(search_name, digest.get(), generation);
+    if (cached.digest != nullptr) {
+      return {cached.digest, cached.digest, cached.id};
+    }
   }
-  env->alias_to_md_id_map.emplace(search_name, id);
 
-  return {explicit_md, implicit_md, static_cast<int32_t>(id)};
+  return {nullptr, digest, -1};
 }
 
 void SaveSupportedHashAlgorithmsAndCacheMD(const EVP_MD* md,
@@ -140,12 +181,57 @@ void SaveSupportedHashAlgorithmsAndCacheMD(const EVP_MD* md,
                                            void* arg) {
   if (!from) return;
   Environment* env = static_cast<Environment*>(arg);
-  auto result = FetchAndMaybeCacheMD(env, from);
-  if (result.explicit_md) {
+  const ncrypto::Digest legacy = ncrypto::Digest::FromName(from);
+  const char* canonical_name = legacy ? EVP_MD_get0_name(legacy) : nullptr;
+  if (canonical_name == nullptr) return;
+
+  auto result = FetchAndMaybeCacheMD(env, from, {}, canonical_name);
+  if (result.cached_md || result.digest) {
     env->supported_hash_algorithms.push_back(from);
   }
 }
 
+struct ProviderHashNameContext {
+  Environment* env;
+};
+
+void SaveSupportedProviderHashName(const char* name, void* arg) {
+  if (name == nullptr) return;
+
+  const std::string_view name_view(name);
+  const bool is_dotted_decimal =
+      name_view.find('.') != std::string_view::npos &&
+      std::all_of(name_view.begin(), name_view.end(), [](unsigned char c) {
+        return (c >= '0' && c <= '9') || c == '.';
+      });
+  if (is_dotted_decimal) return;
+
+  std::string normalized_name(name_view);
+  std::transform(normalized_name.begin(),
+                 normalized_name.end(),
+                 normalized_name.begin(),
+                 [](unsigned char c) {
+                   if (c >= 'A' && c <= 'Z') {
+                     return static_cast<char>(c + ('a' - 'A'));
+                   }
+                   return static_cast<char>(c);
+                 });
+
+  auto* context = static_cast<ProviderHashNameContext*>(arg);
+  auto result = FetchAndMaybeCacheMD(
+      context->env, normalized_name.c_str(), {}, normalized_name.c_str());
+  if (result.cached_md || result.digest) {
+    context->env->supported_hash_algorithms.push_back(normalized_name);
+  }
+}
+
+void SaveSupportedProviderHashAlgorithms(EVP_MD* md, void* arg) {
+  ProviderHashNameContext context = {
+      .env = static_cast<Environment*>(arg),
+  };
+  EVP_MD_names_do_all(md, SaveSupportedProviderHashName, &context);
+}
+
 #else
 void SaveSupportedHashAlgorithms(const EVP_MD* md,
                                  const char* from,
@@ -155,25 +241,34 @@ void SaveSupportedHashAlgorithms(const EVP_MD* md,
   Environment* env = static_cast<Environment*>(arg);
   env->supported_hash_algorithms.push_back(from);
 }
-#endif  // OPENSSL_VERSION_MAJOR >= 3
+#endif  // NCRYPTO_USE_OPENSSL3_PROVIDER
 
 const std::vector<std::string>& GetSupportedHashAlgorithms(Environment* env) {
-  if (env->supported_hash_algorithms.empty()) {
-    MarkPopErrorOnReturn mark_pop_error_on_return;
+  while (true) {
+    SynchronizeHashCache(env);
+    const uint64_t generation = env->hash_cache_generation;
+    if (env->supported_hash_algorithms.empty()) {
+      MarkPopErrorOnReturn mark_pop_error_on_return;
 #if NCRYPTO_USE_BORINGSSL_EVP_DO_ALL_FALLBACK
-    for (const auto& digest : kBoringSSLDigests) {
-      static_cast<void>(digest.get);
-      env->supported_hash_algorithms.emplace_back(digest.name);
-    }
-#elif OPENSSL_VERSION_MAJOR >= 3
-    // Since we'll fetch the EVP_MD*, cache them along the way to speed up
-    // later lookups instead of throwing them away immediately.
-    EVP_MD_do_all_sorted(SaveSupportedHashAlgorithmsAndCacheMD, env);
+      for (const auto& digest : kBoringSSLDigests) {
+        static_cast<void>(digest.get);
+        env->supported_hash_algorithms.emplace_back(digest.name);
+      }
+#elif NCRYPTO_USE_OPENSSL3_PROVIDER
+      // Since we'll fetch the EVP_MD*, cache them along the way to speed up
+      // later lookups instead of throwing them away immediately.
+      EVP_MD_do_all_sorted(SaveSupportedHashAlgorithmsAndCacheMD, env);
+      EVP_MD_do_all_provided(nullptr, SaveSupportedProviderHashAlgorithms, env);
 #else
-    EVP_MD_do_all_sorted(SaveSupportedHashAlgorithms, env);
+      EVP_MD_do_all_sorted(SaveSupportedHashAlgorithms, env);
 #endif
+    }
+    const uint64_t current_generation = ncrypto::getFipsStateGeneration();
+    if (generation == current_generation) {
+      return env->supported_hash_algorithms;
+    }
+    ResetHashCache(env, current_generation);
   }
-  return env->supported_hash_algorithms;
 }
 
 void Hash::GetHashes(const FunctionCallbackInfo<Value>& args) {
@@ -191,18 +286,19 @@ void Hash::GetCachedAliases(const FunctionCallbackInfo<Value>& args) {
   Isolate* isolate = args.GetIsolate();
   Local<Context> context = args.GetIsolate()->GetCurrentContext();
   Environment* env = Environment::GetCurrent(context);
-  size_t size = env->alias_to_md_id_map.size();
+  SynchronizeHashCache(env);
+  size_t size = 0;
   LocalVector<Name> names(isolate);
   LocalVector<Value> values(isolate);
-#if OPENSSL_VERSION_MAJOR >= 3
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  const auto& aliases = env->provider_digest_cache->aliases();
+  size = aliases.size();
   names.reserve(size);
   values.reserve(size);
-  for (auto& [alias, id] : env->alias_to_md_id_map) {
+  for (const auto& [alias, id] : aliases) {
     names.push_back(OneByteString(isolate, alias));
-    values.push_back(Uint32::New(isolate, id));
+    values.push_back(Int32::New(isolate, id));
   }
-#else
-  CHECK(env->alias_to_md_id_map.empty());
 #endif
   Local<Value> prototype = Null(isolate);
   Local<Object> result =
@@ -210,18 +306,24 @@ void Hash::GetCachedAliases(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(result);
 }
 
-const EVP_MD* GetDigestImplementation(Environment* env,
-                                      Local<Value> algorithm,
-                                      Local<Value> cache_id_val,
-                                      Local<Value> algorithm_cache) {
+const EVP_MD* GetDigestImplementation(
+    Environment* env,
+    Local<Value> algorithm,
+    Local<Value> cache_id_val,
+    Local<Value> algorithm_cache,
+    std::optional<ncrypto::Digest>& digest_owner) {
   CHECK(algorithm->IsString());
   CHECK(cache_id_val->IsInt32());
   CHECK(algorithm_cache->IsObject());
+  DCHECK(!digest_owner.has_value());
 
-#if OPENSSL_VERSION_MAJOR >= 3
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  Local<Object> cache = algorithm_cache.As<Object>();
   int32_t cache_id = cache_id_val.As<Int32>()->Value();
-  if (cache_id != -1) {  // Alias already cached, return the cached EVP_MD*.
-    return GetCachedMDByID(env, cache_id);
+  if (cache_id != -1) {
+    // Alias already cached, return the cached EVP_MD*.
+    if (const EVP_MD* md = GetCachedMDByID(env, cache_id, cache)) return md;
+    if (env->isolate()->HasPendingException()) return nullptr;
   }
 
   // Only decode the algorithm when we don't have it cached to avoid
@@ -229,11 +331,11 @@ const EVP_MD* GetDigestImplementation(Environment* env,
   Isolate* isolate = env->isolate();
   Utf8Value utf8(isolate, algorithm);
 
-  auto result = FetchAndMaybeCacheMD(env, *utf8);
+  auto result = FetchAndMaybeCacheMD(env, *utf8, cache);
+  if (env->isolate()->HasPendingException()) return nullptr;
   if (result.cache_id != -1) {
-    // Add the alias to both C++ side and JS side to speedup the lookup
-    // next time.
-    env->alias_to_md_id_map.emplace(*utf8, result.cache_id);
+    // Add the alias to the JavaScript side to speed up the next lookup. The
+    // native cache added it while inserting the implementation.
     if (algorithm_cache.As<Object>()
             ->Set(isolate->GetCurrentContext(),
                   algorithm,
@@ -243,7 +345,12 @@ const EVP_MD* GetDigestImplementation(Environment* env,
     }
   }
 
-  return result.explicit_md ? result.explicit_md : result.implicit_md;
+  if (result.cached_md != nullptr) return result.cached_md;
+  if (result.digest) {
+    digest_owner.emplace(result.digest);
+    return digest_owner->get();
+  }
+  return nullptr;
 #else
   Utf8Value utf8(env->isolate(), algorithm);
   return ncrypto::getDigestByName(*utf8);
@@ -257,21 +364,12 @@ void MarkInvalidXofLength() {
   EVPerr(EVP_F_EVP_DIGESTFINALXOF, EVP_R_NOT_XOF_OR_INVALID_LENGTH);
 #endif
 }
-// crypto.digest(algorithm, algorithmId, algorithmCache,
-//               input, outputEncoding, outputEncodingId, outputLength)
-void Hash::OneShotDigest(const FunctionCallbackInfo<Value>& args) {
-  Environment* env = Environment::GetCurrent(args);
-  Isolate* isolate = env->isolate();
-  CHECK_EQ(args.Length(), 7);
-  CHECK(args[0]->IsString());                                  // algorithm
-  CHECK(args[1]->IsInt32());                                   // algorithmId
-  CHECK(args[2]->IsObject());                                  // algorithmCache
-  CHECK(args[3]->IsString() || args[3]->IsArrayBufferView());  // input
-  CHECK(args[4]->IsString());                                  // outputEncoding
-  CHECK(args[5]->IsUint32() || args[5]->IsUndefined());  // outputEncodingId
-  CHECK(args[6]->IsUint32() || args[6]->IsUndefined());  // outputLength
 
-  const EVP_MD* md = GetDigestImplementation(env, args[0], args[1], args[2]);
+void OneShotDigestWithMD(Environment* env,
+                         const FunctionCallbackInfo<Value>& args,
+                         const EVP_MD* md,
+                         const CShakeOptions* options) {
+  Isolate* isolate = env->isolate();
   if (md == nullptr) [[unlikely]] {
     Utf8Value method(isolate, args[0]);
     std::string message =
@@ -313,7 +411,7 @@ void Hash::OneShotDigest(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
-  if (output_length == 0) {
+  auto return_empty_output = [&]() {
     if (output_enc == BUFFER) {
       Local<Uint8Array> u8;
       if (Buffer::New(isolate, ArrayBuffer::New(isolate, 0), 0, 0)
@@ -323,28 +421,72 @@ void Hash::OneShotDigest(const FunctionCallbackInfo<Value>& args) {
     } else {
       args.GetReturnValue().Set(String::Empty(isolate));
     }
+  };
+
+  const bool has_digest_options = options != nullptr && !options->empty();
+  if (output_length == 0 && !has_digest_options) {
+    return return_empty_output();
+  }
+
+  if (!has_digest_options) {
+    DataPointer output = ([&]() -> DataPointer {
+      if (args[3]->IsString()) {
+        Utf8Value utf8(isolate, args[3]);
+        ncrypto::Buffer<const unsigned char> input = {
+            .data = reinterpret_cast<const unsigned char*>(utf8.out()),
+            .len = static_cast<size_t>(utf8.length()),
+        };
+        return is_xof ? ncrypto::xofHashDigest(input, md, output_length)
+                      : ncrypto::hashDigest(input, md);
+      }
+
+      ArrayBufferViewContents<unsigned char> input(args[3]);
+      ncrypto::Buffer<const unsigned char> buffer = {
+          .data = input.data(),
+          .len = input.length(),
+      };
+      return is_xof ? ncrypto::xofHashDigest(buffer, md, output_length)
+                    : ncrypto::hashDigest(buffer, md);
+    })();
+    if (!output) [[unlikely]] {
+      return ThrowCryptoError(env, ERR_get_error());
+    }
+
+    Local<Value> ret;
+    if (StringBytes::Encode(env->isolate(),
+                            static_cast<const char*>(output.get()),
+                            output.size(),
+                            output_enc)
+            .ToLocal(&ret)) {
+      args.GetReturnValue().Set(ret);
+    }
     return;
   }
 
-  DataPointer output = ([&]() -> DataPointer {
+  EVPMDCtxPointer ctx = EVPMDCtxPointer::New();
+  if (!options->Initialize(&ctx, md)) {
+    return ThrowCryptoError(
+        env, ERR_get_error(), "Digest options are not supported");
+  }
+
+  const bool updated = [&]() {
     if (args[3]->IsString()) {
-      Utf8Value utf8(isolate, args[3]);
-      ncrypto::Buffer<const unsigned char> buf = {
-          .data = reinterpret_cast<const unsigned char*>(utf8.out()),
-          .len = utf8.length(),
-      };
-      return is_xof ? ncrypto::xofHashDigest(buf, md, output_length)
-                    : ncrypto::hashDigest(buf, md);
+      Utf8Value input(isolate, args[3]);
+      return ctx.digestUpdate(ncrypto::Buffer<const void>{
+          .data = input.out(),
+          .len = static_cast<size_t>(input.length()),
+      });
     }
 
     ArrayBufferViewContents<unsigned char> input(args[3]);
-    ncrypto::Buffer<const unsigned char> buf = {
-        .data = reinterpret_cast<const unsigned char*>(input.data()),
+    return ctx.digestUpdate(ncrypto::Buffer<const void>{
+        .data = input.data(),
         .len = input.length(),
-    };
-    return is_xof ? ncrypto::xofHashDigest(buf, md, output_length)
-                  : ncrypto::hashDigest(buf, md);
-  })();
+    });
+  }();
+  if (!updated) return ThrowCryptoError(env, ERR_get_error());
+  if (output_length == 0) return return_empty_output();
+  DataPointer output = ctx.digestFinal(output_length);
 
   if (!output) [[unlikely]] {
     return ThrowCryptoError(env, ERR_get_error());
@@ -360,6 +502,54 @@ void Hash::OneShotDigest(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+// crypto.digest(algorithm, algorithmId, algorithmCache, input, outputEncoding,
+//               outputEncodingId, outputLength[, functionName, customization])
+void Hash::OneShotDigest(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK(args.Length() == 7 || args.Length() == 9);
+  CHECK(args[0]->IsString());                                  // algorithm
+  CHECK(args[1]->IsInt32());                                   // algorithmId
+  CHECK(args[2]->IsObject());                                  // algorithmCache
+  CHECK(args[3]->IsString() || args[3]->IsArrayBufferView());  // input
+  CHECK(args[4]->IsString());                                  // outputEncoding
+  CHECK(args[5]->IsUint32() || args[5]->IsUndefined());  // outputEncodingId
+  CHECK(args[6]->IsUint32() || args[6]->IsUndefined());  // outputLength
+
+  if (args.Length() == 7) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    const int32_t cache_id = args[1].As<Int32>()->Value();
+    if (cache_id != -1) {
+      if (const EVP_MD* md =
+              GetCachedMDByID(env, cache_id, args[2].As<Object>())) {
+        return OneShotDigestWithMD(env, args, md, nullptr);
+      }
+      if (env->isolate()->HasPendingException()) return;
+    }
+#else
+    Utf8Value utf8(env->isolate(), args[0]);
+    return OneShotDigestWithMD(
+        env, args, ncrypto::getDigestByName(*utf8), nullptr);
+#endif
+  }
+
+  if (args.Length() == 9) {
+    CShakeOptions options;
+    if (GetCShakeOptions(args, 7, &options).IsNothing()) return;
+
+    std::optional<ncrypto::Digest> digest_owner;
+    const EVP_MD* md =
+        GetDigestImplementation(env, args[0], args[1], args[2], digest_owner);
+    if (env->isolate()->HasPendingException()) return;
+    return OneShotDigestWithMD(env, args, md, &options);
+  }
+
+  std::optional<ncrypto::Digest> digest_owner;
+  const EVP_MD* md =
+      GetDigestImplementation(env, args[0], args[1], args[2], digest_owner);
+  if (env->isolate()->HasPendingException()) return;
+  OneShotDigestWithMD(env, args, md, nullptr);
+}
+
 void Hash::Initialize(Environment* env, Local<Object> target) {
   Isolate* isolate = env->isolate();
   Local<Context> context = env->context();
@@ -396,30 +586,64 @@ void Hash::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
 #endif
 }
 
-// new Hash(algorithm, algorithmId, xofLen, algorithmCache)
+// new Hash(algorithm, xofLen, algorithmId, algorithmCache[, functionName,
+//          customization])
 void Hash::New(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
+  CHECK(args.Length() == 4 || args.Length() == 6);
+
+  Maybe<unsigned int> xof_md_len = Nothing<unsigned int>();
+  if (!args[1]->IsUndefined()) {
+    CHECK(args[1]->IsUint32());
+    xof_md_len = Just<unsigned int>(args[1].As<Uint32>()->Value());
+  }
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  // This is the common path after the first lookup. Avoid constructing a
+  // digest owner when the Environment already owns the cached implementation.
+  if (args.Length() == 4 && args[0]->IsString()) {
+    CHECK(args[2]->IsInt32());
+    const int32_t cache_id = args[2].As<Int32>()->Value();
+    if (cache_id != -1) {
+      if (const EVP_MD* md =
+              GetCachedMDByID(env, cache_id, args[3].As<Object>())) {
+        Hash* hash = new Hash(env, args.This());
+        if (!hash->HashInit(md, xof_md_len)) {
+          return ThrowCryptoError(
+              env, ERR_get_error(), "Digest method not supported");
+        }
+        return;
+      }
+      if (env->isolate()->HasPendingException()) return;
+    }
+  }
+#endif
 
   const Hash* orig = nullptr;
+  std::optional<ncrypto::Digest> digest_owner;
   const EVP_MD* md = nullptr;
   if (args[0]->IsObject()) {
     ASSIGN_OR_RETURN_UNWRAP(&orig, args[0].As<Object>());
     CHECK_NOT_NULL(orig);
     md = orig->mdctx_.getDigest();
   } else {
-    md = GetDigestImplementation(env, args[0], args[2], args[3]);
-  }
-
-  Maybe<unsigned int> xof_md_len = Nothing<unsigned int>();
-  if (!args[1]->IsUndefined()) {
-    CHECK(args[1]->IsUint32());
-    xof_md_len = Just<unsigned int>(args[1].As<Uint32>()->Value());
+    md = GetDigestImplementation(env, args[0], args[2], args[3], digest_owner);
+    if (env->isolate()->HasPendingException()) return;
   }
 
   Hash* hash = new Hash(env, args.This());
-  if (md == nullptr || !hash->HashInit(md, xof_md_len)) {
-    return ThrowCryptoError(env, ERR_get_error(),
-                            "Digest method not supported");
+  if (args.Length() == 4) {
+    if (md == nullptr || !hash->HashInit(md, xof_md_len)) {
+      return ThrowCryptoError(
+          env, ERR_get_error(), "Digest method not supported");
+    }
+  } else {
+    CShakeOptions options;
+    if (GetCShakeOptions(args, 4, &options).IsNothing()) return;
+    if (md == nullptr || !hash->HashInit(md, options, xof_md_len)) {
+      return ThrowCryptoError(
+          env, ERR_get_error(), "Digest method not supported");
+    }
   }
 
   if (orig != nullptr && !orig->mdctx_.copyTo(hash->mdctx_)) {
@@ -427,9 +651,9 @@ void Hash::New(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
-bool Hash::HashInit(const EVP_MD* md, Maybe<unsigned int> xof_md_len) {
+bool Hash::HashInit(const EVP_MD* digest, Maybe<unsigned int> xof_md_len) {
   mdctx_ = EVPMDCtxPointer::New();
-  if (!mdctx_.digestInit(md)) [[unlikely]] {
+  if (!mdctx_.digestInit(digest)) [[unlikely]] {
     mdctx_.reset();
     return false;
   }
@@ -440,7 +664,7 @@ bool Hash::HashInit(const EVP_MD* md, Maybe<unsigned int> xof_md_len) {
   // default lengths
   // TODO(@panva): remove this behaviour when DEP0198 is End-Of-Life
   if (mdctx_.hasXofFlag() && !xof_md_len.IsJust() && md_len_ == 0) {
-    const char* name = OBJ_nid2sn(EVP_MD_type(md));
+    const char* name = OBJ_nid2sn(EVP_MD_type(digest));
     if (name != nullptr) {
       if (strcmp(name, "SHAKE128") == 0) {
         md_len_ = 16;
@@ -464,6 +688,30 @@ bool Hash::HashInit(const EVP_MD* md, Maybe<unsigned int> xof_md_len) {
   return true;
 }
 
+bool Hash::HashInit(const EVP_MD* digest,
+                    const CShakeOptions& options,
+                    Maybe<unsigned int> xof_md_len) {
+  mdctx_ = EVPMDCtxPointer::New();
+  if (!options.Initialize(&mdctx_, digest)) [[unlikely]] {
+    mdctx_.reset();
+    return false;
+  }
+
+  md_len_ = mdctx_.getDigestSize();
+  if (xof_md_len.IsJust() && xof_md_len.FromJust() != md_len_) {
+    // This is a little hack to cause createHash to fail when an incorrect
+    // hashSize option was passed for a non-XOF hash function.
+    if (!mdctx_.hasXofFlag()) [[unlikely]] {
+      MarkInvalidXofLength();
+      mdctx_.reset();
+      return false;
+    }
+    md_len_ = xof_md_len.FromJust();
+  }
+
+  return true;
+}
+
 bool Hash::HashUpdate(const char* data, size_t len) {
   if (!mdctx_) return false;
   return mdctx_.digestUpdate(ncrypto::Buffer<const void>{
@@ -528,7 +776,10 @@ void Hash::HashDigest(const FunctionCallbackInfo<Value>& args) {
 }
 
 HashConfig::HashConfig(HashConfig&& other) noexcept
-    : in(std::move(other.in)), digest(other.digest), length(other.length) {}
+    : in(std::move(other.in)),
+      digest(other.digest),
+      options(std::move(other.options)),
+      length(other.length) {}
 
 HashConfig& HashConfig::operator=(HashConfig&& other) noexcept {
   if (&other == this) return *this;
@@ -538,6 +789,9 @@ HashConfig& HashConfig::operator=(HashConfig&& other) noexcept {
 
 void HashConfig::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TraitTrackInline(in, "in");
+  if (options.has_value()) {
+    tracker->TrackField("options", *options);
+  }
 }
 
 MaybeLocal<Value> HashTraits::EncodeOutput(Environment* env,
@@ -555,8 +809,8 @@ Maybe<void> HashTraits::AdditionalConfig(
 
   CHECK(args[offset]->IsString());  // Hash algorithm
   Utf8Value digest(env->isolate(), args[offset]);
-  params->digest = ncrypto::getDigestByName(*digest);
-  if (params->digest == nullptr) [[unlikely]] {
+  params->digest = ncrypto::Digest::FromName(*digest);
+  if (!params->digest) [[unlikely]] {
     THROW_ERR_CRYPTO_INVALID_DIGEST(env, "Invalid digest: %s", digest);
     return Nothing<void>();
   }
@@ -568,7 +822,14 @@ Maybe<void> HashTraits::AdditionalConfig(
   }
   params->in = IsCryptoJobAsync(mode) ? data.ToCopy() : data.ToByteSource();
 
-  unsigned int expected = EVP_MD_size(params->digest);
+  if (static_cast<unsigned int>(args.Length()) > offset + 3) {
+    params->options.emplace();
+    if (GetCShakeOptions(args, offset + 3, &*params->options).IsNothing()) {
+      return Nothing<void>();
+    }
+  }
+
+  unsigned int expected = EVP_MD_size(params->digest.get());
   params->length = expected;
   if (args[offset + 2]->IsUint32()) [[unlikely]] {
     // length is expressed in terms of bits
@@ -576,7 +837,8 @@ Maybe<void> HashTraits::AdditionalConfig(
         static_cast<uint32_t>(args[offset + 2].As<Uint32>()->Value()) /
         CHAR_BIT;
     if (params->length != expected) {
-      if ((EVP_MD_flags(params->digest) & EVP_MD_FLAG_XOF) == 0) [[unlikely]] {
+      if ((EVP_MD_flags(params->digest.get()) & EVP_MD_FLAG_XOF) == 0)
+          [[unlikely]] {
         THROW_ERR_CRYPTO_INVALID_DIGEST(env, "Digest method not supported");
         return Nothing<void>();
       }
@@ -593,8 +855,11 @@ bool HashTraits::DeriveBits(Environment* env,
                             CryptoErrorStore* errors) {
   auto ctx = EVPMDCtxPointer::New();
 
-  if (!ctx.digestInit(params.digest) || !ctx.digestUpdate(params.in))
-      [[unlikely]] {
+  const bool initialized =
+      params.options.has_value()
+          ? params.options->Initialize(&ctx, params.digest.get())
+          : ctx.digestInit(params.digest.get());
+  if (!initialized || !ctx.digestUpdate(params.in)) [[unlikely]] {
     return false;
   }
 
diff --git a/src/crypto/crypto_hash.h b/src/crypto/crypto_hash.h
index 3ae6a16c2579..146e9cf55b52 100644
--- a/src/crypto/crypto_hash.h
+++ b/src/crypto/crypto_hash.h
@@ -21,7 +21,10 @@ class Hash final : public BaseObject {
   SET_MEMORY_INFO_NAME(Hash)
   SET_SELF_SIZE(Hash)
 
-  bool HashInit(const EVP_MD* md, v8::Maybe<unsigned int> xof_md_len);
+  bool HashInit(const EVP_MD* digest, v8::Maybe<unsigned int> xof_md_len);
+  bool HashInit(const EVP_MD* digest,
+                const CShakeOptions& options,
+                v8::Maybe<unsigned int> xof_md_len);
   bool HashUpdate(const char* data, size_t len);
 
   static void GetHashes(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -43,7 +46,8 @@ class Hash final : public BaseObject {
 
 struct HashConfig final : public MemoryRetainer {
   ByteSource in;
-  const EVP_MD* digest;
+  ncrypto::Digest digest;
+  std::optional<CShakeOptions> options;
   unsigned int length;
 
   HashConfig() = default;
diff --git a/src/crypto/crypto_hmac.cc b/src/crypto/crypto_hmac.cc
index 7b5fa8605f9b..541dfe7e7811 100644
--- a/src/crypto/crypto_hmac.cc
+++ b/src/crypto/crypto_hmac.cc
@@ -141,6 +141,9 @@ void Hmac::HmacDigest(const FunctionCallbackInfo<Value>& args) {
       return ThrowCryptoError(env, ERR_get_error(), "Failed to finalize HMAC");
     }
     hmac->ctx_.reset();
+  } else {
+    // The context has already been finalized; never emit unwritten bytes.
+    buf.len = 0;
   }
 
   Local<Value> ret;
diff --git a/src/crypto/crypto_keys.cc b/src/crypto/crypto_keys.cc
index b4e3aa72292f..2d80caf76661 100644
--- a/src/crypto/crypto_keys.cc
+++ b/src/crypto/crypto_keys.cc
@@ -1695,12 +1695,15 @@ void NativeKeyObject::Initialize(Environment* env, Local<Object> target) {
             NativeKeyObject::CreateNativeKeyObjectClass);
   SetMethod(
       env->context(), target, "getKeyObjectSlots", NativeKeyObject::GetSlots);
+  SetMethodNoSideEffect(
+      env->context(), target, "isKeyObject", NativeKeyObject::IsKeyObject);
 }
 
 void NativeKeyObject::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
   registry->Register(NativeKeyObject::CreateNativeKeyObjectClass);
   registry->Register(NativeKeyObject::GetSlots);
+  registry->Register(NativeKeyObject::IsKeyObject);
   registry->Register(NativeKeyObject::New);
 }
 
@@ -1709,6 +1712,12 @@ bool NativeKeyObject::HasInstance(Environment* env, Local<Value> value) {
   return !t.IsEmpty() && t->HasInstance(value);
 }
 
+void NativeKeyObject::IsKeyObject(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_EQ(args.Length(), 1);
+  args.GetReturnValue().Set(HasInstance(env, args[0]));
+}
+
 void NativeKeyObject::New(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   CHECK_EQ(args.Length(), 1);
@@ -1839,12 +1848,15 @@ void NativeCryptoKey::Initialize(Environment* env, Local<Object> target) {
             NativeCryptoKey::CreateCryptoKeyClass);
   SetMethod(
       env->context(), target, "getCryptoKeySlots", NativeCryptoKey::GetSlots);
+  SetMethodNoSideEffect(
+      env->context(), target, "isCryptoKey", NativeCryptoKey::IsCryptoKey);
 }
 
 void NativeCryptoKey::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
   registry->Register(NativeCryptoKey::CreateCryptoKeyClass);
   registry->Register(NativeCryptoKey::GetSlots);
+  registry->Register(NativeCryptoKey::IsCryptoKey);
   registry->Register(NativeCryptoKey::New);
 }
 
@@ -1861,6 +1873,12 @@ bool NativeCryptoKey::HasInstance(Environment* env, Local<Value> value) {
   return IsNativeCryptoKey(env, value);
 }
 
+void NativeCryptoKey::IsCryptoKey(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_EQ(args.Length(), 1);
+  args.GetReturnValue().Set(HasInstance(env, args[0]));
+}
+
 MaybeLocal<Value> NativeCryptoKey::Create(Environment* env,
                                           const KeyObjectData& data,
                                           Local<Value> algorithm,
diff --git a/src/crypto/crypto_keys.h b/src/crypto/crypto_keys.h
index b09756f719cf..8fffbec60467 100644
--- a/src/crypto/crypto_keys.h
+++ b/src/crypto/crypto_keys.h
@@ -209,6 +209,7 @@ class NativeKeyObject : public BaseObject {
   static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void CreateNativeKeyObjectClass(
       const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void IsKeyObject(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   // True if `value` is a real NativeKeyObject instance. Uses the
   // FunctionTemplate stored on the Environment as a brand check.
@@ -277,6 +278,7 @@ class NativeCryptoKey : public BaseObject {
   static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void CreateCryptoKeyClass(
       const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void IsCryptoKey(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   static v8::MaybeLocal<v8::Value> Create(Environment* env,
                                           const KeyObjectData& data,
diff --git a/src/crypto/crypto_mac.cc b/src/crypto/crypto_mac.cc
new file mode 100644
index 000000000000..7f43e760ccf7
--- /dev/null
+++ b/src/crypto/crypto_mac.cc
@@ -0,0 +1,656 @@
+#include "crypto/crypto_mac.h"
+#include "base_object-inl.h"
+#include "env-inl.h"
+#include "memory_tracker-inl.h"
+#include "node_buffer.h"
+#include "node_errors.h"
+#include "string_bytes.h"
+#include "v8.h"
+
+#if OPENSSL_WITH_EVP_MAC
+#include <openssl/core_names.h>
+#include <openssl/evp.h>
+#include <openssl/params.h>
+
+#include <algorithm>
+#include <array>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+#endif
+
+namespace node {
+
+using v8::Array;
+using v8::Context;
+using v8::FunctionCallbackInfo;
+using v8::FunctionTemplate;
+using v8::Int32;
+using v8::Isolate;
+using v8::Local;
+using v8::LocalVector;
+using v8::Name;
+using v8::Null;
+using v8::Object;
+using v8::Uint32;
+using v8::Value;
+
+namespace crypto {
+
+#if OPENSSL_WITH_EVP_MAC
+namespace {
+
+struct InitializedMac final {
+  ncrypto::EVPMacCtxPointer context;
+  size_t output_size = 0;
+  bool has_output_length = false;
+};
+
+struct MaybeCachedMac final {
+  EVP_MAC* cached_mac = nullptr;
+  ncrypto::EVPMacPointer mac;
+  int32_t cache_id = -1;
+  ncrypto::MacKind kind = ncrypto::MacKind::kOther;
+};
+
+bool MaybeThrowCryptoError(Environment* env, const char* message) {
+  const unsigned long error = ERR_get_error();  // NOLINT(runtime/int)
+  if (error == 0) return false;
+  ThrowCryptoError(env, error, message);
+  return true;
+}
+
+void ThrowMacError(Environment* env, const char* message) {
+  if (!MaybeThrowCryptoError(env, message)) {
+    THROW_ERR_CRYPTO_OPERATION_FAILED(env, message);
+  }
+}
+
+void ResetMacCache(Environment* env,
+                   uint64_t generation,
+                   Local<Object> algorithm_cache = Local<Object>()) {
+  ncrypto::MacCache* cache = env->provider_mac_cache.get();
+  CHECK_NOT_NULL(cache);
+  if (!algorithm_cache.IsEmpty()) {
+    Isolate* isolate = env->isolate();
+    Local<Context> context = env->context();
+    for (const auto& entry : cache->aliases()) {
+      if (algorithm_cache
+              ->Set(context,
+                    OneByteString(isolate, entry.first),
+                    Int32::New(isolate, -1))
+              .IsNothing()) {
+        return;
+      }
+    }
+  }
+  cache->reset(generation);
+  env->supported_mac_algorithms.clear();
+  env->supported_mac_algorithms_initialized = false;
+  env->mac_cache_generation = generation;
+}
+
+bool SynchronizeMacCache(Environment* env,
+                         Local<Object> algorithm_cache = Local<Object>()) {
+  const uint64_t generation = ncrypto::getFipsStateGeneration();
+  if (env->mac_cache_generation == generation) return false;
+  ResetMacCache(env, generation, algorithm_cache);
+  return true;
+}
+
+ncrypto::MacCache::Result GetCachedMacByID(
+    Environment* env,
+    int32_t id,
+    Local<Object> algorithm_cache = Local<Object>()) {
+  if (SynchronizeMacCache(env, algorithm_cache) ||
+      env->provider_mac_cache == nullptr) {
+    return {};
+  }
+  return env->provider_mac_cache->lookup(id, env->mac_cache_generation);
+}
+
+MaybeCachedMac FetchAndMaybeCacheMac(
+    Environment* env,
+    const char* name,
+    Local<Object> algorithm_cache = Local<Object>()) {
+  SynchronizeMacCache(env, algorithm_cache);
+  if (env->isolate()->HasPendingException()) return {};
+  ncrypto::MacCache* cache = env->provider_mac_cache.get();
+  CHECK_NOT_NULL(cache);
+  const uint64_t generation = env->mac_cache_generation;
+
+  if (auto cached = cache->lookup(name, generation); cached.mac != nullptr) {
+    return {cached.mac, {}, cached.id, cached.kind};
+  }
+
+  ncrypto::EVPMacPointer mac;
+  {
+    ncrypto::MarkPopErrorOnReturn mark_pop_error_on_return;
+    mac = ncrypto::EVPMacPointer::Fetch(name);
+  }
+  if (!mac) return {};
+
+  if (generation == ncrypto::getFipsStateGeneration()) {
+    auto cached = cache->insert(name, std::move(mac), generation);
+    if (cached.mac != nullptr) {
+      return {cached.mac, {}, cached.id, cached.kind};
+    }
+  }
+
+  const ncrypto::MacKind kind = ncrypto::MacCache::GetKind(mac.get());
+  return {nullptr, std::move(mac), -1, kind};
+}
+
+EVP_MAC* GetMacImplementation(Environment* env,
+                              Local<Value> algorithm,
+                              Local<Value> cache_id_value,
+                              Local<Value> algorithm_cache,
+                              ncrypto::EVPMacPointer* mac_owner,
+                              ncrypto::MacKind* kind) {
+  CHECK(algorithm->IsString());
+  CHECK(cache_id_value->IsInt32());
+  CHECK(algorithm_cache->IsObject());
+  CHECK_NOT_NULL(mac_owner);
+  CHECK_NOT_NULL(kind);
+
+  Local<Object> cache = algorithm_cache.As<Object>();
+  const int32_t cache_id = cache_id_value.As<Int32>()->Value();
+  if (cache_id != -1) {
+    auto cached = GetCachedMacByID(env, cache_id, cache);
+    if (cached.mac != nullptr) {
+      *kind = cached.kind;
+      return cached.mac;
+    }
+    if (env->isolate()->HasPendingException()) return nullptr;
+  }
+
+  Isolate* isolate = env->isolate();
+  Utf8Value utf8(isolate, algorithm);
+  MaybeCachedMac result = FetchAndMaybeCacheMac(env, *utf8, cache);
+  if (env->isolate()->HasPendingException()) return nullptr;
+  if (result.cache_id != -1) {
+    if (cache
+            ->Set(
+                env->context(), algorithm, Int32::New(isolate, result.cache_id))
+            .IsNothing()) {
+      return nullptr;
+    }
+  }
+
+  if (result.cached_mac != nullptr) {
+    *kind = result.kind;
+    return result.cached_mac;
+  }
+  if (result.mac) {
+    *mac_owner = std::move(result.mac);
+    *kind = result.kind;
+    return mac_owner->get();
+  }
+  return nullptr;
+}
+
+bool IsSettableParameter(const ncrypto::EVPMacCtxPointer& context,
+                         const char* name,
+                         unsigned int type) {
+  const OSSL_PARAM* settable = context.getSettableParams();
+  const OSSL_PARAM* descriptor =
+      settable == nullptr ? nullptr : OSSL_PARAM_locate_const(settable, name);
+  return descriptor != nullptr && descriptor->data_type == type;
+}
+
+bool RequireSettableParameter(Environment* env,
+                              const ncrypto::EVPMacCtxPointer& context,
+                              Local<Value> algorithm,
+                              const char* option,
+                              const char* parameter,
+                              unsigned int type) {
+  if (IsSettableParameter(context, parameter, type)) return true;
+  Utf8Value name(env->isolate(), algorithm);
+  THROW_ERR_INVALID_ARG_VALUE(
+      env,
+      "The property 'options.%s' is not supported by MAC %s",
+      option,
+      *name);
+  return false;
+}
+
+bool InitializeMacContext(Environment* env,
+                          const FunctionCallbackInfo<Value>& args,
+                          InitializedMac* output) {
+  CHECK(args.Length() == 5 || args.Length() == 10);
+  CHECK(args[0]->IsString());
+  CHECK(args[1]->IsInt32());
+  CHECK(args[2]->IsObject());
+
+  Isolate* isolate = env->isolate();
+  ByteSource key = ByteSource::FromSecretKeyBytes(env, args[3]);
+
+  std::optional<Utf8Value> digest;
+  if (!args[4]->IsUndefined()) {
+    CHECK(args[4]->IsString());
+    digest.emplace(isolate, args[4]);
+  }
+  std::optional<Utf8Value> cipher;
+  if (!args[5]->IsUndefined()) {
+    CHECK(args[5]->IsString());
+    cipher.emplace(isolate, args[5]);
+  }
+
+  const bool has_iv = !args[6]->IsUndefined();
+  ByteSource iv;
+  if (has_iv) iv = ByteSource::FromBuffer(args[6]);
+  const bool has_customization = !args[7]->IsUndefined();
+  ByteSource customization;
+  if (has_customization) customization = ByteSource::FromBuffer(args[7]);
+  const bool has_salt = !args[8]->IsUndefined();
+  ByteSource salt;
+  if (has_salt) salt = ByteSource::FromBuffer(args[8]);
+
+  const bool has_output_length = !args[9]->IsUndefined();
+  size_t output_length = 0;
+  if (has_output_length) {
+    CHECK(args[9]->IsUint32());
+    output_length = args[9].As<Uint32>()->Value();
+  }
+
+  ncrypto::EVPMacPointer mac_owner;
+  ncrypto::MacKind kind = ncrypto::MacKind::kOther;
+  EVP_MAC* mac =
+      GetMacImplementation(env, args[0], args[1], args[2], &mac_owner, &kind);
+  if (mac == nullptr) {
+    if (env->isolate()->IsExecutionTerminating() ||
+        env->isolate()->HasPendingException()) {
+      return false;
+    }
+    Utf8Value name(env->isolate(), args[0]);
+    THROW_ERR_CRYPTO_INVALID_MAC(env, "Invalid MAC: %s", *name);
+    return false;
+  }
+
+  if (kind == ncrypto::MacKind::kHmac && !digest.has_value()) {
+    THROW_ERR_INVALID_ARG_VALUE(
+        env, "The property 'options.digest' is required for HMAC");
+    return false;
+  }
+  if (kind == ncrypto::MacKind::kCmac && !cipher.has_value()) {
+    THROW_ERR_INVALID_ARG_VALUE(
+        env, "The property 'options.cipher' is required for CMAC");
+    return false;
+  }
+  if (kind == ncrypto::MacKind::kGmac) {
+    if (!cipher.has_value()) {
+      THROW_ERR_INVALID_ARG_VALUE(
+          env, "The property 'options.cipher' is required for GMAC");
+      return false;
+    }
+    if (!has_iv || iv.empty()) {
+      THROW_ERR_INVALID_ARG_VALUE(
+          env, "The property 'options.iv' must be non-empty for GMAC");
+      return false;
+    }
+  }
+
+  ncrypto::EVPMacCtxPointer context = ncrypto::EVPMacCtxPointer::New(mac);
+  if (!context) {
+    ThrowMacError(env, "Failed to create MAC context");
+    return false;
+  }
+
+  std::array<OSSL_PARAM, 7> params;
+  size_t count = 0;
+  if (digest.has_value()) {
+    if (!RequireSettableParameter(env,
+                                  context,
+                                  args[0],
+                                  "digest",
+                                  OSSL_MAC_PARAM_DIGEST,
+                                  OSSL_PARAM_UTF8_STRING)) {
+      return false;
+    }
+    params[count++] = OSSL_PARAM_construct_utf8_string(
+        OSSL_MAC_PARAM_DIGEST, const_cast<char*>(digest->out()), 0);
+  }
+  if (cipher.has_value()) {
+    if (!RequireSettableParameter(env,
+                                  context,
+                                  args[0],
+                                  "cipher",
+                                  OSSL_MAC_PARAM_CIPHER,
+                                  OSSL_PARAM_UTF8_STRING)) {
+      return false;
+    }
+    params[count++] = OSSL_PARAM_construct_utf8_string(
+        OSSL_MAC_PARAM_CIPHER, const_cast<char*>(cipher->out()), 0);
+  }
+
+  unsigned char empty_parameter = 0;
+  auto add_bytes = [&](bool present,
+                       const ByteSource& value,
+                       const char* option,
+                       const char* parameter) {
+    if (!present) return true;
+    if (!RequireSettableParameter(env,
+                                  context,
+                                  args[0],
+                                  option,
+                                  parameter,
+                                  OSSL_PARAM_OCTET_STRING)) {
+      return false;
+    }
+    void* data = value.empty() ? static_cast<void*>(&empty_parameter)
+                               : const_cast<void*>(value.data());
+    params[count++] =
+        OSSL_PARAM_construct_octet_string(parameter, data, value.size());
+    return true;
+  };
+
+  if (!add_bytes(has_iv, iv, "iv", OSSL_MAC_PARAM_IV) ||
+      !add_bytes(has_customization,
+                 customization,
+                 "customization",
+                 OSSL_MAC_PARAM_CUSTOM) ||
+      !add_bytes(has_salt, salt, "salt", OSSL_MAC_PARAM_SALT)) {
+    return false;
+  }
+
+  if (has_output_length) {
+    if (output_length > Buffer::kMaxLength) {
+      env->isolate()->ThrowException(ERR_BUFFER_TOO_LARGE(env->isolate()));
+      return false;
+    }
+    if (!RequireSettableParameter(env,
+                                  context,
+                                  args[0],
+                                  "outputLength",
+                                  OSSL_MAC_PARAM_SIZE,
+                                  OSSL_PARAM_UNSIGNED_INTEGER)) {
+      return false;
+    }
+    params[count++] =
+        OSSL_PARAM_construct_size_t(OSSL_MAC_PARAM_SIZE, &output_length);
+  }
+  params[count] = OSSL_PARAM_construct_end();
+
+  if (!context.init(key, params.data())) {
+    ThrowMacError(env, "Failed to initialize MAC");
+    return false;
+  }
+
+  const size_t output_size = context.getSize();
+  if (output_size > Buffer::kMaxLength) {
+    ERR_clear_error();
+    env->isolate()->ThrowException(ERR_BUFFER_TOO_LARGE(env->isolate()));
+    return false;
+  }
+  if (has_output_length && output_size != output_length) {
+    ERR_clear_error();
+    Utf8Value name(env->isolate(), args[0]);
+    THROW_ERR_INVALID_ARG_VALUE(
+        env,
+        "The property 'options.outputLength' was not honored by MAC %s",
+        *name);
+    return false;
+  }
+  if (!has_output_length && output_size == 0) {
+    ERR_clear_error();
+    THROW_ERR_CRYPTO_OPERATION_FAILED(env, "MAC did not report an output size");
+    return false;
+  }
+
+  output->context = std::move(context);
+  output->output_size = output_size;
+  output->has_output_length = has_output_length;
+  return true;
+}
+
+v8::MaybeLocal<Value> FinalizeMac(Environment* env,
+                                  ncrypto::EVPMacCtxPointer* context,
+                                  size_t output_size,
+                                  bool has_output_length,
+                                  enum encoding encoding) {
+  ncrypto::DataPointer result = context->final(output_size);
+  if (!result) {
+    ThrowMacError(env, "Failed to finalize MAC");
+    context->reset();
+    return {};
+  }
+  context->reset();
+  if (has_output_length && result.size() != output_size) {
+    THROW_ERR_CRYPTO_OPERATION_FAILED(
+        env, "MAC returned an unexpected output length");
+    return {};
+  }
+  if (encoding != BUFFER) {
+    return StringBytes::Encode(env->isolate(),
+                               static_cast<const char*>(result.get()),
+                               result.size(),
+                               encoding);
+  }
+  if (result.size() == 0) return Buffer::New(env, 0);
+
+  ByteSource bytes = ByteSource::Allocated(result.release());
+  return bytes.ToBuffer(env);
+}
+
+void SaveMacName(const char* name, void* arg) {
+  if (name == nullptr) return;
+  const std::string_view view(name);
+  const bool is_dotted_decimal =
+      view.find('.') != std::string_view::npos &&
+      std::all_of(view.begin(), view.end(), [](unsigned char c) {
+        return (c >= '0' && c <= '9') || c == '.';
+      });
+  if (is_dotted_decimal) return;
+
+  std::string normalized(view);
+  std::transform(normalized.begin(),
+                 normalized.end(),
+                 normalized.begin(),
+                 [](unsigned char c) {
+                   if (c >= 'A' && c <= 'Z') {
+                     return static_cast<char>(c + ('a' - 'A'));
+                   }
+                   return static_cast<char>(c);
+                 });
+  static_cast<Environment*>(arg)->supported_mac_algorithms.push_back(
+      std::move(normalized));
+}
+
+void SaveSupportedProviderMac(EVP_MAC* enumerated, void* arg) {
+  Environment* env = static_cast<Environment*>(arg);
+  const char* name = EVP_MAC_get0_name(enumerated);
+  if (name == nullptr) return;
+
+  MaybeCachedMac result = FetchAndMaybeCacheMac(env, name);
+  EVP_MAC* fetched =
+      result.cached_mac != nullptr ? result.cached_mac : result.mac.get();
+  if (fetched == nullptr) return;
+  EVP_MAC_names_do_all(fetched, SaveMacName, env);
+}
+
+const std::vector<std::string>& GetSupportedMacAlgorithms(Environment* env) {
+  while (true) {
+    SynchronizeMacCache(env);
+    const uint64_t generation = env->mac_cache_generation;
+    if (!env->supported_mac_algorithms_initialized) {
+      ncrypto::MarkPopErrorOnReturn mark_pop_error_on_return;
+      EVP_MAC_do_all_provided(nullptr, SaveSupportedProviderMac, env);
+      std::sort(env->supported_mac_algorithms.begin(),
+                env->supported_mac_algorithms.end());
+      env->supported_mac_algorithms.erase(
+          std::unique(env->supported_mac_algorithms.begin(),
+                      env->supported_mac_algorithms.end()),
+          env->supported_mac_algorithms.end());
+      env->supported_mac_algorithms_initialized = true;
+    }
+
+    const uint64_t current_generation = ncrypto::getFipsStateGeneration();
+    if (generation == current_generation) {
+      return env->supported_mac_algorithms;
+    }
+    ResetMacCache(env, current_generation);
+  }
+}
+
+}  // namespace
+#endif  // OPENSSL_WITH_EVP_MAC
+
+#if OPENSSL_WITH_EVP_MAC
+bool Mac::MacUpdate(const char* data, size_t length) {
+  if (!context_) return false;
+  if (length == 0) return true;
+  if (EVP_MAC_update(context_.get(),
+                     reinterpret_cast<const unsigned char*>(data),
+                     length) == 1) {
+    return true;
+  }
+  MaybeThrowCryptoError(env(), "Failed to update MAC");
+  context_.reset();
+  return false;
+}
+
+Mac::Mac(Environment* env,
+         Local<Object> wrap,
+         ncrypto::EVPMacCtxPointer&& context,
+         size_t output_size,
+         bool has_output_length)
+    : BaseObject(env, wrap),
+      context_(std::move(context)),
+      output_size_(output_size),
+      has_output_length_(has_output_length) {
+  MakeWeak();
+}
+#else
+Mac::Mac(Environment* env, Local<Object> wrap) : BaseObject(env, wrap) {
+  MakeWeak();
+}
+#endif
+
+void Mac::MemoryInfo(MemoryTracker* tracker) const {
+#if OPENSSL_WITH_EVP_MAC
+  tracker->TrackFieldWithSize("context", context_ ? kSizeOf_EVP_MAC_CTX : 0);
+#else
+  static_cast<void>(tracker);
+#endif
+}
+
+void Mac::Initialize(Environment* env, Local<Object> target) {
+  Isolate* isolate = env->isolate();
+  Local<Context> context = env->context();
+  Local<FunctionTemplate> t = NewFunctionTemplate(isolate, New);
+  t->InstanceTemplate()->SetInternalFieldCount(Mac::kInternalFieldCount);
+  SetProtoMethod(isolate, t, "update", MacUpdate);
+  SetProtoMethod(isolate, t, "final", MacFinal);
+  SetConstructorFunction(context, target, "Mac", t);
+
+  SetMethodNoSideEffect(context, target, "getMacs", GetMacs);
+  SetMethodNoSideEffect(
+      context, target, "getCachedMacAliases", GetCachedAliases);
+}
+
+void Mac::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
+  registry->Register(New);
+  registry->Register(MacUpdate);
+  registry->Register(MacFinal);
+  registry->Register(GetMacs);
+  registry->Register(GetCachedAliases);
+}
+
+void Mac::New(const FunctionCallbackInfo<Value>& args) {
+  CHECK(args.IsConstructCall());
+#if OPENSSL_WITH_EVP_MAC
+  CHECK(args.Length() == 5 || args.Length() == 10);
+  Environment* env = Environment::GetCurrent(args);
+  InitializedMac initialized;
+  if (!InitializeMacContext(env, args, &initialized)) return;
+  new Mac(env,
+          args.This(),
+          std::move(initialized.context),
+          initialized.output_size,
+          initialized.has_output_length);
+#else
+  THROW_ERR_CRYPTO_MAC_NOT_SUPPORTED(Environment::GetCurrent(args),
+                                     "MAC is not supported");
+#endif
+}
+
+void Mac::MacUpdate(const FunctionCallbackInfo<Value>& args) {
+#if OPENSSL_WITH_EVP_MAC
+  Decode<Mac>(args,
+              [](Mac* mac,
+                 const FunctionCallbackInfo<Value>& args,
+                 const char* data,
+                 size_t length) {
+                args.GetReturnValue().Set(mac->MacUpdate(data, length));
+              });
+#else
+  THROW_ERR_CRYPTO_MAC_NOT_SUPPORTED(Environment::GetCurrent(args),
+                                     "MAC is not supported");
+#endif
+}
+
+void Mac::MacFinal(const FunctionCallbackInfo<Value>& args) {
+#if OPENSSL_WITH_EVP_MAC
+  Mac* mac;
+  ASSIGN_OR_RETURN_UNWRAP(&mac, args.This());
+  Environment* env = mac->env();
+  if (!mac->context_) {
+    THROW_ERR_CRYPTO_OPERATION_FAILED(env, "MAC context is not initialized");
+    return;
+  }
+  enum encoding encoding = BUFFER;
+  if (args.Length() >= 1) {
+    encoding = ParseEncoding(env->isolate(), args[0], BUFFER);
+  }
+  Local<Value> result;
+  if (FinalizeMac(env,
+                  &mac->context_,
+                  mac->output_size_,
+                  mac->has_output_length_,
+                  encoding)
+          .ToLocal(&result)) {
+    args.GetReturnValue().Set(result);
+  }
+#else
+  THROW_ERR_CRYPTO_MAC_NOT_SUPPORTED(Environment::GetCurrent(args),
+                                     "MAC is not supported");
+#endif
+}
+
+void Mac::GetMacs(const FunctionCallbackInfo<Value>& args) {
+#if OPENSSL_WITH_EVP_MAC
+  Local<Context> context = args.GetIsolate()->GetCurrentContext();
+  Environment* env = Environment::GetCurrent(context);
+  Local<Value> result;
+  if (ToV8Value(context, GetSupportedMacAlgorithms(env)).ToLocal(&result)) {
+    args.GetReturnValue().Set(result);
+  }
+#else
+  args.GetReturnValue().Set(Array::New(args.GetIsolate(), 0));
+#endif
+}
+
+void Mac::GetCachedAliases(const FunctionCallbackInfo<Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  LocalVector<Name> names(isolate);
+  LocalVector<Value> values(isolate);
+#if OPENSSL_WITH_EVP_MAC
+  Environment* env = Environment::GetCurrent(args);
+  SynchronizeMacCache(env);
+  const auto& aliases = env->provider_mac_cache->aliases();
+  names.reserve(aliases.size());
+  values.reserve(aliases.size());
+  for (const auto& [alias, id] : aliases) {
+    names.push_back(OneByteString(isolate, alias));
+    values.push_back(Int32::New(isolate, id));
+  }
+#endif
+  Local<Object> result = Object::New(
+      isolate, Null(isolate), names.data(), values.data(), names.size());
+  args.GetReturnValue().Set(result);
+}
+
+}  // namespace crypto
+}  // namespace node
diff --git a/src/crypto/crypto_mac.h b/src/crypto/crypto_mac.h
new file mode 100644
index 000000000000..3223b1487107
--- /dev/null
+++ b/src/crypto/crypto_mac.h
@@ -0,0 +1,51 @@
+#ifndef SRC_CRYPTO_CRYPTO_MAC_H_
+#define SRC_CRYPTO_CRYPTO_MAC_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "base_object.h"
+#include "crypto/crypto_util.h"
+#include "env.h"
+#include "memory_tracker.h"
+#include "v8.h"
+
+namespace node {
+namespace crypto {
+
+class Mac final : public BaseObject {
+ public:
+  static void Initialize(Environment* env, v8::Local<v8::Object> target);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(Mac)
+  SET_SELF_SIZE(Mac)
+
+ private:
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void MacUpdate(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void MacFinal(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetMacs(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetCachedAliases(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+#if OPENSSL_WITH_EVP_MAC
+  Mac(Environment* env,
+      v8::Local<v8::Object> wrap,
+      ncrypto::EVPMacCtxPointer&& context,
+      size_t output_size,
+      bool has_output_length);
+  bool MacUpdate(const char* data, size_t length);
+
+  ncrypto::EVPMacCtxPointer context_;
+  size_t output_size_ = 0;
+  bool has_output_length_ = false;
+#else
+  Mac(Environment* env, v8::Local<v8::Object> wrap);
+#endif
+};
+
+}  // namespace crypto
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_CRYPTO_CRYPTO_MAC_H_
diff --git a/src/crypto/crypto_rsa.cc b/src/crypto/crypto_rsa.cc
index 15479284933d..f6919221a4f2 100644
--- a/src/crypto/crypto_rsa.cc
+++ b/src/crypto/crypto_rsa.cc
@@ -22,6 +22,7 @@ using ncrypto::EVPKeyPointer;
 #if NCRYPTO_USE_LEGACY_KEY_TYPES
 using ncrypto::RSAPointer;
 #endif
+using v8::Array;
 using v8::ArrayBuffer;
 using v8::BackingStoreInitializationMode;
 using v8::FunctionCallbackInfo;
@@ -38,6 +39,23 @@ using v8::Uint32;
 using v8::Value;
 
 namespace crypto {
+namespace {
+constexpr uint32_t kMaxRsaOtherPrimeInfos = 8;
+
+bool IsRsaPssDigestEncodable(const Digest& digest) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  const int nid = EVP_MD_type(digest.get());
+  if (nid == NID_undef) return false;
+
+  const ASN1_OBJECT* object = OBJ_nid2obj(nid);
+  return object != nullptr && OBJ_length(object) > 0;
+#else
+  static_cast<void>(digest);
+  return true;
+#endif
+}
+}  // namespace
+
 EVPKeyCtxPointer RsaKeyGenTraits::Setup(RsaKeyPairGenConfig* params) {
   auto ctx = EVPKeyCtxPointer::NewFromID(
       params->params.variant == kKeyVariantRSA_PSS ? EVP_PKEY_RSA_PSS
@@ -58,7 +76,8 @@ EVPKeyCtxPointer RsaKeyGenTraits::Setup(RsaKeyPairGenConfig* params) {
   }
 
   if (params->params.variant == kKeyVariantRSA_PSS) {
-    if (params->params.md && !ctx.setRsaPssKeygenMd(params->params.md)) {
+    if (params->params.md && (!IsRsaPssDigestEncodable(params->params.md) ||
+                              !ctx.setRsaPssKeygenMd(params->params.md))) {
       return {};
     }
 
@@ -71,7 +90,8 @@ EVPKeyCtxPointer RsaKeyGenTraits::Setup(RsaKeyPairGenConfig* params) {
       mgf1_md = params->params.md;
     }
 
-    if (mgf1_md && !ctx.setRsaPssKeygenMgf1Md(mgf1_md)) {
+    if (mgf1_md && (!IsRsaPssDigestEncodable(mgf1_md) ||
+                    !ctx.setRsaPssKeygenMgf1Md(mgf1_md))) {
       return {};
     }
 
@@ -322,6 +342,29 @@ bool ExportJWKRsaKey(Environment* env,
             .IsNothing()) {
       return false;
     }
+
+    const auto other_prime_infos = rsa.getOtherPrimeInfos();
+    if (!other_prime_infos.empty()) {
+      const uint32_t count = static_cast<uint32_t>(other_prime_infos.size());
+      Local<Array> oth = Array::New(env->isolate(), count);
+      for (uint32_t i = 0; i < count; i++) {
+        const auto& info = other_prime_infos[i];
+        Local<Object> item = Object::New(env->isolate());
+        if (SetEncodedValue(env, item, env->jwk_r_string(), info.r)
+                .IsNothing() ||
+            SetEncodedValue(env, item, env->jwk_d_string(), info.d)
+                .IsNothing() ||
+            SetEncodedValue(env, item, env->jwk_t_string(), info.t)
+                .IsNothing() ||
+            !oth->Set(env->context(), i, item).FromMaybe(false)) {
+          return false;
+        }
+      }
+      if (!target->DefineOwnProperty(env->context(), env->jwk_oth_string(), oth)
+               .FromMaybe(false)) {
+        return false;
+      }
+    }
   }
 
   return true;
@@ -331,12 +374,13 @@ KeyObjectData ImportJWKRsaKey(Environment* env, Local<Object> jwk) {
   Local<Value> n_value;
   Local<Value> e_value;
   Local<Value> d_value;
+  Local<Value> oth_value;
 
   if (!jwk->Get(env->context(), env->jwk_n_string()).ToLocal(&n_value) ||
       !jwk->Get(env->context(), env->jwk_e_string()).ToLocal(&e_value) ||
       !jwk->Get(env->context(), env->jwk_d_string()).ToLocal(&d_value) ||
-      !n_value->IsString() ||
-      !e_value->IsString()) {
+      !jwk->Get(env->context(), env->jwk_oth_string()).ToLocal(&oth_value) ||
+      !n_value->IsString() || !e_value->IsString()) {
     THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
     return {};
   }
@@ -347,6 +391,10 @@ KeyObjectData ImportJWKRsaKey(Environment* env, Local<Object> jwk) {
   }
 
   KeyType type = d_value->IsString() ? kKeyTypePrivate : kKeyTypePublic;
+  if (type == kKeyTypePublic && !oth_value->IsUndefined()) {
+    THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+    return {};
+  }
 
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   ncrypto::Rsa rsa_view;
@@ -400,19 +448,79 @@ KeyObjectData ImportJWKRsaKey(Environment* env, Local<Object> jwk) {
     ByteSource dq = ByteSource::FromEncodedString(env, dq_value.As<String>());
     ByteSource qi = ByteSource::FromEncodedString(env, qi_value.As<String>());
 
-    if (!rsa_view.setPrivateKey(
-            d.ToBN(), q.ToBN(), p.ToBN(), dp.ToBN(), dq.ToBN(), qi.ToBN())) {
+    ncrypto::Rsa::OtherPrimeInfoPointers other_prime_infos;
+    if (!oth_value->IsUndefined()) {
+      if (!oth_value->IsArray()) {
+        THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+        return {};
+      }
+
+      Local<Array> oth = oth_value.As<Array>();
+      const uint32_t length = oth->Length();
+      if (length == 0 || length > kMaxRsaOtherPrimeInfos) {
+        THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+        return {};
+      }
+      other_prime_infos.reserve(length);
+      for (uint32_t i = 0; i < length; i++) {
+        Local<Value> item_value;
+        Local<Value> r_value;
+        Local<Value> other_d_value;
+        Local<Value> t_value;
+        if (!oth->Get(env->context(), i).ToLocal(&item_value) ||
+            !item_value->IsObject()) {
+          THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+          return {};
+        }
+
+        Local<Object> item = item_value.As<Object>();
+        if (!item->Get(env->context(), env->jwk_r_string()).ToLocal(&r_value) ||
+            !item->Get(env->context(), env->jwk_d_string())
+                 .ToLocal(&other_d_value) ||
+            !item->Get(env->context(), env->jwk_t_string()).ToLocal(&t_value) ||
+            !r_value->IsString() || !other_d_value->IsString() ||
+            !t_value->IsString()) {
+          THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+          return {};
+        }
+
+        other_prime_infos.push_back({
+            ByteSource::FromEncodedString(env, r_value.As<String>()).ToBN(),
+            ByteSource::FromEncodedString(env, other_d_value.As<String>())
+                .ToBN(),
+            ByteSource::FromEncodedString(env, t_value.As<String>()).ToBN(),
+        });
+      }
+    }
+
+    if (!rsa_view.setPrivateKey(d.ToBN(),
+                                q.ToBN(),
+                                p.ToBN(),
+                                dp.ToBN(),
+                                dq.ToBN(),
+                                qi.ToBN(),
+                                std::move(other_prime_infos))) {
       THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
       return {};
     }
 
-    // Verify that n == p * q.
+    // Verify that n is the product of all prime factors.
     const auto& pub = rsa_view.getPublicKey();
     const auto& priv = rsa_view.getPrivateKey();
-    auto pq = BignumPointer::New();
+    auto product = BignumPointer::New();
     BN_CTX* ctx = BN_CTX_new();
-    bool n_valid = ctx && pq && BN_mul(pq.get(), priv.p, priv.q, ctx) == 1 &&
-                   BN_cmp(pq.get(), pub.n) == 0;
+    bool n_valid =
+        ctx && product && BN_mul(product.get(), priv.p, priv.q, ctx) == 1;
+    for (const auto& info : rsa_view.getOtherPrimeInfos()) {
+      auto next = BignumPointer::New();
+      if (!n_valid || !next ||
+          BN_mul(next.get(), product.get(), info.r, ctx) != 1) {
+        n_valid = false;
+        break;
+      }
+      product = std::move(next);
+    }
+    n_valid = n_valid && BN_cmp(product.get(), pub.n) == 0;
     BN_CTX_free(ctx);
     if (!n_valid) {
       THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
diff --git a/src/crypto/crypto_tls.cc b/src/crypto/crypto_tls.cc
index 5a531209e232..14cf5cc8c85d 100644
--- a/src/crypto/crypto_tls.cc
+++ b/src/crypto/crypto_tls.cc
@@ -23,6 +23,7 @@
 #include <cstdio>
 #include "async_wrap-inl.h"
 #include "crypto/crypto_bio.h"
+#include "crypto/crypto_client_hello.h"
 #include "crypto/crypto_common.h"
 #include "crypto/crypto_context.h"
 #include "crypto/crypto_util.h"
@@ -104,40 +105,18 @@ SSL_SESSION* GetSessionCallback(
 // The TLS library invokes this before version negotiation and before session
 // or ticket resumption, which makes async session lookup possible. If required
 // the handshake is suspended here and resumed once JS has answered.
-#ifdef OPENSSL_IS_BORINGSSL
-ssl_select_cert_result_t EarlyClientHelloCallback(const SSL_CLIENT_HELLO* ch) {
-  TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(ch->ssl));
-  if (!w->should_suspend_for_client_hello()) return ssl_select_cert_success;
-
-  const uint8_t* ext;
-  size_t ext_len;
-  bool has_ticket = SSL_early_callback_ctx_extension_get(
-                        ch, TLSEXT_TYPE_session_ticket, &ext, &ext_len) &&
-                    ext_len > 0;
+ClientHelloResult EarlyClientHelloCallback(const ClientHelloContext& hello) {
+  TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(hello.ssl()));
+  if (!w->should_suspend_for_client_hello()) {
+    return ClientHelloResult::kContinue;
+  }
 
-  return w->OnEarlyClientHello(ch->session_id, ch->session_id_len, has_ticket)
-             ? ssl_select_cert_success
-             : ssl_select_cert_retry;
+  auto session_id = hello.session_id();
+  return w->OnEarlyClientHello(
+             session_id.data(), session_id.size(), hello.has_session_ticket())
+             ? ClientHelloResult::kContinue
+             : ClientHelloResult::kRetry;
 }
-#else
-int EarlyClientHelloCallback(SSL* s, int* al, void* arg) {
-  TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(s));
-  if (!w->should_suspend_for_client_hello()) return SSL_CLIENT_HELLO_SUCCESS;
-
-  const unsigned char* session_id;
-  size_t session_id_len = SSL_client_hello_get0_session_id(s, &session_id);
-
-  const unsigned char* ext;
-  size_t ext_len;
-  bool has_ticket = SSL_client_hello_get0_ext(
-                        s, TLSEXT_TYPE_session_ticket, &ext, &ext_len) == 1 &&
-                    ext_len > 0;
-
-  return w->OnEarlyClientHello(session_id, session_id_len, has_ticket)
-             ? SSL_CLIENT_HELLO_SUCCESS
-             : SSL_CLIENT_HELLO_RETRY;
-}
-#endif
 
 void KeylogCallback(const SSL* s, const char* line) {
   TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(s));
@@ -265,11 +244,13 @@ int SelectALPNCallback(
 
     unsigned int result_int = callback_result.As<Number>()->Value();
 
-    // The callback returns an offset into the given buffer, for the selected
-    // protocol that should be returned. We then set outlen & out to point
-    // to the selected input length & value directly:
-    *outlen = *(in + result_int);
-    *out = (in + result_int + 1);
+    // The callback returns an offset into the given buffer, at which the
+    // selected protocol sits in ALPN wire format: a length byte followed by
+    // that many name bytes.
+    SetSelectedProtocol(
+        out,
+        outlen,
+        {reinterpret_cast<const char*>(in + result_int + 1), in[result_int]});
 
     return SSL_TLSEXT_ERR_OK;
   }
@@ -278,20 +259,20 @@ int SelectALPNCallback(
 
   if (alpn_protos.empty()) return SSL_TLSEXT_ERR_NOACK;
 
-  int status = SSL_select_next_proto(const_cast<unsigned char**>(out),
-                                     outlen,
-                                     alpn_protos.data(),
-                                     alpn_protos.size(),
-                                     in,
-                                     inlen);
+  const std::span<const uint8_t> supported{alpn_protos.data(),
+                                           alpn_protos.size()};
+  const std::span<const uint8_t> offered{in, inlen};
+  auto selected = SelectNextProtocol(supported, offered);
 
   // Previous versions of Node.js returned SSL_TLSEXT_ERR_NOACK if no protocol
   // match was found. This would neither cause a fatal alert nor would it result
   // in a useful ALPN response as part of the Server Hello message.
   // We now return SSL_TLSEXT_ERR_ALERT_FATAL in that case as per Section 3.2
   // of RFC 7301, which causes a fatal no_application_protocol alert.
-  return status == OPENSSL_NPN_NEGOTIATED ? SSL_TLSEXT_ERR_OK
-                                          : SSL_TLSEXT_ERR_ALERT_FATAL;
+  if (!selected.has_value()) return SSL_TLSEXT_ERR_ALERT_FATAL;
+
+  SetSelectedProtocol(out, outlen, *selected);
+  return SSL_TLSEXT_ERR_OK;
 }
 
 MaybeLocal<Value> GetSSLOCSPResponse(Environment* env, SSL* ssl) {
@@ -410,7 +391,7 @@ TLSWrap::TLSWrap(Environment* env,
   ssl_ = sc_->CreateSSL();
   CHECK(ssl_);
 
-  sc_->SetClientHelloCallback(EarlyClientHelloCallback);
+  SetClientHelloCallback<EarlyClientHelloCallback>(sc_->ctx().get());
   sc_->SetGetSessionCallback(GetSessionCallback);
   sc_->SetNewSessionCallback(NewSessionCallback);
 
@@ -1765,6 +1746,13 @@ void TLSWrap::GetPeerX509Certificate(const FunctionCallbackInfo<Value>& args) {
     args.GetReturnValue().Set(ret);
 }
 
+void TLSWrap::HasPeerCertificate(const FunctionCallbackInfo<Value>& args) {
+  TLSWrap* w;
+  ASSIGN_OR_RETURN_UNWRAP(&w, args.This());
+  bool has_peer_cert = static_cast<bool>(X509Pointer::PeerFrom(w->ssl_));
+  args.GetReturnValue().Set(has_peer_cert);
+}
+
 void TLSWrap::GetCertificate(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* w;
   ASSIGN_OR_RETURN_UNWRAP(&w, args.This());
@@ -2288,6 +2276,8 @@ void TLSWrap::Initialize(
       isolate, t, "getPeerCertificate", GetPeerCertificate);
   SetProtoMethodNoSideEffect(
       isolate, t, "getPeerX509Certificate", GetPeerX509Certificate);
+  SetProtoMethodNoSideEffect(
+      isolate, t, "hasPeerCertificate", HasPeerCertificate);
   SetProtoMethodNoSideEffect(isolate, t, "getPeerFinished", GetPeerFinished);
   SetProtoMethodNoSideEffect(isolate, t, "getProtocol", GetProtocol);
   SetProtoMethodNoSideEffect(isolate, t, "getSession", GetSession);
@@ -2347,6 +2337,7 @@ void TLSWrap::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(GetFinished);
   registry->Register(GetPeerCertificate);
   registry->Register(GetPeerX509Certificate);
+  registry->Register(HasPeerCertificate);
   registry->Register(GetPeerFinished);
   registry->Register(GetProtocol);
   registry->Register(GetSession);
diff --git a/src/crypto/crypto_tls.h b/src/crypto/crypto_tls.h
index 9a5f59ed472e..2d3ccef24fac 100644
--- a/src/crypto/crypto_tls.h
+++ b/src/crypto/crypto_tls.h
@@ -229,6 +229,8 @@ class TLSWrap : public AsyncWrap,
       const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetPeerX509Certificate(
       const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void HasPeerCertificate(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetPeerFinished(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetProtocol(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetServername(const v8::FunctionCallbackInfo<v8::Value>& args);
diff --git a/src/crypto/crypto_tls_certificates.cc b/src/crypto/crypto_tls_certificates.cc
new file mode 100644
index 000000000000..ace1d41aefec
--- /dev/null
+++ b/src/crypto/crypto_tls_certificates.cc
@@ -0,0 +1,96 @@
+#include "crypto/crypto_tls_certificates.h"
+
+#include "crypto/crypto_context.h"
+#include "crypto/crypto_keys.h"
+#include "crypto/crypto_util.h"
+
+namespace node::crypto {
+
+using ncrypto::DeleteFnPtr;
+using ncrypto::EVPKeyPointer;
+using ncrypto::X509Pointer;
+
+X509_STORE* GetOrCreateOwnedCertStore(Environment* env,
+                                      SSL_CTX* ctx,
+                                      X509_STORE** cache) {
+  if (cache != nullptr && *cache != nullptr) return *cache;
+
+  X509_STORE* cert_store = SSL_CTX_get_cert_store(ctx);
+  if (cert_store == GetOrCreateRootCertStore(env)) {
+    cert_store = NewRootCertStore(env);
+    SSL_CTX_set_cert_store(ctx, cert_store);
+  }
+
+  if (cache != nullptr) *cache = cert_store;
+  return cert_store;
+}
+
+void UseDefaultRootCertStore(Environment* env, SSL_CTX* ctx) {
+  X509_STORE* store = GetOrCreateRootCertStore(env);
+
+  // Increment reference count so global store is not deleted along with CTX.
+  X509_STORE_up_ref(store);
+  SSL_CTX_set_cert_store(ctx, store);
+}
+
+size_t AddCACertificates(Environment* env,
+                         SSL_CTX* ctx,
+                         const ncrypto::BIOPointer& bio,
+                         X509_STORE** cache) {
+  if (!bio) return 0;
+
+  size_t count = 0;
+  while (X509Pointer x509 = X509Pointer(PEM_read_bio_X509_AUX(
+             bio.get(), nullptr, NoPasswordCallback, nullptr))) {
+    CHECK_EQ(1,
+             X509_STORE_add_cert(GetOrCreateOwnedCertStore(env, ctx, cache),
+                                 x509.get()));
+    CHECK_EQ(1, SSL_CTX_add_client_CA(ctx, x509.get()));
+    count++;
+  }
+  return count;
+}
+
+bool AddCRL(Environment* env,
+            SSL_CTX* ctx,
+            const ncrypto::BIOPointer& bio,
+            X509_STORE** cache) {
+  if (!bio) return false;
+
+  DeleteFnPtr<X509_CRL, X509_CRL_free> crl(
+      PEM_read_bio_X509_CRL(bio.get(), nullptr, NoPasswordCallback, nullptr));
+  if (!crl) return false;
+
+  X509_STORE* cert_store = GetOrCreateOwnedCertStore(env, ctx, cache);
+  CHECK_EQ(1, X509_STORE_add_crl(cert_store, crl.get()));
+  CHECK_EQ(1,
+           X509_STORE_set_flags(
+               cert_store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL));
+  return true;
+}
+
+PrivateKeyResult UsePrivateKey(SSL_CTX* ctx,
+                               const ncrypto::BIOPointer& bio,
+                               const ByteSource* passphrase) {
+  if (!bio) return PrivateKeyResult::kParseError;
+
+  ByteSource empty_passphrase;
+  if (passphrase == nullptr) passphrase = &empty_passphrase;
+  // This redirection is necessary because the PasswordCallback expects a
+  // pointer to a pointer to the passphrase ByteSource to allow passing in
+  // const ByteSources.
+  const ByteSource* pass_ptr = passphrase;
+  EVPKeyPointer key(
+      PEM_read_bio_PrivateKey(bio.get(), nullptr, PasswordCallback, &pass_ptr));
+  if (!key) return PrivateKeyResult::kParseError;
+  if (!SSL_CTX_use_PrivateKey(ctx, key.get()))
+    return PrivateKeyResult::kApplyError;
+  return PrivateKeyResult::kSuccess;
+}
+
+bool UsePrivateKey(SSL_CTX* ctx, const KeyObjectData& key) {
+  if (key.GetKeyType() != KeyType::kKeyTypePrivate) return false;
+  return SSL_CTX_use_PrivateKey(ctx, key.GetAsymmetricKey().get());
+}
+
+}  // namespace node::crypto
diff --git a/src/crypto/crypto_tls_certificates.h b/src/crypto/crypto_tls_certificates.h
new file mode 100644
index 000000000000..e36a583e6d4b
--- /dev/null
+++ b/src/crypto/crypto_tls_certificates.h
@@ -0,0 +1,60 @@
+#ifndef SRC_CRYPTO_CRYPTO_TLS_CERTIFICATES_H_
+#define SRC_CRYPTO_CRYPTO_TLS_CERTIFICATES_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "ncrypto.h"
+
+namespace node {
+
+class Environment;
+
+namespace crypto {
+
+class ByteSource;
+class KeyObjectData;
+
+// Return a store that may be modified by this SSL_CTX. If the context uses
+// Node's shared root store, replace it with a private copy first.
+X509_STORE* GetOrCreateOwnedCertStore(Environment* env,
+                                      SSL_CTX* ctx,
+                                      X509_STORE** cache = nullptr);
+
+// Attach Node's process-wide default root store to the SSL_CTX.
+void UseDefaultRootCertStore(Environment* env, SSL_CTX* ctx);
+
+// Add every PEM certificate in |bio| to the context's certificate store and
+// acceptable-client-CA list. Returns the number of certificates read.
+size_t AddCACertificates(Environment* env,
+                         SSL_CTX* ctx,
+                         const ncrypto::BIOPointer& bio,
+                         X509_STORE** cache = nullptr);
+
+// Add one PEM CRL and enable CRL checking.
+bool AddCRL(Environment* env,
+            SSL_CTX* ctx,
+            const ncrypto::BIOPointer& bio,
+            X509_STORE** cache = nullptr);
+
+enum class PrivateKeyResult {
+  kSuccess,
+  kParseError,
+  kApplyError,
+};
+
+PrivateKeyResult UsePrivateKey(SSL_CTX* ctx,
+                               const ncrypto::BIOPointer& bio,
+                               const ByteSource* passphrase = nullptr);
+
+bool UsePrivateKey(SSL_CTX* ctx, const KeyObjectData& key);
+
+int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
+                                  ncrypto::BIOPointer&& in,
+                                  ncrypto::X509Pointer* cert,
+                                  ncrypto::X509Pointer* issuer);
+
+}  // namespace crypto
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_CRYPTO_CRYPTO_TLS_CERTIFICATES_H_
diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
index 133a5c7f7f1d..942e00accba9 100644
--- a/src/crypto/crypto_util.cc
+++ b/src/crypto/crypto_util.cc
@@ -6,18 +6,32 @@
 #include "memory_tracker-inl.h"
 #include "ncrypto.h"
 #include "node_buffer.h"
+#include "node_diagnostics_channel.h"
 #include "node_options-inl.h"
+#include "node_realm-inl.h"
 #include "string_bytes.h"
 #include "threadpoolwork-inl.h"
 #include "util-inl.h"
 #include "v8.h"
 
+#include <atomic>
+#include <deque>
+#include <mutex>
 #include "math.h"
 
 #if OPENSSL_VERSION_MAJOR >= 3
 #include "openssl/provider.h"
 #endif
 
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 4)
+#include <openssl/indicator.h>
+#endif
+
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(4, 0)
+#include <openssl/core_names.h>
+#include <openssl/params.h>
+#endif
+
 namespace node {
 
 using ncrypto::BignumPointer;
@@ -36,6 +50,7 @@ using v8::BackingStoreInitializationMode;
 using v8::BackingStoreOnFailureMode;
 using v8::BigInt;
 using v8::Context;
+using v8::DictionaryTemplate;
 using v8::EscapableHandleScope;
 using v8::Exception;
 using v8::Function;
@@ -76,6 +91,108 @@ size_t MemoryRetainerTraits<crypto::ByteSource>::SelfSize(
 
 namespace crypto {
 
+CShakeOptions::CShakeOptions(CShakeOptions&& other) noexcept
+    : function_name(std::move(other.function_name)),
+      customization(std::move(other.customization)),
+      flags(other.flags) {}
+
+CShakeOptions& CShakeOptions::operator=(CShakeOptions&& other) noexcept {
+  if (&other == this) return *this;
+  this->~CShakeOptions();
+  return *new (this) CShakeOptions(std::move(other));
+}
+
+void CShakeOptions::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackFieldWithSize("function_name", function_name.size());
+  tracker->TrackFieldWithSize("customization", customization.size());
+}
+
+bool CShakeOptions::Initialize(ncrypto::EVPMDCtxPointer* ctx,
+                               const EVP_MD* digest) const {
+  if (!ctx || !*ctx || digest == nullptr) return false;
+  if (empty()) return ctx->digestInit(digest);
+
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(4, 0)
+  const bool is_cshake =
+      EVP_MD_is_a(digest, "CSHAKE-128") || EVP_MD_is_a(digest, "CSHAKE-256");
+  if (!is_cshake) return false;
+
+  OSSL_PARAM params[3];
+  size_t count = 0;
+  if (has(kFunctionName)) {
+    params[count++] = OSSL_PARAM_construct_utf8_string(
+        OSSL_DIGEST_PARAM_FUNCTION_NAME,
+        const_cast<char*>(function_name.c_str()),
+        function_name.size());
+  }
+  if (has(kCustomization)) {
+    params[count++] = OSSL_PARAM_construct_utf8_string(
+        OSSL_DIGEST_PARAM_CUSTOMIZATION,
+        const_cast<char*>(customization.c_str()),
+        customization.size());
+  }
+  params[count] = OSSL_PARAM_construct_end();
+  return ctx->digestInit(digest, params);
+#else
+  return false;
+#endif
+}
+
+namespace {
+bool ContainsNullByte(std::string_view value) {
+  return value.find('\0') != std::string_view::npos;
+}
+
+v8::Maybe<void> GetDigestStringOption(
+    Environment* env,
+    const v8::FunctionCallbackInfo<v8::Value>& args,
+    unsigned int offset,
+    CShakeOptions::Flag flag,
+    std::string* target,
+    CShakeOptions* options) {
+  if (args[offset]->IsUndefined()) return v8::JustVoid();
+  CHECK(IsAnyBufferSource(args[offset]));
+  ArrayBufferOrViewContents<char> value(args[offset]);
+  if (!value.CheckSizeInt32()) {
+    THROW_ERR_OUT_OF_RANGE(env, "digest option is too big");
+    return v8::Nothing<void>();
+  }
+  target->assign(value.data(), value.size());
+  if (ContainsNullByte(*target)) {
+    THROW_ERR_INVALID_ARG_VALUE(env,
+                                "Digest options must not contain null bytes");
+    return v8::Nothing<void>();
+  }
+  options->flags |= flag;
+  return v8::JustVoid();
+}
+}  // namespace
+
+v8::Maybe<void> GetCShakeOptions(
+    const v8::FunctionCallbackInfo<v8::Value>& args,
+    unsigned int offset,
+    CShakeOptions* options) {
+  Environment* env = Environment::GetCurrent(args);
+  if (GetDigestStringOption(env,
+                            args,
+                            offset,
+                            CShakeOptions::kFunctionName,
+                            &options->function_name,
+                            options)
+          .IsNothing() ||
+      GetDigestStringOption(env,
+                            args,
+                            offset + 1,
+                            CShakeOptions::kCustomization,
+                            &options->customization,
+                            options)
+          .IsNothing()) {
+    return v8::Nothing<void>();
+  }
+
+  return v8::JustVoid();
+}
+
 int PasswordCallback(char* buf, int size, int rwflag, void* u) {
   const ByteSource* passphrase = *static_cast<const ByteSource**>(u);
   if (passphrase != nullptr) {
@@ -99,6 +216,238 @@ int NoPasswordCallback(char* buf, int size, int rwflag, void* u) {
   return 0;
 }
 
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 4)
+namespace {
+
+constexpr size_t kMaxPendingFipsIndicatorEvents = 256;
+constexpr std::string_view kFipsIndicatorChannel = "crypto.fips.indicator";
+
+struct FipsIndicatorEvent {
+  std::string operation;
+  std::string reason;
+  bool blocked;
+  uint32_t count = 1;
+  uint32_t dropped = 0;
+};
+
+Local<DictionaryTemplate> GetFipsIndicatorEventTemplate(Environment* env) {
+  auto tmpl = env->fips_indicator_event_template();
+  if (tmpl.IsEmpty()) {
+    static constexpr std::string_view names[] = {
+        "operation",
+        "reason",
+        "blocked",
+        "count",
+        "dropped",
+    };
+    tmpl = DictionaryTemplate::New(env->isolate(), names);
+    env->set_fips_indicator_event_template(tmpl);
+  }
+  return tmpl;
+}
+
+class FipsIndicatorState final {
+ public:
+  static FipsIndicatorState& Get() {
+    static FipsIndicatorState state;
+    return state;
+  }
+
+  void Install() {
+    reject_unapproved_.store(
+        per_process::cli_options->force_fips_crypto &&
+            per_process::cli_options->force_fips_crypto_policy == "strict",
+        std::memory_order_release);
+    std::call_once(install_once_, [this]() {
+      OSSL_INDICATOR_get_callback(nullptr, &previous_callback_);
+      OSSL_INDICATOR_set_callback(nullptr, OnOpenSSLIndicator);
+    });
+  }
+
+  void Setup(Environment* env) {
+    CHECK(env->owns_process_state());
+    auto channel =
+        diagnostics_channel::Channel::Get(env, kFipsIndicatorChannel);
+    if (!channel) return;
+
+    Realm* realm = env->principal_realm();
+    auto* binding = realm->GetBindingData<diagnostics_channel::BindingData>();
+    CHECK_NOT_NULL(binding);
+    const uint32_t index =
+        binding->GetOrCreateChannelIndex(std::string(kFipsIndicatorChannel));
+
+    {
+      Mutex::ScopedLock lock(mutex_);
+      CHECK_NULL(env_);
+      env_ = env;
+      channel_ = channel;
+    }
+    env->AddCleanupHook(Cleanup, this);
+    binding->SetChannelStatusCallback(
+        index, [this](bool active) { SetActive(active); });
+    SetActive(channel->HasSubscribers());
+  }
+
+ private:
+  void SetActive(bool active) {
+    subscription_generation_++;
+    active_.store(active, std::memory_order_release);
+    if (active) return;
+
+    {
+      Mutex::ScopedLock lock(mutex_);
+      events_.clear();
+      dropped_events_ = 0;
+    }
+  }
+
+  static int OnOpenSSLIndicator(const char* operation,
+                                const char* reason,
+                                const OSSL_PARAM* params) {
+    return Get().OnIndicator(operation, reason, params);
+  }
+
+  static void Cleanup(void* data) {
+    static_cast<FipsIndicatorState*>(data)->CleanupEnvironment();
+  }
+
+  int OnIndicator(const char* operation,
+                  const char* reason,
+                  const OSSL_PARAM* params) {
+    const int previous_result =
+        previous_callback_ == nullptr
+            ? 1
+            : previous_callback_(operation, reason, params);
+    const int result = reject_unapproved_.load(std::memory_order_acquire)
+                           ? 0
+                           : previous_result;
+    if (!active_.load(std::memory_order_acquire)) return result;
+
+    const bool blocked = result == 0;
+    {
+      Mutex::ScopedLock lock(mutex_);
+      if (env_ != nullptr && active_.load(std::memory_order_relaxed)) {
+        const std::string operation_string =
+            operation == nullptr ? "" : operation;
+        const std::string reason_string = reason == nullptr ? "" : reason;
+        const auto existing = std::find_if(
+            events_.begin(),
+            events_.end(),
+            [&](const FipsIndicatorEvent& event) {
+              return event.operation == operation_string &&
+                     event.reason == reason_string && event.blocked == blocked;
+            });
+        if (existing == events_.end()) {
+          if (events_.size() < kMaxPendingFipsIndicatorEvents) {
+            events_.push_back({operation_string, reason_string, blocked});
+          } else if (dropped_events_ != UINT32_MAX) {
+            dropped_events_++;
+          }
+        } else if (existing->count != UINT32_MAX) {
+          existing->count++;
+        } else if (dropped_events_ != UINT32_MAX) {
+          dropped_events_++;
+        }
+        if (!dispatch_scheduled_) {
+          dispatch_scheduled_ = true;
+          env_->SetImmediateThreadsafe(
+              [](Environment* env) { Get().Drain(env); },
+              CallbackFlags::kUnrefed);
+        }
+      }
+    }
+    return result;
+  }
+
+  void Drain(Environment* env) {
+    CHECK(env->owns_process_state());
+    std::deque<FipsIndicatorEvent> events;
+    {
+      Mutex::ScopedLock lock(mutex_);
+      if (env_ != env) return;
+      events.swap(events_);
+      if (!events.empty()) events.front().dropped = dropped_events_;
+      dropped_events_ = 0;
+      dispatch_scheduled_ = false;
+    }
+    if (events.empty() || !channel_ || !channel_->HasSubscribers()) return;
+
+    Isolate* isolate = env->isolate();
+    HandleScope handle_scope(isolate);
+    Local<Context> context = env->context();
+    const uint64_t subscription_generation = subscription_generation_;
+    for (const auto& event : events) {
+      if (subscription_generation_ != subscription_generation) return;
+      MaybeLocal<Value> values[] = {
+          OneByteString(isolate, event.operation),
+          OneByteString(isolate, event.reason),
+          v8::Boolean::New(isolate, event.blocked),
+          Uint32::New(isolate, event.count),
+          Uint32::New(isolate, event.dropped),
+      };
+      Local<Object> value;
+      if (!NewDictionaryInstance(
+               context, GetFipsIndicatorEventTemplate(env), values)
+               .ToLocal(&value)) {
+        return;
+      }
+      channel_->Publish(env, value);
+      if (subscription_generation_ != subscription_generation) return;
+    }
+  }
+
+  void CleanupEnvironment() {
+    subscription_generation_++;
+    active_.store(false, std::memory_order_release);
+    {
+      Mutex::ScopedLock lock(mutex_);
+      env_ = nullptr;
+      channel_.reset();
+      events_.clear();
+      dropped_events_ = 0;
+      dispatch_scheduled_ = false;
+    }
+  }
+
+  std::once_flag install_once_;
+  std::atomic<bool> active_{false};
+  std::atomic<bool> reject_unapproved_{false};
+  OSSL_INDICATOR_CALLBACK* previous_callback_ = nullptr;
+  Mutex mutex_;
+  Environment* env_ = nullptr;
+  BaseObjectPtr<diagnostics_channel::Channel> channel_;
+  std::deque<FipsIndicatorEvent> events_;
+  uint32_t dropped_events_ = 0;
+  bool dispatch_scheduled_ = false;
+  uint64_t subscription_generation_ = 0;
+};
+
+}  // namespace
+#endif
+
+void InstallFipsIndicatorCallback() {
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 4)
+  const auto& options = per_process::cli_options;
+  const bool strict = options->force_fips_crypto &&
+                      options->force_fips_crypto_policy == "strict";
+  if (options->enable_fips_indicator_events || strict) {
+    FipsIndicatorState::Get().Install();
+  }
+#endif
+}
+
+void SetupFipsIndicatorChannel(const FunctionCallbackInfo<Value>& args) {
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 4)
+  Environment* env = Environment::GetCurrent(args);
+  if (env->owns_process_state() &&
+      per_process::cli_options->enable_fips_indicator_events) {
+    FipsIndicatorState::Get().Setup(env);
+  }
+#else
+  USE(args);
+#endif
+}
+
 std::optional<std::string> ProcessFipsOptions() {
   const bool enable_fips = per_process::cli_options->enable_fips_crypto;
   const bool force_fips = per_process::cli_options->force_fips_crypto;
@@ -156,6 +505,7 @@ void InitCryptoOnce() {
   Mutex::ScopedLock fips_lock(fips_mutex);
 #ifndef OPENSSL_IS_BORINGSSL
   OPENSSL_INIT_SETTINGS* settings = OPENSSL_INIT_new();
+  CHECK_NOT_NULL(settings);
 
 #if OPENSSL_VERSION_MAJOR < 3
   // --openssl-config=...
@@ -176,6 +526,7 @@ void InitCryptoOnce() {
 #endif
 
   OPENSSL_init_ssl(0, settings);
+  InstallFipsIndicatorCallback();
 
 #if OPENSSL_WITH_OPENSSL_PQC
   // Configure all loaded providers to prefer seed-only format for ML-KEM and
@@ -231,6 +582,11 @@ void GetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(IsFipsEnabled() ? 1 : 0);
 }
 
+void GetFipsCryptoGeneration(const FunctionCallbackInfo<Value>& args) {
+  args.GetReturnValue().Set(BigInt::NewFromUnsigned(
+      args.GetIsolate(), ncrypto::getFipsStateGeneration()));
+}
+
 void SetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
   Mutex::ScopedLock lock(per_process::cli_options_mutex);
   Mutex::ScopedLock fips_lock(fips_mutex);
@@ -891,6 +1247,10 @@ void Initialize(Environment* env, Local<Object> target) {
 #endif  // !OPENSSL_NO_ENGINE
 
   SetMethodNoSideEffect(context, target, "getFipsCrypto", GetFipsCrypto);
+  SetMethodNoSideEffect(
+      context, target, "getFipsCryptoGeneration", GetFipsCryptoGeneration);
+  SetMethod(
+      context, target, "setupFipsIndicatorChannel", SetupFipsIndicatorChannel);
   SetMethod(context, target, "setFipsCrypto", SetFipsCrypto);
   SetMethodNoSideEffect(context, target, "testFipsCrypto", TestFipsCrypto);
 
@@ -910,6 +1270,8 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
 #endif  // !OPENSSL_NO_ENGINE
 
   registry->Register(GetFipsCrypto);
+  registry->Register(GetFipsCryptoGeneration);
+  registry->Register(SetupFipsIndicatorChannel);
   registry->Register(SetFipsCrypto);
   registry->Register(TestFipsCrypto);
   registry->Register(SecureBuffer);
diff --git a/src/crypto/crypto_util.h b/src/crypto/crypto_util.h
index c74a6e7fd507..aafdd3bf273b 100644
--- a/src/crypto/crypto_util.h
+++ b/src/crypto/crypto_util.h
@@ -50,6 +50,7 @@ namespace node::crypto {
 constexpr size_t kSizeOf_DH = 144;
 constexpr size_t kSizeOf_EC_KEY = 80;
 constexpr size_t kSizeOf_EVP_CIPHER_CTX = 168;
+constexpr size_t kSizeOf_EVP_MAC_CTX = 16;
 constexpr size_t kSizeOf_EVP_MD_CTX = 48;
 constexpr size_t kSizeOf_EVP_PKEY = 72;
 constexpr size_t kSizeOf_EVP_PKEY_CTX = 80;
@@ -67,6 +68,7 @@ constexpr T NumBitsToBytes(T bits) {
 // options were applied successfully.
 std::optional<std::string> ProcessFipsOptions();
 bool IsFipsEnabled();
+void InstallFipsIndicatorCallback();
 
 bool InitCryptoOnce(v8::Isolate* isolate);
 void InitCryptoOnce();
@@ -286,6 +288,35 @@ enum CryptoJobMode { kCryptoJobAsync, kCryptoJobSync, kCryptoJobWebCrypto };
 CryptoJobMode GetCryptoJobMode(v8::Local<v8::Value> args);
 bool IsCryptoJobAsync(CryptoJobMode mode);
 
+struct CShakeOptions final : public MemoryRetainer {
+  enum Flag : uint8_t {
+    kFunctionName = 1 << 0,
+    kCustomization = 1 << 1,
+  };
+
+  std::string function_name;
+  std::string customization;
+  uint8_t flags = 0;
+
+  CShakeOptions() = default;
+  CShakeOptions(CShakeOptions&& other) noexcept;
+  CShakeOptions& operator=(CShakeOptions&& other) noexcept;
+
+  bool empty() const { return flags == 0; }
+  bool has(Flag flag) const { return (flags & flag) != 0; }
+
+  bool Initialize(ncrypto::EVPMDCtxPointer* ctx, const EVP_MD* digest) const;
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(CShakeOptions)
+  SET_SELF_SIZE(CShakeOptions)
+};
+
+v8::Maybe<void> GetCShakeOptions(
+    const v8::FunctionCallbackInfo<v8::Value>& args,
+    unsigned int offset,
+    CShakeOptions* options);
+
 v8::MaybeLocal<v8::Value> CreateWebCryptoJobError(Environment* env,
                                                   v8::Local<v8::Value> cause);
 
diff --git a/src/crypto/crypto_x509.cc b/src/crypto/crypto_x509.cc
index 6ed7d7d25db0..b81141e1a915 100644
--- a/src/crypto/crypto_x509.cc
+++ b/src/crypto/crypto_x509.cc
@@ -807,7 +807,7 @@ Local<FunctionTemplate> X509Certificate::GetConstructorTemplate(
   Local<FunctionTemplate> tmpl = env->x509_constructor_template();
   if (tmpl.IsEmpty()) {
     Isolate* isolate = env->isolate();
-    tmpl = NewFunctionTemplate(isolate, nullptr);
+    tmpl = NewFunctionTemplate(isolate, NewFromHandle);
     tmpl->InstanceTemplate()->SetInternalFieldCount(
         X509Certificate::kInternalFieldCount);
     tmpl->SetClassName(
@@ -850,43 +850,118 @@ Local<FunctionTemplate> X509Certificate::GetConstructorTemplate(
   return tmpl;
 }
 
-bool X509Certificate::HasInstance(Environment* env, Local<Object> object) {
-  return GetConstructorTemplate(env)->HasInstance(object);
+bool X509Certificate::HasInstance(Environment* env, Local<Value> value) {
+  return GetConstructorTemplate(env)->HasInstance(value);
+}
+
+void X509Certificate::NewFromHandle(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  if (args.Length() == 1 && args[0]->IsArrayBufferView()) {
+    ArrayBufferViewContents<unsigned char> buf(args[0].As<ArrayBufferView>());
+    auto result = X509Pointer::Parse(ncrypto::Buffer<const unsigned char>{
+        .data = buf.data(),
+        .len = buf.length(),
+    });
+    if (!result.value) [[unlikely]] {
+      return ThrowCryptoError(env, result.error.value_or(0));
+    }
+    new X509Certificate(env,
+                        args.This(),
+                        std::make_shared<ManagedX509>(std::move(result.value)));
+    return;
+  }
+
+  if (args.Length() != 1 || !HasInstance(env, args[0])) {
+    THROW_ERR_INVALID_ARG_TYPE(
+        env, "value must be an X509CertificateHandle or BufferSource");
+    return;
+  }
+
+  X509Certificate* handle = Unwrap<X509Certificate>(args[0].As<Object>());
+  CHECK_NOT_NULL(handle);
+  Local<Object> issuer;
+  if (handle->issuer_cert_) issuer = handle->issuer_cert_->object();
+  new X509Certificate(env, args.This(), handle->cert_, issuer);
+}
+
+void X509Certificate::CreateX509CertificateClass(
+    const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_EQ(args.Length(), 1);
+  CHECK(args[0]->IsFunction());
+
+  Local<Value> ctor;
+  if (!GetConstructorTemplate(env)->GetFunction(env->context()).ToLocal(&ctor))
+    return;
+
+  Local<Value> ret;
+  if (!args[0]
+           .As<Function>()
+           ->Call(env->context(), Undefined(env->isolate()), 1, &ctor)
+           .ToLocal(&ret)) {
+    return;
+  }
+
+  Local<Array> constructors = ret.As<Array>();
+  Local<Value> internal_ctor;
+  if (!constructors->Get(env->context(), 1).ToLocal(&internal_ctor)) return;
+  CHECK(env->crypto_internal_x509_certificate_constructor().IsEmpty());
+  env->set_crypto_internal_x509_certificate_constructor(
+      internal_ctor.As<Function>());
+  args.GetReturnValue().Set(constructors);
+}
+
+void X509Certificate::IsX509Certificate(
+    const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_EQ(args.Length(), 1);
+  args.GetReturnValue().Set(HasInstance(env, args[0]));
 }
 
 MaybeLocal<Object> X509Certificate::New(Environment* env,
                                         X509Pointer cert,
-                                        STACK_OF(X509) * issuer_chain) {
+                                        const STACK_OF(X509) * issuer_chain) {
   std::shared_ptr<ManagedX509> mcert(new ManagedX509(std::move(cert)));
   return New(env, std::move(mcert), issuer_chain);
 }
 
 MaybeLocal<Object> X509Certificate::New(Environment* env,
                                         std::shared_ptr<ManagedX509> cert,
-                                        STACK_OF(X509) * issuer_chain) {
-  EscapableHandleScope scope(env->isolate());
-  Local<Function> ctor;
-  if (!GetConstructorTemplate(env)->GetFunction(env->context()).ToLocal(&ctor))
-    return MaybeLocal<Object>();
+                                        const STACK_OF(X509) * issuer_chain) {
+  return NewWithIssuers(env, std::move(cert), issuer_chain, 0);
+}
 
+MaybeLocal<Object> X509Certificate::NewWithIssuers(
+    Environment* env,
+    std::shared_ptr<ManagedX509> cert,
+    const STACK_OF(X509) * issuer_chain,
+    int start) {
+  EscapableHandleScope scope(env->isolate());
   Local<Object> obj;
-  if (!ctor->NewInstance(env->context()).ToLocal(&obj))
+  if (!GetConstructorTemplate(env)
+           ->InstanceTemplate()
+           ->NewInstance(env->context())
+           .ToLocal(&obj)) {
     return MaybeLocal<Object>();
+  }
 
-  Local<Object> issuer_chain_obj;
-  if (issuer_chain != nullptr && sk_X509_num(issuer_chain)) {
-    X509Pointer cert(X509_dup(sk_X509_value(issuer_chain, 0)));
-    sk_X509_delete(issuer_chain, 0);
-    auto maybeObj =
-        sk_X509_num(issuer_chain)
-            ? X509Certificate::New(env, std::move(cert), issuer_chain)
-            : X509Certificate::New(env, std::move(cert));
-    if (!maybeObj.ToLocal(&issuer_chain_obj)) [[unlikely]] {
+  Local<Object> issuer;
+  if (issuer_chain != nullptr && start < sk_X509_num(issuer_chain)) {
+    X509Pointer issuer_cert =
+        X509View(sk_X509_value(issuer_chain, start)).clone();
+    if (!issuer_cert) [[unlikely]] {
+      return MaybeLocal<Object>();
+    }
+    if (!NewWithIssuers(env,
+                        std::make_shared<ManagedX509>(std::move(issuer_cert)),
+                        issuer_chain,
+                        start + 1)
+             .ToLocal(&issuer)) [[unlikely]] {
       return MaybeLocal<Object>();
     }
   }
 
-  new X509Certificate(env, obj, std::move(cert), issuer_chain_obj);
+  new X509Certificate(env, obj, std::move(cert), issuer);
   return scope.Escape(obj);
 }
 
@@ -903,23 +978,29 @@ MaybeLocal<Object> X509Certificate::GetPeerCert(Environment* env,
                                                 GetPeerCertificateFlag flag) {
   ClearErrorOnReturn clear_error_on_return;
 
+  // The peer chain is owned by the SSL session and must not be modified. Its
+  // first entry is the peer certificate on the client but not on the server.
+  const STACK_OF(X509)* ssl_certs = SSL_get_peer_cert_chain(ssl.get());
+  int issuers_start = 0;
+
   X509Pointer cert;
   if ((flag & GetPeerCertificateFlag::SERVER) ==
       GetPeerCertificateFlag::SERVER) {
     cert = X509Pointer::PeerFrom(ssl);
   }
-
-  STACK_OF(X509)* ssl_certs = SSL_get_peer_cert_chain(ssl.get());
-  if (!cert && (ssl_certs == nullptr || sk_X509_num(ssl_certs) == 0))
-    return MaybeLocal<Object>();
-
-  if (!cert) [[unlikely]] {
-    cert.reset(sk_X509_value(ssl_certs, 0));
-    sk_X509_delete(ssl_certs, 0);
+  if (!cert) {
+    if (ssl_certs == nullptr || sk_X509_num(ssl_certs) == 0)
+      return MaybeLocal<Object>();
+    cert = X509View(sk_X509_value(ssl_certs, 0)).clone();
+    if (!cert) [[unlikely]]
+      return MaybeLocal<Object>();
+    issuers_start = 1;
   }
 
-  return sk_X509_num(ssl_certs) ? New(env, std::move(cert), ssl_certs)
-                                : New(env, std::move(cert));
+  return NewWithIssuers(env,
+                        std::make_shared<ManagedX509>(std::move(cert)),
+                        ssl_certs,
+                        issuers_start);
 }
 
 v8::MaybeLocal<v8::Value> X509Certificate::toObject(Environment* env) {
@@ -963,11 +1044,31 @@ X509Certificate::X509CertificateTransferData::Deserialize(
   if (!X509Certificate::New(env, data_).ToLocal(&handle))
     return {};
 
-  return BaseObjectPtr<BaseObject>(
-      Unwrap<X509Certificate>(handle.As<Object>()));
+  Local<Value> module =
+      FIXED_ONE_BYTE_STRING(env->isolate(), "internal/crypto/x509");
+  if (env->builtin_module_require()
+          ->Call(context, Null(env->isolate()), 1, &module)
+          .IsEmpty()) {
+    return {};
+  }
+
+  Local<Function> ctor = env->crypto_internal_x509_certificate_constructor();
+  CHECK(!ctor.IsEmpty());
+  Local<Value> cert;
+  if (!ctor->NewInstance(context, 1, &handle).ToLocal(&cert)) return {};
+
+  return BaseObjectPtr<BaseObject>(Unwrap<X509Certificate>(cert.As<Object>()));
 }
 
 BaseObject::TransferMode X509Certificate::GetTransferMode() const {
+  Local<Value> transfer_mode =
+      object()
+          ->GetPrivate(env()->context(), env()->transfer_mode_private_symbol())
+          .ToLocalChecked();
+  if (transfer_mode->IsUint32() &&
+      (transfer_mode.As<Uint32>()->Value() & TransferMode::kCloneable) == 0) {
+    return BaseObject::TransferMode::kDisallowCloneAndTransfer;
+  }
   return BaseObject::TransferMode::kCloneable;
 }
 
@@ -977,6 +1078,12 @@ std::unique_ptr<worker::TransferData> X509Certificate::CloneForMessaging()
 }
 
 void X509Certificate::Initialize(Environment* env, Local<Object> target) {
+  SetMethod(env->context(),
+            target,
+            "createX509CertificateClass",
+            CreateX509CertificateClass);
+  SetMethodNoSideEffect(
+      env->context(), target, "isX509Certificate", IsX509Certificate);
   SetMethod(env->context(), target, "parseX509", Parse);
 
   NODE_DEFINE_CONSTANT(target, X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT);
@@ -989,6 +1096,9 @@ void X509Certificate::Initialize(Environment* env, Local<Object> target) {
 
 void X509Certificate::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
+  registry->Register(CreateX509CertificateClass);
+  registry->Register(IsX509Certificate);
+  registry->Register(NewFromHandle);
   registry->Register(Parse);
   registry->Register(Subject);
   registry->Register(SubjectAltName);
diff --git a/src/crypto/crypto_x509.h b/src/crypto/crypto_x509.h
index c94e832a2845..a6f64d4f2d4f 100644
--- a/src/crypto/crypto_x509.h
+++ b/src/crypto/crypto_x509.h
@@ -49,17 +49,23 @@ class X509Certificate final : public BaseObject {
   static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
   static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
       Environment* env);
-  static bool HasInstance(Environment* env, v8::Local<v8::Object> object);
+  static bool HasInstance(Environment* env, v8::Local<v8::Value> value);
+
+  static void CreateX509CertificateClass(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void IsX509Certificate(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void NewFromHandle(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   static v8::MaybeLocal<v8::Object> New(
       Environment* env,
       ncrypto::X509Pointer cert,
-      STACK_OF(X509) * issuer_chain = nullptr);
+      const STACK_OF(X509) * issuer_chain = nullptr);
 
   static v8::MaybeLocal<v8::Object> New(
       Environment* env,
       std::shared_ptr<ManagedX509> cert,
-      STACK_OF(X509)* issuer_chain = nullptr);
+      const STACK_OF(X509) * issuer_chain = nullptr);
 
   static v8::MaybeLocal<v8::Object> GetCert(Environment* env,
                                             const ncrypto::SSLPointer& ssl);
@@ -115,6 +121,13 @@ class X509Certificate final : public BaseObject {
                   std::shared_ptr<ManagedX509> cert,
                   v8::Local<v8::Object> issuer_chain = v8::Local<v8::Object>());
 
+  // Like New(), but reads the issuer chain from issuer_chain[start] upward.
+  static v8::MaybeLocal<v8::Object> NewWithIssuers(
+      Environment* env,
+      std::shared_ptr<ManagedX509> cert,
+      const STACK_OF(X509) * issuer_chain,
+      int start);
+
   std::shared_ptr<ManagedX509> cert_;
   BaseObjectPtr<X509Certificate> issuer_cert_;
 };
diff --git a/src/dataqueue/queue.cc b/src/dataqueue/queue.cc
index 8516362b7a87..cef5f4456b3a 100644
--- a/src/dataqueue/queue.cc
+++ b/src/dataqueue/queue.cc
@@ -174,14 +174,35 @@ class DataQueueImpl final : public DataQueue,
     backpressure_listeners_.erase(listener);
   }
 
+  // Both notifications below can re-enter this DataQueue: a listener may end
+  // up calling into JavaScript, which can destroy the owner of a listener and
+  // so mutate backpressure_listeners_ (or drop the last reference to this
+  // queue) while we are iterating. Hold a reference, iterate a snapshot, and
+  // re-check membership so a listener removed mid-notification is not called.
   void NotifyBackpressure(size_t amount) {
     if (idempotent_) return;
-    for (auto& listener : backpressure_listeners_) listener->EntryRead(amount);
+    if (backpressure_listeners_.empty()) return;
+    auto self = shared_from_this();
+    std::vector<BackpressureListener*> listeners(
+        backpressure_listeners_.begin(), backpressure_listeners_.end());
+    for (auto* listener : listeners) {
+      if (backpressure_listeners_.contains(listener)) {
+        listener->EntryRead(amount);
+      }
+    }
   }
 
   void NotifyBeforePull() {
     if (idempotent_) return;
-    for (auto& listener : backpressure_listeners_) listener->BeforePull();
+    if (backpressure_listeners_.empty()) return;
+    auto self = shared_from_this();
+    std::vector<BackpressureListener*> listeners(
+        backpressure_listeners_.begin(), backpressure_listeners_.end());
+    for (auto* listener : listeners) {
+      if (backpressure_listeners_.contains(listener)) {
+        listener->BeforePull();
+      }
+    }
   }
 
   bool HasBackpressureListeners() const noexcept {
@@ -847,13 +868,19 @@ class FdEntry final : public EntryImpl {
   // the race
   //   condition described in the comment above.
  public:
-  static std::unique_ptr<FdEntry> Create(Environment* env, Local<Value> path) {
+  static std::unique_ptr<FdEntry> Create(Environment* env,
+                                         Local<Value> path,
+                                         int* status) {
     // We're only going to create the FdEntry if the file exists.
     uv_fs_t req = uv_fs_t();
     auto cleanup = OnScopeLeave([&] { uv_fs_req_cleanup(&req); });
 
     auto buf = std::make_shared<BufferValue>(env->isolate(), path);
-    if (uv_fs_stat(nullptr, &req, buf->out(), nullptr) < 0) return nullptr;
+    int err = uv_fs_stat(nullptr, &req, buf->out(), nullptr);
+    if (err < 0) {
+      if (status != nullptr) *status = err;
+      return nullptr;
+    }
 
     return std::make_unique<FdEntry>(
         env, std::move(buf), req.statbuf, 0, req.statbuf.st_size);
@@ -1162,8 +1189,9 @@ std::unique_ptr<DataQueue::Entry> DataQueue::CreateDataQueueEntry(
 }
 
 std::unique_ptr<DataQueue::Entry> DataQueue::CreateFdEntry(Environment* env,
-                                                           Local<Value> path) {
-  return FdEntry::Create(env, path);
+                                                           Local<Value> path,
+                                                           int* status) {
+  return FdEntry::Create(env, path, status);
 }
 
 void DataQueue::Initialize(Environment* env, v8::Local<v8::Object> target) {
diff --git a/src/dataqueue/queue.h b/src/dataqueue/queue.h
index 190c54111b3e..64c7404e8b41 100644
--- a/src/dataqueue/queue.h
+++ b/src/dataqueue/queue.h
@@ -226,8 +226,11 @@ class DataQueue : public MemoryRetainer {
   static std::unique_ptr<Entry> CreateDataQueueEntry(
       std::shared_ptr<DataQueue> data_queue);
 
+  // Returns nullptr if the file cannot be stat'd. When `status` is given, it
+  // is set to the libuv error code so callers can report why.
   static std::unique_ptr<Entry> CreateFdEntry(Environment* env,
-                                              v8::Local<v8::Value> path);
+                                              v8::Local<v8::Value> path,
+                                              int* status = nullptr);
 
   // Creates a Reader for the given queue. If the queue is idempotent,
   // any number of readers can be created, all of which are guaranteed
diff --git a/src/debug_utils.h b/src/debug_utils.h
index 616f6c03e49a..f381e48547c1 100644
--- a/src/debug_utils.h
+++ b/src/debug_utils.h
@@ -49,7 +49,6 @@ void NODE_EXTERN_PRIVATE FWrite(FILE* file, const std::string& str);
   V(COMPILE_CACHE)                                                             \
   V(CONTEXTIFY)                                                                \
   V(DIAGNOSTICS)                                                               \
-  V(HUGEPAGES)                                                                 \
   V(INSPECTOR_SERVER)                                                          \
   V(INSPECTOR_CLIENT)                                                          \
   V(INSPECTOR_PROFILER)                                                        \
diff --git a/src/dtls/dtls.cc b/src/dtls/dtls.cc
new file mode 100644
index 000000000000..288d317dfa14
--- /dev/null
+++ b/src/dtls/dtls.cc
@@ -0,0 +1,98 @@
+#include "dtls.h"
+
+#if HAVE_OPENSSL && HAVE_DTLS
+
+#include "dtls_context.h"
+#include "dtls_endpoint.h"
+#include "dtls_session.h"
+
+#include <env-inl.h>
+#include <node_external_reference.h>
+#include <node_sockaddr-inl.h>
+#include <util-inl.h>
+#include <v8.h>
+
+namespace node {
+
+using v8::Context;
+using v8::Local;
+using v8::Object;
+using v8::ObjectTemplate;
+using v8::Value;
+
+namespace dtls {
+
+void CreatePerContextProperties(Local<Object> target,
+                                Local<Value> unused,
+                                Local<Context> context,
+                                void* priv) {
+  Environment* env = Environment::GetCurrent(context);
+
+  // Register constructors.
+  DTLSContext::InitPerContext(target, context, env);
+  DTLSEndpoint::InitPerContext(target, context, env);
+  DTLSSession::InitPerContext(target, context, env);
+
+  // Endpoint state indices
+  NODE_DEFINE_CONSTANT(target, IDX_ENDPOINT_STATE_BOUND);
+  NODE_DEFINE_CONSTANT(target, IDX_ENDPOINT_STATE_LISTENING);
+  NODE_DEFINE_CONSTANT(target, IDX_ENDPOINT_STATE_CLOSING);
+  NODE_DEFINE_CONSTANT(target, IDX_ENDPOINT_STATE_DESTROYED);
+  NODE_DEFINE_CONSTANT(target, IDX_ENDPOINT_STATE_SESSION_COUNT);
+  NODE_DEFINE_CONSTANT(target, IDX_ENDPOINT_STATE_BUSY);
+
+  // Session state indices
+  NODE_DEFINE_CONSTANT(target, IDX_SESSION_STATE_HANDSHAKING);
+  NODE_DEFINE_CONSTANT(target, IDX_SESSION_STATE_OPEN);
+  NODE_DEFINE_CONSTANT(target, IDX_SESSION_STATE_CLOSING);
+  NODE_DEFINE_CONSTANT(target, IDX_SESSION_STATE_DESTROYED);
+  NODE_DEFINE_CONSTANT(target, IDX_SESSION_STATE_HAS_MESSAGE_LISTENER);
+
+  // Endpoint stats indices (for BigUint64Array access from JS)
+#define V(name, _) IDX_STATS_ENDPOINT_##name,
+  enum IDX_STATS_ENDPOINT { DTLS_ENDPOINT_STATS(V) IDX_STATS_ENDPOINT_COUNT };
+#undef V
+#define V(name, _) NODE_DEFINE_CONSTANT(target, IDX_STATS_ENDPOINT_##name);
+  DTLS_ENDPOINT_STATS(V);
+#undef V
+  NODE_DEFINE_CONSTANT(target, IDX_STATS_ENDPOINT_COUNT);
+
+  // Session stats indices
+#define V(name, _) IDX_STATS_SESSION_##name,
+  enum IDX_STATS_SESSION { DTLS_SESSION_STATS(V) IDX_STATS_SESSION_COUNT };
+#undef V
+#define V(name, _) NODE_DEFINE_CONSTANT(target, IDX_STATS_SESSION_##name);
+  DTLS_SESSION_STATS(V);
+#undef V
+  NODE_DEFINE_CONSTANT(target, IDX_STATS_SESSION_COUNT);
+
+  // SSL verify mode constants
+  constexpr auto SSL_VERIFY_NONE_VALUE = SSL_VERIFY_NONE;
+  constexpr auto SSL_VERIFY_PEER_VALUE = SSL_VERIFY_PEER;
+  constexpr auto SSL_VERIFY_FAIL_IF_NO_PEER_CERT_VALUE =
+      SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
+  NODE_DEFINE_CONSTANT(target, SSL_VERIFY_NONE_VALUE);
+  NODE_DEFINE_CONSTANT(target, SSL_VERIFY_PEER_VALUE);
+  NODE_DEFINE_CONSTANT(target, SSL_VERIFY_FAIL_IF_NO_PEER_CERT_VALUE);
+}
+
+void CreatePerIsolateProperties(IsolateData* isolate_data,
+                                Local<ObjectTemplate> target) {
+  // Per-isolate initialization (currently none needed).
+}
+
+void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
+  DTLSContext::RegisterExternalReferences(registry);
+  DTLSEndpoint::RegisterExternalReferences(registry);
+  DTLSSession::RegisterExternalReferences(registry);
+}
+
+}  // namespace dtls
+}  // namespace node
+
+NODE_BINDING_CONTEXT_AWARE_INTERNAL(dtls,
+                                    node::dtls::CreatePerContextProperties)
+NODE_BINDING_PER_ISOLATE_INIT(dtls, node::dtls::CreatePerIsolateProperties)
+NODE_BINDING_EXTERNAL_REFERENCE(dtls, node::dtls::RegisterExternalReferences)
+
+#endif  // HAVE_OPENSSL && HAVE_DTLS
diff --git a/src/dtls/dtls.h b/src/dtls/dtls.h
new file mode 100644
index 000000000000..1faed3910e21
--- /dev/null
+++ b/src/dtls/dtls.h
@@ -0,0 +1,109 @@
+#pragma once
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#if HAVE_OPENSSL && HAVE_DTLS
+
+#include <env.h>
+#include <node_errors.h>
+#include <uv.h>
+#include <v8.h>
+
+#include <cstdint>
+
+namespace node::dtls {
+
+// Utilities for updating stats maintained in an AliasedStruct.
+template <typename Stats, uint64_t Stats::*member>
+void IncrementStat(Stats* stats, uint64_t amt = 1) {
+  stats->*member += amt;
+}
+
+template <typename Stats, uint64_t Stats::*member>
+void RecordTimestampStat(Stats* stats) {
+  stats->*member = uv_hrtime();
+}
+
+#define DTLS_STAT_INCREMENT(Type, name)                                        \
+  IncrementStat<Type, &Type::name>(stats_.Data())
+#define DTLS_STAT_INCREMENT_N(Type, name, amt)                                 \
+  IncrementStat<Type, &Type::name>(stats_.Data(), amt)
+#define DTLS_STAT_RECORD_TIMESTAMP(Type, name)                                 \
+  RecordTimestampStat<Type, &Type::name>(stats_.Data())
+
+#define DTLS_STAT_FIELD(_, name) uint64_t name;
+
+// ============================================================================
+// Stats X-macros: V(ENUM_NAME, field_name)
+
+#define DTLS_ENDPOINT_STATS(V)                                                 \
+  V(CREATED_AT, created_at)                                                    \
+  V(DESTROYED_AT, destroyed_at)                                                \
+  V(BYTES_RECEIVED, bytes_received)                                            \
+  V(BYTES_SENT, bytes_sent)                                                    \
+  V(PACKETS_RECEIVED, packets_received)                                        \
+  V(PACKETS_SENT, packets_sent)                                                \
+  V(SERVER_SESSIONS, server_sessions)                                          \
+  V(CLIENT_SESSIONS, client_sessions)                                          \
+  V(SERVER_BUSY_COUNT, server_busy_count)
+
+#define DTLS_SESSION_STATS(V)                                                  \
+  V(CREATED_AT, created_at)                                                    \
+  V(DESTROYED_AT, destroyed_at)                                                \
+  V(CLOSING_AT, closing_at)                                                    \
+  V(HANDSHAKE_COMPLETED_AT, handshake_completed_at)                            \
+  V(BYTES_RECEIVED, bytes_received)                                            \
+  V(BYTES_SENT, bytes_sent)                                                    \
+  V(MESSAGES_RECEIVED, messages_received)                                      \
+  V(MESSAGES_SENT, messages_sent)                                              \
+  V(RETRANSMIT_COUNT, retransmit_count)
+
+// State "indices" shared between C++ and JS via AliasedStruct/DataView. These
+// are BYTE OFFSETS into the state struct, not sequential indices: session_count
+// is a uint32, so `busy`, which follows it, sits at byte offset 8. The
+// static_asserts in dtls_endpoint.cc pin these to the actual struct layout.
+// Keep in sync with lib/internal/dtls/state.js.
+enum DTLSEndpointStateIndex {
+  IDX_ENDPOINT_STATE_BOUND = 0,
+  IDX_ENDPOINT_STATE_LISTENING = 1,
+  IDX_ENDPOINT_STATE_CLOSING = 2,
+  IDX_ENDPOINT_STATE_DESTROYED = 3,
+  IDX_ENDPOINT_STATE_SESSION_COUNT = 4,
+  IDX_ENDPOINT_STATE_BUSY = 8,
+};
+
+enum DTLSSessionStateIndex {
+  IDX_SESSION_STATE_HANDSHAKING = 0,
+  IDX_SESSION_STATE_OPEN,
+  IDX_SESSION_STATE_CLOSING,
+  IDX_SESSION_STATE_DESTROYED,
+  IDX_SESSION_STATE_HAS_MESSAGE_LISTENER,
+  IDX_SESSION_STATE_COUNT
+};
+
+// Callback indices for JS dispatch
+enum DTLSCallbackIndex {
+  DTLS_CB_ENDPOINT_CLOSE = 0,
+  DTLS_CB_ENDPOINT_ERROR,
+  DTLS_CB_SESSION_NEW,
+  DTLS_CB_SESSION_CLOSE,
+  DTLS_CB_SESSION_ERROR,
+  DTLS_CB_SESSION_HANDSHAKE,
+  DTLS_CB_SESSION_MESSAGE,
+  DTLS_CB_SESSION_KEYLOG,
+  DTLS_CB_SESSION_TICKET,
+  DTLS_CB_COUNT
+};
+
+void CreatePerContextProperties(v8::Local<v8::Object> target,
+                                v8::Local<v8::Value> unused,
+                                v8::Local<v8::Context> context,
+                                void* priv);
+void CreatePerIsolateProperties(IsolateData* isolate_data,
+                                v8::Local<v8::ObjectTemplate> target);
+void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+
+}  // namespace node::dtls
+
+#endif  // HAVE_OPENSSL && HAVE_DTLS
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/dtls/dtls_context.cc b/src/dtls/dtls_context.cc
new file mode 100644
index 000000000000..b5ee22fb6475
--- /dev/null
+++ b/src/dtls/dtls_context.cc
@@ -0,0 +1,448 @@
+#include "dtls_context.h"
+#include "dtls_session.h"
+
+#if HAVE_OPENSSL && HAVE_DTLS
+
+#include <base_object-inl.h>
+#include <crypto/crypto_bio.h>
+#include <crypto/crypto_client_hello.h>
+#include <crypto/crypto_tls_certificates.h>
+#include <crypto/crypto_util.h>
+#include <env-inl.h>
+#include <memory_tracker-inl.h>
+#include <node_errors.h>
+#include <node_sockaddr-inl.h>
+#include <util-inl.h>
+#include <uv.h>
+
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/rand.h>
+#include <openssl/srtp.h>
+#include <openssl/ssl.h>
+
+#include <cstring>
+
+namespace node {
+
+using v8::Context;
+using v8::FunctionCallbackInfo;
+using v8::FunctionTemplate;
+using v8::Isolate;
+using v8::Local;
+using v8::Object;
+using v8::Value;
+
+namespace dtls {
+
+namespace {
+// The cookie secret is 32 bytes (256 bits).
+constexpr size_t kCookieSecretLen = 32;
+// Cookies are bound to a coarse time window so they expire. A cookie is
+// accepted for the window it was minted in and the immediately preceding one,
+// giving ~30-60s of validity -- ample for the cookie exchange while bounding
+// how long a captured cookie can be replayed.
+constexpr uint64_t kCookieWindowNs = 30ull * 1000 * 1000 * 1000;
+}  // namespace
+
+DTLSContext::DTLSContext(Environment* env,
+                         Local<Object> wrap,
+                         ncrypto::SSLCtxPointer ctx,
+                         bool is_server)
+    : BaseObject(env, wrap),
+      ctx_(std::move(ctx)),
+      is_server_(is_server),
+      cookie_secret_(kCookieSecretLen) {
+  MakeWeak();
+
+  // Generate random cookie secret for HMAC-based cookie generation.
+  CHECK_EQ(RAND_bytes(cookie_secret_.data(), kCookieSecretLen), 1);
+
+  // Cookie generate/verify callbacks are registered on the SSL_CTX so they
+  // are inherited by all SSL objects created from it. However, we do NOT set
+  // SSL_OP_COOKIE_EXCHANGE on the context -- DTLSv1_listen() sets this option
+  // automatically on the per-SSL object when it runs (see d1_lib.c:804 in
+  // OpenSSL). This is important: if SSL_OP_COOKIE_EXCHANGE were set on the
+  // context, any SSL created from it would attempt a fresh cookie exchange,
+  // which is wrong for session SSLs that have already completed cookie
+  // verification via DTLSv1_listen().
+  SSL_CTX_set_cookie_generate_cb(ctx_.get(), CookieGenerateCallback);
+  SSL_CTX_set_cookie_verify_cb(ctx_.get(), CookieVerifyCallback);
+
+  // Store pointer to this context in the SSL_CTX app data for callbacks.
+  SSL_CTX_set_app_data(ctx_.get(), this);
+}
+
+void DTLSContext::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackFieldWithSize("cookie_secret", cookie_secret_.size());
+  tracker->TrackFieldWithSize("alpn_protos", alpn_protos_.size());
+}
+
+Local<FunctionTemplate> DTLSContext::GetConstructorTemplate(Environment* env) {
+  auto tmpl = env->dtls_context_constructor_template();
+  if (tmpl.IsEmpty()) {
+    Isolate* isolate = env->isolate();
+    tmpl = NewFunctionTemplate(isolate, New);
+    tmpl->SetClassName(FIXED_ONE_BYTE_STRING(isolate, "DTLSContext"));
+    tmpl->InstanceTemplate()->SetInternalFieldCount(
+        BaseObject::kInternalFieldCount);
+
+    SetProtoMethod(isolate, tmpl, "setCert", SetCert);
+    SetProtoMethod(isolate, tmpl, "setKey", SetKey);
+    SetProtoMethod(isolate, tmpl, "addCACert", AddCACert);
+    SetProtoMethod(isolate, tmpl, "setCiphers", SetCiphers);
+    SetProtoMethod(isolate, tmpl, "setALPN", SetALPN);
+    SetProtoMethod(isolate, tmpl, "setSRTP", SetSRTP);
+    SetProtoMethod(isolate, tmpl, "setVerifyMode", SetVerifyMode);
+    SetProtoMethod(isolate, tmpl, "loadDefaultCAs", LoadDefaultCAs);
+    SetProtoMethod(isolate, tmpl, "setECDHCurve", SetECDHCurve);
+
+    env->set_dtls_context_constructor_template(tmpl);
+  }
+  return tmpl;
+}
+
+void DTLSContext::InitPerContext(Local<Object> target,
+                                 Local<Context> context,
+                                 Environment* env) {
+  SetConstructorFunction(
+      context, target, "DTLSContext", GetConstructorTemplate(env));
+}
+
+void DTLSContext::RegisterExternalReferences(
+    ExternalReferenceRegistry* registry) {
+  registry->Register(New);
+  registry->Register(SetCert);
+  registry->Register(SetKey);
+  registry->Register(AddCACert);
+  registry->Register(SetCiphers);
+  registry->Register(SetALPN);
+  registry->Register(SetSRTP);
+  registry->Register(SetVerifyMode);
+  registry->Register(LoadDefaultCAs);
+  registry->Register(SetECDHCurve);
+}
+
+// new DTLSContext(isServer)
+void DTLSContext::New(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK(args.IsConstructCall());
+
+  bool is_server = args[0]->IsTrue();
+
+  const SSL_METHOD* method;
+  if (is_server) {
+    method = DTLS_server_method();
+  } else {
+    method = DTLS_client_method();
+  }
+
+  ncrypto::SSLCtxPointer ctx(SSL_CTX_new(method));
+  if (!ctx) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
+                                             "Failed to create DTLS SSL_CTX");
+  }
+
+  // Default to DTLS 1.2 only. DTLS 1.0 (based on TLS 1.1) is deprecated
+  // by RFC 8996 and lacks AEAD cipher suites.
+  SSL_CTX_set_min_proto_version(ctx.get(), DTLS1_2_VERSION);
+  SSL_CTX_set_max_proto_version(ctx.get(), DTLS1_2_VERSION);
+
+  // Disable OpenSSL's MTU querying (we manage MTU manually).
+  SSL_CTX_set_options(ctx.get(), SSL_OP_NO_QUERY_MTU);
+
+  // Enable all workarounds for maximum compatibility.
+  SSL_CTX_set_options(ctx.get(), SSL_OP_ALL);
+
+  if (is_server) {
+    // NOTE: SSL_OP_COOKIE_EXCHANGE must NOT be set on the context.
+    // DTLSv1_listen() sets it per-SSL automatically (see d1_lib.c:804).
+    // Setting it here would cause session SSLs created via CreateFromSSL()
+    // to attempt a redundant cookie exchange, hanging the handshake.
+
+    // Enable session caching for session resumption.
+    SSL_CTX_set_session_cache_mode(
+        ctx.get(), SSL_SESS_CACHE_SERVER | SSL_SESS_CACHE_NO_AUTO_CLEAR);
+  } else {
+    // Client session caching for resumption.
+    SSL_CTX_set_session_cache_mode(
+        ctx.get(), SSL_SESS_CACHE_CLIENT | SSL_SESS_CACHE_NO_INTERNAL);
+  }
+
+  // NOTE: We do NOT call SSL_CTX_set_default_verify_paths() here.
+  // CA loading is handled in JS: if the user provides custom CAs, only
+  // those are loaded (via addCACert). Otherwise, system default CAs are
+  // loaded via loadDefaultCAs(). This matches Node.js TLS behavior.
+
+  new DTLSContext(env, args.This(), std::move(ctx), is_server);
+}
+
+void DTLSContext::SetCert(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+  Environment* env = ctx->env();
+
+  if (!args[0]->IsString()) {
+    return THROW_ERR_INVALID_ARG_TYPE(env, "cert must be a string (PEM)");
+  }
+
+  Utf8Value cert_pem(env->isolate(), args[0]);
+
+  auto bio = crypto::NodeBIO::NewFixed(*cert_pem, cert_pem.length());
+  if (!bio) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to create BIO");
+  }
+
+  ncrypto::X509Pointer cert;
+  ncrypto::X509Pointer issuer;
+  if (crypto::SSL_CTX_use_certificate_chain(
+          ctx->ctx_.get(), std::move(bio), &cert, &issuer) != 1) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(env, "PEM_read_bio_X509 failed");
+  }
+}
+
+void DTLSContext::SetKey(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+  Environment* env = ctx->env();
+
+  if (!args[0]->IsString()) {
+    return THROW_ERR_INVALID_ARG_TYPE(env, "key must be a string (PEM)");
+  }
+
+  Utf8Value key_pem(env->isolate(), args[0]);
+
+  auto bio = crypto::NodeBIO::NewFixed(*key_pem, key_pem.length());
+  if (!bio) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to create BIO");
+  }
+
+  switch (crypto::UsePrivateKey(ctx->ctx_.get(), bio)) {
+    case crypto::PrivateKeyResult::kSuccess:
+      break;
+    case crypto::PrivateKeyResult::kParseError:
+      return THROW_ERR_CRYPTO_OPERATION_FAILED(
+          env, "PEM_read_bio_PrivateKey failed");
+    case crypto::PrivateKeyResult::kApplyError:
+      return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
+                                               "SSL_CTX_use_PrivateKey failed");
+  }
+
+  // Verify that the private key matches the certificate.
+  if (SSL_CTX_check_private_key(ctx->ctx_.get()) != 1) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(
+        env, "Private key does not match certificate");
+  }
+}
+
+void DTLSContext::AddCACert(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+  Environment* env = ctx->env();
+
+  if (!args[0]->IsString()) {
+    return THROW_ERR_INVALID_ARG_TYPE(env, "ca must be a string (PEM)");
+  }
+
+  Utf8Value ca_pem(env->isolate(), args[0]);
+
+  auto bio = crypto::NodeBIO::NewFixed(*ca_pem, ca_pem.length());
+  if (!bio) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to create BIO");
+  }
+
+  ncrypto::ClearErrorOnReturn clear_error_on_return;
+  if (crypto::AddCACertificates(env, ctx->ctx_.get(), bio) == 0) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(
+        env, "No CA certificates found in PEM data");
+  }
+}
+
+void DTLSContext::SetCiphers(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+  Environment* env = ctx->env();
+
+  if (!args[0]->IsString()) {
+    return THROW_ERR_INVALID_ARG_TYPE(env, "ciphers must be a string");
+  }
+
+  Utf8Value ciphers(env->isolate(), args[0]);
+  if (SSL_CTX_set_cipher_list(ctx->ctx_.get(), *ciphers) != 1) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
+                                             "SSL_CTX_set_cipher_list failed");
+  }
+}
+
+void DTLSContext::SetALPN(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+  Environment* env = ctx->env();
+
+  if (!Buffer::HasInstance(args[0])) {
+    return THROW_ERR_INVALID_ARG_TYPE(env, "alpnProtocols must be a Buffer");
+  }
+
+  const uint8_t* data = reinterpret_cast<const uint8_t*>(Buffer::Data(args[0]));
+  size_t len = Buffer::Length(args[0]);
+
+  if (ctx->is_server_) {
+    // Server: store protocols for the selection callback.
+    ctx->alpn_protos_.assign(data, data + len);
+    SSL_CTX_set_alpn_select_cb(ctx->ctx_.get(), ALPNSelectCallback, ctx);
+  } else {
+    // Client: advertise protocols to the server. Returns 0 on success.
+    if (SSL_CTX_set_alpn_protos(ctx->ctx_.get(), data, len) != 0) {
+      return THROW_ERR_CRYPTO_OPERATION_FAILED(
+          env, "SSL_CTX_set_alpn_protos failed");
+    }
+  }
+}
+
+void DTLSContext::SetSRTP(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+  Environment* env = ctx->env();
+
+  if (!args[0]->IsString()) {
+    return THROW_ERR_INVALID_ARG_TYPE(env, "srtpProfiles must be a string");
+  }
+
+  Utf8Value profiles(env->isolate(), args[0]);
+  if (SSL_CTX_set_tlsext_use_srtp(ctx->ctx_.get(), *profiles) != 0) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(
+        env, "SSL_CTX_set_tlsext_use_srtp failed");
+  }
+}
+
+void DTLSContext::SetVerifyMode(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+
+  int mode = args[0]->Int32Value(ctx->env()->context()).FromJust();
+  SSL_CTX_set_verify(ctx->ctx_.get(), mode, nullptr);
+}
+
+void DTLSContext::LoadDefaultCAs(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+  crypto::UseDefaultRootCertStore(ctx->env(), ctx->ctx_.get());
+}
+
+void DTLSContext::SetECDHCurve(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+  Environment* env = ctx->env();
+
+  CHECK(args[0]->IsString());
+  Utf8Value curve(env->isolate(), args[0]);
+
+  // "auto" means use OpenSSL's default curve selection.
+  if (strcmp(*curve, "auto") != 0) {
+    if (!SSL_CTX_set1_curves_list(ctx->ctx_.get(), *curve)) {
+      return THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to set ECDH curve");
+    }
+  }
+}
+
+// HMAC-SHA256 cookie derived from the peer's address and a coarse time window
+// so cookies expire (see kCookieWindowNs). During DTLSv1_listen() the peer
+// address comes from DTLSContext::current_cookie_peer_ (set synchronously
+// before the call); during the session handshake it comes from the
+// DTLSSession stored in SSL app_data.
+bool DTLSContext::ComputeCookie(SSL* ssl,
+                                uint64_t window,
+                                unsigned char* out,
+                                unsigned int* out_len) {
+  SSL_CTX* ctx = SSL_get_SSL_CTX(ssl);
+  DTLSContext* dtls_ctx = static_cast<DTLSContext*>(SSL_CTX_get_app_data(ctx));
+  CHECK_NOT_NULL(dtls_ctx);
+
+  // Message = peer address bytes followed by the 8-byte window counter.
+  unsigned char msg[sizeof(struct sockaddr_storage) + sizeof(uint64_t)];
+  size_t addr_len = 0;
+
+  void* app_data = SSL_get_app_data(ssl);
+  if (app_data != nullptr) {
+    // Session handshake path.
+    const sockaddr* sa =
+        static_cast<DTLSSession*>(app_data)->remote_address().data();
+    addr_len = SocketAddress::GetLength(sa);
+    memcpy(msg, sa, addr_len);
+  } else {
+    // DTLSv1_listen path -- use the peer address stored on the context.
+    const sockaddr* sa = dtls_ctx->current_cookie_peer_.data();
+    addr_len = SocketAddress::GetLength(sa);
+    memcpy(msg, sa, addr_len);
+  }
+
+  // Append the window counter in a fixed byte order.
+  for (size_t i = 0; i < sizeof(uint64_t); i++) {
+    msg[addr_len + i] = static_cast<unsigned char>((window >> (8 * i)) & 0xff);
+  }
+
+  unsigned char* result = HMAC(EVP_sha256(),
+                               dtls_ctx->cookie_secret_.data(),
+                               dtls_ctx->cookie_secret_.size(),
+                               msg,
+                               addr_len + sizeof(uint64_t),
+                               out,
+                               out_len);
+  return result != nullptr;
+}
+
+int DTLSContext::CookieGenerateCallback(SSL* ssl,
+                                        unsigned char* cookie,
+                                        unsigned int* cookie_len) {
+  const uint64_t window = uv_hrtime() / kCookieWindowNs;
+  return ComputeCookie(ssl, window, cookie, cookie_len) ? 1 : 0;
+}
+
+int DTLSContext::CookieVerifyCallback(SSL* ssl,
+                                      const unsigned char* cookie,
+                                      unsigned int cookie_len) {
+  const uint64_t window = uv_hrtime() / kCookieWindowNs;
+
+  // Accept a cookie minted in the current window or the immediately preceding
+  // one, so a handshake that straddles a window boundary still succeeds.
+  unsigned char expected[EVP_MAX_MD_SIZE];
+  unsigned int expected_len = 0;
+  for (int i = 0; i < 2; i++) {
+    if (i == 1 && window == 0) break;
+    if (ComputeCookie(ssl, window - i, expected, &expected_len) &&
+        cookie_len == expected_len &&
+        CRYPTO_memcmp(cookie, expected, expected_len) == 0) {
+      return 1;
+    }
+  }
+  return 0;
+}
+
+int DTLSContext::ALPNSelectCallback(SSL* ssl,
+                                    const unsigned char** out,
+                                    unsigned char* outlen,
+                                    const unsigned char* in,
+                                    unsigned int inlen,
+                                    void* arg) {
+  DTLSContext* ctx = static_cast<DTLSContext*>(arg);
+
+  if (ctx->alpn_protos_.empty()) {
+    return SSL_TLSEXT_ERR_NOACK;
+  }
+
+  auto selected = crypto::SelectNextProtocol(
+      {ctx->alpn_protos_.data(), ctx->alpn_protos_.size()}, {in, inlen});
+
+  if (!selected.has_value()) {
+    return SSL_TLSEXT_ERR_NOACK;
+  }
+
+  crypto::SetSelectedProtocol(out, outlen, *selected);
+  return SSL_TLSEXT_ERR_OK;
+}
+
+}  // namespace dtls
+}  // namespace node
+
+#endif  // HAVE_OPENSSL && HAVE_DTLS
diff --git a/src/dtls/dtls_context.h b/src/dtls/dtls_context.h
new file mode 100644
index 000000000000..cb0b13092463
--- /dev/null
+++ b/src/dtls/dtls_context.h
@@ -0,0 +1,102 @@
+#pragma once
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#if HAVE_OPENSSL && HAVE_DTLS
+
+#include <base_object.h>
+#include <env.h>
+#include <ncrypto.h>
+#include <node_sockaddr.h>
+#include <v8.h>
+
+#include <openssl/dtls1.h>
+#include <openssl/ssl.h>
+
+#include <vector>
+
+namespace node::dtls {
+
+// DTLSContext wraps an SSL_CTX configured for DTLS.
+// It manages certificate/key configuration, cipher selection,
+// ALPN, and automatic cookie generation/verification for servers.
+class DTLSContext final : public BaseObject {
+ public:
+  static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
+      Environment* env);
+  static void InitPerContext(v8::Local<v8::Object> target,
+                             v8::Local<v8::Context> context,
+                             Environment* env);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+
+  DTLSContext(Environment* env,
+              v8::Local<v8::Object> wrap,
+              ncrypto::SSLCtxPointer ctx,
+              bool is_server);
+
+  SSL_CTX* ssl_ctx() const { return ctx_.get(); }
+
+  // Set the peer address for cookie generation during DTLSv1_listen().
+  void set_cookie_peer(const SocketAddress& addr) {
+    current_cookie_peer_ = addr;
+  }
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(DTLSContext)
+  SET_SELF_SIZE(DTLSContext)
+
+ private:
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetCert(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetKey(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void AddCACert(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetCiphers(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetALPN(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetSRTP(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetVerifyMode(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void LoadDefaultCAs(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetECDHCurve(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+  // Compute the address-and-time-window-bound cookie for |window| into |out|
+  // (which must have room for EVP_MAX_MD_SIZE bytes). Shared by the cookie
+  // generate/verify callbacks.
+  static bool ComputeCookie(SSL* ssl,
+                            uint64_t window,
+                            unsigned char* out,
+                            unsigned int* out_len);
+
+  // Automatic DTLS cookie callbacks
+  static int CookieGenerateCallback(SSL* ssl,
+                                    unsigned char* cookie,
+                                    unsigned int* cookie_len);
+  static int CookieVerifyCallback(SSL* ssl,
+                                  const unsigned char* cookie,
+                                  unsigned int cookie_len);
+
+  // ALPN selection callback (server-side)
+  static int ALPNSelectCallback(SSL* ssl,
+                                const unsigned char** out,
+                                unsigned char* outlen,
+                                const unsigned char* in,
+                                unsigned int inlen,
+                                void* arg);
+
+  ncrypto::SSLCtxPointer ctx_;
+  bool is_server_;
+
+  // Secret key for HMAC-based cookie generation
+  std::vector<uint8_t> cookie_secret_;
+
+  // Peer address for current DTLSv1_listen cookie exchange.
+  // Set synchronously before DTLSv1_listen() and consumed by the
+  // cookie generate/verify callbacks during that call.
+  SocketAddress current_cookie_peer_;
+
+  // ALPN protocols (server-side selection list)
+  std::vector<uint8_t> alpn_protos_;
+};
+
+}  // namespace node::dtls
+
+#endif  // HAVE_OPENSSL && HAVE_DTLS
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/dtls/dtls_endpoint.cc b/src/dtls/dtls_endpoint.cc
new file mode 100644
index 000000000000..44279399e478
--- /dev/null
+++ b/src/dtls/dtls_endpoint.cc
@@ -0,0 +1,704 @@
+#include "dtls_endpoint.h"
+#include "dtls.h"
+#include "dtls_context.h"
+#include "dtls_session.h"
+
+#if HAVE_OPENSSL && HAVE_DTLS
+
+#include <aliased_struct-inl.h>
+#include <base_object-inl.h>
+#include <env-inl.h>
+#include <handle_wrap.h>
+#include <memory_tracker-inl.h>
+#include <node_buffer.h>
+#include <node_errors.h>
+#include <node_sockaddr-inl.h>
+#include <permission/permission.h>
+#include <util-inl.h>
+
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+
+#include <cstddef>
+#include <cstring>
+
+namespace node {
+
+using v8::Context;
+using v8::Function;
+using v8::FunctionCallbackInfo;
+using v8::FunctionTemplate;
+using v8::HandleScope;
+using v8::Int32;
+using v8::Isolate;
+using v8::Local;
+using v8::Object;
+using v8::String;
+using v8::Value;
+
+namespace dtls {
+
+namespace {
+struct SendReq {
+  uv_udp_send_t req;
+  uv_buf_t buf;
+  std::vector<uint8_t> data;
+};
+}  // namespace
+
+// The endpoint state "indices" are byte offsets into DTLSEndpointStateData,
+// accessed from JS via a DataView. Pin them to the actual struct layout so a
+// mismatch (as once existed for `busy`, which follows a uint32) can't recur.
+static_assert(IDX_ENDPOINT_STATE_BOUND ==
+              offsetof(DTLSEndpointStateData, bound));
+static_assert(IDX_ENDPOINT_STATE_LISTENING ==
+              offsetof(DTLSEndpointStateData, listening));
+static_assert(IDX_ENDPOINT_STATE_CLOSING ==
+              offsetof(DTLSEndpointStateData, closing));
+static_assert(IDX_ENDPOINT_STATE_DESTROYED ==
+              offsetof(DTLSEndpointStateData, destroyed));
+static_assert(IDX_ENDPOINT_STATE_SESSION_COUNT ==
+              offsetof(DTLSEndpointStateData, session_count));
+static_assert(IDX_ENDPOINT_STATE_BUSY == offsetof(DTLSEndpointStateData, busy));
+
+DTLSEndpoint::DTLSEndpoint(Environment* env, Local<Object> wrap)
+    : HandleWrap(env,
+                 wrap,
+                 reinterpret_cast<uv_handle_t*>(&handle_),
+                 PROVIDER_DTLS_ENDPOINT),
+      state_(env->isolate()),
+      stats_(env->isolate()) {
+  CHECK_EQ(uv_udp_init(env->event_loop(), &handle_), 0);
+  handle_.data = this;
+  MakeWeak();
+  DTLS_STAT_RECORD_TIMESTAMP(DTLSEndpointStats, created_at);
+}
+
+Local<FunctionTemplate> DTLSEndpoint::GetConstructorTemplate(Environment* env) {
+  auto tmpl = env->dtls_endpoint_constructor_template();
+  if (tmpl.IsEmpty()) {
+    Isolate* isolate = env->isolate();
+    tmpl = NewFunctionTemplate(isolate, New);
+    tmpl->SetClassName(FIXED_ONE_BYTE_STRING(isolate, "DTLSEndpoint"));
+    tmpl->InstanceTemplate()->SetInternalFieldCount(
+        HandleWrap::kInternalFieldCount);
+
+    SetProtoMethod(isolate, tmpl, "bind", DoBind);
+    SetProtoMethod(isolate, tmpl, "listen", DoListen);
+    SetProtoMethod(isolate, tmpl, "connect", DoConnect);
+    SetProtoMethod(isolate, tmpl, "close", DoClose);
+    SetProtoMethod(isolate, tmpl, "destroy", DoDestroy);
+    SetProtoMethod(isolate, tmpl, "getState", GetState);
+    SetProtoMethod(isolate, tmpl, "getStats", GetStats);
+    SetProtoMethod(isolate, tmpl, "getAddress", GetAddress);
+    SetProtoMethod(isolate, tmpl, "setMTU", SetMTU);
+    SetProtoMethod(isolate, tmpl, "setCallbacks", DoSetCallbacks);
+
+    env->set_dtls_endpoint_constructor_template(tmpl);
+  }
+  return tmpl;
+}
+
+void DTLSEndpoint::InitPerContext(Local<Object> target,
+                                  Local<Context> context,
+                                  Environment* env) {
+  SetConstructorFunction(
+      context, target, "DTLSEndpoint", GetConstructorTemplate(env));
+}
+
+void DTLSEndpoint::RegisterExternalReferences(
+    ExternalReferenceRegistry* registry) {
+  registry->Register(New);
+  registry->Register(DoBind);
+  registry->Register(DoListen);
+  registry->Register(DoConnect);
+  registry->Register(DoClose);
+  registry->Register(DoDestroy);
+  registry->Register(GetState);
+  registry->Register(GetStats);
+  registry->Register(GetAddress);
+  registry->Register(SetMTU);
+  registry->Register(DoSetCallbacks);
+}
+
+void DTLSEndpoint::New(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK(args.IsConstructCall());
+  new DTLSEndpoint(env, args.This());
+}
+
+int DTLSEndpoint::Bind(const SocketAddress& address) {
+  if (IsHandleClosing()) return UV_EINVAL;
+  if (state_->bound) return UV_EALREADY;
+
+  unsigned int flags = 0;
+  if (address.family() == AF_INET6) {
+    flags |= UV_UDP_IPV6ONLY;
+  }
+
+  int err = uv_udp_bind(&handle_, address.data(), flags);
+  if (err != 0) return err;
+
+  state_->bound = 1;
+
+  // Don't keep the event loop alive unless we're listening or have sessions.
+  uv_unref(reinterpret_cast<uv_handle_t*>(&handle_));
+
+  return 0;
+}
+
+int DTLSEndpoint::Listen(DTLSContext* context) {
+  if (IsHandleClosing()) return UV_EINVAL;
+  if (listening_) return UV_EALREADY;
+
+  server_context_.reset(context);
+  listening_ = true;
+  state_->listening = 1;
+
+  // Start receiving UDP datagrams.
+  int err = uv_udp_recv_start(&handle_, OnAlloc, OnRecv);
+  if (err != 0) {
+    listening_ = false;
+    state_->listening = 0;
+    server_context_.reset();
+    return err;
+  }
+
+  // Ref the handle while listening.
+  uv_ref(reinterpret_cast<uv_handle_t*>(&handle_));
+
+  return 0;
+}
+
+BaseObjectPtr<DTLSSession> DTLSEndpoint::Connect(DTLSContext* context,
+                                                 const SocketAddress& remote,
+                                                 const char* servername,
+                                                 const char* verify_host,
+                                                 bool verify_is_ip) {
+  if (IsHandleClosing()) {
+    THROW_ERR_INVALID_STATE(env(), "Endpoint is closing");
+    return {};
+  }
+
+  // Check if we already have a session for this address.
+  auto it = sessions_.find(remote);
+  if (it != sessions_.end()) {
+    THROW_ERR_INVALID_STATE(env(), "Session already exists for this address");
+    return {};
+  }
+
+  auto session = DTLSSession::Create(env(),
+                                     this,
+                                     context->ssl_ctx(),
+                                     remote,
+                                     false /* is_server */,
+                                     servername,
+                                     verify_host,
+                                     verify_is_ip);
+
+  if (!session) return {};
+
+  sessions_[remote] = session;
+  state_->session_count = sessions_.size();
+  DTLS_STAT_INCREMENT(DTLSEndpointStats, client_sessions);
+
+  // Ref the handle while we have sessions.
+  uv_ref(reinterpret_cast<uv_handle_t*>(&handle_));
+
+  // Start receiving if not already.
+  if (!listening_) {
+    uv_udp_recv_start(&handle_, OnAlloc, OnRecv);
+  }
+
+  // Initiate the DTLS handshake by running Cycle.
+  session->Cycle();
+
+  return session;
+}
+
+int DTLSEndpoint::SendTo(const SocketAddress& dest,
+                         const uint8_t* data,
+                         size_t len) {
+  if (IsHandleClosing()) return UV_EINVAL;
+
+  // Try synchronous send first.
+  uv_buf_t buf =
+      uv_buf_init(const_cast<char*>(reinterpret_cast<const char*>(data)), len);
+  int err = uv_udp_try_send(&handle_, &buf, 1, dest.data());
+
+  if (err == static_cast<int>(len)) {
+    DTLS_STAT_INCREMENT_N(DTLSEndpointStats, bytes_sent, len);
+    DTLS_STAT_INCREMENT(DTLSEndpointStats, packets_sent);
+    return 0;  // Sent successfully.
+  }
+
+  if (err != UV_EAGAIN && err < 0) {
+    return err;  // Real error.
+  }
+
+  // Async send: copy the data since it won't outlive this call.
+  auto* req = new SendReq();
+  req->data.assign(data, data + len);
+  req->buf = uv_buf_init(reinterpret_cast<char*>(req->data.data()), len);
+
+  err = uv_udp_send(&req->req, &handle_, &req->buf, 1, dest.data(), OnSend);
+  if (err != 0) {
+    delete req;
+    return err;
+  }
+
+  DTLS_STAT_INCREMENT_N(DTLSEndpointStats, bytes_sent, len);
+  DTLS_STAT_INCREMENT(DTLSEndpointStats, packets_sent);
+  return 0;
+}
+
+void DTLSEndpoint::RemoveSession(const SocketAddress& addr) {
+  sessions_.erase(addr);
+  state_->session_count = sessions_.size();
+
+  // Unref if no more sessions and not listening.
+  if (sessions_.empty() && !listening_ && !IsHandleClosing()) {
+    uv_unref(reinterpret_cast<uv_handle_t*>(&handle_));
+  }
+}
+
+void DTLSEndpoint::CloseGracefully() {
+  if (IsHandleClosing()) return;
+
+  state_->closing = 1;
+
+  // Close all sessions gracefully (this may send close_notify).
+  auto sessions_copy = sessions_;
+  sessions_.clear();
+  state_->session_count = 0;
+  for (auto& [addr, session] : sessions_copy) {
+    session->Close();
+  }
+
+  // Stop listening.
+  if (listening_) {
+    uv_udp_recv_stop(&handle_);
+    listening_ = false;
+    state_->listening = 0;
+  }
+
+  server_context_.reset();
+
+  // Keep ourselves alive until OnClose() runs, so a garbage collection while
+  // uv_close() is in flight cannot collect the wrapper before the close is
+  // reported. Released in OnClose().
+  self_ref_ = BaseObjectPtr<DTLSEndpoint>(this);
+
+  // HandleWrap::Close() calls uv_close and manages the lifecycle.
+  HandleWrap::Close();
+}
+
+void DTLSEndpoint::Destroy() {
+  if (IsHandleClosing()) return;
+
+  state_->destroyed = 1;
+
+  // Copy session list to avoid iterator invalidation.
+  auto sessions_copy = sessions_;
+  sessions_.clear();
+  state_->session_count = 0;
+  for (auto& [addr, session] : sessions_copy) {
+    session->Destroy();
+  }
+
+  server_context_.reset();
+
+  if (listening_) {
+    uv_udp_recv_stop(&handle_);
+    listening_ = false;
+    state_->listening = 0;
+  }
+
+  // Keep ourselves alive until OnClose() (see CloseGracefully()).
+  self_ref_ = BaseObjectPtr<DTLSEndpoint>(this);
+
+  HandleWrap::Close();
+}
+
+Local<Function> DTLSEndpoint::GetCallback(int index) const {
+  if (index < 0 || index >= DTLS_CB_COUNT) return Local<Function>();
+  Local<Function> cb = callbacks_[index].Get(env()->isolate());
+  return cb;
+}
+
+void DTLSEndpoint::SetCallbacks(Local<Object> callbacks) {
+  Isolate* isolate = env()->isolate();
+  Local<Context> context = env()->context();
+
+  const char* names[] = {
+      "onEndpointClose",
+      "onEndpointError",
+      "onSessionNew",
+      "onSessionClose",
+      "onSessionError",
+      "onSessionHandshake",
+      "onSessionMessage",
+      "onSessionKeylog",
+      "onSessionTicket",
+  };
+
+  for (int i = 0; i < DTLS_CB_COUNT; i++) {
+    Local<String> name;
+    if (!String::NewFromUtf8(isolate, names[i]).ToLocal(&name)) {
+      THROW_ERR_OPERATION_FAILED(isolate,
+                                 "Failed to create callback name string");
+      return;
+    }
+    Local<Value> val;
+    if (!callbacks->Get(context, name).ToLocal(&val) || !val->IsFunction()) {
+      THROW_ERR_MISSING_ARGS(
+          isolate, ("Missing DTLS callback: " + std::string(names[i])).c_str());
+      return;
+    }
+    callbacks_[i].Reset(isolate, val.As<Function>());
+  }
+}
+
+// --- libuv callbacks ---
+
+void DTLSEndpoint::OnAlloc(uv_handle_t* handle,
+                           size_t suggested_size,
+                           uv_buf_t* buf) {
+  DTLSEndpoint* endpoint = static_cast<DTLSEndpoint*>(handle->data);
+  // Reuse a single receive buffer. libuv delivers datagrams one at a time on
+  // this thread, and OnRecv fully consumes each datagram (copying it into the
+  // session's BIO) before the next OnAlloc, so a per-endpoint buffer suffices
+  // and avoids a heap allocation on every packet.
+  if (endpoint->recv_buf_.empty()) {
+    endpoint->recv_buf_.resize(65536);
+  }
+  buf->base = endpoint->recv_buf_.data();
+  buf->len = endpoint->recv_buf_.size();
+}
+
+void DTLSEndpoint::OnRecv(uv_udp_t* handle,
+                          ssize_t nread,
+                          const uv_buf_t* buf,
+                          const struct sockaddr* addr,
+                          unsigned int flags) {
+  DTLSEndpoint* endpoint = static_cast<DTLSEndpoint*>(handle->data);
+
+  // buf->base is the endpoint's reusable recv_buf_; it is not freed here.
+  if (nread == 0 && addr == nullptr) {
+    return;
+  }
+
+  if (nread < 0) {
+    HandleScope handle_scope(endpoint->env()->isolate());
+    Context::Scope context_scope(endpoint->env()->context());
+    Local<Value> argv[] = {
+        String::NewFromUtf8(endpoint->env()->isolate(), uv_strerror(nread))
+            .ToLocalChecked(),
+    };
+    Local<Function> cb = endpoint->GetCallback(DTLS_CB_ENDPOINT_ERROR);
+    if (!cb.IsEmpty()) {
+      endpoint->MakeCallback(cb, 1, argv);
+    }
+    return;
+  }
+
+  if (addr == nullptr) {
+    return;
+  }
+
+  IncrementStat<DTLSEndpointStats, &DTLSEndpointStats::bytes_received>(
+      endpoint->stats_.Data(), nread);
+  IncrementStat<DTLSEndpointStats, &DTLSEndpointStats::packets_received>(
+      endpoint->stats_.Data());
+
+  SocketAddress remote(addr);
+  endpoint->ProcessDatagram(
+      reinterpret_cast<const uint8_t*>(buf->base), nread, remote);
+}
+
+void DTLSEndpoint::OnSend(uv_udp_send_t* req, int status) {
+  SendReq* send_req = reinterpret_cast<SendReq*>(req);
+  delete send_req;
+}
+
+void DTLSEndpoint::OnClose() {
+  state_->closing = 0;
+  state_->destroyed = 1;
+  DTLS_STAT_RECORD_TIMESTAMP(DTLSEndpointStats, destroyed_at);
+
+  // Release the strong self-reference taken when the close was initiated.
+  // HandleWrap::OnClose still holds its own reference for the duration of this
+  // call, so this does not free us here.
+  self_ref_.reset();
+
+  // A close initiated outside CloseGracefully()/Destroy() (e.g. an endpoint
+  // abandoned mid-construction and closed at environment teardown) takes no
+  // self-reference, so its wrapper may already be collected. There is no JS
+  // side to notify in that case; skip it rather than touch a freed wrapper.
+  if (persistent().IsEmpty()) return;
+
+  Local<Function> cb = GetCallback(DTLS_CB_ENDPOINT_CLOSE);
+  if (!cb.IsEmpty()) {
+    Local<Value> argv[] = {};
+    MakeCallback(cb, 0, argv);
+  }
+}
+
+void DTLSEndpoint::ProcessDatagram(const uint8_t* data,
+                                   size_t len,
+                                   const SocketAddress& remote) {
+  if (IsHandleClosing()) return;
+
+  // Look up existing session by remote address.
+  auto it = sessions_.find(remote);
+  if (it != sessions_.end()) {
+    it->second->Receive(data, len);
+    return;
+  }
+
+  // No existing session. If we're in server mode, try to accept.
+  if (listening_ && server_context_) {
+    AcceptConnection(data, len, remote);
+  }
+}
+
+void DTLSEndpoint::AcceptConnection(const uint8_t* data,
+                                    size_t len,
+                                    const SocketAddress& remote) {
+  if (state_->busy) {
+    DTLS_STAT_INCREMENT(DTLSEndpointStats, server_busy_count);
+    return;
+  }
+
+  HandleScope handle_scope(env()->isolate());
+  Context::Scope context_scope(env()->context());
+
+  // Stateless cookie exchange via DTLSv1_listen() for DoS protection.
+  //
+  // The standard OpenSSL DTLS server flow (see s_server.c) is:
+  //   1. Create SSL with BIO_s_datagram() wrapping the UDP socket
+  //   2. DTLSv1_listen(ssl, &peer) -- stateless cookie exchange
+  //   3. Connect the socket to the verified peer
+  //   4. SSL_accept(ssl) -- continue the handshake on the SAME SSL
+  //
+  // We diverge in one key way: we use memory BIOs instead of datagram
+  // BIOs because Node.js manages UDP I/O through libuv (uv_udp_t),
+  // not through raw socket FDs. This means DTLSv1_listen()'s internal
+  // BIO_dgram_get_peer()/set_peer() calls are no-ops -- we provide the
+  // peer address to the cookie callbacks via DTLSContext::current_cookie_peer_
+  // instead. After DTLSv1_listen() returns 1, we hand the SSL (with its
+  // memory BIOs) to a DTLSSession via CreateFromSSL(). The SSL's internal
+  // state machine has been prepared by DTLSv1_listen() to continue the
+  // handshake from TLS_ST_SR_CLNT_HELLO, so Cycle() -> SSL_do_handshake()
+  // immediately produces the ServerHello flight.
+  ncrypto::SSLPointer ssl(SSL_new(server_context_->ssl_ctx()));
+  if (!ssl) return;
+
+  auto in = ncrypto::BIOPointer::NewMem();
+  auto out = ncrypto::BIOPointer::NewMem();
+  if (!in || !out) return;
+
+  BIO_set_mem_eof_return(in.get(), -1);
+  BIO_set_mem_eof_return(out.get(), -1);
+  // SSL_set_bio takes ownership of both BIOs.
+  BIO* in_raw = in.release();
+  BIO* out_raw = out.release();
+  SSL_set_bio(ssl.get(), in_raw, out_raw);
+  SSL_set_accept_state(ssl.get());
+  SSL_set_options(ssl.get(), SSL_OP_NO_QUERY_MTU | SSL_OP_COOKIE_EXCHANGE);
+  SSL_set_mtu(ssl.get(), mtu_);
+
+  // Set peer address on context for the cookie callbacks.
+  server_context_->set_cookie_peer(remote);
+
+  BIO_write(in_raw, data, len);
+
+  DeleteFnPtr<BIO_ADDR, BIO_ADDR_free> peer(BIO_ADDR_new());
+  int ret = DTLSv1_listen(ssl.get(), peer.get());
+
+  if (ret == 0) {
+    // Send HelloVerifyRequest.
+    uint8_t resp_buf[65536];
+    int resp_len;
+    while ((resp_len = BIO_read(out_raw, resp_buf, sizeof(resp_buf))) > 0) {
+      SendTo(remote, resp_buf, resp_len);
+    }
+    return;
+  }
+
+  if (ret < 0) {
+    return;  // Error — drop packet.
+  }
+
+  // Cookie verified. Hand the SSL (which has already completed cookie
+  // exchange and consumed the ClientHello) to a DTLSSession. Calling
+  // Cycle() will drive SSL_do_handshake to produce the ServerHello.
+  auto session = DTLSSession::CreateFromSSL(
+      env(), this, std::move(ssl), in_raw, out_raw, remote);
+
+  if (!session) return;
+
+  sessions_[remote] = session;
+  state_->session_count = sessions_.size();
+  DTLS_STAT_INCREMENT(DTLSEndpointStats, server_sessions);
+
+  uv_ref(reinterpret_cast<uv_handle_t*>(&handle_));
+
+  // Drive the handshake forward — produces ServerHello etc.
+  session->Cycle();
+
+  // Emit the new session to JS.
+  Local<Value> argv[] = {session->object()};
+  Local<Function> cb = GetCallback(DTLS_CB_SESSION_NEW);
+  if (!cb.IsEmpty()) {
+    MakeCallback(cb, 1, argv);
+  }
+}
+
+// --- JS binding methods ---
+
+void DTLSEndpoint::DoBind(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+  Environment* env = endpoint->env();
+
+  CHECK(args[0]->IsString());  // host
+  CHECK(args[1]->IsInt32());   // port
+
+  Utf8Value host(env->isolate(), args[0]);
+  int port = args[1].As<Int32>()->Value();
+
+  SocketAddress addr;
+  if (!SocketAddress::New(*host, port, &addr)) {
+    return THROW_ERR_INVALID_ARG_VALUE(env, "Invalid address");
+  }
+
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kNet, addr.ToString());
+
+  int err = endpoint->Bind(addr);
+  if (err != 0) {
+    return THROW_ERR_INVALID_STATE(env, uv_strerror(err));
+  }
+}
+
+void DTLSEndpoint::DoListen(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+  Environment* env = endpoint->env();
+
+  THROW_IF_INSUFFICIENT_PERMISSIONS(env, permission::PermissionScope::kNet, "");
+
+  DTLSContext* context;
+  ASSIGN_OR_RETURN_UNWRAP(&context, args[0].As<Object>());
+
+  int err = endpoint->Listen(context);
+  if (err != 0) {
+    return THROW_ERR_INVALID_STATE(env, uv_strerror(err));
+  }
+}
+
+void DTLSEndpoint::DoConnect(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+  Environment* env = endpoint->env();
+
+  DTLSContext* context;
+  ASSIGN_OR_RETURN_UNWRAP(&context, args[0].As<Object>());
+
+  CHECK(args[1]->IsString());  // host
+  CHECK(args[2]->IsInt32());   // port
+
+  Utf8Value host(env->isolate(), args[1]);
+  int port = args[2].As<Int32>()->Value();
+
+  SocketAddress remote;
+  if (!SocketAddress::New(*host, port, &remote)) {
+    return THROW_ERR_INVALID_ARG_VALUE(env, "Invalid remote address");
+  }
+
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kNet, remote.ToString());
+
+  // Optional: servername (SNI), verifyHost (expected peer identity), and
+  // whether verifyHost is an IP literal. These are resolved in JS and applied
+  // to the client SSL before the handshake starts.
+  Utf8Value servername(env->isolate(), args[3]);
+  Utf8Value verify_host(env->isolate(), args[4]);
+  const char* servername_ptr = args[3]->IsString() ? *servername : nullptr;
+  const char* verify_host_ptr = args[4]->IsString() ? *verify_host : nullptr;
+  bool verify_is_ip = args[5]->IsTrue();
+
+  auto session = endpoint->Connect(
+      context, remote, servername_ptr, verify_host_ptr, verify_is_ip);
+  if (session) {
+    args.GetReturnValue().Set(session->object());
+  }
+}
+
+void DTLSEndpoint::DoClose(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+  endpoint->CloseGracefully();
+}
+
+void DTLSEndpoint::DoDestroy(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+  endpoint->Destroy();
+}
+
+void DTLSEndpoint::GetState(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+  args.GetReturnValue().Set(endpoint->state_.GetArrayBuffer());
+}
+
+void DTLSEndpoint::GetStats(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+  args.GetReturnValue().Set(endpoint->stats_.GetArrayBuffer());
+}
+
+void DTLSEndpoint::GetAddress(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+
+  if (endpoint->IsHandleClosing()) return;
+
+  SocketAddress addr = SocketAddress::FromSockName(endpoint->handle_);
+  Local<Object> obj;
+  if (addr.ToJS(endpoint->env()).ToLocal(&obj)) {
+    args.GetReturnValue().Set(obj);
+  }
+}
+
+void DTLSEndpoint::SetMTU(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+
+  CHECK(args[0]->IsInt32());
+  int mtu = args[0].As<Int32>()->Value();
+  if (mtu < 256 || mtu > 65535) {
+    return THROW_ERR_OUT_OF_RANGE(endpoint->env(),
+                                  "MTU must be between 256 and 65535");
+  }
+  endpoint->mtu_ = mtu;
+}
+
+void DTLSEndpoint::DoSetCallbacks(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+  CHECK(args[0]->IsObject());
+  endpoint->SetCallbacks(args[0].As<Object>());
+}
+
+void DTLSEndpoint::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackField("sessions", sessions_.size());
+  tracker->TrackFieldWithSize("recv_buf", recv_buf_.size());
+}
+
+}  // namespace dtls
+}  // namespace node
+
+#endif  // HAVE_OPENSSL && HAVE_DTLS
diff --git a/src/dtls/dtls_endpoint.h b/src/dtls/dtls_endpoint.h
new file mode 100644
index 000000000000..bed49a7db0e0
--- /dev/null
+++ b/src/dtls/dtls_endpoint.h
@@ -0,0 +1,171 @@
+#pragma once
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#if HAVE_OPENSSL && HAVE_DTLS
+
+#include <aliased_struct.h>
+#include <env.h>
+#include <handle_wrap.h>
+#include <node_sockaddr.h>
+#include <uv.h>
+#include <v8.h>
+
+#include <openssl/ssl.h>
+
+#include <unordered_map>
+#include <vector>
+
+#include "dtls.h"
+#include "dtls_context.h"
+#include "dtls_session.h"
+
+namespace node::dtls {
+
+// Shared C++ <-> JS state for a DTLS endpoint.
+struct DTLSEndpointStateData {
+  uint8_t bound = 0;
+  uint8_t listening = 0;
+  uint8_t closing = 0;
+  uint8_t destroyed = 0;
+  uint32_t session_count = 0;
+  uint8_t busy = 0;
+};
+
+// Stats collected for a DTLS endpoint, backed by a BigUint64Array.
+struct DTLSEndpointStats {
+  DTLS_ENDPOINT_STATS(DTLS_STAT_FIELD)
+};
+
+// DTLSEndpoint manages a single UDP socket and dispatches incoming
+// datagrams to the appropriate DTLSSession based on the remote address.
+// For server mode, it handles stateless cookie exchange via DTLSv1_listen()
+// before creating new sessions.
+class DTLSEndpoint final : public HandleWrap {
+ public:
+  static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
+      Environment* env);
+  static void InitPerContext(v8::Local<v8::Object> target,
+                             v8::Local<v8::Context> context,
+                             Environment* env);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+
+  DTLSEndpoint(Environment* env, v8::Local<v8::Object> wrap);
+
+  // Bind the UDP socket to the given address.
+  int Bind(const SocketAddress& address);
+
+  // Start listening for incoming DTLS connections (server mode).
+  // |context| provides the SSL_CTX for creating new sessions.
+  int Listen(DTLSContext* context);
+
+  // Initiate a client connection to the given address.
+  // |servername|/|verify_host|/|verify_is_ip| configure SNI and peer identity
+  // verification on the client SSL before the handshake begins; see
+  // DTLSSession::Create.
+  // Returns the created DTLSSession.
+  BaseObjectPtr<DTLSSession> Connect(DTLSContext* context,
+                                     const SocketAddress& remote,
+                                     const char* servername = nullptr,
+                                     const char* verify_host = nullptr,
+                                     bool verify_is_ip = false);
+
+  // Send a raw UDP datagram to the given address.
+  // Called by DTLSSession to send encrypted packets.
+  int SendTo(const SocketAddress& dest, const uint8_t* data, size_t len);
+
+  // Remove a session from the endpoint (called on session close/destroy).
+  void RemoveSession(const SocketAddress& addr);
+
+  // Close the endpoint gracefully (close all sessions first).
+  void CloseGracefully();
+
+  // Immediately destroy the endpoint.
+  void Destroy();
+
+  // Get the JS callback function for a given callback index.
+  v8::Local<v8::Function> GetCallback(int index) const;
+
+  // Set the JS callbacks.
+  void SetCallbacks(v8::Local<v8::Object> callbacks);
+
+  bool is_listening() const { return listening_; }
+  uint32_t mtu() const { return mtu_; }
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(DTLSEndpoint)
+  SET_SELF_SIZE(DTLSEndpoint)
+
+ private:
+  // JS binding methods
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoBind(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoListen(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoConnect(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoClose(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoDestroy(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetState(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetStats(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetAddress(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetMTU(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoSetCallbacks(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+  // libuv callbacks
+  static void OnAlloc(uv_handle_t* handle,
+                      size_t suggested_size,
+                      uv_buf_t* buf);
+  static void OnRecv(uv_udp_t* handle,
+                     ssize_t nread,
+                     const uv_buf_t* buf,
+                     const struct sockaddr* addr,
+                     unsigned int flags);
+  static void OnSend(uv_udp_send_t* req, int status);
+
+  // Called by HandleWrap after uv_close completes.
+  void OnClose() override;
+
+  // Process an incoming datagram.
+  void ProcessDatagram(const uint8_t* data,
+                       size_t len,
+                       const SocketAddress& remote);
+
+  // Handle a new client connection (server mode).
+  void AcceptConnection(const uint8_t* data,
+                        size_t len,
+                        const SocketAddress& remote);
+
+  uv_udp_t handle_;
+
+  // Reusable receive buffer for uv_udp_recv (see OnAlloc). libuv delivers one
+  // datagram at a time and OnRecv consumes each before the next OnAlloc, so a
+  // single buffer per endpoint avoids a heap allocation on every packet.
+  std::vector<char> recv_buf_;
+
+  // Session table: maps remote address -> session.
+  std::unordered_map<SocketAddress,
+                     BaseObjectPtr<DTLSSession>,
+                     SocketAddress::Hash>
+      sessions_;
+
+  // Server context (set when listening).
+  BaseObjectPtr<DTLSContext> server_context_;
+
+  // JS callbacks
+  v8::Global<v8::Function> callbacks_[DTLS_CB_COUNT];
+
+  AliasedStruct<DTLSEndpointStateData> state_;
+  AliasedStruct<DTLSEndpointStats> stats_;
+
+  // Strong self-reference held while a graceful close/destroy is in flight, so
+  // the wrapper is not garbage-collected before OnClose() runs and reports the
+  // close. Cleared in OnClose().
+  BaseObjectPtr<DTLSEndpoint> self_ref_;
+
+  bool listening_ = false;
+  uint32_t mtu_ = 1200;  // Conservative default MTU for data payload
+};
+
+}  // namespace node::dtls
+
+#endif  // HAVE_OPENSSL && HAVE_DTLS
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/dtls/dtls_session.cc b/src/dtls/dtls_session.cc
new file mode 100644
index 000000000000..ed63daaa4b31
--- /dev/null
+++ b/src/dtls/dtls_session.cc
@@ -0,0 +1,768 @@
+#include "dtls_session.h"
+#include "dtls.h"
+#include "dtls_endpoint.h"
+
+#if HAVE_OPENSSL && HAVE_DTLS
+
+#include <aliased_struct-inl.h>
+#include <async_wrap-inl.h>
+#include <base_object-inl.h>
+#include <env-inl.h>
+#include <memory_tracker-inl.h>
+#include <node_buffer.h>
+#include <node_errors.h>
+#include <node_sockaddr-inl.h>
+#include <timer_wrap-inl.h>
+#include <util-inl.h>
+
+#include <openssl/err.h>
+#include <openssl/srtp.h>
+#include <openssl/ssl.h>
+#include <openssl/x509_vfy.h>
+#include <openssl/x509v3.h>
+
+#include <cstring>
+
+namespace node {
+
+using v8::Context;
+using v8::Function;
+using v8::FunctionCallbackInfo;
+using v8::FunctionTemplate;
+using v8::HandleScope;
+using v8::Isolate;
+using v8::Local;
+using v8::MaybeLocal;
+using v8::Object;
+using v8::String;
+using v8::Value;
+
+namespace dtls {
+
+DTLSSession::DTLSSession(Environment* env,
+                         Local<Object> wrap,
+                         DTLSEndpoint* endpoint,
+                         ncrypto::SSLPointer ssl,
+                         BIO* enc_in,
+                         BIO* enc_out,
+                         const SocketAddress& remote,
+                         bool is_server)
+    : AsyncWrap(env, wrap, PROVIDER_DTLS_SESSION),
+      endpoint_(endpoint),
+      ssl_(std::move(ssl)),
+      enc_in_(enc_in),
+      enc_out_(enc_out),
+      retransmit_timer_(env,
+                        [this] {
+                          if (destroyed_) return;
+                          // Keep ourselves alive across the callback: emitting
+                          // an error or running Cycle() below can synchronously
+                          // destroy this session, and this timer lives on it.
+                          BaseObjectPtr<DTLSSession> strong_ref{this};
+                          DTLS_STAT_INCREMENT(DTLSSessionStats,
+                                              retransmit_count);
+                          int ret = DTLSv1_handle_timeout(ssl_.get());
+                          if (ret < 0) {
+                            // Handshake timeout expired.
+                            HandleScope hs(this->env()->isolate());
+                            Context::Scope cs(this->env()->context());
+                            Local<Value> argv[] = {
+                                String::NewFromUtf8(this->env()->isolate(),
+                                                    "DTLS handshake timeout")
+                                    .ToLocalChecked(),
+                            };
+                            EmitCallback(DTLS_CB_SESSION_ERROR, 1, argv);
+                            return;
+                          }
+                          Cycle();
+                        }),
+      remote_address_(remote),
+      is_server_(is_server),
+      state_(env->isolate()),
+      stats_(env->isolate()) {
+  MakeWeak();
+  DTLS_STAT_RECORD_TIMESTAMP(DTLSSessionStats, created_at);
+  retransmit_timer_.Unref();
+
+  // Update shared state.
+  state_->handshaking = 1;
+  state_->open = 0;
+
+  // Store this session in SSL app data for callbacks.
+  SSL_set_app_data(ssl_.get(), this);
+
+  // Enable keylog for TLS key export (useful for Wireshark debugging).
+  SSL_CTX_set_keylog_callback(SSL_get_SSL_CTX(ssl_.get()), SSLKeylogCallback);
+
+  // Set the MTU on the SSL object.
+  SSL_set_mtu(ssl_.get(), endpoint->mtu());
+}
+
+DTLSSession::~DTLSSession() = default;
+
+Local<FunctionTemplate> DTLSSession::GetConstructorTemplate(Environment* env) {
+  auto tmpl = env->dtls_session_constructor_template();
+  if (tmpl.IsEmpty()) {
+    Isolate* isolate = env->isolate();
+    tmpl = NewFunctionTemplate(isolate, New);
+    tmpl->SetClassName(FIXED_ONE_BYTE_STRING(isolate, "DTLSSession"));
+    tmpl->InstanceTemplate()->SetInternalFieldCount(
+        AsyncWrap::kInternalFieldCount);
+
+    SetProtoMethod(isolate, tmpl, "send", DoSend);
+    SetProtoMethod(isolate, tmpl, "close", DoClose);
+    SetProtoMethod(isolate, tmpl, "destroy", DoDestroy);
+    SetProtoMethod(isolate, tmpl, "getState", GetState);
+    SetProtoMethod(isolate, tmpl, "getStats", GetStats);
+    SetProtoMethod(isolate, tmpl, "getRemoteAddress", GetRemoteAddress);
+    SetProtoMethod(isolate, tmpl, "getProtocol", GetProtocol);
+    SetProtoMethod(isolate, tmpl, "getCipher", GetCipher);
+    SetProtoMethod(isolate, tmpl, "getPeerCertificate", GetPeerCertificate);
+    SetProtoMethod(isolate, tmpl, "getALPNProtocol", GetALPNProtocol);
+    SetProtoMethod(isolate, tmpl, "exportKeyingMaterial", ExportKeyingMaterial);
+    SetProtoMethod(isolate, tmpl, "getSRTPProfile", GetSRTPProfile);
+    SetProtoMethod(isolate, tmpl, "getServername", GetServername);
+
+    env->set_dtls_session_constructor_template(tmpl);
+  }
+  return tmpl;
+}
+
+void DTLSSession::InitPerContext(Local<Object> target,
+                                 Local<Context> context,
+                                 Environment* env) {
+  SetConstructorFunction(
+      context, target, "DTLSSession", GetConstructorTemplate(env));
+}
+
+void DTLSSession::RegisterExternalReferences(
+    ExternalReferenceRegistry* registry) {
+  registry->Register(New);
+  registry->Register(DoSend);
+  registry->Register(DoClose);
+  registry->Register(DoDestroy);
+  registry->Register(GetState);
+  registry->Register(GetStats);
+  registry->Register(GetRemoteAddress);
+  registry->Register(GetProtocol);
+  registry->Register(GetCipher);
+  registry->Register(GetPeerCertificate);
+  registry->Register(GetALPNProtocol);
+  registry->Register(ExportKeyingMaterial);
+  registry->Register(GetSRTPProfile);
+  registry->Register(GetServername);
+}
+
+BaseObjectPtr<DTLSSession> DTLSSession::Create(Environment* env,
+                                               DTLSEndpoint* endpoint,
+                                               SSL_CTX* ssl_ctx,
+                                               const SocketAddress& remote,
+                                               bool is_server,
+                                               const char* servername,
+                                               const char* verify_host,
+                                               bool verify_is_ip) {
+  // Create the SSL object.
+  SSL* ssl_raw = SSL_new(ssl_ctx);
+  if (ssl_raw == nullptr) {
+    THROW_ERR_CRYPTO_OPERATION_FAILED(env, "SSL_new failed");
+    return {};
+  }
+
+  ncrypto::SSLPointer ssl(ssl_raw);
+
+  // Create memory BIOs for encrypted data I/O.
+  auto enc_in = ncrypto::BIOPointer::NewMem();
+  auto enc_out = ncrypto::BIOPointer::NewMem();
+  if (!enc_in || !enc_out) {
+    THROW_ERR_CRYPTO_OPERATION_FAILED(env, "BIO_new failed");
+    return {};
+  }
+
+  // Make the BIOs non-blocking.
+  BIO_set_mem_eof_return(enc_in.get(), -1);
+  BIO_set_mem_eof_return(enc_out.get(), -1);
+
+  // Associate BIOs with the SSL object. SSL_set_bio takes ownership.
+  BIO* enc_in_raw = enc_in.release();
+  BIO* enc_out_raw = enc_out.release();
+  SSL_set_bio(ssl.get(), enc_in_raw, enc_out_raw);
+
+  // Set the MTU (since we use SSL_OP_NO_QUERY_MTU).
+  SSL_set_mtu(ssl.get(), endpoint->mtu());
+
+  // Set the handshake direction.
+  if (is_server) {
+    SSL_set_accept_state(ssl.get());
+  } else {
+    SSL_set_connect_state(ssl.get());
+
+    // Configure SNI and peer identity verification BEFORE the handshake
+    // starts. The caller (DTLSEndpoint::Connect) runs Cycle() immediately
+    // after Create() returns, which emits the ClientHello, so anything that
+    // must appear in that flight (SNI) has to be set here rather than via a
+    // post-construction setter.
+    if (servername != nullptr && servername[0] != '\0') {
+      if (!SSL_set_tlsext_host_name(ssl.get(), servername)) {
+        THROW_ERR_CRYPTO_OPERATION_FAILED(env,
+                                          "Failed to set servername (SNI)");
+        return {};
+      }
+    }
+
+    // When identity verification is requested, bind the expected peer name
+    // (or IP) into the verification parameters. Combined with the context's
+    // SSL_VERIFY_PEER mode this makes a name mismatch fail the handshake,
+    // rather than accepting any certificate that merely chains to a trusted
+    // CA. A failure to configure it is fatal: proceeding would silently skip
+    // the identity check.
+    if (verify_host != nullptr && verify_host[0] != '\0') {
+      if (verify_is_ip) {
+        if (!X509_VERIFY_PARAM_set1_ip_asc(SSL_get0_param(ssl.get()),
+                                           verify_host)) {
+          THROW_ERR_CRYPTO_OPERATION_FAILED(
+              env, "Failed to set peer IP address for verification");
+          return {};
+        }
+      } else {
+        SSL_set_hostflags(ssl.get(), X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
+        if (!SSL_set1_host(ssl.get(), verify_host)) {
+          THROW_ERR_CRYPTO_OPERATION_FAILED(
+              env, "Failed to set peer hostname for verification");
+          return {};
+        }
+      }
+    }
+  }
+
+  // Create the JS wrapper object.
+  Local<FunctionTemplate> tmpl = GetConstructorTemplate(env);
+  Local<Object> obj;
+  if (!tmpl->InstanceTemplate()->NewInstance(env->context()).ToLocal(&obj)) {
+    return {};
+  }
+
+  auto session = MakeBaseObject<DTLSSession>(env,
+                                             obj,
+                                             endpoint,
+                                             std::move(ssl),
+                                             enc_in_raw,
+                                             enc_out_raw,
+                                             remote,
+                                             is_server);
+
+  return session;
+}
+
+BaseObjectPtr<DTLSSession> DTLSSession::CreateFromSSL(
+    Environment* env,
+    DTLSEndpoint* endpoint,
+    ncrypto::SSLPointer ssl,
+    BIO* enc_in,
+    BIO* enc_out,
+    const SocketAddress& remote) {
+  Local<FunctionTemplate> tmpl = GetConstructorTemplate(env);
+  Local<Object> obj;
+  if (!tmpl->InstanceTemplate()->NewInstance(env->context()).ToLocal(&obj)) {
+    return {};
+  }
+
+  return MakeBaseObject<DTLSSession>(env,
+                                     obj,
+                                     endpoint,
+                                     std::move(ssl),
+                                     enc_in,
+                                     enc_out,
+                                     remote,
+                                     true /* is_server */);
+}
+
+void DTLSSession::New(const FunctionCallbackInfo<Value>& args) {
+  // Sessions are created internally via DTLSSession::Create,
+  // not directly from JS.
+  CHECK(args.IsConstructCall());
+}
+
+void DTLSSession::Receive(const uint8_t* data, size_t len) {
+  if (destroyed_ || closed_) return;
+
+  // Write the encrypted datagram into enc_in_ BIO.
+  int written = BIO_write(enc_in_, data, len);
+  if (written <= 0) return;
+
+  // Run the state machine.
+  Cycle();
+}
+
+void DTLSSession::Cycle() {
+  if (destroyed_) return;
+
+  // Pin a strong reference to ourselves for the duration of the pump. A JS
+  // callback dispatched below (message/handshake/error) can synchronously
+  // destroy this session, which removes the endpoint's only strong reference
+  // and would otherwise free `this` while we are still using ssl_/state_.
+  BaseObjectPtr<DTLSSession> strong_ref{this};
+
+  // Prevent infinite recursion.
+  if (++cycle_depth_ > 1) {
+    cycle_depth_--;
+    return;
+  }
+
+  HandleScope handle_scope(env()->isolate());
+  Context::Scope context_scope(env()->context());
+
+  // If handshake is not yet complete, drive it forward.
+  if (!handshake_complete_) {
+    int ret = SSL_do_handshake(ssl_.get());
+    if (ret <= 0) {
+      int err = SSL_get_error(ssl_.get(), ret);
+      if (err == SSL_ERROR_SSL) {
+        unsigned long ossl_err = ERR_get_error();  // NOLINT(runtime/int)
+        char err_buf[256];
+        ERR_error_string_n(ossl_err, err_buf, sizeof(err_buf));
+        // Flush any fatal alert OpenSSL queued for the peer before emitting the
+        // error, which tears the session down and detaches the endpoint.
+        EncOut();
+        Local<Value> argv[] = {
+            String::NewFromUtf8(env()->isolate(), err_buf).ToLocalChecked(),
+        };
+        EmitCallback(DTLS_CB_SESSION_ERROR, 1, argv);
+        cycle_depth_--;
+        return;
+      }
+      // SSL_ERROR_WANT_READ/WRITE is normal during handshake.
+    }
+    // Flush any handshake data produced.
+    EncOut();
+
+    // Check if handshake just completed.
+    if (SSL_is_init_finished(ssl_.get()) && !handshake_complete_) {
+      handshake_complete_ = true;
+      state_->handshaking = 0;
+      state_->open = 1;
+      DTLS_STAT_RECORD_TIMESTAMP(DTLSSessionStats, handshake_completed_at);
+
+      Local<Value> argv[] = {
+          String::NewFromUtf8(env()->isolate(), SSL_get_version(ssl_.get()))
+              .ToLocalChecked(),
+      };
+      EmitCallback(DTLS_CB_SESSION_HANDSHAKE, 1, argv);
+    }
+  }
+
+  // Read any decrypted application data.
+  ClearOut();
+  // Flush any pending encrypted output.
+  EncOut();
+
+  UpdateTimer();
+  cycle_depth_--;
+}
+
+void DTLSSession::ClearOut() {
+  if (destroyed_) return;
+
+  // Try to read decrypted application data from OpenSSL. A DTLS record's
+  // plaintext is at most 2^14 bytes, so one SSL_read yields at most that much.
+  uint8_t buf[16384];
+  int read;
+
+  while ((read = SSL_read(ssl_.get(), buf, sizeof(buf))) > 0) {
+    DTLS_STAT_INCREMENT_N(DTLSSessionStats, bytes_received, read);
+    DTLS_STAT_INCREMENT(DTLSSessionStats, messages_received);
+    // Emit the data to JS via callback.
+    Local<Value> argv[] = {
+        Buffer::Copy(env(), reinterpret_cast<const char*>(buf), read)
+            .ToLocalChecked(),
+    };
+    EmitCallback(DTLS_CB_SESSION_MESSAGE, 1, argv);
+    // The message handler may have destroyed the session synchronously; stop
+    // reading if so (Cycle()'s strong reference keeps `this` itself alive).
+    if (destroyed_) return;
+  }
+
+  int err = SSL_get_error(ssl_.get(), read);
+  switch (err) {
+    case SSL_ERROR_WANT_READ:
+    case SSL_ERROR_WANT_WRITE:
+      // Normal - need more data or need to flush.
+      break;
+
+    case SSL_ERROR_ZERO_RETURN:
+      // Peer sent close_notify.
+      if (!closed_) {
+        closed_ = true;
+        state_->closing = 1;
+        state_->open = 0;
+        // Send our close_notify back.
+        SSL_shutdown(ssl_.get());
+        EncOut();
+        // Detach from the endpoint's session table before notifying JS so an
+        // observer of the close sees a consistent session count. Cycle() holds
+        // a strong reference for the duration of the pump.
+        if (auto ep = endpoint_.get()) ep->RemoveSession(remote_address_);
+        Local<Value> argv[] = {};
+        EmitCallback(DTLS_CB_SESSION_CLOSE, 0, argv);
+        Destroy();
+      }
+      break;
+
+    case SSL_ERROR_SSL: {
+      // SSL error during handshake or data exchange.
+      unsigned long ossl_err = ERR_get_error();  // NOLINT(runtime/int)
+      char err_buf[256];
+      ERR_error_string_n(ossl_err, err_buf, sizeof(err_buf));
+      // Flush any fatal alert OpenSSL queued for the peer before emitting the
+      // error, which tears the session down and detaches the endpoint.
+      EncOut();
+      Local<Value> argv[] = {
+          String::NewFromUtf8(env()->isolate(), err_buf).ToLocalChecked(),
+      };
+      EmitCallback(DTLS_CB_SESSION_ERROR, 1, argv);
+      break;
+    }
+
+    default:
+      break;
+  }
+}
+
+void DTLSSession::EncOut() {
+  if (destroyed_) return;
+  auto ep = endpoint_.get();
+  if (ep == nullptr) return;
+
+  // Read encrypted data from enc_out_ BIO and send via UDP.
+  // Read in a loop since there may be multiple DTLS records.
+  uint8_t buf[65536];
+  int read;
+  while ((read = BIO_read(enc_out_, buf, sizeof(buf))) > 0) {
+    ep->SendTo(remote_address_, buf, read);
+  }
+}
+
+void DTLSSession::UpdateTimer() {
+  if (destroyed_) return;
+
+  struct timeval tv;
+  if (DTLSv1_get_timeout(ssl_.get(), &tv)) {
+    uint64_t timeout_ms = tv.tv_sec * 1000 + tv.tv_usec / 1000;
+    if (timeout_ms == 0) timeout_ms = 1;  // Minimum 1ms.
+    retransmit_timer_.Update(timeout_ms);
+  } else {
+    // No timeout needed (handshake complete or not started).
+    retransmit_timer_.Stop();
+  }
+}
+
+int DTLSSession::Send(const uint8_t* data, size_t len) {
+  if (destroyed_ || closed_) return -1;
+
+  if (!handshake_complete_) {
+    // Can't send application data before handshake.
+    return -1;
+  }
+
+  int written = SSL_write(ssl_.get(), data, len);
+  if (written > 0) {
+    DTLS_STAT_INCREMENT_N(DTLSSessionStats, bytes_sent, written);
+    DTLS_STAT_INCREMENT(DTLSSessionStats, messages_sent);
+    EncOut();
+  }
+  return written;
+}
+
+void DTLSSession::Close() {
+  if (destroyed_ || closed_) return;
+
+  // Emitting the close below can synchronously free this session (a client
+  // session that owns its endpoint tears the endpoint -- and thus itself --
+  // down from the close callback), and we call Destroy() afterwards. Pin a
+  // strong reference so `this` survives until we return.
+  BaseObjectPtr<DTLSSession> strong_ref{this};
+
+  closed_ = true;
+  state_->closing = 1;
+  DTLS_STAT_RECORD_TIMESTAMP(DTLSSessionStats, closing_at);
+
+  // Send close_notify.
+  int ret = SSL_shutdown(ssl_.get());
+  if (ret == 0) {
+    // Need to call again for bidirectional shutdown.
+    SSL_shutdown(ssl_.get());
+  }
+  EncOut();
+
+  retransmit_timer_.Stop();
+
+  state_->open = 0;
+
+  // Detach from the endpoint's session table before notifying JS, so an
+  // observer of the close (e.g. one awaiting `closed`) sees a consistent
+  // session count. We stay alive via strong_ref, and endpoint_ remains valid
+  // for the callback below; the Destroy() that follows clears it.
+  if (auto ep = endpoint_.get()) ep->RemoveSession(remote_address_);
+
+  // Notify JS.
+  HandleScope handle_scope(env()->isolate());
+  Context::Scope context_scope(env()->context());
+  Local<Value> argv[] = {};
+  EmitCallback(DTLS_CB_SESSION_CLOSE, 0, argv);
+
+  // Release the remaining resources. RemoveSession above already detached us,
+  // so the one inside Destroy() is a no-op.
+  Destroy();
+}
+
+void DTLSSession::Destroy() {
+  if (destroyed_) return;
+  destroyed_ = true;
+  closed_ = true;
+
+  state_->destroyed = 1;
+  DTLS_STAT_RECORD_TIMESTAMP(DTLSSessionStats, destroyed_at);
+  state_->open = 0;
+  state_->handshaking = 0;
+
+  retransmit_timer_.Close();
+
+  // Promote to strong ref to keep endpoint alive during removal,
+  // then release our weak pointer.
+  BaseObjectPtr<DTLSEndpoint> ep = endpoint_;
+  endpoint_.reset();
+  if (ep) ep->RemoveSession(remote_address_);
+}
+
+void DTLSSession::SSLKeylogCallback(const SSL* ssl, const char* line) {
+  DTLSSession* session = static_cast<DTLSSession*>(SSL_get_app_data(ssl));
+  if (session == nullptr || session->destroyed_) return;
+
+  HandleScope handle_scope(session->env()->isolate());
+  Context::Scope context_scope(session->env()->context());
+
+  Local<Value> argv[] = {
+      String::NewFromUtf8(session->env()->isolate(), line).ToLocalChecked(),
+  };
+  session->EmitCallback(DTLS_CB_SESSION_KEYLOG, 1, argv);
+}
+
+MaybeLocal<Value> DTLSSession::EmitCallback(int cb_index,
+                                            int argc,
+                                            Local<Value>* argv) {
+  auto ep = endpoint_.get();
+  if (ep == nullptr) return MaybeLocal<Value>();
+  Local<Function> cb = ep->GetCallback(cb_index);
+  if (cb.IsEmpty()) return MaybeLocal<Value>();
+
+  return MakeCallback(cb, argc, argv);
+}
+
+// --- JS binding methods ---
+
+void DTLSSession::DoSend(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+
+  if (!Buffer::HasInstance(args[0])) {
+    return THROW_ERR_INVALID_ARG_TYPE(session->env(), "data must be a Buffer");
+  }
+
+  const uint8_t* data = reinterpret_cast<const uint8_t*>(Buffer::Data(args[0]));
+  size_t len = Buffer::Length(args[0]);
+
+  int written = session->Send(data, len);
+  args.GetReturnValue().Set(written);
+}
+
+void DTLSSession::DoClose(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  session->Close();
+}
+
+void DTLSSession::DoDestroy(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  session->Destroy();
+}
+
+void DTLSSession::GetState(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  args.GetReturnValue().Set(session->state_.GetArrayBuffer());
+}
+
+void DTLSSession::GetStats(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  args.GetReturnValue().Set(session->stats_.GetArrayBuffer());
+}
+
+void DTLSSession::GetRemoteAddress(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  Environment* env = session->env();
+
+  Local<Object> obj;
+  if (session->remote_address_.ToJS(env).ToLocal(&obj)) {
+    args.GetReturnValue().Set(obj);
+  }
+}
+
+void DTLSSession::GetProtocol(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+
+  const char* version = SSL_get_version(session->ssl_.get());
+  args.GetReturnValue().Set(
+      String::NewFromUtf8(session->env()->isolate(), version).ToLocalChecked());
+}
+
+void DTLSSession::GetCipher(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  Environment* env = session->env();
+
+  const SSL_CIPHER* cipher = SSL_get_current_cipher(session->ssl_.get());
+  if (cipher == nullptr) return;
+
+  Local<Object> info = Object::New(env->isolate());
+  info->Set(env->context(),
+            FIXED_ONE_BYTE_STRING(env->isolate(), "name"),
+            String::NewFromUtf8(env->isolate(), SSL_CIPHER_get_name(cipher))
+                .ToLocalChecked())
+      .Check();
+  info->Set(
+          env->context(),
+          FIXED_ONE_BYTE_STRING(env->isolate(), "standardName"),
+          String::NewFromUtf8(env->isolate(), SSL_CIPHER_standard_name(cipher))
+              .ToLocalChecked())
+      .Check();
+  info->Set(env->context(),
+            FIXED_ONE_BYTE_STRING(env->isolate(), "version"),
+            String::NewFromUtf8(env->isolate(), SSL_CIPHER_get_version(cipher))
+                .ToLocalChecked())
+      .Check();
+
+  args.GetReturnValue().Set(info);
+}
+
+void DTLSSession::GetPeerCertificate(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  Environment* env = session->env();
+
+  X509* peer_cert = SSL_get0_peer_certificate(session->ssl_.get());
+  if (peer_cert == nullptr) return;
+
+  // Return the PEM-encoded certificate.
+  auto bio = ncrypto::BIOPointer::NewMem();
+  if (PEM_write_bio_X509(bio.get(), peer_cert)) {
+    char* data;
+    long len = BIO_get_mem_data(bio.get(), &data);  // NOLINT(runtime/int)
+    if (len > 0) {
+      args.GetReturnValue().Set(
+          String::NewFromUtf8(
+              env->isolate(), data, v8::NewStringType::kNormal, len)
+              .ToLocalChecked());
+    }
+  }
+}
+
+void DTLSSession::GetALPNProtocol(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+
+  const unsigned char* alpn = nullptr;
+  unsigned int alpn_len = 0;
+  SSL_get0_alpn_selected(session->ssl_.get(), &alpn, &alpn_len);
+
+  if (alpn != nullptr && alpn_len > 0) {
+    args.GetReturnValue().Set(
+        String::NewFromUtf8(session->env()->isolate(),
+                            reinterpret_cast<const char*>(alpn),
+                            v8::NewStringType::kNormal,
+                            alpn_len)
+            .ToLocalChecked());
+  }
+}
+
+void DTLSSession::ExportKeyingMaterial(
+    const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  Environment* env = session->env();
+
+  if (!args[0]->IsNumber() || !args[1]->IsString()) {
+    return THROW_ERR_INVALID_ARG_TYPE(
+        env, "Expected (length: number, label: string[, context: Buffer])");
+  }
+
+  int length = args[0]->Int32Value(env->context()).FromJust();
+  Utf8Value label(env->isolate(), args[1]);
+
+  const uint8_t* context_value = nullptr;
+  size_t context_len = 0;
+  bool use_context = false;
+
+  if (args.Length() > 2 && Buffer::HasInstance(args[2])) {
+    context_value = reinterpret_cast<const uint8_t*>(Buffer::Data(args[2]));
+    context_len = Buffer::Length(args[2]);
+    use_context = true;
+  }
+
+  std::vector<uint8_t> out(length);
+  int ret = SSL_export_keying_material(session->ssl_.get(),
+                                       out.data(),
+                                       length,
+                                       *label,
+                                       label.length(),
+                                       context_value,
+                                       context_len,
+                                       use_context ? 1 : 0);
+
+  if (ret != 1) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(
+        env, "SSL_export_keying_material failed");
+  }
+
+  args.GetReturnValue().Set(
+      Buffer::Copy(env, reinterpret_cast<const char*>(out.data()), length)
+          .ToLocalChecked());
+}
+
+void DTLSSession::GetSRTPProfile(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+
+  const SRTP_PROTECTION_PROFILE* profile =
+      SSL_get_selected_srtp_profile(session->ssl_.get());
+
+  if (profile != nullptr) {
+    args.GetReturnValue().Set(
+        String::NewFromUtf8(session->env()->isolate(), profile->name)
+            .ToLocalChecked());
+  }
+}
+
+void DTLSSession::GetServername(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+
+  const char* servername =
+      SSL_get_servername(session->ssl_.get(), TLSEXT_NAMETYPE_host_name);
+  if (servername != nullptr) {
+    args.GetReturnValue().Set(
+        String::NewFromUtf8(session->env()->isolate(), servername)
+            .ToLocalChecked());
+  }
+}
+
+void DTLSSession::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackField("remote_address", remote_address_);
+}
+
+}  // namespace dtls
+}  // namespace node
+
+#endif  // HAVE_OPENSSL && HAVE_DTLS
diff --git a/src/dtls/dtls_session.h b/src/dtls/dtls_session.h
new file mode 100644
index 000000000000..162752b6eb4c
--- /dev/null
+++ b/src/dtls/dtls_session.h
@@ -0,0 +1,183 @@
+#pragma once
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#if HAVE_OPENSSL && HAVE_DTLS
+
+#include <aliased_struct.h>
+#include <async_wrap.h>
+#include <base_object.h>
+#include <env.h>
+#include <ncrypto.h>
+#include <node_sockaddr.h>
+#include <timer_wrap.h>
+#include <uv.h>
+#include <v8.h>
+
+#include <openssl/bio.h>
+#include <openssl/ssl.h>
+
+#include "dtls.h"
+
+namespace node::dtls {
+
+class DTLSEndpoint;
+
+// Shared C++ <-> JS state for a DTLS session.
+struct DTLSSessionStateData {
+  uint8_t handshaking = 0;
+  uint8_t open = 0;
+  uint8_t closing = 0;
+  uint8_t destroyed = 0;
+  uint8_t has_message_listener = 0;
+};
+
+// Stats collected for a DTLS session, backed by a BigUint64Array.
+struct DTLSSessionStats {
+  DTLS_SESSION_STATS(DTLS_STAT_FIELD)
+};
+
+// DTLSSession represents a single DTLS association with a remote peer.
+// It wraps an OpenSSL SSL* object configured for DTLS, using memory BIOs
+// to interface with the endpoint's UDP socket.
+class DTLSSession final : public AsyncWrap {
+ public:
+  static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
+      Environment* env);
+  static void InitPerContext(v8::Local<v8::Object> target,
+                             v8::Local<v8::Context> context,
+                             Environment* env);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+
+  // Create a new DTLS session.
+  // |endpoint| - the owning endpoint (for sending packets)
+  // |ssl_ctx| - the SSL_CTX to create the SSL* from
+  // |remote| - the peer address
+  // |is_server| - true if this is a server-side session
+  // |servername|   - SNI to advertise (client only); nullptr to omit.
+  // |verify_host|  - expected peer identity to verify (client only);
+  //                  nullptr disables identity checking.
+  // |verify_is_ip| - true if |verify_host| is an IP literal (verified
+  //                  against iPAddress SANs) rather than a DNS name.
+  static BaseObjectPtr<DTLSSession> Create(Environment* env,
+                                           DTLSEndpoint* endpoint,
+                                           SSL_CTX* ssl_ctx,
+                                           const SocketAddress& remote,
+                                           bool is_server,
+                                           const char* servername = nullptr,
+                                           const char* verify_host = nullptr,
+                                           bool verify_is_ip = false);
+
+  // Create a session from an already-initialized SSL object.
+  // Used by the server after DTLSv1_listen() returns 1 — the SSL
+  // has already verified the cookie and is ready to continue.
+  static BaseObjectPtr<DTLSSession> CreateFromSSL(Environment* env,
+                                                  DTLSEndpoint* endpoint,
+                                                  ncrypto::SSLPointer ssl,
+                                                  BIO* enc_in,
+                                                  BIO* enc_out,
+                                                  const SocketAddress& remote);
+
+  ~DTLSSession() override;
+
+  // Called by the endpoint when a datagram arrives from this session's peer.
+  void Receive(const uint8_t* data, size_t len);
+
+  // Send application data to the peer.
+  int Send(const uint8_t* data, size_t len);
+
+  // Initiate a graceful shutdown (sends close_notify).
+  void Close();
+
+  // Immediately destroy the session without sending close_notify.
+  void Destroy();
+
+  const SocketAddress& remote_address() const { return remote_address_; }
+  bool is_server() const { return is_server_; }
+  bool is_handshake_complete() const { return handshake_complete_; }
+  bool is_closed() const { return closed_; }
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(DTLSSession)
+  SET_SELF_SIZE(DTLSSession)
+
+  // Public constructor required by MakeBaseObject<>.
+  DTLSSession(Environment* env,
+              v8::Local<v8::Object> wrap,
+              DTLSEndpoint* endpoint,
+              ncrypto::SSLPointer ssl,
+              BIO* enc_in,
+              BIO* enc_out,
+              const SocketAddress& remote,
+              bool is_server);
+
+ private:
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoSend(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoClose(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoDestroy(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetState(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetStats(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetRemoteAddress(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetProtocol(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetCipher(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetPeerCertificate(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetALPNProtocol(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void ExportKeyingMaterial(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetSRTPProfile(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetServername(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+ public:
+  // The core state machine pump. Processes pending OpenSSL I/O:
+  //   1. ClearOut() - SSL_read() -> emit decrypted data to JS
+  //   2. ClearIn()  - SSL_write() pending cleartext
+  //   3. EncOut()   - read enc_out_ BIO -> send via endpoint UDP
+  //   4. UpdateTimer() - schedule retransmit timer if needed
+  void Cycle();
+
+ private:
+  // Read decrypted application data from OpenSSL and emit to JS.
+  void ClearOut();
+
+  // Flush encrypted data from enc_out_ BIO and send via the endpoint.
+  void EncOut();
+
+  // Update the DTLS retransmission timer based on OpenSSL's timeout.
+  void UpdateTimer();
+
+  // OpenSSL keylog callback.
+  static void SSLKeylogCallback(const SSL* ssl, const char* line);
+
+  // Emit a callback to JS via the endpoint's callback dispatch.
+  v8::MaybeLocal<v8::Value> EmitCallback(int cb_index,
+                                         int argc,
+                                         v8::Local<v8::Value>* argv);
+
+  BaseObjectWeakPtr<DTLSEndpoint> endpoint_;
+  ncrypto::SSLPointer ssl_;
+
+  // Memory BIOs: encrypted data flows through these.
+  // enc_in_: network datagrams written here -> SSL_read() extracts cleartext
+  // enc_out_: SSL_write() puts ciphertext here -> we read and send via UDP
+  BIO* enc_in_ = nullptr;
+  BIO* enc_out_ = nullptr;
+
+  TimerWrapHandle retransmit_timer_;
+
+  SocketAddress remote_address_;
+  bool is_server_;
+  bool handshake_complete_ = false;
+  bool closed_ = false;
+  bool destroyed_ = false;
+  int cycle_depth_ = 0;
+
+  AliasedStruct<DTLSSessionStateData> state_;
+  AliasedStruct<DTLSSessionStats> stats_;
+};
+
+}  // namespace node::dtls
+
+#endif  // HAVE_OPENSSL && HAVE_DTLS
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/env-inl.h b/src/env-inl.h
index efabadbcc0bc..e41afd25ffc3 100644
--- a/src/env-inl.h
+++ b/src/env-inl.h
@@ -221,7 +221,7 @@ inline cppgc::AllocationHandle& Environment::cppgc_allocation_handle() const {
 
 inline v8::ExternalMemoryAccounter* Environment::external_memory_accounter()
     const {
-  return external_memory_accounter_;
+  return external_memory_accounter_.get();
 }
 
 inline Environment* Environment::from_timer_handle(uv_timer_t* handle) {
@@ -923,26 +923,60 @@ inline void Environment::set_heap_snapshot_near_heap_limit(uint32_t limit) {
   heap_snapshot_near_heap_limit_ = limit;
 }
 
+inline void Environment::set_heap_profile_near_heap_limit(uint32_t limit) {
+  heap_profile_near_heap_limit_ = limit;
+}
+
 inline bool Environment::is_in_heapsnapshot_heap_limit_callback() const {
   return is_in_heapsnapshot_heap_limit_callback_;
 }
 
+inline bool Environment::is_in_heap_profile_near_heap_limit_callback() const {
+  return is_in_heap_profile_near_heap_limit_callback_;
+}
+
 inline bool Environment::report_exclude_env() const {
   return options_->report_exclude_env;
 }
 
 inline void Environment::AddHeapSnapshotNearHeapLimitCallback() {
   DCHECK(!heapsnapshot_near_heap_limit_callback_added_);
+  const bool was_registered = heap_profile_near_heap_limit_callback_added_;
   heapsnapshot_near_heap_limit_callback_added_ = true;
-  isolate_->AddNearHeapLimitCallback(Environment::NearHeapLimitCallback, this);
+  if (!was_registered) {
+    isolate_->AddNearHeapLimitCallback(Environment::NearHeapLimitCallback,
+                                       this);
+  }
 }
 
 inline void Environment::RemoveHeapSnapshotNearHeapLimitCallback(
     size_t heap_limit) {
   DCHECK(heapsnapshot_near_heap_limit_callback_added_);
   heapsnapshot_near_heap_limit_callback_added_ = false;
-  isolate_->RemoveNearHeapLimitCallback(Environment::NearHeapLimitCallback,
-                                        heap_limit);
+  if (!heap_profile_near_heap_limit_callback_added_) {
+    isolate_->RemoveNearHeapLimitCallback(Environment::NearHeapLimitCallback,
+                                          heap_limit);
+  }
+}
+
+inline void Environment::AddHeapProfileNearHeapLimitCallback() {
+  DCHECK(!heap_profile_near_heap_limit_callback_added_);
+  const bool was_registered = heapsnapshot_near_heap_limit_callback_added_;
+  heap_profile_near_heap_limit_callback_added_ = true;
+  if (!was_registered) {
+    isolate_->AddNearHeapLimitCallback(Environment::NearHeapLimitCallback,
+                                       this);
+  }
+}
+
+inline void Environment::RemoveHeapProfileNearHeapLimitCallback(
+    size_t heap_limit) {
+  DCHECK(heap_profile_near_heap_limit_callback_added_);
+  heap_profile_near_heap_limit_callback_added_ = false;
+  if (!heapsnapshot_near_heap_limit_callback_added_) {
+    isolate_->RemoveNearHeapLimitCallback(Environment::NearHeapLimitCallback,
+                                          heap_limit);
+  }
 }
 
 }  // namespace node
diff --git a/src/env.cc b/src/env.cc
index b381cc341734..5626b2a7e10e 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -9,13 +9,18 @@
 #include "node_context_data.h"
 #include "node_contextify.h"
 #include "node_errors.h"
+#include "node_file_utils.h"
 #include "node_internals.h"
 #include "node_options-inl.h"
 #include "node_process-inl.h"
+#include "node_profiling.h"
 #include "node_shadow_realm.h"
 #include "node_snapshotable.h"
 #include "node_v8_platform-inl.h"
 #include "node_worker.h"
+#if HAVE_OPENSSL
+#include "ncrypto.h"
+#endif
 #include "req_wrap-inl.h"
 #include "stream_base.h"
 #include "tracing/agent.h"
@@ -33,6 +38,7 @@
 #include <limits>
 #include <memory>
 #include <optional>
+#include <sstream>
 #include <unordered_map>
 
 namespace node {
@@ -851,7 +857,7 @@ Environment::Environment(IsolateData* isolate_data,
                          ThreadId thread_id,
                          std::string_view thread_name)
     : isolate_(isolate),
-      external_memory_accounter_(new ExternalMemoryAccounter()),
+      external_memory_accounter_(std::make_unique<ExternalMemoryAccounter>()),
       isolate_data_(isolate_data),
       async_hooks_(isolate, MAYBE_FIELD_PTR(env_info, async_hooks)),
       immediate_info_(isolate, MAYBE_FIELD_PTR(env_info, immediate_info)),
@@ -878,6 +884,14 @@ Environment::Environment(IsolateData* isolate_data,
                      ? AllocateEnvironmentThreadId().id
                      : thread_id.id),
       thread_name_(thread_name) {
+#if HAVE_OPENSSL && NCRYPTO_USE_OPENSSL3_PROVIDER
+  provider_digest_cache = std::make_unique<ncrypto::DigestCache>();
+  provider_cipher_cache = std::make_unique<ncrypto::CipherCache>();
+#if OPENSSL_WITH_EVP_MAC
+  provider_mac_cache = std::make_unique<ncrypto::MacCache>();
+#endif
+#endif
+
   if (!is_main_thread()) {
     // If this is a Worker thread, we can always safely use the parent's
     // Isolate's code cache because of the shared read-only heap.
@@ -895,6 +909,9 @@ Environment::Environment(IsolateData* isolate_data,
           isolate_data->snapshot_data()->code_cache);
     }
   }
+  if (is_main_thread() && !isolate_data->builtin_code_cache().empty()) {
+    builtin_loader()->RefreshCodeCache(isolate_data->builtin_code_cache());
+  }
 
   // Compile builtins eagerly when building the snapshot so that inner functions
   // of essential builtins that are loaded in the snapshot can have faster first
@@ -975,7 +992,12 @@ Environment::Environment(IsolateData* isolate_data,
     // spawn/worker nor use addons or enable inspector
     // unless explicitly allowed by the user
     if (!options_->allow_addons) {
-      options_->allow_native_addons = false;
+      // In audit mode addon loading must stay enabled: the denial is
+      // published through the diagnostics channel by the permission
+      // check in DLOpen() instead of being rejected upfront.
+      if (!options_->permission_audit) {
+        options_->allow_native_addons = false;
+      }
       permission()->Apply(this, args, permission::PermissionScope::kAddon);
     }
     if (!options_->allow_inspector) {
@@ -1101,6 +1123,9 @@ Environment::~Environment() {
   if (heapsnapshot_near_heap_limit_callback_added_) {
     RemoveHeapSnapshotNearHeapLimitCallback(0);
   }
+  if (heap_profile_near_heap_limit_callback_added_) {
+    RemoveHeapProfileNearHeapLimitCallback(0);
+  }
 
   isolate()->GetHeapProfiler()->RemoveBuildEmbedderGraphCallback(
       BuildEmbedderGraph, this);
@@ -1129,13 +1154,21 @@ Environment::~Environment() {
   // Also, since the main thread usually stops just before the process exits,
   // this is far less relevant here.
   if (!is_main_thread()) {
+#if HAVE_OPENSSL
+    // Provider methods can contain callbacks into native addons. Release the
+    // environment-owned methods before unloading any addon DSOs.
+    provider_digest_cache.reset();
+    provider_cipher_cache.reset();
+#if OPENSSL_WITH_EVP_MAC
+    provider_mac_cache.reset();
+#endif
+#endif
     // Dereference all addons that were loaded into this environment.
     for (binding::DLib& addon : loaded_addons_) {
       addon.Close();
     }
   }
 
-  delete external_memory_accounter_;
   if (cpu_profiler_) {
     for (auto& it : pending_profiles_) {
       cpu_profiler_->Stop(it);
@@ -2160,14 +2193,49 @@ void Environment::TracePromises(PromiseHookType type,
   PrintCurrentStackTrace(isolate);
 }
 
+// V8 only invokes the most recently registered near-heap-limit callback.
+// To allow the snapshot and profile handlers to coexist on the same
+// isolate, both register through this single V8-facing entry point. It fans
+// out to whichever sub-handlers are active and returns the largest requested
+// heap limit.
 size_t Environment::NearHeapLimitCallback(void* data,
                                           size_t current_heap_limit,
                                           size_t initial_heap_limit) {
   auto* env = static_cast<Environment*>(data);
 
+  // Profile and snapshot generation can allocate and invoke this callback
+  // recursively. Only extend the heap for the operation already in progress;
+  // do not start the other diagnostic from the nested invocation.
+  if (env->is_in_heapsnapshot_heap_limit_callback_) {
+    return HeapSnapshotNearHeapLimitCallback(
+        data, current_heap_limit, initial_heap_limit);
+  }
+  if (env->is_in_heap_profile_near_heap_limit_callback_) {
+    return HeapProfileNearHeapLimitCallback(
+        data, current_heap_limit, initial_heap_limit);
+  }
+
+  size_t new_limit = current_heap_limit;
+  if (env->heapsnapshot_near_heap_limit_callback_added_) {
+    new_limit = std::max(new_limit,
+                         HeapSnapshotNearHeapLimitCallback(
+                             data, current_heap_limit, initial_heap_limit));
+  }
+  if (env->heap_profile_near_heap_limit_callback_added_) {
+    new_limit = std::max(new_limit,
+                         HeapProfileNearHeapLimitCallback(
+                             data, current_heap_limit, initial_heap_limit));
+  }
+  return new_limit;
+}
+
+size_t Environment::HeapSnapshotNearHeapLimitCallback(
+    void* data, size_t current_heap_limit, size_t initial_heap_limit) {
+  auto* env = static_cast<Environment*>(data);
+
   Debug(env,
         DebugCategory::DIAGNOSTICS,
-        "Invoked NearHeapLimitCallback, processing=%d, "
+        "Invoked HeapSnapshotNearHeapLimitCallback, processing=%d, "
         "current_limit=%" PRIu64 ", "
         "initial_limit=%" PRIu64 "\n",
         env->is_in_heapsnapshot_heap_limit_callback_,
@@ -2289,6 +2357,85 @@ size_t Environment::NearHeapLimitCallback(void* data,
   return new_limit;
 }
 
+size_t Environment::HeapProfileNearHeapLimitCallback(
+    void* data, size_t current_heap_limit, size_t initial_heap_limit) {
+  auto* env = static_cast<Environment*>(data);
+
+  Debug(env,
+        DebugCategory::DIAGNOSTICS,
+        "Invoked HeapProfileNearHeapLimitCallback, processing=%d, "
+        "current_limit=%" PRIu64 ", "
+        "initial_limit=%" PRIu64 "\n",
+        env->is_in_heap_profile_near_heap_limit_callback_,
+        static_cast<uint64_t>(current_heap_limit),
+        static_cast<uint64_t>(initial_heap_limit));
+
+  const size_t max_young_gen_size = env->isolate_data()->max_young_gen_size;
+  const size_t new_limit = current_heap_limit + max_young_gen_size;
+
+  if (env->is_in_heap_profile_near_heap_limit_callback_) {
+    return new_limit;
+  }
+
+  env->is_in_heap_profile_near_heap_limit_callback_ = true;
+  auto reset_in_callback = OnScopeLeave(
+      [env]() { env->is_in_heap_profile_near_heap_limit_callback_ = false; });
+  auto restore_initial_limit = OnScopeLeave(
+      [env]() { env->isolate()->AutomaticallyRestoreInitialHeapLimit(0.95); });
+  auto uninstall_callback = [env]() {
+    env->RemoveHeapProfileNearHeapLimitCallback(0);
+  };
+
+  std::string dir = env->options()->diagnostic_dir;
+  if (dir.empty()) {
+    dir = Environment::GetCwd(env->exec_path_);
+  }
+  DiagnosticFilename name(env, "Heap", "heapprofile");
+  std::string filename = dir + kPathSeparator + (*name);
+
+  Debug(env, DebugCategory::DIAGNOSTICS, "Writing %s...\n", *name);
+
+  std::ostringstream out;
+  if (!node::SerializeHeapProfile(env->isolate(), out)) {
+    Debug(env,
+          DebugCategory::DIAGNOSTICS,
+          "No sampling heap profile active; uninstalling callback.\n");
+    uninstall_callback();
+    return new_limit;
+  }
+
+  std::string profile = std::move(out).str();
+  uv_buf_t buffer = uv_buf_init(profile.data(), profile.size());
+  const int err = WriteFileSync(filename.c_str(), buffer);
+  if (err != 0) {
+    FPrintF(stderr,
+            "Failed to write heap profile %s: %s\n",
+            filename,
+            uv_strerror(err));
+    uninstall_callback();
+    return new_limit;
+  }
+
+  env->heap_limit_profile_taken_ += 1;
+  FPrintF(stderr, "Wrote heap profile to %s\n", filename);
+
+  Debug(env,
+        DebugCategory::DIAGNOSTICS,
+        "%" PRIu32 "/%" PRIu32 " heap profiles written.\n",
+        env->heap_limit_profile_taken_,
+        env->heap_profile_near_heap_limit_);
+
+  if (env->heap_limit_profile_taken_ == env->heap_profile_near_heap_limit_) {
+    Debug(env,
+          DebugCategory::DIAGNOSTICS,
+          "Removing the near heap limit callback");
+    uninstall_callback();
+  }
+
+  // Returning a larger value is required by V8 even after the final write.
+  return new_limit;
+}
+
 inline size_t Environment::SelfSize() const {
   size_t size = sizeof(*this);
   // Remove non pointer fields that will be tracked in MemoryInfo()
diff --git a/src/env.h b/src/env.h
index 84fad81e7b34..4410ccb3e101 100644
--- a/src/env.h
+++ b/src/env.h
@@ -53,10 +53,6 @@
 #include "v8-profiler.h"
 #include "v8.h"
 
-#if HAVE_OPENSSL
-#include <openssl/evp.h>
-#endif
-
 #include <array>
 #include <atomic>
 #include <cstdint>
@@ -72,6 +68,12 @@
 #include <variant>
 #include <vector>
 
+namespace ncrypto {
+class CipherCache;
+class DigestCache;
+class MacCache;
+}  // namespace ncrypto
+
 namespace node {
 
 namespace shadow_realm {
@@ -166,6 +168,13 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
   inline uv_loop_t* event_loop() const;
   inline MultiIsolatePlatform* platform() const;
   inline const SnapshotData* snapshot_data() const;
+  // See node::SetBuiltinCodeCache().
+  const std::vector<builtins::CodeCacheInfo>& builtin_code_cache() const {
+    return builtin_code_cache_;
+  }
+  void set_builtin_code_cache(std::vector<builtins::CodeCacheInfo> entries) {
+    builtin_code_cache_ = std::move(entries);
+  }
   inline std::shared_ptr<PerIsolateOptions> options();
 
   inline NodeArrayBufferAllocator* node_allocator() const;
@@ -255,6 +264,7 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
   MultiIsolatePlatform* platform_;
 
   const SnapshotData* snapshot_data_;
+  std::vector<builtins::CodeCacheInfo> builtin_code_cache_;
   std::optional<SnapshotConfig> snapshot_config_;
 
   std::shared_ptr<PerIsolateOptions> options_;
@@ -997,6 +1007,12 @@ class Environment final : public MemoryRetainer {
   static size_t NearHeapLimitCallback(void* data,
                                       size_t current_heap_limit,
                                       size_t initial_heap_limit);
+  static size_t HeapSnapshotNearHeapLimitCallback(void* data,
+                                                  size_t current_heap_limit,
+                                                  size_t initial_heap_limit);
+  static size_t HeapProfileNearHeapLimitCallback(void* data,
+                                                 size_t current_heap_limit,
+                                                 size_t initial_heap_limit);
   static void BuildEmbedderGraph(v8::Isolate* isolate,
                                  v8::EmbedderGraph* graph,
                                  void* data);
@@ -1074,13 +1090,17 @@ class Environment final : public MemoryRetainer {
 
   inline void set_heap_snapshot_near_heap_limit(uint32_t limit);
   inline bool is_in_heapsnapshot_heap_limit_callback() const;
+  inline void set_heap_profile_near_heap_limit(uint32_t limit);
+  inline bool is_in_heap_profile_near_heap_limit_callback() const;
 
   inline bool report_exclude_env() const;
 
   inline void AddHeapSnapshotNearHeapLimitCallback();
-
   inline void RemoveHeapSnapshotNearHeapLimitCallback(size_t heap_limit);
 
+  inline void AddHeapProfileNearHeapLimitCallback();
+  inline void RemoveHeapProfileNearHeapLimitCallback(size_t heap_limit);
+
   v8::CpuProfilingResult StartCpuProfile(const CpuProfileOptions& options);
   v8::CpuProfile* StopCpuProfile(v8::ProfilerId profile_id);
 
@@ -1093,13 +1113,14 @@ class Environment final : public MemoryRetainer {
   };
 
 #if HAVE_OPENSSL
-#if OPENSSL_VERSION_MAJOR >= 3
-  // We declare another alias here to avoid having to include crypto_util.h
-  using EVPMDPointer = DeleteFnPtr<EVP_MD, EVP_MD_free>;
-  std::vector<EVPMDPointer> evp_md_cache;
-#endif  // OPENSSL_VERSION_MAJOR >= 3
-  std::unordered_map<std::string, size_t> alias_to_md_id_map;
+  uint64_t hash_cache_generation = 0;
+  std::unique_ptr<ncrypto::DigestCache> provider_digest_cache;
+  std::unique_ptr<ncrypto::CipherCache> provider_cipher_cache;
   std::vector<std::string> supported_hash_algorithms;
+  uint64_t mac_cache_generation = 0;
+  std::unique_ptr<ncrypto::MacCache> provider_mac_cache;
+  std::vector<std::string> supported_mac_algorithms;
+  bool supported_mac_algorithms_initialized = false;
 #endif  // HAVE_OPENSSL
 
   v8::Global<v8::Module> temporary_required_module_facade_original;
@@ -1114,7 +1135,7 @@ class Environment final : public MemoryRetainer {
 
   std::list<binding::DLib> loaded_addons_;
   v8::Isolate* const isolate_;
-  v8::ExternalMemoryAccounter* const external_memory_accounter_;
+  const std::unique_ptr<v8::ExternalMemoryAccounter> external_memory_accounter_;
   IsolateData* const isolate_data_;
 
   bool env_handle_initialized_ = false;
@@ -1179,6 +1200,11 @@ class Environment final : public MemoryRetainer {
   uint32_t heap_snapshot_near_heap_limit_ = 0;
   bool heapsnapshot_near_heap_limit_callback_added_ = false;
 
+  bool is_in_heap_profile_near_heap_limit_callback_ = false;
+  uint32_t heap_limit_profile_taken_ = 0;
+  uint32_t heap_profile_near_heap_limit_ = 0;
+  bool heap_profile_near_heap_limit_callback_added_ = false;
+
   uint32_t module_id_counter_ = 0;
   uint32_t script_id_counter_ = 0;
   uint32_t function_id_counter_ = 0;
diff --git a/src/env_properties.h b/src/env_properties.h
index 4f0d55225d70..fc1772f926e5 100644
--- a/src/env_properties.h
+++ b/src/env_properties.h
@@ -240,12 +240,15 @@
   V(jwk_n_string, "n")                                                         \
   V(jwk_oct_string, "oct")                                                     \
   V(jwk_okp_string, "OKP")                                                     \
+  V(jwk_oth_string, "oth")                                                     \
   V(jwk_p_string, "p")                                                         \
   V(jwk_priv_string, "priv")                                                   \
   V(jwk_pub_string, "pub")                                                     \
   V(jwk_q_string, "q")                                                         \
   V(jwk_qi_string, "qi")                                                       \
+  V(jwk_r_string, "r")                                                         \
   V(jwk_rsa_string, "RSA")                                                     \
+  V(jwk_t_string, "t")                                                         \
   V(jwk_x_string, "x")                                                         \
   V(jwk_y_string, "y")                                                         \
   V(kill_signal_string, "killSignal")                                          \
@@ -433,11 +436,15 @@
   V(ephemeral_key_template, v8::DictionaryTemplate)                            \
   V(dir_instance_template, v8::ObjectTemplate)                                 \
   V(dns_ns_record_template, v8::DictionaryTemplate)                            \
+  V(dtls_context_constructor_template, v8::FunctionTemplate)                   \
+  V(dtls_endpoint_constructor_template, v8::FunctionTemplate)                  \
+  V(dtls_session_constructor_template, v8::FunctionTemplate)                   \
   V(fd_constructor_template, v8::ObjectTemplate)                               \
   V(fdclose_constructor_template, v8::ObjectTemplate)                          \
   V(ffi_dynamic_library_constructor_template, v8::FunctionTemplate)            \
   V(ffi_function_constructor_template, v8::FunctionTemplate)                   \
   V(filehandlereadwrap_template, v8::ObjectTemplate)                           \
+  V(fips_indicator_event_template, v8::DictionaryTemplate)                     \
   V(free_list_statistics_template, v8::DictionaryTemplate)                     \
   V(fsreqpromise_constructor_template, v8::ObjectTemplate)                     \
   V(handle_wrap_ctor_template, v8::FunctionTemplate)                           \
@@ -504,6 +511,7 @@
   V(async_hooks_promise_resolve_function, v8::Function)                        \
   V(buffer_prototype_object, v8::Object)                                       \
   V(crypto_internal_cryptokey_constructor, v8::Function)                       \
+  V(crypto_internal_x509_certificate_constructor, v8::Function)                \
   V(crypto_key_object_private_constructor, v8::Function)                       \
   V(crypto_key_object_public_constructor, v8::Function)                        \
   V(crypto_key_object_secret_constructor, v8::Function)                        \
diff --git a/src/ffi/data.cc b/src/ffi/data.cc
index 308bde60cae2..bc287ddd13f9 100644
--- a/src/ffi/data.cc
+++ b/src/ffi/data.cc
@@ -163,8 +163,7 @@ Maybe<void> ValidateStringLength(Environment* env, size_t len) {
 Maybe<std::pair<uint8_t*, size_t>> GetValidatedPointerAndOffset(
     Environment* env, const FunctionCallbackInfo<Value>& args) {
   uintptr_t raw_ptr;
-  if (args.Length() < 1 ||
-      !GetValidatedPointerAddress(env, args[0], "pointer").To(&raw_ptr)) {
+  if (!GetValidatedPointerAddress(env, args[0], "pointer").To(&raw_ptr)) {
     return {};
   }
 
@@ -204,8 +203,7 @@ Maybe<PointerOffsetAndValue> GetValidatedPointerOffsetAndValue(
   size_t offset;
   Local<Value> value;
   uintptr_t raw_ptr;
-  if (args.Length() < 1 ||
-      !GetValidatedPointerAddress(env, args[0], "pointer").To(&raw_ptr)) {
+  if (!GetValidatedPointerAddress(env, args[0], "pointer").To(&raw_ptr)) {
     return {};
   }
 
@@ -556,7 +554,7 @@ void ToBuffer(const FunctionCallbackInfo<Value>& args) {
   }
 
   size_t len;
-  if (args.Length() < 2 || !GetValidatedSize(env, args[1], "length").To(&len)) {
+  if (!GetValidatedSize(env, args[1], "length").To(&len)) {
     return;
   }
 
@@ -618,7 +616,7 @@ void ToArrayBuffer(const FunctionCallbackInfo<Value>& args) {
   }
 
   size_t len;
-  if (args.Length() < 2 || !GetValidatedSize(env, args[1], "length").To(&len)) {
+  if (!GetValidatedSize(env, args[1], "length").To(&len)) {
     return;
   }
 
@@ -671,7 +669,8 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
   if (args.Length() < 1) {
     THROW_ERR_INVALID_ARG_TYPE(
         env,
-        "The first argument must be a Buffer, ArrayBuffer, or ArrayBufferView");
+        "The first argument must be a Buffer, ArrayBuffer, SharedArrayBuffer, "
+        "or ArrayBufferView");
     return;
   }
 
@@ -689,18 +688,18 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
   } else {
     THROW_ERR_INVALID_ARG_TYPE(
         env,
-        "The first argument must be a Buffer, ArrayBuffer, or ArrayBufferView");
+        "The first argument must be a Buffer, ArrayBuffer, SharedArrayBuffer, "
+        "or ArrayBufferView");
     return;
   }
 
   uintptr_t ptr;
-  if (args.Length() < 2 ||
-      !GetValidatedPointerAddress(env, args[1], "pointer").To(&ptr)) {
+  if (!GetValidatedPointerAddress(env, args[1], "pointer").To(&ptr)) {
     return;
   }
 
   size_t len;
-  if (args.Length() < 3 || !GetValidatedSize(env, args[2], "length").To(&len)) {
+  if (!GetValidatedSize(env, args[2], "length").To(&len)) {
     return;
   }
 
diff --git a/src/histogram.cc b/src/histogram.cc
index 0997d3cb481c..f2b93d3b8be4 100644
--- a/src/histogram.cc
+++ b/src/histogram.cc
@@ -46,14 +46,8 @@ void StopHandleHistogram(Local<Value> receiver) {
   histogram->OnStop();
 }
 
-Histogram::Histogram(const Options& options) {
-  hdr_histogram* histogram;
-  CHECK_EQ(0, hdr_init(options.lowest,
-                       options.highest,
-                       options.figures,
-                       &histogram));
-  histogram_.reset(histogram);
-
+Histogram::Histogram(HistogramPointer histogram, const Options& options)
+    : histogram_(std::move(histogram)) {
   // alpha = 1 - 2^(-1/halfLife). With halfLife <= 0, EWMA is disabled.
   if (options.half_life > 0) {
     ewma_alpha_ = 1.0 - std::exp(-std::log(2.0) / options.half_life);
@@ -61,6 +55,15 @@ Histogram::Histogram(const Options& options) {
   threshold_ = options.threshold;
 }
 
+std::shared_ptr<Histogram> Histogram::Create(const Options& options) {
+  hdr_histogram* histogram;
+  if (hdr_init(options.lowest, options.highest, options.figures, &histogram) !=
+      0) {
+    return {};
+  }
+  return std::make_shared<Histogram>(HistogramPointer(histogram), options);
+}
+
 void Histogram::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TrackFieldWithSize("histogram", GetMemorySize());
 }
@@ -295,28 +298,29 @@ static double NormalCdf(double x) {
 
 // Student's t-distribution CDF: P(T <= t) for df degrees of freedom.
 static double StudentTCdf(double t, double df) {
-  double x = df / (df + t * t);
-  double ibeta = RegularizedIncompleteBeta(df / 2.0, 0.5, x);
-  if (t >= 0.0) {
-    return 1.0 - 0.5 * ibeta;
+  double squared = t * t;
+  double denominator = df + squared;
+  if (squared < df) {
+    double x = squared / denominator;
+    double ibeta = RegularizedIncompleteBeta(0.5, df / 2.0, x);
+    return t >= 0.0 ? 0.5 + 0.5 * ibeta : 0.5 - 0.5 * ibeta;
   }
-  return 0.5 * ibeta;
+
+  double x = df / denominator;
+  double ibeta = RegularizedIncompleteBeta(df / 2.0, 0.5, x);
+  return t >= 0.0 ? 1.0 - 0.5 * ibeta : 0.5 * ibeta;
 }
 
-// Student's t-distribution quantile (inverse CDF) using bisection.
-// Returns the value t such that P(T <= t) = p.
-static double StudentTQuantile(double p, double df) {
-  if (p <= 0.0) return -std::numeric_limits<double>::infinity();
-  if (p >= 1.0) return std::numeric_limits<double>::infinity();
-  if (p == 0.5) return 0.0;
+// Positive Student's t-distribution quantile for an upper-tail probability.
+// Using the lower tail avoids loss of precision for probabilities near 1.
+static double StudentTUpperQuantile(double p, double df) {
+  double lo = 0.0;
+  double hi = 1.0;
+  while (StudentTCdf(-hi, df) > p) hi *= 2.0;
 
-  // Bisection search. The range [-1e6, 1e6] is sufficient for any
-  // practical confidence level and degrees of freedom.
-  double lo = -1e6;
-  double hi = 1e6;
   for (int i = 0; i < 100; i++) {
     double mid = (lo + hi) / 2.0;
-    if (StudentTCdf(mid, df) < p) {
+    if (StudentTCdf(-mid, df) > p) {
       lo = mid;
     } else {
       hi = mid;
@@ -333,8 +337,176 @@ static double BinomialCdf(int64_t k, int64_t n, double p) {
   return RegularizedIncompleteBeta(
       static_cast<double>(n - k), static_cast<double>(k + 1), 1.0 - p);
 }
+
+// -----------------------------------------------------------------------
+// Minimal CBOR encoder/decoder (RFC 8949) -- just enough types for
+// histogram export/import: unsigned int, float64, array, and map.
+// -----------------------------------------------------------------------
+
+// CBOR major types (upper 3 bits of the initial byte).
+constexpr uint8_t kCborUint = 0 << 5;   // Major 0: unsigned integer
+constexpr uint8_t kCborArray = 4 << 5;  // Major 4: array
+constexpr uint8_t kCborMap = 5 << 5;    // Major 5: map
+constexpr uint8_t kCborFloat64 = 0xfb;  // Major 7, additional 27
+
+static void CborWriteUint(std::vector<uint8_t>& out,
+                          uint8_t major,
+                          uint64_t val) {
+  if (val <= 23) {
+    out.push_back(major | static_cast<uint8_t>(val));
+  } else if (val <= 0xff) {
+    out.push_back(major | 24);
+    out.push_back(static_cast<uint8_t>(val));
+  } else if (val <= 0xffff) {
+    out.push_back(major | 25);
+    out.push_back(static_cast<uint8_t>(val >> 8));
+    out.push_back(static_cast<uint8_t>(val));
+  } else if (val <= 0xffffffff) {
+    out.push_back(major | 26);
+    out.push_back(static_cast<uint8_t>(val >> 24));
+    out.push_back(static_cast<uint8_t>(val >> 16));
+    out.push_back(static_cast<uint8_t>(val >> 8));
+    out.push_back(static_cast<uint8_t>(val));
+  } else {
+    out.push_back(major | 27);
+    out.push_back(static_cast<uint8_t>(val >> 56));
+    out.push_back(static_cast<uint8_t>(val >> 48));
+    out.push_back(static_cast<uint8_t>(val >> 40));
+    out.push_back(static_cast<uint8_t>(val >> 32));
+    out.push_back(static_cast<uint8_t>(val >> 24));
+    out.push_back(static_cast<uint8_t>(val >> 16));
+    out.push_back(static_cast<uint8_t>(val >> 8));
+    out.push_back(static_cast<uint8_t>(val));
+  }
+}
+
+static void CborWriteFloat64(std::vector<uint8_t>& out, double val) {
+  out.push_back(kCborFloat64);
+  uint64_t bits;
+  memcpy(&bits, &val, sizeof(bits));
+  // Network byte order (big-endian).
+  out.push_back(static_cast<uint8_t>(bits >> 56));
+  out.push_back(static_cast<uint8_t>(bits >> 48));
+  out.push_back(static_cast<uint8_t>(bits >> 40));
+  out.push_back(static_cast<uint8_t>(bits >> 32));
+  out.push_back(static_cast<uint8_t>(bits >> 24));
+  out.push_back(static_cast<uint8_t>(bits >> 16));
+  out.push_back(static_cast<uint8_t>(bits >> 8));
+  out.push_back(static_cast<uint8_t>(bits));
+}
+
+static bool CborReadUint(const uint8_t*& p, const uint8_t* end, uint64_t* val) {
+  if (p >= end) return false;
+  uint8_t info = *p++ & 0x1f;
+  if (info <= 23) {
+    *val = info;
+  } else if (info == 24) {
+    if (p + 1 > end) return false;
+    *val = p[0];
+    p += 1;
+  } else if (info == 25) {
+    if (p + 2 > end) return false;
+    *val = (static_cast<uint64_t>(p[0]) << 8) | p[1];
+    p += 2;
+  } else if (info == 26) {
+    if (p + 4 > end) return false;
+    *val = (static_cast<uint64_t>(p[0]) << 24) |
+           (static_cast<uint64_t>(p[1]) << 16) |
+           (static_cast<uint64_t>(p[2]) << 8) | p[3];
+    p += 4;
+  } else if (info == 27) {
+    if (p + 8 > end) return false;
+    *val = (static_cast<uint64_t>(p[0]) << 56) |
+           (static_cast<uint64_t>(p[1]) << 48) |
+           (static_cast<uint64_t>(p[2]) << 40) |
+           (static_cast<uint64_t>(p[3]) << 32) |
+           (static_cast<uint64_t>(p[4]) << 24) |
+           (static_cast<uint64_t>(p[5]) << 16) |
+           (static_cast<uint64_t>(p[6]) << 8) | p[7];
+    p += 8;
+  } else {
+    return false;  // Indefinite length or reserved -- not supported.
+  }
+  return true;
+}
+
+static bool CborReadFloat64(const uint8_t*& p,
+                            const uint8_t* end,
+                            double* val) {
+  if (p >= end || *p != kCborFloat64) return false;
+  p++;
+  if (p + 8 > end) return false;
+  uint64_t bits = (static_cast<uint64_t>(p[0]) << 56) |
+                  (static_cast<uint64_t>(p[1]) << 48) |
+                  (static_cast<uint64_t>(p[2]) << 40) |
+                  (static_cast<uint64_t>(p[3]) << 32) |
+                  (static_cast<uint64_t>(p[4]) << 24) |
+                  (static_cast<uint64_t>(p[5]) << 16) |
+                  (static_cast<uint64_t>(p[6]) << 8) | p[7];
+  p += 8;
+  memcpy(val, &bits, sizeof(*val));
+  return true;
+}
+
+// Read a value that may be either a uint or float64.
+static bool CborReadNumber(const uint8_t*& p, const uint8_t* end, double* val) {
+  if (p >= end) return false;
+  if (*p == kCborFloat64) return CborReadFloat64(p, end, val);
+  uint64_t u;
+  if (!CborReadUint(p, end, &u)) return false;
+  *val = static_cast<double>(u);
+  return true;
+}
+
+// Histogram export format version.
+constexpr uint64_t kExportVersion = 1;
+
+// Integer keys for the top-level CBOR map.
+constexpr uint64_t kKeyVersion = 0;
+constexpr uint64_t kKeyLowest = 1;
+constexpr uint64_t kKeyHighest = 2;
+constexpr uint64_t kKeyFigures = 3;
+constexpr uint64_t kKeyTotalCount = 4;
+constexpr uint64_t kKeyMin = 5;
+constexpr uint64_t kKeyMax = 6;
+constexpr uint64_t kKeyNormOffset = 7;
+constexpr uint64_t kKeyConvRatio = 8;
+constexpr uint64_t kKeyCountsLen = 9;
+constexpr uint64_t kKeyCounts = 10;
+constexpr uint64_t kKeyEwma = 11;
+
+// Integer keys for the EWMA sub-map.
+constexpr uint64_t kEwmaAlpha = 0;
+constexpr uint64_t kEwmaMean = 1;
+constexpr uint64_t kEwmaVariance = 2;
+constexpr uint64_t kEwmaErrorRate = 3;
+constexpr uint64_t kEwmaThreshold = 4;
 }  // namespace
 
+Histogram::MeanCIResult Histogram::MeanCI(double confidence) const {
+  RwLock::ScopedReadLock lock(mutex_);
+  int64_t count = histogram_->total_count;
+  double mean = hdr_mean(histogram_.get());
+  if (count < 2) {
+    double nan = std::numeric_limits<double>::quiet_NaN();
+    return {mean, nan, nan};
+  }
+
+  double stddev = hdr_stddev(histogram_.get());
+  if (stddev == 0.0) return {mean, mean, mean};
+
+  // HdrHistogram computes population stddev (divides by N). The confidence
+  // interval requires sample variance (divides by N-1).
+  double variance = stddev * stddev * static_cast<double>(count) /
+                    static_cast<double>(count - 1);
+  double standard_error = std::sqrt(variance / static_cast<double>(count));
+  double alpha = 1.0 - confidence;
+  double t_crit =
+      StudentTUpperQuantile(alpha / 2.0, static_cast<double>(count - 1));
+  double margin = t_crit * standard_error;
+  return {mean, mean - margin, mean + margin};
+}
+
 Histogram::WelchTestResult Histogram::WelchTest(const Histogram& other,
                                                 double confidence) const {
   auto do_welch = [&]() -> WelchTestResult {
@@ -370,7 +542,7 @@ Histogram::WelchTestResult Histogram::WelchTest(const Histogram& other,
 
     // Confidence interval on the difference of means.
     double alpha = 1.0 - confidence;
-    double t_crit = StudentTQuantile(1.0 - alpha / 2.0, df);
+    double t_crit = StudentTUpperQuantile(alpha / 2.0, df);
     double margin = t_crit * std::sqrt(se_sum);
     double diff = mean1 - mean2;
 
@@ -590,8 +762,319 @@ Histogram::PercentileCIResult Histogram::PercentileCI(double percentile,
   return {value, lower_val, upper_val};
 }
 
+// Serialize the histogram to a CBOR (RFC 8949) byte sequence. There is no
+// standard for serializing histograms, so this format is specific to this
+// implementation. But, it has been designed to be compact, extensible, and
+// portable across languages and platforms. Should be easily parseable in
+// other languages with or without a CBOR library.
+//
+// The delta-encoded sparse counts is a space-saving optimization in the
+// common case.
+//
+// Layout: a CBOR map with integer keys:
+//   0  -> uint    format version (currently 1)
+//   1  -> uint    lowest discernible value
+//   2  -> uint    highest trackable value
+//   3  -> uint    significant figures
+//   4  -> uint    total count
+//   5  -> uint    min value
+//   6  -> uint    max value
+//   7  -> uint    normalizing index offset
+//   8  -> float64 conversion ratio
+//   9  -> uint    counts array length
+//   10 -> array   delta-encoded sparse counts as flat [delta, count, ...]
+//                 (first delta is the absolute index)
+//   11 -> map     EWMA state (omitted when alpha = 0):
+//        0 -> float64 alpha
+//        1 -> float64 mean
+//        2 -> float64 variance
+//        3 -> float64 error rate
+//        4 -> uint    threshold
+std::vector<uint8_t> Histogram::Export() const {
+  RwLock::ScopedReadLock lock(mutex_);
+
+  // Count non-zero buckets for the sparse encoding.
+  int32_t non_zero = 0;
+  for (int32_t i = 0; i < histogram_->counts_len; i++) {
+    if (histogram_->counts[i] != 0) non_zero++;
+  }
+
+  bool has_ewma = ewma_alpha_ > 0;
+  uint64_t map_size = has_ewma ? 12 : 11;
+
+  std::vector<uint8_t> out;
+  out.reserve(64 + non_zero * 10);
+
+  // Top-level map.
+  CborWriteUint(out, kCborMap, map_size);
+
+  // 0: version
+  CborWriteUint(out, kCborUint, kKeyVersion);
+  CborWriteUint(out, kCborUint, kExportVersion);
+  // 1: lowest
+  CborWriteUint(out, kCborUint, kKeyLowest);
+  CborWriteUint(out,
+                kCborUint,
+                static_cast<uint64_t>(histogram_->lowest_discernible_value));
+  // 2: highest
+  CborWriteUint(out, kCborUint, kKeyHighest);
+  CborWriteUint(out,
+                kCborUint,
+                static_cast<uint64_t>(histogram_->highest_trackable_value));
+  // 3: figures
+  CborWriteUint(out, kCborUint, kKeyFigures);
+  CborWriteUint(
+      out, kCborUint, static_cast<uint64_t>(histogram_->significant_figures));
+  // 4: total_count
+  CborWriteUint(out, kCborUint, kKeyTotalCount);
+  CborWriteUint(out, kCborUint, static_cast<uint64_t>(histogram_->total_count));
+  // 5: min
+  CborWriteUint(out, kCborUint, kKeyMin);
+  CborWriteUint(out, kCborUint, static_cast<uint64_t>(histogram_->min_value));
+  // 6: max
+  CborWriteUint(out, kCborUint, kKeyMax);
+  CborWriteUint(out, kCborUint, static_cast<uint64_t>(histogram_->max_value));
+  // 7: normalizing_index_offset
+  CborWriteUint(out, kCborUint, kKeyNormOffset);
+  CborWriteUint(out,
+                kCborUint,
+                static_cast<uint64_t>(histogram_->normalizing_index_offset));
+  // 8: conversion_ratio
+  CborWriteUint(out, kCborUint, kKeyConvRatio);
+  CborWriteFloat64(out, histogram_->conversion_ratio);
+  // 9: counts_len
+  CborWriteUint(out, kCborUint, kKeyCountsLen);
+  CborWriteUint(out, kCborUint, static_cast<uint64_t>(histogram_->counts_len));
+  // 10: sparse counts -- array of [delta, count, ...] pairs.
+  // Indices are delta-encoded: the first value is the absolute index,
+  // each subsequent value is the difference from the previous index.
+  CborWriteUint(out, kCborUint, kKeyCounts);
+  CborWriteUint(out, kCborArray, static_cast<uint64_t>(non_zero) * 2);
+  int32_t prev_idx = 0;
+  for (int32_t i = 0; i < histogram_->counts_len; i++) {
+    if (histogram_->counts[i] != 0) {
+      CborWriteUint(out, kCborUint, static_cast<uint64_t>(i - prev_idx));
+      CborWriteUint(
+          out, kCborUint, static_cast<uint64_t>(histogram_->counts[i]));
+      prev_idx = i;
+    }
+  }
+
+  // 11: EWMA state (optional)
+  if (has_ewma) {
+    CborWriteUint(out, kCborUint, kKeyEwma);
+    CborWriteUint(out, kCborMap, 5);
+    CborWriteUint(out, kCborUint, kEwmaAlpha);
+    CborWriteFloat64(out, ewma_alpha_);
+    CborWriteUint(out, kCborUint, kEwmaMean);
+    CborWriteFloat64(out, ewma_mean_);
+    CborWriteUint(out, kCborUint, kEwmaVariance);
+    CborWriteFloat64(out, ewma_variance_);
+    CborWriteUint(out, kCborUint, kEwmaErrorRate);
+    CborWriteFloat64(out, ewma_error_rate_);
+    CborWriteUint(out, kCborUint, kEwmaThreshold);
+    CborWriteUint(out, kCborUint, static_cast<uint64_t>(threshold_));
+  }
+
+  return out;
+}
+
+std::shared_ptr<Histogram> Histogram::Import(const uint8_t* data, size_t len) {
+  const uint8_t* p = data;
+  const uint8_t* end = data + len;
+
+  // Read top-level map header.
+  if (p >= end || (*p >> 5) != 5) return nullptr;  // Must be a map.
+  uint64_t map_size;
+  if (!CborReadUint(p, end, &map_size)) return nullptr;
+
+  int64_t lowest = 1;
+  int64_t highest = std::numeric_limits<int64_t>::max();
+  int figures = 3;
+  int64_t total_count = 0;
+  int64_t min_value = std::numeric_limits<int64_t>::max();
+  int64_t max_value = 0;
+  int32_t norm_offset = 0;
+  double conv_ratio = 1.0;
+  int32_t counts_len = 0;
+  uint64_t version = 0;
+
+  // Sparse counts storage.
+  std::vector<std::pair<int32_t, int64_t>> sparse_counts;
+
+  // EWMA state.
+  double ewma_alpha = 0;
+  double ewma_mean = 0;
+  double ewma_variance = 0;
+  double ewma_error_rate = 0;
+  int64_t threshold = 0;
+
+  for (uint64_t i = 0; i < map_size; i++) {
+    // Read key (unsigned int).
+    uint64_t key;
+    if (!CborReadUint(p, end, &key)) return nullptr;
+
+    switch (key) {
+      case kKeyVersion:
+        if (!CborReadUint(p, end, &version)) return nullptr;
+        if (version != kExportVersion) return nullptr;
+        break;
+      case kKeyLowest: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        lowest = static_cast<int64_t>(v);
+        break;
+      }
+      case kKeyHighest: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        highest = static_cast<int64_t>(v);
+        break;
+      }
+      case kKeyFigures: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        figures = static_cast<int>(v);
+        break;
+      }
+      case kKeyTotalCount: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        total_count = static_cast<int64_t>(v);
+        break;
+      }
+      case kKeyMin: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        min_value = static_cast<int64_t>(v);
+        break;
+      }
+      case kKeyMax: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        max_value = static_cast<int64_t>(v);
+        break;
+      }
+      case kKeyNormOffset: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        norm_offset = static_cast<int32_t>(v);
+        break;
+      }
+      case kKeyConvRatio:
+        if (!CborReadNumber(p, end, &conv_ratio)) return nullptr;
+        break;
+      case kKeyCountsLen: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        counts_len = static_cast<int32_t>(v);
+        break;
+      }
+      case kKeyCounts: {
+        // Array of flat [delta, count, ...] pairs. Indices are
+        // delta-encoded: accumulate to recover absolute indices.
+        if (p >= end || (*p >> 5) != 4) return nullptr;
+        uint64_t arr_len;
+        if (!CborReadUint(p, end, &arr_len)) return nullptr;
+        if (arr_len % 2 != 0) return nullptr;
+        // Each element needs at least 1 byte of CBOR encoding, so
+        // arr_len can't exceed the remaining buffer. Without this
+        // check, a crafted buffer claiming arr_len=2^60 would cause
+        // reserve() to OOM-crash before the loop catches the error.
+        if (arr_len > static_cast<uint64_t>(end - p)) return nullptr;
+        sparse_counts.reserve(static_cast<size_t>(arr_len / 2));
+        int32_t acc_idx = 0;
+        for (uint64_t j = 0; j < arr_len; j += 2) {
+          uint64_t delta, cnt;
+          if (!CborReadUint(p, end, &delta)) return nullptr;
+          if (!CborReadUint(p, end, &cnt)) return nullptr;
+          acc_idx += static_cast<int32_t>(delta);
+          sparse_counts.emplace_back(acc_idx, static_cast<int64_t>(cnt));
+        }
+        break;
+      }
+      case kKeyEwma: {
+        // Sub-map for EWMA state.
+        if (p >= end || (*p >> 5) != 5) return nullptr;
+        uint64_t sub_size;
+        if (!CborReadUint(p, end, &sub_size)) return nullptr;
+        for (uint64_t j = 0; j < sub_size; j++) {
+          uint64_t sub_key;
+          if (!CborReadUint(p, end, &sub_key)) return nullptr;
+          switch (sub_key) {
+            case kEwmaAlpha:
+              if (!CborReadNumber(p, end, &ewma_alpha)) return nullptr;
+              break;
+            case kEwmaMean:
+              if (!CborReadNumber(p, end, &ewma_mean)) return nullptr;
+              break;
+            case kEwmaVariance:
+              if (!CborReadNumber(p, end, &ewma_variance)) return nullptr;
+              break;
+            case kEwmaErrorRate:
+              if (!CborReadNumber(p, end, &ewma_error_rate)) return nullptr;
+              break;
+            case kEwmaThreshold: {
+              uint64_t v;
+              if (!CborReadUint(p, end, &v)) return nullptr;
+              threshold = static_cast<int64_t>(v);
+              break;
+            }
+            default:
+              return nullptr;  // Unknown EWMA key.
+          }
+        }
+        break;
+      }
+      default:
+        return nullptr;  // Unknown key.
+    }
+  }
+
+  // Reconstruct the histogram.
+  Options opts;
+  opts.lowest = lowest;
+  opts.highest = highest;
+  opts.figures = figures;
+  // Compute half_life from alpha: alpha = 1 - 2^(-1/halfLife)
+  // => halfLife = -1 / log2(1 - alpha)
+  if (ewma_alpha > 0 && ewma_alpha < 1) {
+    opts.half_life = -1.0 / std::log2(1.0 - ewma_alpha);
+  }
+  opts.threshold = threshold;
+
+  auto histogram = Histogram::Create(opts);
+  if (!histogram) return nullptr;
+
+  // Validate counts_len matches what the options produce.
+  if (histogram->histogram_->counts_len != counts_len) return nullptr;
+
+  // Restore counts directly.
+  for (const auto& [idx, cnt] : sparse_counts) {
+    if (idx < 0 || idx >= counts_len) return nullptr;
+    histogram->histogram_->counts[idx] = cnt;
+  }
+  histogram->histogram_->total_count = total_count;
+  histogram->histogram_->min_value = min_value;
+  histogram->histogram_->max_value = max_value;
+  histogram->histogram_->normalizing_index_offset = norm_offset;
+  histogram->histogram_->conversion_ratio = conv_ratio;
+
+  // Restore EWMA state.
+  if (ewma_alpha > 0) {
+    histogram->ewma_mean_ = ewma_mean;
+    histogram->ewma_variance_ = ewma_variance;
+    histogram->ewma_error_rate_ = ewma_error_rate;
+    histogram->ewma_initialized_ = true;
+  }
+
+  return histogram;
+}
+
 HistogramImpl::HistogramImpl(const Histogram::Options& options)
-    : histogram_(new Histogram(options)) {}
+    : histogram_(Histogram::Create(options)) {
+  CHECK(histogram_);
+}
 
 HistogramImpl::HistogramImpl(std::shared_ptr<Histogram> histogram)
     : histogram_(std::move(histogram)) {}
@@ -675,6 +1158,7 @@ void HistogramImpl::AddMethods(Isolate* isolate, Local<FunctionTemplate> tmpl) {
   SetProtoMethodNoSideEffect(isolate, tmpl, "percentilesAt", GetPercentilesAt);
   SetProtoMethodNoSideEffect(isolate, tmpl, "linearBuckets", GetLinearBuckets);
   SetProtoMethodNoSideEffect(isolate, tmpl, "logBuckets", GetLogBuckets);
+  SetProtoMethodNoSideEffect(isolate, tmpl, "meanCI", GetMeanCI);
   SetProtoMethodNoSideEffect(isolate, tmpl, "welchTest", GetWelchTest);
   SetProtoMethodNoSideEffect(
       isolate, tmpl, "mannWhitneyTest", GetMannWhitneyTest);
@@ -690,6 +1174,7 @@ void HistogramImpl::AddMethods(Isolate* isolate, Local<FunctionTemplate> tmpl) {
                             "ewmaErrorRate",
                             GetEwmaErrorRate,
                             &fast_get_ewma_error_rate_);
+  SetProtoMethodNoSideEffect(isolate, tmpl, "export", DoExport);
   SetFastMethod(isolate, instance, "reset", DoReset, &fast_reset_);
 }
 
@@ -728,6 +1213,7 @@ void HistogramImpl::RegisterExternalReferences(
   registry->Register(GetPercentilesAt);
   registry->Register(GetLinearBuckets);
   registry->Register(GetLogBuckets);
+  registry->Register(GetMeanCI);
   registry->Register(GetWelchTest);
   registry->Register(GetMannWhitneyTest);
   registry->Register(GetCohensD);
@@ -736,6 +1222,7 @@ void HistogramImpl::RegisterExternalReferences(
   registry->Register(GetEwmaMean);
   registry->Register(GetEwmaStddev);
   registry->Register(GetEwmaErrorRate);
+  registry->Register(DoExport);
   registry->Register(fast_get_ewma_mean_);
   registry->Register(fast_get_ewma_stddev_);
   registry->Register(fast_get_ewma_error_rate_);
@@ -922,10 +1409,12 @@ void HistogramBase::New(const FunctionCallbackInfo<Value>& args) {
   if (args.Length() > 4 && args[4]->IsNumber()) {
     threshold = static_cast<int64_t>(args[4].As<Number>()->Value());
   }
-  new HistogramBase(
-      env,
-      args.This(),
+  auto histogram = Histogram::Create(
       Histogram::Options{lowest, highest, figures, half_life, threshold});
+  if (!histogram) {
+    return THROW_ERR_INVALID_ARG_VALUE(env, "Invalid histogram options");
+  }
+  new HistogramBase(env, args.This(), std::move(histogram));
 }
 
 Local<FunctionTemplate> HistogramBase::GetConstructorTemplate(
@@ -960,16 +1449,17 @@ void HistogramBase::RegisterExternalReferences(
   registry->Register(RecordCorrected);
   registry->Register(fast_record_);
   registry->Register(fast_record_delta_);
+  registry->Register(HistogramImpl::DoImport);
   HistogramImpl::RegisterExternalReferences(registry);
 }
 
 void HistogramBase::Initialize(IsolateData* isolate_data,
                                Local<ObjectTemplate> target) {
-  SetConstructorFunction(isolate_data->isolate(),
-                         target,
-                         "Histogram",
-                         GetConstructorTemplate(isolate_data),
-                         SetConstructorFunctionFlag::NONE);
+  Isolate* isolate = isolate_data->isolate();
+  Local<FunctionTemplate> tmpl = GetConstructorTemplate(isolate_data);
+  SetMethodNoSideEffect(isolate, tmpl, "import", HistogramImpl::DoImport);
+  SetConstructorFunction(
+      isolate, target, "Histogram", tmpl, SetConstructorFunctionFlag::NONE);
 }
 
 BaseObjectPtr<BaseObject> HistogramBase::HistogramTransferData::Deserialize(
@@ -1432,6 +1922,21 @@ void HistogramImpl::GetKsTest(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set((*histogram)->KsTest(*(other->histogram())));
 }
 
+void HistogramImpl::GetMeanCI(const FunctionCallbackInfo<Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  CHECK(args[0]->IsNumber());
+  double confidence = args[0].As<Number>()->Value();
+
+  auto result = (*histogram)->MeanCI(confidence);
+
+  Local<Value> values[] = {Number::New(isolate, result.mean),
+                           Number::New(isolate, result.lower),
+                           Number::New(isolate, result.upper)};
+  Local<Array> arr = Array::New(isolate, &values[0], arraysize(values));
+  args.GetReturnValue().Set(arr);
+}
+
 void HistogramImpl::GetWelchTest(const FunctionCallbackInfo<Value>& args) {
   Isolate* isolate = args.GetIsolate();
   HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
@@ -1528,6 +2033,46 @@ double HistogramImpl::FastGetEwmaErrorRate(Local<Value> receiver) {
   return (*histogram)->EwmaErrorRate();
 }
 
+void HistogramImpl::DoExport(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  std::vector<uint8_t> data = (*histogram)->Export();
+
+  auto store = v8::ArrayBuffer::NewBackingStore(env->isolate(), data.size());
+  memcpy(store->Data(), data.data(), data.size());
+  auto buf = v8::ArrayBuffer::New(env->isolate(), std::move(store));
+  auto arr = v8::Uint8Array::New(buf, 0, data.size());
+  args.GetReturnValue().Set(arr);
+}
+
+void HistogramImpl::DoImport(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  if (!args[0]->IsUint8Array()) {
+    THROW_ERR_INVALID_ARG_TYPE(env, "data must be a Uint8Array");
+    return;
+  }
+  Local<v8::Uint8Array> input = args[0].As<v8::Uint8Array>();
+  auto backing = input->Buffer()->GetBackingStore();
+  const uint8_t* data =
+      static_cast<const uint8_t*>(backing->Data()) + input->ByteOffset();
+  size_t len = input->ByteLength();
+
+  auto histogram = Histogram::Import(data, len);
+  if (!histogram) {
+    THROW_ERR_INVALID_ARG_VALUE(env, "Invalid histogram export data");
+    return;
+  }
+
+  // Create a new HistogramBase wrapping the imported histogram.
+  Local<FunctionTemplate> tmpl =
+      HistogramBase::GetConstructorTemplate(env->isolate_data());
+  Local<Object> obj;
+  if (!tmpl->InstanceTemplate()->NewInstance(env->context()).ToLocal(&obj))
+    return;
+  new HistogramBase(env, obj, std::move(histogram));
+  args.GetReturnValue().Set(obj);
+}
+
 void HistogramImpl::GetPercentilesAt(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
diff --git a/src/histogram.h b/src/histogram.h
index 31a2e9833d3e..2af0e4a4f82e 100644
--- a/src/histogram.h
+++ b/src/histogram.h
@@ -12,6 +12,7 @@
 #include "v8.h"
 
 #include <limits>
+#include <vector>
 
 namespace node {
 
@@ -36,7 +37,12 @@ class Histogram : public MemoryRetainer {
                             // exceeding this threshold.
   };
 
-  explicit Histogram(const Options& options);
+  using HistogramPointer = DeleteFnPtr<hdr_histogram, hdr_close>;
+
+  // Factory method that returns nullptr on hdr_init failure.
+  static std::shared_ptr<Histogram> Create(const Options& options);
+
+  Histogram(HistogramPointer histogram, const Options& options);
   virtual ~Histogram() = default;
 
   inline bool Record(int64_t value);
@@ -74,7 +80,13 @@ class Histogram : public MemoryRetainer {
                      int64_t* values,
                      size_t length) const;
 
-  // Statistical hypothesis testing
+  // Statistical analysis
+  struct MeanCIResult {
+    double mean;
+    double lower;
+    double upper;
+  };
+
   struct WelchTestResult {
     double t_statistic;
     double degrees_of_freedom;
@@ -95,6 +107,7 @@ class Histogram : public MemoryRetainer {
     int64_t upper;
   };
 
+  MeanCIResult MeanCI(double confidence = 0.95) const;
   WelchTestResult WelchTest(const Histogram& other,
                             double confidence = 0.95) const;
   MannWhitneyResult MannWhitneyTest(const Histogram& other) const;
@@ -103,6 +116,10 @@ class Histogram : public MemoryRetainer {
   PercentileCIResult PercentileCI(double percentile,
                                   double confidence = 0.95) const;
 
+  // CBOR-encoded export/import for histogram exchange.
+  std::vector<uint8_t> Export() const;
+  static std::shared_ptr<Histogram> Import(const uint8_t* data, size_t len);
+
   inline bool RecordCorrected(int64_t value, int64_t expected_interval);
 
   template <typename Iterator>
@@ -120,7 +137,6 @@ class Histogram : public MemoryRetainer {
  private:
   inline void UpdateEwma(double value);
 
-  using HistogramPointer = DeleteFnPtr<hdr_histogram, hdr_close>;
   HistogramPointer histogram_;
   uint64_t prev_ = 0;
   size_t exceeds_ = 0;
@@ -180,6 +196,7 @@ class HistogramImpl {
   static void GetPercentilesAt(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetLinearBuckets(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetLogBuckets(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetMeanCI(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetWelchTest(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetMannWhitneyTest(
       const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -189,6 +206,8 @@ class HistogramImpl {
   static void GetEwmaMean(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetEwmaStddev(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetEwmaErrorRate(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoExport(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoImport(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   static void FastReset(v8::Local<v8::Value> receiver);
   static double FastGetCount(v8::Local<v8::Value> receiver);
diff --git a/src/js_native_api.h b/src/js_native_api.h
index d2375ecd3248..2a36c4e3ddf3 100644
--- a/src/js_native_api.h
+++ b/src/js_native_api.h
@@ -55,8 +55,8 @@ NAPI_EXTERN napi_status NAPI_CDECL napi_create_object(napi_env env,
 NAPI_EXTERN napi_status NAPI_CDECL
 node_api_create_object_with_properties(napi_env env,
                                        napi_value prototype_or_null,
-                                       napi_value* property_names,
-                                       napi_value* property_values,
+                                       const napi_value* property_names,
+                                       const napi_value* property_values,
                                        size_t property_count,
                                        napi_value* result);
 #endif  // NAPI_EXPERIMENTAL
diff --git a/src/js_native_api_v8.cc b/src/js_native_api_v8.cc
index 5e533d2a6822..6ae976df2971 100644
--- a/src/js_native_api_v8.cc
+++ b/src/js_native_api_v8.cc
@@ -1621,8 +1621,8 @@ napi_status NAPI_CDECL napi_create_object(napi_env env, napi_value* result) {
 napi_status NAPI_CDECL
 node_api_create_object_with_properties(napi_env env,
                                        napi_value prototype_or_null,
-                                       napi_value* property_names,
-                                       napi_value* property_values,
+                                       const napi_value* property_names,
+                                       const napi_value* property_values,
                                        size_t property_count,
                                        napi_value* result) {
   CHECK_ENV_NOT_IN_GC(env);
diff --git a/src/large_pages/node_large_page.cc b/src/large_pages/node_large_page.cc
deleted file mode 100644
index 43ebb7641a62..000000000000
--- a/src/large_pages/node_large_page.cc
+++ /dev/null
@@ -1,464 +0,0 @@
-// Copyright (C) 2018 Intel Corporation
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"),
-// to deal in the Software without restriction, including without limitation
-// the rights to use, copy, modify, merge, publish, distribute, sublicense,
-// and/or sell copies of the Software, and to permit persons to whom
-// the Software is furnished to do so, subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
-// THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
-// OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
-// ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
-// OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// SPDX-License-Identifier: MIT
-
-// The functions in this file map the .text section of Node.js into 2MB pages.
-// They perform the following steps:
-//
-// 1: Find the Node.js binary's `.text` section in memory. This is done below in
-//    `FindNodeTextRegion`. It is accomplished in a platform-specific way. On
-//    Linux and FreeBSD, `dl_iterate_phdr(3)` is used. When the region is found,
-//    it is "trimmed" as follows:
-//    * Modify the start to point to the very beginning of the Node.js `.text`
-//      section (from symbol `__node_text_start` declared in node_text_start.S).
-//    * Possibly modify the end to account for the `lpstub` section which
-//      contains `MoveTextRegionToLargePages`, the function we do not wish to
-//      move (see below).
-//    * Align the address of the start to its nearest higher large page
-//      boundary.
-//    * Align the address of the end to its nearest lower large page boundary.
-//
-// 2: Move the text region to large pages. This is done below in
-//    `MoveTextRegionToLargePages`. We need to be very careful:
-//    a) `MoveTextRegionToLargePages` itself should not be moved.
-//       We use gcc attributes
-//       (__section__) to put it outside the `.text` section,
-//       (__aligned__) to align it at the 2M boundary, and
-//       (__noline__) to not inline this function.
-//    b) `MoveTextRegionToLargePages` should not call any function(s) that might
-//       be moved.
-//    To move the .text section, perform the following steps:
-//      * Map a new, temporary area and copy the original code there.
-//      * Use mmap using the start address with MAP_FIXED so we get exactly the
-//        same virtual address (except on macOS). On platforms other than Linux,
-//        use mmap flags to request hugepages.
-//      * On Linux use madvise with MADV_HUGEPAGE to use anonymous 2MB pages.
-//      * If successful copy the code to the newly mapped area and protect it to
-//        be readable and executable.
-//      * Unmap the temporary area.
-
-#include "node_large_page.h"
-
-#include <cerrno>   // NOLINT(build/include)
-
-// Besides returning ENOTSUP at runtime we do nothing if this define is missing.
-#if defined(NODE_ENABLE_LARGE_CODE_PAGES) && NODE_ENABLE_LARGE_CODE_PAGES
-#include "debug_utils-inl.h"
-
-#if defined(__linux__) || defined(__FreeBSD__)
-#if defined(__linux__)
-#ifndef _GNU_SOURCE
-#define _GNU_SOURCE
-#endif  // ifndef _GNU_SOURCE
-#include <sys/prctl.h>
-#if !defined(PR_SET_VMA)
-#define PR_SET_VMA 0x53564d41
-#define PR_SET_VMA_ANON_NAME 0
-#endif
-#elif defined(__FreeBSD__)
-#include "uv.h"  // uv_exepath
-#endif  // defined(__linux__)
-#include <link.h>
-#endif  // defined(__linux__) || defined(__FreeBSD__)
-
-#include <sys/types.h>
-#include <sys/mman.h>
-#if defined(__FreeBSD__)
-#include <sys/sysctl.h>
-#elif defined(__APPLE__)
-#include <mach/vm_map.h>
-#endif
-
-#include <climits>  // PATH_MAX
-#include <cstdlib>
-#include <cstdint>
-#include <cstring>
-#include <string>
-#include <fstream>
-
-#if defined(__linux__) || defined(__FreeBSD__)
-extern "C" {
-// This symbol must be declared weak because this file becomes part of all
-// Node.js targets (like node_mksnapshot, node_mkcodecache, and cctest) and
-// those files do not supply the symbol.
-extern char __attribute__((weak)) __node_text_start;
-extern char __start_lpstub;
-}  // extern "C"
-#endif  // defined(__linux__) || defined(__FreeBSD__)
-
-#endif  // defined(NODE_ENABLE_LARGE_CODE_PAGES) && NODE_ENABLE_LARGE_CODE_PAGES
-namespace node {
-#if defined(NODE_ENABLE_LARGE_CODE_PAGES) && NODE_ENABLE_LARGE_CODE_PAGES
-
-namespace {
-
-struct text_region {
-  char* from = nullptr;
-  char* to = nullptr;
-  bool found_text_region = false;
-};
-
-static const size_t hps = 2L * 1024 * 1024;
-
-template <typename... Args>
-inline void Debug(std::string fmt, Args&&... args) {
-  node::Debug(&per_process::enabled_debug_list,
-              DebugCategory::HUGEPAGES,
-              (std::string("Hugepages info: ") + fmt).c_str(),
-              std::forward<Args>(args)...);
-}
-
-inline void PrintWarning(const char* warn) {
-  fprintf(stderr, "Hugepages WARNING: %s\n", warn);
-}
-
-inline void PrintSystemError(int error) {
-  PrintWarning(strerror(error));
-}
-
-inline uintptr_t hugepage_align_up(uintptr_t addr) {
-  return (((addr) + (hps) - 1) & ~((hps) - 1));
-}
-
-inline uintptr_t hugepage_align_down(uintptr_t addr) {
-  return ((addr) & ~((hps) - 1));
-}
-
-#if defined(__linux__) || defined(__FreeBSD__)
-#if defined(__FreeBSD__)
-#ifndef ElfW
-#define ElfW(name) Elf_##name
-#endif  // ifndef ElfW
-#endif  // defined(__FreeBSD__)
-
-struct dl_iterate_params {
-  uintptr_t start = 0;
-  uintptr_t end = 0;
-  uintptr_t reference_sym = reinterpret_cast<uintptr_t>(&__node_text_start);
-  std::string exename;
-};
-
-int FindMapping(struct dl_phdr_info* info, size_t, void* data) {
-  auto dl_params = static_cast<dl_iterate_params*>(data);
-  if (dl_params->exename == std::string(info->dlpi_name)) {
-    for (int idx = 0; idx < info->dlpi_phnum; idx++) {
-      const ElfW(Phdr)* phdr = &info->dlpi_phdr[idx];
-      if (phdr->p_type == PT_LOAD && (phdr->p_flags & PF_X)) {
-        uintptr_t start = info->dlpi_addr + phdr->p_vaddr;
-        uintptr_t end = start + phdr->p_memsz;
-
-        if (dl_params->reference_sym >= start &&
-            dl_params->reference_sym <= end) {
-          dl_params->start = start;
-          dl_params->end = end;
-          return 1;
-        }
-      }
-    }
-  }
-  return 0;
-}
-#endif  // defined(__linux__) || defined(__FreeBSD__)
-
-struct text_region FindNodeTextRegion() {
-  struct text_region nregion;
-#if defined(__linux__) || defined(__FreeBSD__)
-  dl_iterate_params dl_params;
-  uintptr_t lpstub_start = reinterpret_cast<uintptr_t>(&__start_lpstub);
-
-#if defined(__FreeBSD__)
-  // On FreeBSD we need the name of the binary, because `dl_iterate_phdr` does
-  // not pass in an empty string as the `dlpi_name` of the binary but rather its
-  // absolute path.
-  {
-    char selfexe[PATH_MAX];
-    size_t count = sizeof(selfexe);
-    if (uv_exepath(selfexe, &count))
-      return nregion;
-    dl_params.exename = std::string(selfexe, count);
-  }
-#endif  // defined(__FreeBSD__)
-
-  if (dl_iterate_phdr(FindMapping, &dl_params) == 1) {
-    Debug("start: %p - sym: %p - end: %p\n",
-          reinterpret_cast<void*>(dl_params.start),
-          reinterpret_cast<void*>(dl_params.reference_sym),
-          reinterpret_cast<void*>(dl_params.end));
-
-    dl_params.start = dl_params.reference_sym;
-    if (lpstub_start > dl_params.start && lpstub_start <= dl_params.end) {
-      Debug("Trimming end for lpstub: %p\n",
-            reinterpret_cast<void*>(lpstub_start));
-      dl_params.end = lpstub_start;
-    }
-
-    if (dl_params.start < dl_params.end) {
-      char* from = reinterpret_cast<char*>(hugepage_align_up(dl_params.start));
-      char* to = reinterpret_cast<char*>(hugepage_align_down(dl_params.end));
-      Debug("Aligned range is %p - %p\n", from, to);
-      if (from < to) {
-        size_t pagecount = (to - from) / hps;
-        if (pagecount > 0) {
-          nregion.found_text_region = true;
-          nregion.from = from;
-          nregion.to = to;
-        }
-      }
-    }
-  }
-#elif defined(__APPLE__)
-  struct vm_region_submap_info_64 map;
-  mach_msg_type_number_t count = VM_REGION_SUBMAP_INFO_COUNT_64;
-  vm_address_t addr = 0UL;
-  vm_size_t size = 0;
-  natural_t depth = 1;
-
-  while (true) {
-    if (vm_region_recurse_64(mach_task_self(), &addr, &size, &depth,
-                             reinterpret_cast<vm_region_info_64_t>(&map),
-                             &count) != KERN_SUCCESS) {
-      break;
-    }
-
-    if (map.is_submap) {
-      depth++;
-    } else {
-      char* start = reinterpret_cast<char*>(hugepage_align_up(addr));
-      char* end = reinterpret_cast<char*>(hugepage_align_down(addr+size));
-
-      if (end > start && (map.protection & VM_PROT_READ) != 0 &&
-          (map.protection & VM_PROT_EXECUTE) != 0) {
-        nregion.found_text_region = true;
-        nregion.from = start;
-        nregion.to = end;
-        break;
-      }
-
-      addr += size;
-      size = 0;
-    }
-  }
-#endif
-  Debug("Found %d huge pages\n", (nregion.to - nregion.from) / hps);
-  return nregion;
-}
-
-#if defined(__linux__)
-bool IsTransparentHugePagesEnabled() {
-  // File format reference:
-  // https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/mm/huge_memory.c?id=13391c60da3308ed9980de0168f74cce6c62ac1d#n163
-  const char* filename = "/sys/kernel/mm/transparent_hugepage/enabled";
-  std::ifstream config_stream(filename, std::ios::in);
-  if (!config_stream.good()) {
-    PrintWarning("could not open /sys/kernel/mm/transparent_hugepage/enabled");
-    return false;
-  }
-
-  std::string token;
-  config_stream >> token;
-  if ("[always]" == token) return true;
-  config_stream >> token;
-  if ("[madvise]" == token) return true;
-  return false;
-}
-#elif defined(__FreeBSD__)
-bool IsSuperPagesEnabled() {
-  // It is enabled by default on amd64.
-  unsigned int super_pages = 0;
-  size_t super_pages_length = sizeof(super_pages);
-  return sysctlbyname("vm.pmap.pg_ps_enabled",
-                      &super_pages,
-                      &super_pages_length,
-                      nullptr,
-                      0) != -1 &&
-         super_pages >= 1;
-}
-#endif
-
-// Functions in this class must always be inlined because they must end up in
-// the `lpstub` section rather than the `.text` section.
-class MemoryMapPointer {
- public:
-  FORCE_INLINE explicit MemoryMapPointer() {}
-  FORCE_INLINE bool operator==(void* rhs) const { return mem_ == rhs; }
-  FORCE_INLINE void* mem() const { return mem_; }
-  MemoryMapPointer(const MemoryMapPointer&) = delete;
-  MemoryMapPointer(MemoryMapPointer&&) = delete;
-  void operator= (const MemoryMapPointer&) = delete;
-  void operator= (const MemoryMapPointer&&) = delete;
-  FORCE_INLINE void Reset(void* start,
-                          size_t size,
-                          int prot,
-                          int flags,
-                          int fd = -1,
-                          size_t offset = 0) {
-    mem_ = mmap(start, size, prot, flags, fd, offset);
-    size_ = size;
-  }
-  FORCE_INLINE void Reset() {
-    mem_ = nullptr;
-    size_ = 0;
-  }
-  static void SetName(void* mem, size_t size, const char* name) {
-#if defined(__linux__)
-    // Available since the 5.17 kernel release and if the
-    // CONFIG_ANON_VMA_NAME option, we can set an identifier
-    // to an anonymous mapped region. However if the kernel
-    // option is not present or it s an older kernel, it is a no-op.
-    if (mem != MAP_FAILED && mem != nullptr)
-        prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME,
-            reinterpret_cast<uintptr_t>(mem),
-            size,
-            reinterpret_cast<uintptr_t>(name));
-#else
-    (void)name;
-#endif
-  }
-  FORCE_INLINE ~MemoryMapPointer() {
-    if (mem_ == nullptr) return;
-    if (mem_ == MAP_FAILED) return;
-    if (munmap(mem_, size_) == 0) return;
-    PrintSystemError(errno);
-  }
-
- private:
-  size_t size_ = 0;
-  void* mem_ = nullptr;
-};
-
-}  // End of anonymous namespace
-
-int
-#if !defined(__APPLE__)
-__attribute__((__section__("lpstub")))
-#else
-__attribute__((__section__("__TEXT,__lpstub")))
-#endif
-__attribute__((__aligned__(hps)))
-__attribute__((__noinline__))
-MoveTextRegionToLargePages(const text_region& r) {
-  MemoryMapPointer nmem;
-  MemoryMapPointer tmem;
-  void* start = r.from;
-  size_t size = r.to - r.from;
-
-  // Allocate a temporary region and back up the code we will re-map.
-  nmem.Reset(nullptr, size,
-             PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS);
-  if (nmem.mem() == MAP_FAILED) goto fail;
-  memcpy(nmem.mem(), r.from, size);
-
-#if defined(__linux__)
-// We already know the original page is r-xp
-// (PROT_READ, PROT_EXEC, MAP_PRIVATE)
-// We want PROT_WRITE because we are writing into it.
-// We want it at the fixed address and we use MAP_FIXED.
-  tmem.Reset(start, size,
-             PROT_READ | PROT_WRITE | PROT_EXEC,
-             MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED);
-  if (tmem.mem() == MAP_FAILED) goto fail;
-  if (madvise(tmem.mem(), size, 14 /* MADV_HUGEPAGE */) == -1) goto fail;
-  memcpy(start, nmem.mem(), size);
-#elif defined(__FreeBSD__)
-  tmem.Reset(start, size,
-             PROT_READ | PROT_WRITE | PROT_EXEC,
-             MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED |
-             MAP_ALIGNED_SUPER);
-  if (tmem.mem() == MAP_FAILED) goto fail;
-  memcpy(start, nmem.mem(), size);
-#elif defined(__APPLE__)
-  // There is not enough room to reserve the mapping close
-  // to the region address so we content to give a hint
-  // without forcing the new address being closed to.
-  // We explicitally gives all permission since we plan
-  // to write into it.
-  tmem.Reset(start, size,
-             PROT_READ | PROT_WRITE | PROT_EXEC,
-             MAP_PRIVATE | MAP_ANONYMOUS,
-             VM_FLAGS_SUPERPAGE_SIZE_2MB);
-  if (tmem.mem() == MAP_FAILED) goto fail;
-  memcpy(tmem.mem(), nmem.mem(), size);
-  if (mprotect(start, size, PROT_READ | PROT_WRITE | PROT_EXEC) == -1)
-    goto fail;
-  memcpy(start, tmem.mem(), size);
-#endif
-
-  if (mprotect(start, size, PROT_READ | PROT_EXEC) == -1) goto fail;
-  MemoryMapPointer::SetName(start, size, "nodejs Large Page");
-
-  // We need not `munmap(tmem, size)` on success.
-  tmem.Reset();
-  return 0;
-fail:
-  PrintSystemError(errno);
-  return -1;
-}
-#endif  // defined(NODE_ENABLE_LARGE_CODE_PAGES) && NODE_ENABLE_LARGE_CODE_PAGES
-
-// This is the primary API called from main.
-int MapStaticCodeToLargePages() {
-#if defined(NODE_ENABLE_LARGE_CODE_PAGES) && NODE_ENABLE_LARGE_CODE_PAGES
-  bool have_thp = false;
-#if defined(__linux__)
-  have_thp = IsTransparentHugePagesEnabled();
-#elif defined(__FreeBSD__)
-  have_thp = IsSuperPagesEnabled();
-#elif defined(__APPLE__)
-  // pse-36 flag is present in recent mac x64 products.
-  have_thp = true;
-#endif
-  if (!have_thp)
-    return EACCES;
-
-  struct text_region r = FindNodeTextRegion();
-  if (r.found_text_region == false)
-    return ENOENT;
-
-  return MoveTextRegionToLargePages(r);
-#else
-  return ENOTSUP;
-#endif
-}
-
-const char* LargePagesError(int status) {
-  switch (status) {
-    case ENOTSUP:
-      return "Mapping to large pages is not supported.";
-
-    case EACCES:
-      return "Large pages are not enabled.";
-
-    case ENOENT:
-      return "failed to find text region";
-
-    case -1:
-      return "Mapping code to large pages failed. Reverting to default page "
-          "size.";
-
-    case 0:
-      return "OK";
-
-    default:
-      return "Unknown error";
-  }
-}
-
-}  // namespace node
diff --git a/src/large_pages/node_large_page.h b/src/large_pages/node_large_page.h
deleted file mode 100644
index 622cf09ede4e..000000000000
--- a/src/large_pages/node_large_page.h
+++ /dev/null
@@ -1,34 +0,0 @@
-// Copyright (C) 2018 Intel Corporation
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"),
-// to deal in the Software without restriction, including without limitation
-// the rights to use, copy, modify, merge, publish, distribute, sublicense,
-// and/or sell copies of the Software, and to permit persons to whom
-// the Software is furnished to do so, subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
-// THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
-// OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
-// ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
-// OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// SPDX-License-Identifier: MIT
-
-#ifndef SRC_LARGE_PAGES_NODE_LARGE_PAGE_H_
-#define SRC_LARGE_PAGES_NODE_LARGE_PAGE_H_
-
-#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-namespace node {
-int MapStaticCodeToLargePages();
-const char* LargePagesError(int status);
-}  // namespace node
-
-#endif  // NODE_WANT_INTERNALS
-#endif  // SRC_LARGE_PAGES_NODE_LARGE_PAGE_H_
diff --git a/src/large_pages/node_text_start.S b/src/large_pages/node_text_start.S
deleted file mode 100644
index 2a643457b572..000000000000
--- a/src/large_pages/node_text_start.S
+++ /dev/null
@@ -1,29 +0,0 @@
-#if defined(__ELF__)
-.section .note.GNU-stack,"",%progbits
-#endif
-// Add .note.gnu.property note for x86_64 to enable Intel CET
-// Based on: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html
-// Refs: https://github.com/nodejs/node/issues/59084
-#if defined(__x86_64__) || defined(_M_X64)
-.section	.note.gnu.property,"a"
-.align 8
-.long	 1f - 0f
-.long	 4f - 1f
-.long	 5
-0:
-.string	 "GNU"
-1:
-.align 8
-.long	 0xc0000002
-.long	 3f - 2f
-2:
-.long	 0x3
-3:
-.align 8
-4:
-#endif
-.text
-.align 0x2000
-.global __node_text_start
-.hidden __node_text_start
-__node_text_start:
diff --git a/src/node.cc b/src/node.cc
index 00282634419d..fcf572d71e06 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -81,8 +81,6 @@
 #include "../deps/v8/third_party/vtune/v8-vtune.h"
 #endif
 
-#include "large_pages/node_large_page.h"
-
 #if defined(__APPLE__) || defined(__linux__) || defined(_WIN32)
 #define NODE_USE_V8_WASM_TRAP_HANDLER 1
 #else
@@ -386,6 +384,10 @@ MaybeLocal<Value> StartExecution(Environment* env,
     return StartExecution(env, "internal/main/check_syntax");
   }
 
+  if (env->options()->bench_runner) {
+    return StartExecution(env, "internal/main/bench_runner");
+  }
+
   if (env->options()->test_runner) {
     return StartExecution(env, "internal/main/test_runner");
   }
@@ -723,6 +725,14 @@ void ResetStdio() {
 #endif  // __POSIX__
 }
 
+// Validates the benchmark runner options of the global (per-process) options
+// once every option source has been parsed. See
+// EnvironmentOptions::CheckBenchOptions().
+static void CheckGlobalBenchOptions(std::vector<std::string>* errors) {
+  Mutex::ScopedLock lock(per_process::cli_options_mutex);
+  per_process::cli_options->per_isolate->per_env->CheckBenchOptions(errors);
+}
+
 static ExitCode ProcessGlobalArgsInternal(std::vector<std::string>* args,
                                           std::vector<std::string>* exec_args,
                                           std::vector<std::string>* errors,
@@ -786,6 +796,20 @@ static ExitCode ProcessGlobalArgsInternal(std::vector<std::string>* args,
     v8_args.emplace_back("--js-source-phase-imports");
   }
 
+  // V8 aborts the process when external memory grows by more than
+  // --external-memory-max-reasonable-size gigabytes in a single step. That
+  // limit is a Chromium-oriented sanity check; allocating a buffer larger
+  // than it is a legitimate thing to do in Node, and should raise a
+  // RangeError rather than crash. Disable the check unless the user asked
+  // for a specific limit.
+  // Refs: https://github.com/nodejs/node/issues/65534
+  if (std::ranges::none_of(v8_args, [](const std::string& arg) {
+        return arg.starts_with("--external-memory-max-reasonable-size") ||
+               arg.starts_with("--external_memory_max_reasonable_size");
+      })) {
+    v8_args.emplace_back("--external-memory-max-reasonable-size=0");
+  }
+
 #ifdef __POSIX__
   // Block SIGPROF signals when sleeping in epoll_wait/kevent/etc.  Avoids the
   // performance penalty of frequent EINTR wakeups when the profiler is running.
@@ -818,8 +842,16 @@ int ProcessGlobalArgs(std::vector<std::string>* args,
                       std::vector<std::string>* exec_args,
                       std::vector<std::string>* errors,
                       OptionEnvvarSettings settings) {
-  return static_cast<int>(
-      ProcessGlobalArgsInternal(args, exec_args, errors, settings));
+  const ExitCode exit_code =
+      ProcessGlobalArgsInternal(args, exec_args, errors, settings);
+  if (exit_code != ExitCode::kNoFailure) return static_cast<int>(exit_code);
+  // Embedders parse every option source in a single pass, so the benchmark
+  // options can be validated right away.
+  CheckGlobalBenchOptions(errors);
+  if (!errors->empty()) {
+    return static_cast<int>(ExitCode::kInvalidCommandLineArgument);
+  }
+  return static_cast<int>(ExitCode::kNoFailure);
 }
 
 static std::atomic_bool init_called{false};
@@ -1000,6 +1032,11 @@ static ExitCode InitializeNodeWithArgsInternal(
     if (exit_code != ExitCode::kNoFailure) return exit_code;
   }
 
+  // Every option source has now been parsed, so cross-source option
+  // constraints can finally be validated.
+  CheckGlobalBenchOptions(errors);
+  if (!errors->empty()) return ExitCode::kInvalidCommandLineArgument;
+
   // Set the process.title immediately after processing argv if --title is set.
   if (!per_process::cli_options->title.empty())
     uv_set_process_title(per_process::cli_options->title.c_str());
@@ -1125,15 +1162,12 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
   }
 
   if (!(flags & ProcessInitializationFlags::kNoUseLargePages) &&
-      (per_process::cli_options->use_largepages == "on" ||
-       per_process::cli_options->use_largepages == "silent")) {
-    int lp_result = node::MapStaticCodeToLargePages();
-    if (per_process::cli_options->use_largepages == "on" && lp_result != 0) {
-      result->errors_.emplace_back(node::LargePagesError(lp_result));
-    }
+      (per_process::cli_options->use_largepages == "on")) {
+    result->errors_.emplace_back("--use-largepages is no longer supported.");
   }
 
-  if (!per_process::cli_options->run.empty()) {
+  // A bare `--run` (empty value) lists the available scripts; a value runs it.
+  if (per_process::cli_options->has_run) {
     auto positional_args = task_runner::GetPositionalArgs(args);
     result->early_return_ = true;
     task_runner::RunTask(
@@ -1221,6 +1255,7 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
     }
 
     OPENSSL_INIT_SETTINGS* settings = OPENSSL_INIT_new();
+    CHECK_NOT_NULL(settings);
     OPENSSL_INIT_set_config_filename(settings, conf_file);
     OPENSSL_INIT_set_config_appname(settings, conf_section_name);
     OPENSSL_INIT_set_config_file_flags(settings,
@@ -1250,6 +1285,7 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
       result->errors_.emplace_back(std::move(*fips_error));
       return result;
     }
+    crypto::InstallFipsIndicatorCallback();
 
     // Ensure CSPRNG is properly seeded.
     CHECK(ncrypto::CSPRNG(nullptr, 0));
@@ -1286,6 +1322,10 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
     cppgc::InitializeProcess(allocator);
   }
 
+  if (flags & ProcessInitializationFlags::kNoHarvestBuiltinCodeCache) {
+    builtins::BuiltinLoader::SetHarvestCodeCache(false);
+  }
+
   if (!(flags & ProcessInitializationFlags::kNoInitializeV8)) {
     V8::Initialize();
 
diff --git a/src/node.h b/src/node.h
index 1c0726a82415..5e54a60fcf53 100644
--- a/src/node.h
+++ b/src/node.h
@@ -223,7 +223,8 @@ enum Flags : uint32_t {
   kNoParseGlobalDebugVariables = 1 << 9,
   // Do not adjust OS resource limits for this process.
   kNoAdjustResourceLimits = 1 << 10,
-  // Do not map code segments into large pages for this process.
+  // Legacy flag for not mapping code segments into large pages for this
+  // process. The feature is no longer supported so this is just a no-op.
   kNoUseLargePages = 1 << 11,
   // Skip printing output for --help, --version, --v8-options.
   kNoPrintHelpOrVersionOutput = 1 << 12,
@@ -233,6 +234,11 @@ enum Flags : uint32_t {
   kNoInitializeCppgc = 1 << 13,
   // Initialize the process for predictable snapshot generation.
   kGeneratePredictableSnapshot = 1 << 14,
+  // Do not serialize a code cache for builtins that had to be compiled without
+  // one. By default such caches are kept so that worker threads created later
+  // start faster; an embedder that supplies an EmbedderBuiltinCodeCache or
+  // never creates workers only pays for the serialization.
+  kNoHarvestBuiltinCodeCache = 1 << 15,
 
   // Emulate the behavior of InitializeNodeWithArgs() when passing
   // a flags argument to the InitializeOncePerProcess() replacement
@@ -678,6 +684,43 @@ struct InspectorParentHandle {
   virtual ~InspectorParentHandle() = default;
 };
 
+// Code cache for the built-in JavaScript of Environments that are bootstrapped
+// rather than deserialized from a snapshot; see SetBuiltinCodeCache().
+class NODE_EXTERN EmbedderBuiltinCodeCache {
+ public:
+  struct Entry {
+    std::string id;  // e.g. "internal/bootstrap/node"
+    std::unique_ptr<v8::ScriptCompiler::CachedData> data;
+  };
+  explicit EmbedderBuiltinCodeCache(std::vector<Entry> entries);
+  ~EmbedderBuiltinCodeCache();
+
+  // Compiles every built-in module in `context`, which must come from
+  // NewContext(), and returns their code caches; empty on failure.
+  static std::vector<Entry> Generate(v8::Local<v8::Context> context);
+
+  v8::ScriptCompiler::CachedData::CompatibilityCheckResult CompatibilityCheck(
+      v8::Isolate* isolate) const;
+
+  EmbedderBuiltinCodeCache(const EmbedderBuiltinCodeCache&) = delete;
+  EmbedderBuiltinCodeCache& operator=(const EmbedderBuiltinCodeCache&) = delete;
+
+  struct Impl;
+
+ private:
+  std::unique_ptr<Impl> impl_;
+  friend NODE_EXTERN v8::ScriptCompiler::CachedData::CompatibilityCheckResult
+  SetBuiltinCodeCache(IsolateData*, const EmbedderBuiltinCodeCache*);
+};
+
+// Environments created from `isolate_data` afterwards start with `cache`'s
+// entries (they share its buffers; `cache` itself may be freed after the call);
+// nullptr clears it. Returns the result of `cache->CompatibilityCheck()` and
+// leaves `isolate_data` unchanged unless that is kSuccess.
+NODE_EXTERN v8::ScriptCompiler::CachedData::CompatibilityCheckResult
+SetBuiltinCodeCache(IsolateData* isolate_data,
+                    const EmbedderBuiltinCodeCache* cache);
+
 // TODO(addaleax): Maybe move per-Environment options parsing here.
 // Returns nullptr when the Environment cannot be created e.g. there are
 // pending JavaScript exceptions.
diff --git a/src/node_api.cc b/src/node_api.cc
index d80569d9e92e..e0e7cca2a4ba 100644
--- a/src/node_api.cc
+++ b/src/node_api.cc
@@ -451,6 +451,7 @@ class ThreadSafeFunction {
 
     if (popped_value) {
       v8::HandleScope scope(env->isolate);
+      v8::Context::Scope context_scope(env->context());
       AsyncResource::CallbackScope cb_scope(&*async_resource);
       napi_value js_callback = nullptr;
       if (!ref.IsEmpty()) {
@@ -469,6 +470,7 @@ class ThreadSafeFunction {
     v8::HandleScope scope(env->isolate);
     EmptyQueue();
     if (finalize_cb) {
+      v8::Context::Scope context_scope(env->context());
       AsyncResource::CallbackScope cb_scope(&*async_resource);
       env->CallFinalizer<false>(finalize_cb, finalize_data, context);
     }
@@ -1236,6 +1238,7 @@ class Work : public node::AsyncResource, public node::ThreadPoolWork {
     // Establish a handle scope here so that every callback doesn't have to.
     // Also it is needed for the exception-handling below.
     v8::HandleScope scope(_env->isolate);
+    v8::Context::Scope context_scope(_env->context());
 
     CallbackScope callback_scope(this);
 
diff --git a/src/node_binding.cc b/src/node_binding.cc
index 2dde536dc229..0437f59ca60e 100644
--- a/src/node_binding.cc
+++ b/src/node_binding.cc
@@ -9,6 +9,20 @@
 #include "util.h"
 
 #include <string>
+#include <vector>
+
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <fcntl.h>
+#include <unistd.h>
+#include <cerrno>
+#include <cstdlib>
+#if defined(__linux__)
+#include <sys/mman.h>
+#include <sys/syscall.h>
+#endif
+#endif
 
 #if HAVE_OPENSSL
 #define NODE_BUILTIN_OPENSSL_BINDINGS(V) V(crypto) V(tls_wrap)
@@ -108,6 +122,7 @@
   NODE_BUILTIN_ICU_BINDINGS(V)                                                 \
   NODE_BUILTIN_PROFILER_BINDINGS(V)                                            \
   NODE_BUILTIN_DEBUG_BINDINGS(V)                                               \
+  NODE_BUILTIN_DTLS_BINDINGS(V)                                                \
   NODE_BUILTIN_QUIC_BINDINGS(V)                                                \
   NODE_BUILTIN_SQLITE_BINDINGS(V)                                              \
   NODE_BUILTIN_FFI_BINDINGS(V)
@@ -437,13 +452,295 @@ inline node_api_addon_get_api_version_func GetNapiAddonGetApiVersionCallback(
       dlib->GetSymbolAddress(STRINGIFY(NODE_API_MODULE_GET_API_VERSION)));
 }
 
-// DLOpen is process.dlopen(module, filename, flags).
-// Used to load 'module.node' dynamically shared objects.
+namespace {
+
+#ifndef _WIN32
+// Write the whole buffer to `fd`, retrying partial writes and EINTR.
+bool WriteAllToFd(int fd, const char* data, size_t len) {
+  size_t off = 0;
+  while (off < len) {
+    ssize_t n = write(fd, data + off, len - off);
+    if (n < 0) {
+      if (errno == EINTR) continue;
+      return false;
+    }
+    off += static_cast<size_t>(n);
+  }
+  return true;
+}
+
+#if defined(__linux__)
+int NodeMemfdCreate(const char* name, unsigned int flags) {
+  return static_cast<int>(syscall(SYS_memfd_create, name, flags));
+}
+#endif  // __linux__
+#endif  // !_WIN32
+
+// Materializes native-addon bytes into a form dlopen()/LoadLibrary() can load,
+// with the smallest, most private on-disk footprint each platform allows:
+//   Linux:        an anonymous in-memory memfd, loaded via /proc/self/fd/N -
+//                 the bytes never touch the filesystem.
+//   other POSIX:  a 0700 mkdtemp() directory plus an O_EXCL|O_NOFOLLOW file,
+//                 unlink()ed right after the load (the mapping keeps it alive).
+//   Windows:      a temp file opened FILE_FLAG_DELETE_ON_CLOSE; its handle is
+//                 retained for the process lifetime so the file is removed
+//                 automatically once the process (and the loaded DLL) exit.
+// Used for an addon that lives somewhere dlopen() cannot open by path, such as
+// a virtual file system.
+class AddonImage {
+ public:
+  AddonImage() = default;
+  ~AddonImage();
+  AddonImage(const AddonImage&) = delete;
+  AddonImage& operator=(const AddonImage&) = delete;
+
+  // The directory a temporary image would be written to, with a trailing
+  // separator; empty when it cannot be determined. Names the resource for the
+  // file-system permission check.
+  static std::string TempDir();
+
+  // On success sets path() to a real, loadable path for `data`.
+  bool Materialize(const char* data, size_t len);
+  const std::string& path() const { return path_; }
+  const std::string& errmsg() const { return errmsg_; }
+
+  // Call exactly once, right after DLib::Open(); `opened` says whether the load
+  // succeeded. Releases the transient resources that are no longer needed (a
+  // successful load holds its own mapping): on POSIX closes the memfd or
+  // unlinks the temp file; on Windows retains the delete-on-close handle for
+  // the process lifetime when opened, or closes it (deleting the file) on
+  // failure.
+  void AfterOpen(bool opened);
+
+ private:
+  std::string path_;
+  std::string errmsg_;
+  bool consumed_ = false;
+#ifdef _WIN32
+  HANDLE handle_ = INVALID_HANDLE_VALUE;
+#else
+  bool MaterializeTempFile(const char* data, size_t len);
+  int fd_ = -1;
+  std::string temp_dir_;  // non-empty only for the temp-file (non-memfd) path
+#endif
+};
+
+#ifdef _WIN32
+
+// Delete-on-close handles kept alive until process exit so their temp files
+// outlive the loaded DLLs and are removed once the process ends.
+Mutex g_retained_addon_handles_mutex;
+std::vector<HANDLE>* g_retained_addon_handles = nullptr;
+
+// static
+std::string AddonImage::TempDir() {
+  wchar_t dir[MAX_PATH + 1];
+  DWORD dir_len = GetTempPathW(MAX_PATH + 1, dir);
+  if (dir_len == 0 || dir_len > MAX_PATH) return std::string();
+  int size = WideCharToMultiByte(
+      CP_UTF8, 0, dir, dir_len, nullptr, 0, nullptr, nullptr);
+  if (size <= 0) return std::string();
+  std::string out(size, '\0');
+  WideCharToMultiByte(
+      CP_UTF8, 0, dir, dir_len, out.data(), size, nullptr, nullptr);
+  return out;
+}
+
+bool AddonImage::Materialize(const char* data, size_t len) {
+  wchar_t dir[MAX_PATH + 1];
+  DWORD dir_len = GetTempPathW(MAX_PATH + 1, dir);
+  if (dir_len == 0 || dir_len > MAX_PATH) {
+    errmsg_ = "could not locate the temporary directory";
+    return false;
+  }
+  wchar_t file[MAX_PATH + 1];
+  if (GetTempFileNameW(dir, L"nod", 0, file) == 0) {
+    errmsg_ = "could not create a temporary file name";
+    return false;
+  }
+  // Reopen the just-created file delete-on-close, sharing delete so the loader
+  // can map it while it is delete-pending; the file is removed when this handle
+  // and the loader's section are both released (i.e. at process exit).
+  handle_ = CreateFileW(file,
+                        GENERIC_READ | GENERIC_WRITE,
+                        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                        nullptr,
+                        CREATE_ALWAYS,
+                        FILE_ATTRIBUTE_TEMPORARY | FILE_FLAG_DELETE_ON_CLOSE,
+                        nullptr);
+  if (handle_ == INVALID_HANDLE_VALUE) {
+    errmsg_ = "could not create a temporary file for the native addon";
+    return false;
+  }
+  size_t off = 0;
+  while (off < len) {
+    DWORD chunk =
+        len - off > MAXDWORD ? MAXDWORD : static_cast<DWORD>(len - off);
+    DWORD written = 0;
+    if (!WriteFile(handle_, data + off, chunk, &written, nullptr)) {
+      errmsg_ = "could not write the native addon to a temporary file";
+      CloseHandle(handle_);
+      handle_ = INVALID_HANDLE_VALUE;
+      return false;
+    }
+    off += written;
+  }
+  int utf8_len =
+      WideCharToMultiByte(CP_UTF8, 0, file, -1, nullptr, 0, nullptr, nullptr);
+  if (utf8_len <= 0) {
+    errmsg_ = "could not encode the temporary file path";
+    CloseHandle(handle_);
+    handle_ = INVALID_HANDLE_VALUE;
+    return false;
+  }
+  path_.resize(utf8_len - 1);
+  WideCharToMultiByte(
+      CP_UTF8, 0, file, -1, path_.data(), utf8_len, nullptr, nullptr);
+  return true;
+}
+
+void AddonImage::AfterOpen(bool opened) {
+  consumed_ = true;
+  if (handle_ == INVALID_HANDLE_VALUE) return;
+  if (!opened) {
+    CloseHandle(handle_);  // delete-on-close removes the file
+    handle_ = INVALID_HANDLE_VALUE;
+    return;
+  }
+  Mutex::ScopedLock lock(g_retained_addon_handles_mutex);
+  if (g_retained_addon_handles == nullptr) {
+    g_retained_addon_handles = new std::vector<HANDLE>();
+  }
+  g_retained_addon_handles->push_back(handle_);
+  handle_ = INVALID_HANDLE_VALUE;
+}
+
+AddonImage::~AddonImage() {
+  // Materialized but Open() was never reached (e.g. an exception in between):
+  // closing the delete-on-close handle removes the file.
+  if (!consumed_ && handle_ != INVALID_HANDLE_VALUE) CloseHandle(handle_);
+}
+
+#else  // !_WIN32
+
+bool AddonImage::Materialize(const char* data, size_t len) {
+#if defined(__linux__)
+  // Prefer an anonymous in-memory fd, loaded through /proc/self/fd: nothing
+  // reaches the filesystem, so there is no temp file to secure, unlink, or
+  // leak, and no noexec-mount problem. Request an executable memfd (MFD_EXEC,
+  // Linux 6.3+); retry without it on older kernels that reject the flag, then
+  // fall back to a temp file if memfd is unavailable entirely.
+#ifndef MFD_CLOEXEC
+#define MFD_CLOEXEC 0x0001U
+#endif
+#ifndef MFD_EXEC
+#define MFD_EXEC 0x0010U
+#endif
+  fd_ = NodeMemfdCreate("node-addon", MFD_CLOEXEC | MFD_EXEC);
+  if (fd_ == -1 && errno == EINVAL) {
+    fd_ = NodeMemfdCreate("node-addon", MFD_CLOEXEC);
+  }
+  if (fd_ != -1) {
+    if (!WriteAllToFd(fd_, data, len)) {
+      errmsg_ = "could not write the native addon to an in-memory file";
+      close(fd_);
+      fd_ = -1;
+      return false;
+    }
+    path_ = "/proc/self/fd/" + std::to_string(fd_);
+    return true;
+  }
+#endif  // __linux__
+  return MaterializeTempFile(data, len);
+}
+
+// static
+std::string AddonImage::TempDir() {
+  const char* env_tmp = getenv("TMPDIR");
+  std::string tmpdir =
+      (env_tmp != nullptr && *env_tmp != '\0') ? env_tmp : "/tmp";
+  if (tmpdir.back() != '/') tmpdir.push_back('/');
+  return tmpdir;
+}
+
+bool AddonImage::MaterializeTempFile(const char* data, size_t len) {
+  // A private 0700 directory (mkdtemp) so no other user can pre-create the path
+  // as a symlink or swap the file between the write and the load; O_EXCL and
+  // O_NOFOLLOW harden the create against a race inside it.
+  std::string tmpl = TempDir() + "node-addon-XXXXXX";
+  std::vector<char> buf(tmpl.begin(), tmpl.end());
+  buf.push_back('\0');
+  if (mkdtemp(buf.data()) == nullptr) {
+    errmsg_ = "could not create a temporary directory for the native addon";
+    return false;
+  }
+  temp_dir_ = buf.data();
+  std::string file = temp_dir_ + "/addon.node";
+  fd_ = open(
+      file.c_str(), O_WRONLY | O_CREAT | O_EXCL | O_NOFOLLOW | O_CLOEXEC, 0600);
+  if (fd_ == -1) {
+    errmsg_ = "could not create a temporary file for the native addon";
+    rmdir(temp_dir_.c_str());
+    temp_dir_.clear();
+    return false;
+  }
+  if (!WriteAllToFd(fd_, data, len)) {
+    errmsg_ = "could not write the native addon to a temporary file";
+    close(fd_);
+    fd_ = -1;
+    unlink(file.c_str());
+    rmdir(temp_dir_.c_str());
+    temp_dir_.clear();
+    return false;
+  }
+  // dlopen() reopens by path; the post-open mapping keeps the inode alive.
+  close(fd_);
+  fd_ = -1;
+  path_ = file;
+  return true;
+}
+
+void AddonImage::AfterOpen(bool opened) {
+  consumed_ = true;
+  // The right cleanup is the same whether or not the load worked.
+  (void)opened;
+  // memfd: the load's mapping (or nothing, on failure) owns it from here.
+  if (fd_ != -1) {
+    close(fd_);
+    fd_ = -1;
+    return;
+  }
+  if (!temp_dir_.empty()) {
+    // On success the mapping keeps the inode alive, so unlinking now leaves no
+    // on-disk trace; on failure this just cleans up.
+    unlink(path_.c_str());
+    rmdir(temp_dir_.c_str());
+    temp_dir_.clear();
+  }
+}
+
+AddonImage::~AddonImage() {
+  if (consumed_) return;
+  if (fd_ != -1) close(fd_);
+  if (!temp_dir_.empty()) {
+    unlink(path_.c_str());
+    rmdir(temp_dir_.c_str());
+  }
+}
+
+#endif  // _WIN32
+
+}  // namespace
+
+// Shared by process.dlopen() and the internal dlopenBinary(). `allow_binary`
+// says whether args[3] may carry the addon's bytes; it is false for
+// process.dlopen(), whose signature stays (module, filename[, flags]).
 //
 // FIXME(bnoordhuis) Not multi-context ready. TBD how to resolve the conflict
 // when two contexts try to load the same shared object. Maybe have a shadow
 // cache that's a plain C list or hash table that's shared across contexts?
-void DLOpen(const FunctionCallbackInfo<Value>& args) {
+static void DLOpenImpl(const FunctionCallbackInfo<Value>& args,
+                       bool allow_binary) {
   Environment* env = Environment::GetCurrent(args);
 
   if (env->no_native_addons()) {
@@ -463,7 +760,11 @@ void DLOpen(const FunctionCallbackInfo<Value>& args) {
   }
 
   int32_t flags = DLib::kDefaultFlags;
-  if (args.Length() > 2 && !args[2]->Int32Value(context).To(&flags)) {
+  // On the internal path an undefined flags argument keeps the default, so a
+  // caller can pass the bytes without choosing flags. process.dlopen() keeps
+  // its original behaviour of rejecting any non-integer that is present.
+  if (args.Length() > 2 && !(allow_binary && args[2]->IsUndefined()) &&
+      !args[2]->Int32Value(context).To(&flags)) {
     return THROW_ERR_INVALID_ARG_TYPE(env, "flag argument must be an integer.");
   }
 
@@ -476,12 +777,44 @@ void DLOpen(const FunctionCallbackInfo<Value>& args) {
     return;  // Exception pending.
   }
 
-  node::Utf8Value filename(env->isolate(), args[1]);  // Cast
-  env->TryLoadAddon(*filename, flags, [&](DLib* dlib) {
+  node::Utf8Value filename(env->isolate(), args[1]);  // The addon's path,
+                                                      // used for diagnostics.
+
+  // On the internal path args[3] carries the addon's bytes, for an addon that
+  // lives somewhere dlopen() cannot open by path (e.g. a virtual file system).
+  // Materialize them into a private, self-cleaning image and load that, while
+  // still reporting `filename` in any error.
+  AddonImage image;
+  const char* load_path = *filename;
+  if (allow_binary && args.Length() > 3 && !args[3]->IsUndefined()) {
+    if (!args[3]->IsArrayBufferView()) {
+      return THROW_ERR_INVALID_ARG_TYPE(
+          env, "binary must be a Buffer, TypedArray, or DataView");
+    }
+    // Loading from bytes materializes them into an image in the temporary
+    // directory, so this needs write access there on top of the addon
+    // permission checked above. The check does not depend on whether the image
+    // actually reaches the file system on this platform (Linux uses an
+    // anonymous memfd): what a program must be granted should not vary by
+    // platform.
+    THROW_IF_INSUFFICIENT_PERMISSIONS(
+        env,
+        permission::PermissionScope::kFileSystemWrite,
+        AddonImage::TempDir());
+    ArrayBufferViewContents<char> binary(args[3]);
+    if (!image.Materialize(binary.data(), binary.length())) {
+      return THROW_ERR_DLOPEN_FAILED(
+          env, "%s: %s", image.errmsg().c_str(), *filename);
+    }
+    load_path = image.path().c_str();
+  }
+
+  env->TryLoadAddon(load_path, flags, [&](DLib* dlib) {
     static Mutex dlib_load_mutex;
     Mutex::ScopedLock lock(dlib_load_mutex);
 
     const bool is_opened = dlib->Open();
+    image.AfterOpen(is_opened);
 
     // Objects containing v14 or later modules will have registered themselves
     // on the pending list.  Activate all of them now.  At present, only one
@@ -581,6 +914,20 @@ void DLOpen(const FunctionCallbackInfo<Value>& args) {
   // coverity[leaked_storage]
 }
 
+// process.dlopen(module, filename[, flags]). Used to load 'module.node'
+// dynamically shared objects.
+void DLOpen(const FunctionCallbackInfo<Value>& args) {
+  DLOpenImpl(args, false);
+}
+
+// Internal only, reached through the process_methods binding rather than the
+// process object: dlopenBinary(module, filename, flags, binary) loads an addon
+// from bytes already in memory. Used for addons served by a virtual file
+// system, which the dynamic loader cannot open by path.
+void DLOpenBinary(const FunctionCallbackInfo<Value>& args) {
+  DLOpenImpl(args, true);
+}
+
 inline struct node_module* FindModule(struct node_module* list,
                                       const char* name,
                                       int flag) {
diff --git a/src/node_binding.h b/src/node_binding.h
index d785ccc2238c..c200cc0d0c8a 100644
--- a/src/node_binding.h
+++ b/src/node_binding.h
@@ -36,6 +36,12 @@ static_assert(static_cast<int>(NM_F_LINKED) ==
 #define NODE_BUILTIN_QUIC_BINDINGS(V)
 #endif
 
+#if HAVE_OPENSSL && HAVE_DTLS
+#define NODE_BUILTIN_DTLS_BINDINGS(V) V(dtls)
+#else
+#define NODE_BUILTIN_DTLS_BINDINGS(V)
+#endif
+
 #if HAVE_SQLITE
 #define NODE_BUILTIN_SQLITE_BINDINGS(V)                                        \
   V(sqlite)                                                                    \
@@ -71,7 +77,8 @@ static_assert(static_cast<int>(NM_F_LINKED) ==
   V(url)                                                                       \
   V(worker)                                                                    \
   NODE_BUILTIN_ICU_BINDINGS(V)                                                 \
-  NODE_BUILTIN_QUIC_BINDINGS(V)
+  NODE_BUILTIN_QUIC_BINDINGS(V)                                                \
+  NODE_BUILTIN_DTLS_BINDINGS(V)
 
 #define NODE_BINDING_CONTEXT_AWARE_CPP(modname, regfunc, priv, flags)          \
   static node::node_module _module = {                                         \
@@ -161,6 +168,7 @@ void CreateInternalBindingTemplates(IsolateData* isolate_data);
 void GetInternalBinding(const v8::FunctionCallbackInfo<v8::Value>& args);
 void GetLinkedBinding(const v8::FunctionCallbackInfo<v8::Value>& args);
 void DLOpen(const v8::FunctionCallbackInfo<v8::Value>& args);
+void DLOpenBinary(const v8::FunctionCallbackInfo<v8::Value>& args);
 
 }  // namespace binding
 
diff --git a/src/node_blob.cc b/src/node_blob.cc
index 57d35358fbfd..a04bc2be0ef5 100644
--- a/src/node_blob.cc
+++ b/src/node_blob.cc
@@ -110,9 +110,12 @@ void BlobFromFilePath(const FunctionCallbackInfo<Value>& args) {
   ToNamespacedPath(env, &path);
   THROW_IF_INSUFFICIENT_PERMISSIONS(
       env, permission::PermissionScope::kFileSystemRead, path.ToStringView());
-  auto entry = DataQueue::CreateFdEntry(env, args[0]);
+  int status = 0;
+  auto entry = DataQueue::CreateFdEntry(env, args[0], &status);
   if (entry == nullptr) {
-    return THROW_ERR_INVALID_ARG_VALUE(env, "Unable to open file as blob");
+    // The file could not be stat'd. Report the libuv error so callers can tell
+    // ENOENT apart from any other reason the path could not be used.
+    return env->ThrowUVException(status, "stat", nullptr, *path);
   }
 
   std::vector<std::unique_ptr<DataQueue::Entry>> entries;
@@ -420,20 +423,16 @@ void Blob::Reader::SetWakeup(const FunctionCallbackInfo<Value>& args) {
   reader->wakeup_.Reset(args.GetIsolate(), args[0].As<Function>());
 }
 
-void Blob::Reader::NotifyPull(bool fin) {
+void Blob::Reader::NotifyPull() {
   if (wakeup_.IsEmpty() || !env()->can_call_into_js()) return;
-  // FIN notifications always fire — they must not be suppressed by
-  // pull_pending_ because there will be no further notifications to
-  // wake the iterator. Regular data notifications respect pull_pending_
-  // to coalesce multiple deliveries within a single packet.
-  if (!fin && pull_pending_) return;
+  // Coalesce notifications: if a wakeup is already pending and the reader
+  // has not yet pulled, skip re-notifying to avoid redundant wakeups
+  // within a single packet.
+  if (pull_pending_) return;
   pull_pending_ = true;
   HandleScope handle_scope(env()->isolate());
   Local<Function> fn = wakeup_.Get(env()->isolate());
-  // Pass fin as the first argument so the JS iterator knows EOS is
-  // imminent and should pull again without waiting for another wakeup.
-  Local<Value> argv[] = {v8::Boolean::New(env()->isolate(), fin)};
-  MakeCallback(fn, 1, argv);
+  MakeCallback(fn, 0, nullptr);
 }
 
 BaseObjectPtr<BaseObject> Blob::BlobTransferData::Deserialize(
diff --git a/src/node_blob.h b/src/node_blob.h
index e782b96594b5..06d3a151cfa5 100644
--- a/src/node_blob.h
+++ b/src/node_blob.h
@@ -82,7 +82,7 @@ class Blob : public BaseObject {
                                         BaseObjectPtr<Blob> blob);
     static void Pull(const v8::FunctionCallbackInfo<v8::Value>& args);
     static void SetWakeup(const v8::FunctionCallbackInfo<v8::Value>& args);
-    void NotifyPull(bool fin = false);
+    void NotifyPull();
 
     explicit Reader(Environment* env,
                     v8::Local<v8::Object> obj,
diff --git a/src/node_buffer.cc b/src/node_buffer.cc
index a0453800d84a..1093b73e6838 100644
--- a/src/node_buffer.cc
+++ b/src/node_buffer.cc
@@ -1661,9 +1661,9 @@ void CreateUnsafeArrayBuffer(const FunctionCallbackInfo<Value>& args) {
 // Returns the offset of the first byte of `arrayBuffer` that is located at a
 // memory address which is a multiple of `alignment`. V8 does not let us choose
 // the address of a backing store, so an aligned view is obtained by
-// over-allocating `alignment - 1` bytes and skipping to that offset. The
-// backing store of a non-resizable ArrayBuffer never moves, so the offset stays
-// aligned for the lifetime of the ArrayBuffer.
+// over-allocating and skipping to that offset. The backing store of a
+// non-resizable ArrayBuffer never moves, so the offset stays aligned for the
+// lifetime of the ArrayBuffer.
 void ArrayBufferAlignedOffset(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   CHECK_EQ(args.Length(), 2);
diff --git a/src/node_builtins.cc b/src/node_builtins.cc
index 0b447d649fd9..c58fa0089105 100644
--- a/src/node_builtins.cc
+++ b/src/node_builtins.cc
@@ -1,4 +1,6 @@
 #include "node_builtins.h"
+#include <atomic>
+#include <cstring>
 #include "debug_utils-inl.h"
 #include "env-inl.h"
 #include "module_wrap.h"
@@ -12,7 +14,6 @@
 #include "v8-value.h"
 
 namespace node {
-namespace builtins {
 
 using loader::HostDefinedOptions;
 using v8::Boolean;
@@ -44,6 +45,16 @@ using v8::TryCatch;
 using v8::Undefined;
 using v8::Value;
 
+namespace builtins {
+
+namespace {
+std::atomic<bool> harvest_code_cache{true};
+}  // namespace
+
+void BuiltinLoader::SetHarvestCodeCache(bool on) {
+  harvest_code_cache = on;
+}
+
 BuiltinLoader::BuiltinLoader()
     : config_(GetConfig()), code_cache_(std::make_shared<BuiltinCodeCache>()) {
   LoadJavaScriptSource();
@@ -140,17 +151,24 @@ BuiltinLoader::BuiltinCategories BuiltinLoader::GetBuiltinCategories() const {
         "internal/quic/quic", "internal/quic/symbols", "internal/quic/stats",
         "internal/quic/state",
 #endif  // !OPENSSL_NO_QUIC
+#if HAVE_DTLS
+        "internal/dtls/dtls", "internal/dtls/symbols", "internal/dtls/stats",
+        "internal/dtls/state",
+#endif  // HAVE_DTLS
 #if !HAVE_FFI
         "internal/ffi-shared-buffer", "internal/ffi/fast-api",
 #endif                  // !HAVE_FFI
-        "ffi",          // Experimental.
-        "quic",         // Experimental.
-        "sqlite",       // Experimental.
-        "stream/iter",  // Experimental.
-        "sys",          // Deprecated.
-        "vfs",          // Experimental.
-        "wasi",         // Experimental.
-        "zlib/iter",    // Experimental.
+        "bench",        // Experimental.
+        "bench/reporters",  // Experimental.
+        "dtls",             // Experimental.
+        "ffi",              // Experimental.
+        "quic",             // Experimental.
+        "sqlite",           // Experimental.
+        "stream/iter",      // Experimental.
+        "sys",              // Deprecated.
+        "vfs",              // Experimental.
+        "wasi",             // Experimental.
+        "zlib/iter",        // Experimental.
 #if !HAVE_SQLITE
         "internal/webstorage",  // Experimental.
         "internal/inspector/webstorage",
@@ -417,6 +435,7 @@ MaybeLocal<Data> BuiltinLoader::LookupAndCompile(
   }
 
   if (result == Result::kWithoutCache && optional_realm != nullptr &&
+      harvest_code_cache &&
       !optional_realm->env()->isolate_data()->is_building_snapshot()) {
     // We failed to accept this cache, maybe because it was rejected, maybe
     // because it wasn't present. Either way, we'll attempt to replace this
@@ -588,12 +607,13 @@ bool BuiltinLoader::CompileAllBuiltinsAndCopyCodeCache(
 
 void BuiltinLoader::RefreshCodeCache(const std::vector<CodeCacheInfo>& in) {
   RwLock::ScopedLock lock(code_cache_->mutex);
-  code_cache_->map.reserve(in.size());
-  DCHECK(code_cache_->map.empty());
+  // May be called more than once, e.g. first with the code cache carried by
+  // the snapshot and then by an embedder with caches it built for additional
+  // (or the same) builtin ids against this isolate: merge, and let the entry
+  // supplied last win for an id present in both.
+  code_cache_->map.reserve(code_cache_->map.size() + in.size());
   for (auto const& [id, data] : in) {
-    auto result = code_cache_->map.emplace(id, data);
-    USE(result.second);
-    DCHECK(result.second);
+    code_cache_->map.insert_or_assign(id, data);
   }
   code_cache_->has_code_cache = true;
 }
@@ -913,6 +933,76 @@ void BuiltinLoader::RegisterExternalReferences(
 }
 
 }  // namespace builtins
+
+struct EmbedderBuiltinCodeCache::Impl {
+  std::vector<builtins::CodeCacheInfo> entries;
+};
+
+EmbedderBuiltinCodeCache::EmbedderBuiltinCodeCache(std::vector<Entry> entries)
+    : impl_(std::make_unique<Impl>()) {
+  impl_->entries.reserve(entries.size());
+  for (Entry& e : entries) {
+    impl_->entries.push_back(
+        {std::move(e.id),
+         builtins::BuiltinCodeCacheData(
+             std::shared_ptr<ScriptCompiler::CachedData>(std::move(e.data)))});
+  }
+}
+
+EmbedderBuiltinCodeCache::~EmbedderBuiltinCodeCache() = default;
+
+ScriptCompiler::CachedData::CompatibilityCheckResult
+EmbedderBuiltinCodeCache::CompatibilityCheck(Isolate* isolate) const {
+  for (const builtins::CodeCacheInfo& info : impl_->entries) {
+    ScriptCompiler::CachedData probe(
+        info.data.data,
+        static_cast<int>(info.data.length),
+        ScriptCompiler::CachedData::BufferNotOwned);
+    auto result = probe.CompatibilityCheck(isolate);
+    if (result != ScriptCompiler::CachedData::kSuccess) return result;
+  }
+  return ScriptCompiler::CachedData::kSuccess;
+}
+
+std::vector<EmbedderBuiltinCodeCache::Entry> EmbedderBuiltinCodeCache::Generate(
+    Local<Context> context) {
+  std::vector<Entry> out;
+  builtins::BuiltinLoader loader;
+  loader.SetEagerCompile();
+  std::vector<builtins::CodeCacheInfo> infos;
+  if (!loader.CompileAllBuiltinsAndCopyCodeCache(context, {}, &infos)) {
+    return out;
+  }
+  out.reserve(infos.size());
+  for (const builtins::CodeCacheInfo& info : infos) {
+    uint8_t* copy = new uint8_t[info.data.length];
+    memcpy(copy, info.data.data, info.data.length);
+    out.push_back({info.id,
+                   std::make_unique<ScriptCompiler::CachedData>(
+                       copy,
+                       static_cast<int>(info.data.length),
+                       ScriptCompiler::CachedData::BufferOwned)});
+  }
+  return out;
+}
+
+ScriptCompiler::CachedData::CompatibilityCheckResult SetBuiltinCodeCache(
+    IsolateData* isolate_data, const EmbedderBuiltinCodeCache* cache) {
+  if (cache == nullptr) {
+    isolate_data->set_builtin_code_cache({});
+    return ScriptCompiler::CachedData::kSuccess;
+  }
+  auto check = cache->CompatibilityCheck(isolate_data->isolate());
+  if (check == ScriptCompiler::CachedData::kSuccess) {
+    isolate_data->set_builtin_code_cache(cache->impl_->entries);
+  } else {
+    per_process::Debug(DebugCategory::CODE_CACHE,
+                       "EmbedderBuiltinCodeCache rejected: %d\n",
+                       static_cast<int>(check));
+  }
+  return check;
+}
+
 }  // namespace node
 
 NODE_BINDING_PER_ISOLATE_INIT(
diff --git a/src/node_builtins.h b/src/node_builtins.h
index b51b85ff6f23..89fe7f5c1aa7 100644
--- a/src/node_builtins.h
+++ b/src/node_builtins.h
@@ -125,8 +125,16 @@ class NODE_EXTERN_PRIVATE BuiltinLoader {
       v8::Local<v8::Context> context,
       const std::vector<std::string>& lazy_builtins,
       std::vector<CodeCacheInfo>* out);
+  // Adds the given code cache entries, replacing existing entries with the
+  // same id. Can be called more than once (e.g. with the snapshot's code cache
+  // and then with caches an embedder built for further builtin ids).
   void RefreshCodeCache(const std::vector<CodeCacheInfo>& in);
 
+  // Whether builtins compiled without a cache serialize one for later
+  // consumers (worker threads copy it). See
+  // ProcessInitializationFlags::kNoHarvestBuiltinCodeCache.
+  static void SetHarvestCodeCache(bool on);
+
   void CopySourceAndCodeCacheReferenceFrom(const BuiltinLoader* other);
 
   [[nodiscard]] std::ranges::keys_view<
diff --git a/src/node_config_file.cc b/src/node_config_file.cc
index 68c13ad881fc..73d2342d81f1 100644
--- a/src/node_config_file.cc
+++ b/src/node_config_file.cc
@@ -451,7 +451,7 @@ ParseResult ConfigReader::ParseConfigObject(
     }
   }
 
-  // Add implicit flags for namespaces (--test, --permission, --watch)
+  // Add implicit flags for namespaces (--bench, --test, --permission, --watch)
   // These flags are automatically enabled when their namespace is present
   for (const auto& ns : namespaces_with_implicit_flags) {
     std::string flag = "--" + ns;
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index 7d52d835ca4c..e82167b1fb4e 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -48,6 +48,7 @@ namespace crypto {
   V(Hmac)                                                                      \
   V(Keygen)                                                                    \
   V(Keys)                                                                      \
+  V(Mac)                                                                       \
   V(NativeCryptoKey)                                                           \
   V(NativeKeyObject)                                                           \
   V(PBKDF2Job)                                                                 \
diff --git a/src/node_crypto.h b/src/node_crypto.h
index 3bb95cb340d2..f3e006e5fee8 100644
--- a/src/node_crypto.h
+++ b/src/node_crypto.h
@@ -48,6 +48,7 @@
 #endif
 #include "crypto/crypto_keygen.h"
 #include "crypto/crypto_keys.h"
+#include "crypto/crypto_mac.h"
 #include "crypto/crypto_pbkdf2.h"
 #include "crypto/crypto_pqc.h"
 #include "crypto/crypto_random.h"
diff --git a/src/node_errors.cc b/src/node_errors.cc
index 2c464bb895e5..cf000047d38d 100644
--- a/src/node_errors.cc
+++ b/src/node_errors.cc
@@ -191,6 +191,9 @@ static std::string GetErrorSource(Isolate* isolate,
 
 static std::atomic<bool> is_in_oom{false};
 static thread_local std::atomic<bool> is_retrieving_js_stacktrace{false};
+// This is thread-local because it only guards re-entrancy within the current
+// thread's uncaught-exception path; no cross-thread synchronization is needed.
+static thread_local bool is_in_uncaught_exception = false;
 MaybeLocal<StackTrace> GetCurrentStackTrace(Isolate* isolate, int frame_count) {
   if (isolate == nullptr) {
     return MaybeLocal<StackTrace>();
@@ -1302,6 +1305,26 @@ void TriggerUncaughtException(Isolate* isolate,
   CHECK(isolate->InContext());
   Local<Context> context = isolate->GetCurrentContext();
   Environment* env = Environment::GetCurrent(context);
+  // Re-entrancy guard: prevent infinite recursion when the JS-level
+  // exception handler (process._fatalException) itself triggers another
+  // exception through the inspector protocol, causing V8's pending message
+  // reporting to call TriggerUncaughtException reentrantly.
+  if (is_in_uncaught_exception) {
+    PrintToStderrAndFlush(
+        "FATAL ERROR: Re-entrant uncaught exception detected.\n"
+        "The exception handler threw an error while processing a\n"
+        "previous uncaught exception, likely due to an inspector\n"
+        "protocol issue. Aborting to prevent infinite recursion.\n" +
+        FormatCaughtException(isolate, context, error, message));
+    ABORT();
+  }
+  // RAII guard to ensure the flag is cleared when TriggerUncaughtException
+  // returns normally. Note: ABORT() and env->Exit() do not run this
+  // destructor, which is intentional — the process is terminating.
+  struct UncaughtExceptionGuard {
+    UncaughtExceptionGuard() { is_in_uncaught_exception = true; }
+    ~UncaughtExceptionGuard() { is_in_uncaught_exception = false; }
+  } uncaught_exception_guard;
   if (env == nullptr) {
     // This means that the exception happens before Environment is assigned
     // to the context e.g. when there is a SyntaxError in a per-context
diff --git a/src/node_errors.h b/src/node_errors.h
index 62cfba88f00d..cab1dc76dcc7 100644
--- a/src/node_errors.h
+++ b/src/node_errors.h
@@ -62,12 +62,15 @@ void OOMErrorHandler(const char* location, const v8::OOMDetails& details);
   V(ERR_CRYPTO_INVALID_KEYLEN, RangeError)                                     \
   V(ERR_CRYPTO_INVALID_KEYPAIR, RangeError)                                    \
   V(ERR_CRYPTO_INVALID_KEYTYPE, RangeError)                                    \
+  V(ERR_CRYPTO_INVALID_MAC, TypeError)                                         \
   V(ERR_CRYPTO_INVALID_MESSAGELEN, RangeError)                                 \
   V(ERR_CRYPTO_INVALID_SCRYPT_PARAMS, RangeError)                              \
   V(ERR_CRYPTO_INVALID_STATE, Error)                                           \
   V(ERR_CRYPTO_INVALID_TAG_LENGTH, RangeError)                                 \
   V(ERR_CRYPTO_JWK_UNSUPPORTED_CURVE, Error)                                   \
   V(ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE, Error)                                \
+  V(ERR_CRYPTO_MAC_NOT_SUPPORTED, Error)                                       \
+  V(ERR_CRYPTO_MAC_UPDATE_FAILED, Error)                                       \
   V(ERR_CRYPTO_OPERATION_FAILED, Error)                                        \
   V(ERR_CRYPTO_TIMING_SAFE_EQUAL_LENGTH, RangeError)                           \
   V(ERR_CRYPTO_UNKNOWN_CIPHER, Error)                                          \
diff --git a/src/node_ffi.cc b/src/node_ffi.cc
index 7e3da95b958f..88327f1f1c47 100644
--- a/src/node_ffi.cc
+++ b/src/node_ffi.cc
@@ -35,6 +35,7 @@ using v8::MaybeLocal;
 using v8::Object;
 using v8::PropertyAttribute;
 using v8::ReadOnly;
+using v8::Signature;
 using v8::String;
 using v8::TryCatch;
 using v8::Value;
@@ -1238,16 +1239,19 @@ Local<FunctionTemplate> DynamicLibrary::GetConstructorTemplate(
     tmpl = NewFunctionTemplate(isolate, DynamicLibrary::New);
     tmpl->InstanceTemplate()->SetInternalFieldCount(
         DynamicLibrary::kInternalFieldCount);
+    Local<Signature> signature = Signature::New(isolate, tmpl);
 
     tmpl->InstanceTemplate()->SetAccessorProperty(
         env->path_string(),
-        FunctionTemplate::New(env->isolate(), DynamicLibrary::GetPath),
+        FunctionTemplate::New(
+            isolate, DynamicLibrary::GetPath, Local<Value>(), signature),
         Local<FunctionTemplate>(),
         attributes);
 
     tmpl->InstanceTemplate()->SetAccessorProperty(
         FIXED_ONE_BYTE_STRING(isolate, "symbols"),
-        FunctionTemplate::New(env->isolate(), DynamicLibrary::GetSymbols),
+        FunctionTemplate::New(
+            isolate, DynamicLibrary::GetSymbols, Local<Value>(), signature),
         Local<FunctionTemplate>(),
         attributes);
 
@@ -1257,7 +1261,8 @@ Local<FunctionTemplate> DynamicLibrary::GetConstructorTemplate(
     // reason.
     tmpl->PrototypeTemplate()->SetAccessorProperty(
         FIXED_ONE_BYTE_STRING(isolate, "functions"),
-        FunctionTemplate::New(env->isolate(), DynamicLibrary::GetFunctions),
+        FunctionTemplate::New(
+            isolate, DynamicLibrary::GetFunctions, Local<Value>(), signature),
         Local<FunctionTemplate>(),
         static_cast<PropertyAttribute>(ReadOnly));
 
diff --git a/src/node_file.cc b/src/node_file.cc
index b2e765346cf1..b047c5a8e6a7 100644
--- a/src/node_file.cc
+++ b/src/node_file.cc
@@ -64,6 +64,8 @@ namespace node {
 namespace fs {
 
 using v8::Array;
+using v8::ArrayBuffer;
+using v8::ArrayBufferView;
 using v8::BigInt;
 using v8::Context;
 using v8::EscapableHandleScope;
@@ -86,6 +88,8 @@ using v8::ObjectTemplate;
 using v8::Promise;
 using v8::String;
 using v8::TryCatch;
+using v8::Uint32Array;
+using v8::Uint8Array;
 using v8::Undefined;
 using v8::Value;
 
@@ -758,6 +762,12 @@ void NewFSReqCallback(const FunctionCallbackInfo<Value>& args) {
   new FSReqCallback(binding_data, args.This(), args[0]->IsTrue());
 }
 
+void CancelFSReq(const FunctionCallbackInfo<Value>& args) {
+  FSReqBase* req_wrap;
+  ASSIGN_OR_RETURN_UNWRAP(&req_wrap, args.This());
+  req_wrap->Cancel();
+}
+
 FSReqAfterScope::FSReqAfterScope(FSReqBase* wrap, uv_fs_t* req)
     : wrap_(wrap),
       req_(req),
@@ -1828,7 +1838,7 @@ static void RmSync(const FunctionCallbackInfo<Value>& args) {
   }
 
   // On Windows path::c_str() returns wide char, convert to std::string first.
-  std::string file_path_str = file_path.string();
+  std::string file_path_str = ConvertPathToUTF8(file_path);
   const char* path_c_str = file_path_str.c_str();
 #ifdef _WIN32
   int permission_denied_error = EPERM;
@@ -1837,14 +1847,14 @@ static void RmSync(const FunctionCallbackInfo<Value>& args) {
 #endif  // !_WIN32
 
   if (error == std::errc::operation_not_permitted) {
-    std::string message = "Operation not permitted: " + file_path_str;
+    std::string message = "Operation not permitted:";
     return env->ThrowErrnoException(EPERM, "rm", message.c_str(), path_c_str);
   } else if (error == std::errc::directory_not_empty) {
-    std::string message = "Directory not empty: " + file_path_str;
+    std::string message = "Directory not empty:";
     return env->ThrowErrnoException(
         ENOTEMPTY, "rm", message.c_str(), path_c_str);
   } else if (error == std::errc::not_a_directory) {
-    std::string message = "Not a directory: " + file_path_str;
+    std::string message = "Not a directory:";
     return env->ThrowErrnoException(ENOTDIR, "rm", message.c_str(), path_c_str);
 #ifdef _AIX
   } else if (error == std::errc::permission_denied ||
@@ -1855,7 +1865,7 @@ static void RmSync(const FunctionCallbackInfo<Value>& args) {
 #else
   } else if (error == std::errc::permission_denied) {
 #endif
-    std::string message = "Permission denied: " + file_path_str;
+    std::string message = "Permission denied:";
     return env->ThrowErrnoException(
         permission_denied_error, "rm", message.c_str(), path_c_str);
   }
@@ -2252,6 +2262,486 @@ static void ReadDir(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+namespace {
+
+// Recursive readdir.
+//
+// The result is breadth-first: every entry of the root, then every entry of
+// the first subdirectory, and so on, each directory's entries in the order
+// uv_fs_scandir() reports them. Symbolic links to directories are followed,
+// see https://github.com/nodejs/node/issues/52663.
+//
+// The tree is walked by one or more threads that share a queue of
+// directories, and the breadth-first order is derived from the tree
+// afterwards, so it does not depend on which thread scanned what. The walk
+// does not touch the Environment; lib does not use it when the permission
+// model is enabled, as every directory would need a check on the main thread.
+
+// Maps an st_mode to the uv_dirent_type_t that uv_fs_scandir would report.
+uv_dirent_type_t DirentTypeFromMode(uint64_t mode) {
+  switch (mode & S_IFMT) {
+    case S_IFREG:
+      return UV_DIRENT_FILE;
+    case S_IFDIR:
+      return UV_DIRENT_DIR;
+    case S_IFLNK:
+      return UV_DIRENT_LINK;
+    case S_IFCHR:
+      return UV_DIRENT_CHAR;
+#ifdef S_IFIFO
+    case S_IFIFO:
+      return UV_DIRENT_FIFO;
+#endif
+#ifdef S_IFSOCK
+    case S_IFSOCK:
+      return UV_DIRENT_SOCKET;
+#endif
+#ifdef S_IFBLK
+    case S_IFBLK:
+      return UV_DIRENT_BLOCK;
+#endif
+    default:
+      return UV_DIRENT_UNKNOWN;
+  }
+}
+
+// Appends `name` to `path`, with a separator unless `path` already ends in
+// one (so that a root of "dir/" does not turn into "dir//name").
+void AppendPathComponent(std::string* path, std::string_view name) {
+  if (name.empty()) return;
+  if (!path->empty()) {
+#ifdef _WIN32
+    const bool has_separator = path->back() == '\\' || path->back() == '/';
+    if (!has_separator) *path += '\\';
+#else
+    const bool has_separator = path->back() == '/';
+    if (!has_separator) *path += '/';
+#endif
+  }
+  path->append(name);
+}
+
+struct ReadDirEntry {
+  // Offset and length of the name within ScannedDirectory::names.
+  uint32_t name_offset;
+  uint32_t name_length;
+  uint8_t type;  // A uv_dirent_type_t.
+  // Whether the walk descends into this entry (a directory, or a symbolic
+  // link to one).
+  bool is_dir = false;
+};
+
+// One directory of the tree.
+struct ScannedDirectory {
+  explicit ScannedDirectory(std::string relative)
+      : relative(std::move(relative)) {}
+
+  std::string_view name(const ReadDirEntry& entry) const {
+    return std::string_view(names).substr(entry.name_offset, entry.name_length);
+  }
+
+  // Path relative to the root; empty for the root itself.
+  const std::string relative;
+  // The entry names, concatenated.
+  std::string names;
+  std::vector<ReadDirEntry> entries;
+  // Indices (into RecursiveReadDir::dirs()) of the subdirectories, in entry
+  // order.
+  std::vector<uint32_t> subdirs;
+};
+
+class RecursiveReadDir {
+ public:
+  explicit RecursiveReadDir(std::string root) : root_(std::move(root)) {
+    dirs_.push_back(std::make_unique<ScannedDirectory>(""));
+  }
+
+  // Scans directories until none are left or an error occurred. May be
+  // called from several threads at once, which then share the work.
+  void Run();
+  void RunWithHelpers(int max_helpers);
+
+  // The following are only valid once every Run() has returned.
+
+  // 0 or a uv error code; error_path() is then the directory that failed.
+  int error() const { return error_; }
+  const std::string& error_path() const { return error_path_; }
+
+  const std::vector<std::unique_ptr<ScannedDirectory>>& dirs() const {
+    return dirs_;
+  }
+
+  // The indices of dirs() in breadth-first order.
+  std::vector<uint32_t> BreadthFirstOrder() const {
+    std::vector<uint32_t> order;
+    order.reserve(dirs_.size());
+    order.push_back(0);
+    for (size_t i = 0; i < order.size(); i++) {
+      for (uint32_t subdir : dirs_[order[i]]->subdirs) order.push_back(subdir);
+    }
+    return order;
+  }
+
+ private:
+  // Reads the directory at `path` into `dir`, resolving the type of entries
+  // where needed, and creates the ScannedDirectory of each subdirectory.
+  static int Scan(const std::string& path,
+                  ScannedDirectory* dir,
+                  std::vector<std::unique_ptr<ScannedDirectory>>* subdirs);
+
+  // Called with the lock held.
+  void MaybeStartHelper();
+
+  // The number of entries a walk has to have seen, with directories still
+  // to scan, before RunWithHelpers() starts a helper thread.
+  static constexpr size_t kHelperThreshold = 1024;
+
+  const std::string root_;
+
+  Mutex mutex_;
+  ConditionVariable cv_;
+  // Directories in the order they were found; the first next_ have been or
+  // are being scanned by one of the active_ threads.
+  std::vector<std::unique_ptr<ScannedDirectory>> dirs_;
+  size_t next_ = 0;
+  size_t active_ = 0;
+  size_t entries_seen_ = 0;
+  int error_ = 0;
+  std::string error_path_;
+  size_t max_helpers_ = 0;
+  std::vector<uv_thread_t> helpers_;
+};
+
+void RecursiveReadDir::RunWithHelpers(int max_helpers) {
+  max_helpers_ = max_helpers;
+  Run();
+  for (uv_thread_t& helper : helpers_) CHECK_EQ(uv_thread_join(&helper), 0);
+}
+
+void RecursiveReadDir::Run() {
+  std::vector<std::unique_ptr<ScannedDirectory>> subdirs;
+  std::string path;
+  Mutex::ScopedLock lock(mutex_);
+  for (;;) {
+    while (next_ == dirs_.size() && active_ > 0 && error_ == 0) {
+      cv_.Wait(lock);
+    }
+    if (next_ == dirs_.size() || error_ != 0) return;
+
+    ScannedDirectory* dir = dirs_[next_++].get();
+    active_++;
+    int r;
+    {
+      Mutex::ScopedUnlock unlock(lock);
+      path = root_;
+      AppendPathComponent(&path, dir->relative);
+      r = Scan(path, dir, &subdirs);
+    }
+    active_--;
+
+    if (r != 0) {
+      if (error_ == 0) {
+        error_ = r;
+        error_path_ = std::move(path);
+      }
+    } else {
+      for (std::unique_ptr<ScannedDirectory>& subdir : subdirs) {
+        dir->subdirs.push_back(static_cast<uint32_t>(dirs_.size()));
+        dirs_.push_back(std::move(subdir));
+      }
+      entries_seen_ += dir->entries.size();
+    }
+    // Wake the others if there is new work, or nothing left to wait for.
+    if (!subdirs.empty() || active_ == 0 || error_ != 0) cv_.Broadcast(lock);
+    subdirs.clear();
+    MaybeStartHelper();
+  }
+}
+
+void RecursiveReadDir::MaybeStartHelper() {
+  if (helpers_.size() >= max_helpers_ || entries_seen_ < kHelperThreshold ||
+      dirs_.size() - next_ < 2) {
+    return;
+  }
+  uv_thread_t helper;
+  int r = uv_thread_create(
+      &helper,
+      [](void* arg) { static_cast<RecursiveReadDir*>(arg)->Run(); },
+      this);
+  if (r == 0) {
+    helpers_.push_back(helper);
+  } else {
+    max_helpers_ = 0;  // Carry on alone.
+  }
+}
+
+int RecursiveReadDir::Scan(
+    const std::string& path,
+    ScannedDirectory* dir,
+    std::vector<std::unique_ptr<ScannedDirectory>>* subdirs) {
+  uv_fs_t req;
+  int r = uv_fs_scandir(nullptr, &req, path.c_str(), 0, nullptr);
+  if (r >= 0) {
+    dir->entries.reserve(r);
+    uv_dirent_t ent;
+    while ((r = uv_fs_scandir_next(&req, &ent)) == 0) {
+      const size_t length = strlen(ent.name);
+      dir->entries.push_back({static_cast<uint32_t>(dir->names.size()),
+                              static_cast<uint32_t>(length),
+                              static_cast<uint8_t>(ent.type)});
+      dir->names.append(ent.name, length);
+    }
+    if (r == UV_EOF) r = 0;
+  }
+  uv_fs_req_cleanup(&req);
+  if (r != 0) return r;
+
+  std::string child;
+  for (ReadDirEntry& entry : dir->entries) {
+    const std::string_view name = dir->name(entry);
+    if (entry.type == UV_DIRENT_UNKNOWN || entry.type == UV_DIRENT_LINK) {
+      // The file system did not report a type, or the entry is a symbolic
+      // link that may point at a directory.
+      child = path;
+      AppendPathComponent(&child, name);
+      if (entry.type == UV_DIRENT_UNKNOWN) {
+        if (uv_fs_lstat(nullptr, &req, child.c_str(), nullptr) == 0) {
+          entry.type = DirentTypeFromMode(req.statbuf.st_mode);
+        }
+        uv_fs_req_cleanup(&req);
+      }
+      if (entry.type == UV_DIRENT_LINK) {
+        if (uv_fs_stat(nullptr, &req, child.c_str(), nullptr) == 0) {
+          entry.is_dir = S_ISDIR(req.statbuf.st_mode);
+        }
+        uv_fs_req_cleanup(&req);
+      }
+    }
+    if (entry.type == UV_DIRENT_DIR) entry.is_dir = true;
+
+    if (entry.is_dir) {
+      std::string relative = dir->relative;
+      AppendPathComponent(&relative, name);
+      subdirs->push_back(
+          std::make_unique<ScannedDirectory>(std::move(relative)));
+    }
+  }
+  return 0;
+}
+
+// Without file types the result is an array of paths relative to the root.
+// With file types it is [names, types, counts, dirs]: `types` is a
+// Uint8Array with the uv_dirent_type_t of every entry, `dirs` the relative
+// path of every directory in the order their entries appear, and `counts` a
+// Uint32Array with the number of entries in each of those directories. See
+// getRecursiveDirents() in lib/internal/fs/utils.js.
+MaybeLocal<Value> MarshalRecursiveReadDir(Isolate* isolate,
+                                          const RecursiveReadDir& walk,
+                                          enum encoding encoding,
+                                          bool with_types) {
+  EscapableHandleScope scope(isolate);
+  const std::vector<uint32_t> order = walk.BreadthFirstOrder();
+
+  LocalVector<Value> names(isolate);
+  LocalVector<Value> dirs(isolate);
+  std::vector<uint8_t> types;
+  std::vector<uint32_t> counts;
+  std::string path;
+  for (uint32_t index : order) {
+    const ScannedDirectory& dir = *walk.dirs()[index];
+    for (const ReadDirEntry& entry : dir.entries) {
+      std::string_view data = dir.name(entry);
+      if (!with_types) {
+        path = dir.relative;
+        AppendPathComponent(&path, data);
+        data = path;
+      }
+      Local<Value> name;
+      if (!StringBytes::Encode(isolate, data.data(), data.size(), encoding)
+               .ToLocal(&name)) {
+        return MaybeLocal<Value>();
+      }
+      names.push_back(name);
+      types.push_back(entry.type);
+    }
+    if (!with_types) continue;
+    counts.push_back(static_cast<uint32_t>(dir.entries.size()));
+    Local<Value> relative;
+    if (!StringBytes::Encode(
+             isolate, dir.relative.data(), dir.relative.size(), encoding)
+             .ToLocal(&relative)) {
+      return MaybeLocal<Value>();
+    }
+    dirs.push_back(relative);
+  }
+
+  if (!with_types) {
+    return scope.Escape(Array::New(isolate, names.data(), names.size()));
+  }
+
+  // One ArrayBuffer holding the types, then (4-byte aligned) the counts.
+  const size_t counts_offset = (types.size() + 3) & ~static_cast<size_t>(3);
+  Local<ArrayBuffer> ab = ArrayBuffer::New(
+      isolate, counts_offset + counts.size() * sizeof(uint32_t));
+  char* bytes = static_cast<char*>(ab->Data());
+  memcpy(bytes, types.data(), types.size());
+  memcpy(
+      bytes + counts_offset, counts.data(), counts.size() * sizeof(uint32_t));
+
+  Local<Value> parts[] = {
+      Array::New(isolate, names.data(), names.size()),
+      Uint8Array::New(ab, 0, types.size()),
+      Uint32Array::New(ab, counts_offset, counts.size()),
+      Array::New(isolate, dirs.data(), dirs.size()),
+  };
+  return scope.Escape(Array::New(isolate, parts, arraysize(parts)));
+}
+
+// The number of thread pool work items that share an asynchronous walk, and
+// the number of helper threads a synchronous walk may start.
+constexpr int kReadDirRecursiveWorkers = 4;
+constexpr int kReadDirRecursiveSyncHelpers = kReadDirRecursiveWorkers - 1;
+
+// An asynchronous recursive readdir: the walk, and the request it settles
+// once every worker has finished.
+class ReadDirRecursiveRequest {
+ public:
+  ReadDirRecursiveRequest(Environment* env,
+                          FSReqBase* req_wrap,
+                          std::string path,
+                          enum encoding encoding,
+                          bool with_types,
+                          int workers)
+      : env_(env),
+        req_wrap_(req_wrap),
+        walk_(std::move(path)),
+        encoding_(encoding),
+        with_types_(with_types),
+        pending_(workers) {}
+
+  RecursiveReadDir* walk() { return &walk_; }
+
+  // Called on the main thread when a worker is done.
+  void OnWorkerDone(int status) {
+    CHECK(status == 0 || status == UV_ECANCELED);
+    if (status == UV_ECANCELED) cancelled_ = true;
+    if (--pending_ > 0) return;
+
+    Isolate* isolate = env_->isolate();
+    HandleScope handle_scope(isolate);
+    Context::Scope context_scope(env_->context());
+
+    // Release the request even if the environment is shutting down.
+    BaseObjectPtr<FSReqBase> req_wrap = std::move(req_wrap_);
+    req_wrap->Detach();
+
+    FS_ASYNC_TRACE_END1(UV_FS_SCANDIR, req_wrap.get(), "result", walk_.error())
+    if (cancelled_ || !env_->can_call_into_js()) return;
+
+    if (walk_.error() != 0) {
+      return req_wrap->Reject(UVException(isolate,
+                                          walk_.error(),
+                                          "scandir",
+                                          nullptr,
+                                          walk_.error_path().c_str()));
+    }
+
+    Local<Value> value;
+    TryCatch try_catch(isolate);
+    if (!MarshalRecursiveReadDir(isolate, walk_, encoding_, with_types_)
+             .ToLocal(&value)) {
+      CHECK(try_catch.CanContinue());
+      return req_wrap->Reject(try_catch.Exception());
+    }
+    req_wrap->Resolve(value);
+  }
+
+ private:
+  Environment* const env_;
+  BaseObjectPtr<FSReqBase> req_wrap_;
+  RecursiveReadDir walk_;
+  const enum encoding encoding_;
+  const bool with_types_;
+  int pending_;
+  bool cancelled_ = false;
+};
+
+class ReadDirRecursiveWork final : public ThreadPoolWork {
+ public:
+  ReadDirRecursiveWork(Environment* env,
+                       std::shared_ptr<ReadDirRecursiveRequest> request)
+      : ThreadPoolWork(env, "readdir_recursive"),
+        request_(std::move(request)) {}
+
+  void DoThreadPoolWork() override { request_->walk()->Run(); }
+
+  void AfterThreadPoolWork(int status) override {
+    std::unique_ptr<ReadDirRecursiveWork> self(this);
+    request_->OnWorkerDone(status);
+  }
+
+ private:
+  std::shared_ptr<ReadDirRecursiveRequest> request_;
+};
+
+}  // namespace
+
+// readdirRecursive(path, encoding, withTypes[, req])
+static void ReadDirRecursive(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  Isolate* isolate = env->isolate();
+
+  const int argc = args.Length();
+  CHECK_GE(argc, 3);
+
+  BufferValue path(isolate, args[0]);
+  CHECK_NOT_NULL(*path);
+  ToNamespacedPath(env, &path);
+
+  const enum encoding encoding = ParseEncoding(isolate, args[1], UTF8);
+
+  bool with_types = args[2]->IsTrue();
+
+  // Every directory would need a permission check, and only the main thread
+  // can do those: lib walks the tree in JS when the permission model is on.
+  CHECK(!env->permission()->enabled());
+
+  if (argc > 3) {  // readdirRecursive(path, encoding, withTypes, req)
+    FSReqBase* req_wrap_async = GetReqWrap(args, 3);
+    CHECK_NOT_NULL(req_wrap_async);
+    req_wrap_async->Init("scandir", nullptr, 0, encoding);
+    FS_ASYNC_TRACE_BEGIN1(
+        UV_FS_SCANDIR, req_wrap_async, "path", TRACE_STR_COPY(*path))
+    auto request =
+        std::make_shared<ReadDirRecursiveRequest>(env,
+                                                  req_wrap_async,
+                                                  path.ToString(),
+                                                  encoding,
+                                                  with_types,
+                                                  kReadDirRecursiveWorkers);
+    for (int i = 0; i < kReadDirRecursiveWorkers; i++) {
+      (new ReadDirRecursiveWork(env, request))->ScheduleWork();
+    }
+  } else {  // readdirRecursive(path, encoding, withTypes)
+    env->PrintSyncTrace();
+    FS_SYNC_TRACE_BEGIN(readdir);
+    RecursiveReadDir walk(path.ToString());
+    walk.RunWithHelpers(kReadDirRecursiveSyncHelpers);
+    FS_SYNC_TRACE_END(readdir);
+
+    if (walk.error() != 0) {
+      return env->ThrowUVException(
+          walk.error(), "scandir", nullptr, walk.error_path().c_str());
+    }
+
+    Local<Value> value;
+    if (MarshalRecursiveReadDir(isolate, walk, encoding, with_types)
+            .ToLocal(&value)) {
+      args.GetReturnValue().Set(value);
+    }
+  }
+}
+
 static inline Maybe<void> AsyncCheckOpenPermissions(Environment* env,
                                                     FSReqBase* req_wrap,
                                                     const BufferValue& path,
@@ -3214,6 +3704,7 @@ class ReadFileJob final : public AsyncWrap, public ThreadPoolWork {
   SET_SELF_SIZE(ReadFileJob)
 
  private:
+  friend class WriteFileJob;
   static constexpr size_t kUnknownSizeChunk = 64 * 1024;
   static constexpr size_t kMaxReadChunk = 256 * 1024 * 1024;
 
@@ -3297,6 +3788,162 @@ class ReadFileJob final : public AsyncWrap, public ThreadPoolWork {
   int fd_ = -1;
 };
 
+// Writes a whole buffer to a file in ONE thread pool round trip -- open +
+// write (until everything is written) + close -- for fs.writeFile() and
+// fs.promises.writeFile() with a path, which otherwise pay one round trip per
+// step.
+//
+// JS: const job = new WriteFileJob(path, flags, mode, buffer);
+//     job.ondone = (err) => {...}; job.run(path);
+// `err` carries the syscall that failed ('open', 'write' or 'close'); the file
+// descriptor opened here is always closed.
+class WriteFileJob final : public AsyncWrap, public ThreadPoolWork {
+ public:
+  static void New(const FunctionCallbackInfo<Value>& args) {
+    CHECK(args.IsConstructCall());
+    Environment* env = Environment::GetCurrent(args);
+    CHECK_GE(args.Length(), 4);
+    BufferValue path(env->isolate(), args[0]);
+    CHECK_NOT_NULL(*path);
+    ToNamespacedPath(env, &path);
+    CHECK(args[1]->IsInt32());
+    CHECK(args[2]->IsInt32());
+    CHECK(args[3]->IsArrayBufferView());
+    new WriteFileJob(env,
+                     args.This(),
+                     path.ToString(),
+                     args[1].As<Int32>()->Value(),
+                     args[2].As<Int32>()->Value(),
+                     args[3].As<ArrayBufferView>());
+  }
+
+  // Returns undefined when the job was scheduled, or the ERR_ACCESS_DENIED
+  // error the asynchronous open() would have delivered (nothing is scheduled).
+  static void Run(const FunctionCallbackInfo<Value>& args) {
+    WriteFileJob* job;
+    ASSIGN_OR_RETURN_UNWRAP(&job, args.This());
+    Environment* env = job->AsyncWrap::env();
+    CHECK(!job->scheduled_);
+    BufferValue path(env->isolate(), args[0]);
+    CHECK_NOT_NULL(*path);
+    ToNamespacedPath(env, &path);
+    Local<Value> access_error;
+    if (ReadFileJob::OpenPermissionError(env, path, job->flags_)
+            .ToLocal(&access_error)) {
+      args.GetReturnValue().Set(access_error);
+      return;
+    }
+    job->scheduled_ = true;
+    job->ClearWeak();
+    FS_ASYNC_TRACE_BEGIN0(UV_FS_WRITE, job)
+    job->ScheduleWork();
+  }
+
+  void DoThreadPoolWork() override {
+    uv_fs_t req;
+    int fd = uv_fs_open(nullptr, &req, path_.c_str(), flags_, mode_, nullptr);
+    uv_fs_req_cleanup(&req);
+    if (fd < 0) return Fail("open", fd);
+
+    size_t written = 0;
+    while (written < length_) {
+      uv_buf_t buf = uv_buf_init(data_ + written,
+                                 static_cast<unsigned int>(std::min<size_t>(
+                                     length_ - written, kMaxWriteChunk)));
+      int r = uv_fs_write(nullptr, &req, fd, &buf, 1, -1, nullptr);
+      uv_fs_req_cleanup(&req);
+      if (r < 0) {
+        Fail("write", r);
+        break;
+      }
+      written += static_cast<size_t>(r);
+    }
+
+    int rc = uv_fs_close(nullptr, &req, fd, nullptr);
+    uv_fs_req_cleanup(&req);
+    if (rc < 0 && error_ == 0) Fail("close", rc);
+  }
+
+  void AfterThreadPoolWork(int status) override {
+    Environment* env = AsyncWrap::env();
+    std::unique_ptr<WriteFileJob> self(this);
+    CHECK(status == 0 || status == UV_ECANCELED);
+    FS_ASYNC_TRACE_END0(UV_FS_WRITE, this)
+    if (status == UV_ECANCELED || !env->can_call_into_js()) return;
+    HandleScope handle_scope(env->isolate());
+    Context::Scope context_scope(env->context());
+    Isolate* isolate = env->isolate();
+    Local<Value> argv[1] = {Null(isolate)};
+    if (error_ != 0) {
+      argv[0] = UVException(isolate,
+                            error_,
+                            syscall_,
+                            nullptr,
+                            syscall_ == kOpen ? path_.c_str() : nullptr);
+    }
+    MakeCallback(env->ondone_string(), arraysize(argv), argv);
+  }
+
+  bool IsNotIndicativeOfMemoryLeakAtExit() const override { return true; }
+  void MemoryInfo(MemoryTracker* tracker) const override {
+    tracker->TrackField("buffer", buffer_);
+    if (copy_) tracker->TrackFieldWithSize("copy", length_);
+  }
+  SET_MEMORY_INFO_NAME(WriteFileJob)
+  SET_SELF_SIZE(WriteFileJob)
+
+ private:
+  static constexpr size_t kMaxWriteChunk = 256 * 1024 * 1024;
+  static constexpr const char* kOpen = "open";
+
+  WriteFileJob(Environment* env,
+               Local<Object> object,
+               std::string&& path,
+               int flags,
+               int mode,
+               Local<ArrayBufferView> view)
+      : AsyncWrap(env, object, AsyncWrap::PROVIDER_FSREQCALLBACK),
+        ThreadPoolWork(env, "fs.writefile"),
+        path_(std::move(path)),
+        flags_(flags),
+        mode_(mode) {
+    // Holding the backing store keeps the memory valid even if the buffer is
+    // detached or collected meanwhile; a resizable buffer can still have its
+    // pages decommitted by a shrink, so its contents are copied instead.
+    length_ = view->ByteLength();
+    backing_store_ = view->Buffer()->GetBackingStore();
+    if (backing_store_->IsResizableByUserJavaScript()) {
+      copy_.reset(new char[length_]);
+      memcpy(copy_.get(),
+             static_cast<char*>(backing_store_->Data()) + view->ByteOffset(),
+             length_);
+      data_ = copy_.get();
+      backing_store_.reset();
+    } else {
+      buffer_.Reset(env->isolate(), view);
+      data_ = static_cast<char*>(backing_store_->Data()) + view->ByteOffset();
+    }
+    MakeWeak();
+  }
+
+  void Fail(const char* syscall, int error) {
+    syscall_ = syscall;
+    error_ = error;
+  }
+
+  const std::string path_;
+  v8::Global<v8::ArrayBufferView> buffer_;
+  std::shared_ptr<v8::BackingStore> backing_store_;
+  std::unique_ptr<char[]> copy_;
+  char* data_ = nullptr;
+  size_t length_ = 0;
+  const int flags_;
+  const int mode_;
+  bool scheduled_ = false;
+  int error_ = 0;
+  const char* syscall_ = nullptr;
+};
+
 // Wrapper for readv(2).
 //
 // bytesRead = fs.readv(fd, buffers[, position], callback)
@@ -3942,217 +4589,266 @@ static void CpSyncCheckPaths(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
-static bool CopyUtimes(const std::filesystem::path& src,
-                       const std::filesystem::path& dest,
-                       Environment* env) {
-  uv_fs_t req;
-  auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
-
-  auto src_path_str = ConvertPathToUTF8(src);
-  int result = uv_fs_stat(nullptr, &req, src_path_str.c_str(), nullptr);
-  if (is_uv_error(result)) {
-    env->ThrowUVException(result, "stat", nullptr, src_path_str.c_str());
-    return false;
+std::vector<std::string> normalizePathToArray(
+    const std::filesystem::path& path) {
+  std::vector<std::string> parts;
+  std::error_code error;
+  std::filesystem::path absPath = std::filesystem::absolute(path, error);
+  if (error) absPath = path;
+#ifdef _WIN32
+  auto wstr = absPath.wstring();
+  if (wstr.starts_with(L"\\\\?\\")) {
+    absPath = std::filesystem::path(wstr.substr(4));
   }
+#endif
+  for (const auto& part : absPath) {
+    if (!part.empty()) parts.push_back(part.string());
+  }
+  return parts;
+}
 
-  const uv_stat_t* const s = static_cast<const uv_stat_t*>(req.ptr);
-  const double source_atime = s->st_atim.tv_sec + s->st_atim.tv_nsec / 1e9;
-  const double source_mtime = s->st_mtim.tv_sec + s->st_mtim.tv_nsec / 1e9;
-
-  auto dest_file_path_str = ConvertPathToUTF8(dest);
-  int utime_result = uv_fs_utime(nullptr,
-                                 &req,
-                                 dest_file_path_str.c_str(),
-                                 source_atime,
-                                 source_mtime,
-                                 nullptr);
-  if (is_uv_error(utime_result)) {
-    env->ThrowUVException(
-        utime_result, "utime", nullptr, dest_file_path_str.c_str());
-    return false;
-  }
-  return true;
+bool isInsideDir(const std::filesystem::path& src,
+                 const std::filesystem::path& dest) {
+  auto srcArr = normalizePathToArray(src);
+  auto destArr = normalizePathToArray(dest);
+  if (srcArr.size() > destArr.size()) return false;
+  return std::equal(srcArr.begin(), srcArr.end(), destArr.begin());
 }
 
-static void CpSyncOverrideFile(const FunctionCallbackInfo<Value>& args) {
-  Environment* env = Environment::GetCurrent(args);
-  Isolate* isolate = env->isolate();
-
-  CHECK_EQ(args.Length(), 4);  // src, dest, mode, preserveTimestamps
-
-  BufferValue src(isolate, args[0]);
-  CHECK_NOT_NULL(*src);
-  ToNamespacedPath(env, &src);
+namespace {
 
-  BufferValue dest(isolate, args[1]);
-  CHECK_NOT_NULL(*dest);
-  ToNamespacedPath(env, &dest);
+// An fs.cp error recorded on whatever thread performed the copy; Throw() /
+// ToException() turn it into the error the JavaScript caller sees.
+struct CpError {
+  enum Kind {
+    kNone,
+    kErrno,
+    kUv,
+    kEinval,
+    kSymlinkToSubdirectory,
+    kEexist,
+    kSocket,
+    kFifo,
+    kUnknown
+  };
+  Kind kind = kNone;
+  int code = 0;
+  const char* syscall = "cp";
+  std::string message;
+  std::string path;
 
-  int mode;
-  if (!GetValidFileMode(env, args[2], UV_FS_COPYFILE).To(&mode)) {
-    return;
+  static CpError Std(const std::error_code& error, const std::string& path) {
+    return {kErrno, error.value(), "cp", error.message(), path};
+  }
+  static CpError Uv(int code, const char* syscall, const std::string& path) {
+    return {kUv, code, syscall, {}, path};
   }
 
-  bool preserve_timestamps = args[3]->IsTrue();
-
-  THROW_IF_INSUFFICIENT_PERMISSIONS(
-      env, permission::PermissionScope::kFileSystemRead, src.ToStringView());
-  THROW_IF_INSUFFICIENT_PERMISSIONS(
-      env, permission::PermissionScope::kFileSystemWrite, dest.ToStringView());
+  Local<Value> ToException(Environment* env) const {
+    Isolate* isolate = env->isolate();
+    switch (kind) {
+      case kErrno:
+        return ErrnoException(
+            isolate, code, syscall, message.c_str(), path.c_str());
+      case kUv:
+        return UVException(isolate, code, syscall, nullptr, path.c_str());
+      case kEinval:
+        return ERR_FS_CP_EINVAL(isolate, "%s", message);
+      case kSymlinkToSubdirectory:
+        return ERR_FS_CP_SYMLINK_TO_SUBDIRECTORY(isolate, "%s", message);
+      case kEexist:
+        return ERR_FS_CP_EEXIST(isolate, "%s", message);
+      // Sockets, FIFOs and unknown entries are reported to JS by kind and
+      // path (see CpDirJob), cpSync skips them; neither builds an error here.
+      case kSocket:
+      case kFifo:
+      case kUnknown:
+      case kNone:
+        break;
+    }
+    UNREACHABLE();
+  }
 
-  auto src_path = src.ToPath();
-  auto dest_path = dest.ToPath();
+  void Throw(Environment* env) const {
+    env->isolate()->ThrowException(ToException(env));
+  }
+};
 
-  std::error_code error;
+CpError CopyUtimes(const std::filesystem::path& src,
+                   const std::filesystem::path& dest) {
+  uv_fs_t req;
+  auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
 
-  if (!std::filesystem::remove(dest_path, error)) {
-    return env->ThrowStdErrException(error, "unlink", *dest);
+  auto src_path_str = ConvertPathToUTF8(src);
+  int result = uv_fs_stat(nullptr, &req, src_path_str.c_str(), nullptr);
+  if (is_uv_error(result)) {
+    return CpError::Uv(result, "stat", src_path_str);
   }
 
-  if (mode == 0) {
-    // if no mode is specified use the faster std::filesystem API
-    if (!std::filesystem::copy_file(src_path, dest_path, error)) {
-      return env->ThrowStdErrException(error, "cp", *dest);
-    }
-  } else {
-    uv_fs_t req;
-    auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
-    auto result = uv_fs_copyfile(nullptr, &req, *src, *dest, mode, nullptr);
-    if (is_uv_error(result)) {
-      return env->ThrowUVException(result, "cp", nullptr, *src, *dest);
-    }
-  }
+  const uv_stat_t* const s = static_cast<const uv_stat_t*>(req.ptr);
+  const double source_atime = s->st_atim.tv_sec + s->st_atim.tv_nsec / 1e9;
+  const double source_mtime = s->st_mtim.tv_sec + s->st_mtim.tv_nsec / 1e9;
 
-  if (preserve_timestamps) {
-    CopyUtimes(src_path, dest_path, env);
+  auto dest_file_path_str = ConvertPathToUTF8(dest);
+  int utime_result = uv_fs_utime(nullptr,
+                                 &req,
+                                 dest_file_path_str.c_str(),
+                                 source_atime,
+                                 source_mtime,
+                                 nullptr);
+  if (is_uv_error(utime_result)) {
+    return CpError::Uv(utime_result, "utime", dest_file_path_str);
   }
+  return {};
 }
 
-std::vector<std::string> normalizePathToArray(
-    const std::filesystem::path& path) {
-  std::vector<std::string> parts;
-  std::filesystem::path absPath = std::filesystem::absolute(path);
-#ifdef _WIN32
-  auto wstr = absPath.wstring();
-  if (wstr.starts_with(L"\\\\?\\")) {
-    absPath = std::filesystem::path(wstr.substr(4));
-  }
-#endif
-  for (const auto& part : absPath) {
-    if (!part.empty()) parts.push_back(part.string());
+struct CpDirOptions {
+  bool force;
+  bool dereference;
+  bool error_on_exist;
+  bool verbatim_symlinks;
+  bool preserve_timestamps;
+  // Set for fs.cp(), which only takes this path for a destination that did
+  // not exist: nothing already present is ever opened for writing or
+  // followed. Directories are created with mkdir() and files with an
+  // exclusive uv_fs_copyfile(), so anything that appears in their place
+  // (a symbolic link included) is EEXIST; sockets, FIFOs and unknown
+  // entries are rejected as the JavaScript walk does; relative link targets
+  // are resolved lexically, as path.resolve() would. fs.cpSync() merges
+  // into existing directories, skips those entries and canonicalizes link
+  // targets.
+  bool fresh_destination;
+  // fs.copyFile() mode flags (COPYFILE_FICLONE etc.) for fresh_destination.
+  int copyfile_flags;
+};
+
+CpError CopyFileFresh(const std::filesystem::path& src,
+                      const std::filesystem::path& dest,
+                      int flags) {
+  uv_fs_t req;
+  auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
+  auto src_str = ConvertPathToUTF8(src);
+  auto dest_str = ConvertPathToUTF8(dest);
+  int rc = uv_fs_copyfile(nullptr,
+                          &req,
+                          src_str.c_str(),
+                          dest_str.c_str(),
+                          flags | UV_FS_COPYFILE_EXCL,
+                          nullptr);
+  if (rc < 0) {
+    return CpError::Uv(rc, "copyfile", dest_str);
   }
-  return parts;
+  return {};
 }
 
-bool isInsideDir(const std::filesystem::path& src,
-                 const std::filesystem::path& dest) {
-  auto srcArr = normalizePathToArray(src);
-  auto destArr = normalizePathToArray(dest);
-  if (srcArr.size() > destArr.size()) return false;
-  return std::equal(srcArr.begin(), srcArr.end(), destArr.begin());
+// mkdir() that does not follow or accept anything already at `path`.
+CpError MakeFreshDirectory(const std::filesystem::path& path) {
+  uv_fs_t req;
+  auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
+  auto path_str = ConvertPathToUTF8(path);
+  int rc = uv_fs_mkdir(nullptr, &req, path_str.c_str(), 0777, nullptr);
+  if (rc < 0) {
+    return CpError::Uv(rc, "mkdir", path_str);
+  }
+  return {};
 }
 
-static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
-  CHECK_EQ(args.Length(), 7);  // src, dest, force, dereference, errorOnExist,
-                               // verbatimSymlinks, preserveTimestamps
-
-  Environment* env = Environment::GetCurrent(args);
-  Isolate* isolate = env->isolate();
-
-  BufferValue src(isolate, args[0]);
-  CHECK_NOT_NULL(*src);
-  ToNamespacedPath(env, &src);
-
-  BufferValue dest(isolate, args[1]);
-  CHECK_NOT_NULL(*dest);
-  ToNamespacedPath(env, &dest);
-
-  bool force = args[2]->IsTrue();
-  bool dereference = args[3]->IsTrue();
-  bool error_on_exist = args[4]->IsTrue();
-  bool verbatim_symlinks = args[5]->IsTrue();
-  bool preserve_timestamps = args[6]->IsTrue();
-
-  auto src_path = src.ToPath();
-  auto dest_path = dest.ToPath();
-
+// The recursive directory copy behind fs.cpSync() and, on the thread pool,
+// fs.cp()/fsPromises.cp() when no filter function is involved. Runs on any
+// thread; touches no JS.
+CpError CopyDirRecursive(const std::filesystem::path& src_path,
+                         const std::filesystem::path& dest_path,
+                         const std::string& dest_display,
+                         const CpDirOptions& options) {
   std::error_code error;
-  std::filesystem::create_directories(dest_path, error);
-  if (error) {
-    return env->ThrowStdErrException(error, "cp", *dest);
+  bool dest_existed = false;
+  if (options.fresh_destination) {
+    CpError made = MakeFreshDirectory(dest_path);
+    if (made.kind != CpError::kNone) return made;
+  } else {
+    dest_existed = std::filesystem::exists(dest_path, error);
+    std::filesystem::create_directories(dest_path, error);
+    if (error) {
+      return CpError::Std(error, dest_display);
+    }
   }
 
   auto file_copy_opts = std::filesystem::copy_options::recursive;
-  if (force) {
+  if (options.force) {
     file_copy_opts |= std::filesystem::copy_options::overwrite_existing;
-  } else if (error_on_exist) {
+  } else if (options.error_on_exist) {
     file_copy_opts |= std::filesystem::copy_options::none;
   } else {
     file_copy_opts |= std::filesystem::copy_options::skip_existing;
   }
 
-  std::function<bool(std::filesystem::path, std::filesystem::path)>
+  std::function<CpError(std::filesystem::path, std::filesystem::path)>
       copy_dir_contents;
-  copy_dir_contents = [verbatim_symlinks,
-                       &copy_dir_contents,
-                       &env,
-                       file_copy_opts,
-                       preserve_timestamps,
-                       force,
-                       error_on_exist,
-                       dereference,
-                       &isolate](std::filesystem::path src,
-                                 std::filesystem::path dest) {
+  copy_dir_contents = [&options, &copy_dir_contents, file_copy_opts](
+                          std::filesystem::path src,
+                          std::filesystem::path dest) -> CpError {
     std::error_code error;
-    for (auto dir_entry : std::filesystem::directory_iterator(src)) {
+    // Only the error_code overloads are used from here on: this runs on a
+    // thread pool thread and exceptions are disabled.
+    auto it = std::filesystem::directory_iterator(src, error);
+    if (error) {
+      return CpError::Std(error, ConvertPathToUTF8(src));
+    }
+    for (const auto end = std::filesystem::directory_iterator(); it != end;
+         it.increment(error)) {
+      if (error) {
+        return CpError::Std(error, ConvertPathToUTF8(src));
+      }
+      const auto& dir_entry = *it;
       auto dest_file_path = dest / dir_entry.path().filename();
       auto dest_str = ConvertPathToUTF8(dest);
 
-      if (dir_entry.is_symlink()) {
-        if (verbatim_symlinks) {
+      if (dir_entry.is_symlink(error)) {
+        if (options.verbatim_symlinks) {
           std::filesystem::copy_symlink(
               dir_entry.path(), dest_file_path, error);
           if (error) {
-            env->ThrowStdErrException(error, "cp", dest_str.c_str());
-            return false;
+            return CpError::Std(error, dest_str);
           }
         } else {
           auto symlink_target =
               std::filesystem::read_symlink(dir_entry.path().c_str(), error);
           if (error) {
-            env->ThrowStdErrException(error, "cp", dest_str.c_str());
-            return false;
+            return CpError::Std(error, dest_str);
           }
 
-          if (std::filesystem::exists(dest_file_path)) {
-            if (std::filesystem::is_symlink((dest_file_path.c_str()))) {
+          if (std::filesystem::exists(dest_file_path, error)) {
+            if (std::filesystem::is_symlink(dest_file_path, error)) {
               auto current_dest_symlink_target =
                   std::filesystem::read_symlink(dest_file_path.c_str(), error);
               if (error) {
-                env->ThrowStdErrException(error, "cp", dest_str.c_str());
-                return false;
+                return CpError::Std(error, dest_str);
               }
 
-              if (!dereference &&
-                  std::filesystem::is_directory(symlink_target) &&
+              if (!options.dereference &&
+                  std::filesystem::is_directory(symlink_target, error) &&
                   isInsideDir(symlink_target, current_dest_symlink_target)) {
-                static constexpr const char* message =
-                    "Cannot copy %s to a subdirectory of self %s";
-                THROW_ERR_FS_CP_EINVAL(
-                    env, message, symlink_target, current_dest_symlink_target);
-                return false;
+                return {CpError::kEinval,
+                        0,
+                        "cp",
+                        SPrintF("Cannot copy %s to a subdirectory of self %s",
+                                symlink_target,
+                                current_dest_symlink_target),
+                        {}};
               }
 
               // Prevent copy if src is a subdir of dest since unlinking
               // dest in this case would result in removing src contents
               // and therefore a broken symlink would be created.
-              if (std::filesystem::is_directory(dest_file_path) &&
+              if (std::filesystem::is_directory(dest_file_path, error) &&
                   isInsideDir(current_dest_symlink_target, symlink_target)) {
-                static constexpr const char* message =
-                    "cannot overwrite %s with %s";
-                THROW_ERR_FS_CP_SYMLINK_TO_SUBDIRECTORY(
-                    env, message, current_dest_symlink_target, symlink_target);
-                return false;
+                return {CpError::kSymlinkToSubdirectory,
+                        0,
+                        "cp",
+                        SPrintF("cannot overwrite %s with %s",
+                                current_dest_symlink_target,
+                                symlink_target),
+                        {}};
               }
 
               // symlinks get overridden by cp even if force: false, this is
@@ -4160,29 +4856,40 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
               // correct? or is it a bug?
               std::filesystem::remove(dest_file_path, error);
               if (error) {
-                env->ThrowStdErrException(error, "cp", dest_str.c_str());
-                return false;
+                return CpError::Std(error, dest_str);
               }
-            } else if (std::filesystem::is_regular_file(dest_file_path)) {
-              if (!dereference || (!force && error_on_exist)) {
-                auto dest_file_path_str = ConvertPathToUTF8(dest_file_path);
-                env->ThrowStdErrException(
+            } else if (std::filesystem::is_regular_file(dest_file_path,
+                                                        error)) {
+              if (!options.dereference ||
+                  (!options.force && options.error_on_exist)) {
+                return CpError::Std(
                     std::make_error_code(std::errc::file_exists),
-                    "cp",
-                    dest_file_path_str.c_str());
-                return false;
+                    ConvertPathToUTF8(dest_file_path));
               }
             }
           }
-          auto symlink_target_absolute = std::filesystem::weakly_canonical(
-              std::filesystem::absolute(src / symlink_target));
+          std::filesystem::path symlink_target_absolute;
+          if (options.fresh_destination) {
+            // As path.resolve() does: lexical only, absolute targets verbatim.
+            symlink_target_absolute =
+                symlink_target.is_absolute()
+                    ? symlink_target
+                    : std::filesystem::absolute(src / symlink_target, error)
+                          .lexically_normal();
+          } else {
+            symlink_target_absolute = std::filesystem::weakly_canonical(
+                std::filesystem::absolute(src / symlink_target, error), error);
+          }
+          if (error) {
+            return CpError::Std(error, dest_str);
+          }
 #ifdef _WIN32
           auto wstr = symlink_target_absolute.wstring();
           if (wstr.starts_with(L"\\\\?\\")) {
             symlink_target_absolute = std::filesystem::path(wstr.substr(4));
           }
 #endif
-          if (dir_entry.is_directory()) {
+          if (dir_entry.is_directory(error)) {
             std::filesystem::create_directory_symlink(
                 symlink_target_absolute, dest_file_path, error);
           } else {
@@ -4190,44 +4897,297 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
                 symlink_target_absolute, dest_file_path, error);
           }
           if (error) {
-            env->ThrowStdErrException(error, "cp", dest_str.c_str());
-            return false;
+            return CpError::Std(error, dest_str);
           }
         }
-      } else if (dir_entry.is_directory()) {
+      } else if (dir_entry.is_directory(error)) {
         auto entry_dir_path = src / dir_entry.path().filename();
-        std::filesystem::create_directory(dest_file_path);
-        auto success = copy_dir_contents(entry_dir_path, dest_file_path);
-        if (!success) {
-          return false;
+        bool created = true;
+        if (options.fresh_destination) {
+          CpError made = MakeFreshDirectory(dest_file_path);
+          if (made.kind != CpError::kNone) return made;
+        } else {
+          created = std::filesystem::create_directory(dest_file_path, error);
+          if (error) {
+            return CpError::Std(error, ConvertPathToUTF8(dest_file_path));
+          }
+        }
+        CpError inner = copy_dir_contents(entry_dir_path, dest_file_path);
+        if (inner.kind != CpError::kNone) {
+          return inner;
+        }
+        // A directory created by the copy gets the mode of its source once
+        // its contents are in (the source may be read-only).
+        if (created) {
+          std::filesystem::permissions(
+              dest_file_path, dir_entry.status(error).permissions(), error);
+          if (error) {
+            return CpError::Std(error, ConvertPathToUTF8(dest_file_path));
+          }
+        }
+        if (options.preserve_timestamps) {
+          CpError stamped = CopyUtimes(entry_dir_path, dest_file_path);
+          if (stamped.kind != CpError::kNone) return stamped;
+        }
+      } else if (dir_entry.is_regular_file(error)) {
+        bool copied = true;
+        if (options.fresh_destination) {
+          CpError fresh = CopyFileFresh(
+              dir_entry.path(), dest_file_path, options.copyfile_flags);
+          if (fresh.kind != CpError::kNone) return fresh;
+        } else {
+          copied = std::filesystem::copy_file(
+              dir_entry.path(), dest_file_path, file_copy_opts, error);
         }
-      } else if (dir_entry.is_regular_file()) {
-        std::filesystem::copy_file(
-            dir_entry.path(), dest_file_path, file_copy_opts, error);
         if (error) {
           if (error == std::errc::file_exists) {
-            THROW_ERR_FS_CP_EEXIST(isolate,
-                                   "[ERR_FS_CP_EEXIST]: Target already exists: "
-                                   "cp returned EEXIST (%s already exists)",
-                                   dest_file_path);
-            return false;
+            return {CpError::kEexist,
+                    0,
+                    "cp",
+                    SPrintF("[ERR_FS_CP_EEXIST]: Target already exists: "
+                            "cp returned EEXIST (%s already exists)",
+                            dest_file_path),
+                    {}};
           }
-          env->ThrowStdErrException(error, "cp", dest_str.c_str());
-          return false;
+          return CpError::Std(error, dest_str);
         }
 
-        if (preserve_timestamps &&
-            !CopyUtimes(dir_entry.path(), dest_file_path, env)) {
-          return false;
+        if (options.preserve_timestamps) {
+          CpError utimes = CopyUtimes(dir_entry.path(), dest_file_path);
+          if (utimes.kind != CpError::kNone) {
+            return utimes;
+          }
+        }
+        // Both copies set the mode before writing the data, which clears
+        // setuid/setgid; put the source mode back once the data is in.
+        if (copied) {
+          std::filesystem::permissions(
+              dest_file_path, dir_entry.status(error).permissions(), error);
+          if (error) {
+            return CpError::Std(error, ConvertPathToUTF8(dest_file_path));
+          }
         }
+      } else if (options.fresh_destination) {
+        CpError::Kind kind = dir_entry.is_socket(error) ? CpError::kSocket
+                             : dir_entry.is_fifo(error) ? CpError::kFifo
+                                                        : CpError::kUnknown;
+        return {kind, UV_EINVAL, "cp", {}, ConvertPathToUTF8(dest_file_path)};
       }
     }
-    return true;
+    return {};
   };
 
-  copy_dir_contents(src_path, dest_path);
+  CpError result = copy_dir_contents(src_path, dest_path);
+  if (result.kind != CpError::kNone) return result;
+  if (!dest_existed) {
+    std::filesystem::permissions(
+        dest_path,
+        std::filesystem::status(src_path, error).permissions(),
+        error);
+    if (error) {
+      return CpError::Std(error, dest_display);
+    }
+  }
+  if (options.preserve_timestamps) return CopyUtimes(src_path, dest_path);
+  return {};
 }
 
+}  // namespace
+
+static void CpSyncOverrideFile(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  Isolate* isolate = env->isolate();
+
+  CHECK_EQ(args.Length(), 4);  // src, dest, mode, preserveTimestamps
+
+  BufferValue src(isolate, args[0]);
+  CHECK_NOT_NULL(*src);
+  ToNamespacedPath(env, &src);
+
+  BufferValue dest(isolate, args[1]);
+  CHECK_NOT_NULL(*dest);
+  ToNamespacedPath(env, &dest);
+
+  int mode;
+  if (!GetValidFileMode(env, args[2], UV_FS_COPYFILE).To(&mode)) {
+    return;
+  }
+
+  bool preserve_timestamps = args[3]->IsTrue();
+
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kFileSystemRead, src.ToStringView());
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kFileSystemWrite, dest.ToStringView());
+
+  auto src_path = src.ToPath();
+  auto dest_path = dest.ToPath();
+
+  std::error_code error;
+
+  if (!std::filesystem::remove(dest_path, error)) {
+    return env->ThrowStdErrException(error, "unlink", *dest);
+  }
+
+  if (mode == 0) {
+    // if no mode is specified use the faster std::filesystem API
+    if (!std::filesystem::copy_file(src_path, dest_path, error)) {
+      return env->ThrowStdErrException(error, "cp", *dest);
+    }
+  } else {
+    uv_fs_t req;
+    auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
+    auto result = uv_fs_copyfile(nullptr, &req, *src, *dest, mode, nullptr);
+    if (is_uv_error(result)) {
+      return env->ThrowUVException(result, "cp", nullptr, *src, *dest);
+    }
+  }
+
+  if (preserve_timestamps) {
+    CpError error = CopyUtimes(src_path, dest_path);
+    if (error.kind != CpError::kNone) {
+      error.Throw(env);
+    }
+  }
+}
+
+static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
+  CHECK_EQ(args.Length(), 7);  // src, dest, force, dereference, errorOnExist,
+                               // verbatimSymlinks, preserveTimestamps
+
+  Environment* env = Environment::GetCurrent(args);
+  Isolate* isolate = env->isolate();
+
+  BufferValue src(isolate, args[0]);
+  CHECK_NOT_NULL(*src);
+  ToNamespacedPath(env, &src);
+
+  BufferValue dest(isolate, args[1]);
+  CHECK_NOT_NULL(*dest);
+  ToNamespacedPath(env, &dest);
+
+  bool force = args[2]->IsTrue();
+  bool dereference = args[3]->IsTrue();
+  bool error_on_exist = args[4]->IsTrue();
+  bool verbatim_symlinks = args[5]->IsTrue();
+  bool preserve_timestamps = args[6]->IsTrue();
+
+  auto src_path = src.ToPath();
+  auto dest_path = dest.ToPath();
+
+  CpError error = CopyDirRecursive(src_path,
+                                   dest_path,
+                                   dest.ToString(),
+                                   {force,
+                                    dereference,
+                                    error_on_exist,
+                                    verbatim_symlinks,
+                                    preserve_timestamps,
+                                    false,
+                                    0});
+  if (error.kind != CpError::kNone) {
+    error.Throw(env);
+  }
+}
+
+// JS: const job = new CpDirJob(src, dest, force, dereference, errorOnExist,
+//                              verbatimSymlinks, preserveTimestamps);
+//     job.ondone = (err) => {...}; job.run();
+// Runs CopyDirRecursive() on the thread pool for fs.cp()/fsPromises.cp().
+class CpDirJob final : public AsyncWrap, public ThreadPoolWork {
+ public:
+  static void New(const FunctionCallbackInfo<Value>& args) {
+    CHECK(args.IsConstructCall());
+    Environment* env = Environment::GetCurrent(args);
+    CHECK_EQ(args.Length(), 8);
+    CHECK(args[7]->IsInt32());
+    BufferValue src(env->isolate(), args[0]);
+    CHECK_NOT_NULL(*src);
+    ToNamespacedPath(env, &src);
+    BufferValue dest(env->isolate(), args[1]);
+    CHECK_NOT_NULL(*dest);
+    ToNamespacedPath(env, &dest);
+    new CpDirJob(env,
+                 args.This(),
+                 src.ToPath(),
+                 dest.ToPath(),
+                 dest.ToString(),
+                 {args[2]->IsTrue(),
+                  args[3]->IsTrue(),
+                  args[4]->IsTrue(),
+                  args[5]->IsTrue(),
+                  args[6]->IsTrue(),
+                  true,
+                  args[7].As<Int32>()->Value()});
+  }
+
+  static void Run(const FunctionCallbackInfo<Value>& args) {
+    CpDirJob* job;
+    ASSIGN_OR_RETURN_UNWRAP(&job, args.This());
+    CHECK(!job->scheduled_);
+    job->scheduled_ = true;
+    job->ClearWeak();
+    job->ScheduleWork();
+  }
+
+  void DoThreadPoolWork() override {
+    error_ = CopyDirRecursive(src_, dest_, dest_display_, options_);
+  }
+
+  void AfterThreadPoolWork(int status) override {
+    Environment* env = AsyncWrap::env();
+    std::unique_ptr<CpDirJob> self(this);
+    CHECK(status == 0 || status == UV_ECANCELED);
+    if (status == UV_ECANCELED || !env->can_call_into_js()) return;
+    Isolate* isolate = env->isolate();
+    HandleScope handle_scope(isolate);
+    Context::Scope context_scope(env->context());
+    Local<Value> argv[] = {
+        Null(isolate), Undefined(isolate), Undefined(isolate)};
+    const char* special = error_.kind == CpError::kSocket    ? "socket"
+                          : error_.kind == CpError::kFifo    ? "fifo"
+                          : error_.kind == CpError::kUnknown ? "unknown"
+                                                             : nullptr;
+    if (special != nullptr) {
+      Local<Value> path;
+      if (!ToV8Value(env->context(), error_.path).ToLocal(&path)) return;
+      argv[1] = OneByteString(isolate, special);
+      argv[2] = path;
+    } else if (error_.kind != CpError::kNone) {
+      argv[0] = error_.ToException(env);
+    }
+    MakeCallback(env->ondone_string(), arraysize(argv), argv);
+  }
+
+  bool IsNotIndicativeOfMemoryLeakAtExit() const override { return true; }
+  SET_NO_MEMORY_INFO()
+  SET_MEMORY_INFO_NAME(CpDirJob)
+  SET_SELF_SIZE(CpDirJob)
+
+ private:
+  CpDirJob(Environment* env,
+           Local<Object> object,
+           std::filesystem::path&& src,
+           std::filesystem::path&& dest,
+           std::string&& dest_display,
+           CpDirOptions options)
+      : AsyncWrap(env, object, AsyncWrap::PROVIDER_FSREQCALLBACK),
+        ThreadPoolWork(env, "fs.cp"),
+        src_(std::move(src)),
+        dest_(std::move(dest)),
+        dest_display_(std::move(dest_display)),
+        options_(options) {
+    MakeWeak();
+  }
+
+  const std::filesystem::path src_;
+  const std::filesystem::path dest_;
+  const std::string dest_display_;
+  const CpDirOptions options_;
+  CpError error_;
+  bool scheduled_ = false;
+};
+
 BindingData::FilePathIsFileReturnType BindingData::FilePathIsFile(
     Environment* env, const std::string& file_path) {
   THROW_IF_INSUFFICIENT_PERMISSIONS(
@@ -4560,6 +5520,7 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
   SetMethod(isolate, target, "rmSync", RmSync);
   SetMethod(isolate, target, "mkdir", MKDir);
   SetMethod(isolate, target, "readdir", ReadDir);
+  SetMethod(isolate, target, "readdirRecursive", ReadDirRecursive);
   SetMethod(isolate, target, "internalModuleStat", InternalModuleStat);
   SetMethod(isolate, target, "stat", Stat);
   SetMethod(isolate, target, "lstat", LStat);
@@ -4597,6 +5558,12 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
   SetMethod(isolate, target, "cpSyncOverrideFile", CpSyncOverrideFile);
   SetMethod(isolate, target, "cpSyncCopyDir", CpSyncCopyDir);
 
+  Local<FunctionTemplate> cpj = NewFunctionTemplate(isolate, CpDirJob::New);
+  cpj->InstanceTemplate()->SetInternalFieldCount(CpDirJob::kInternalFieldCount);
+  cpj->Inherit(AsyncWrap::GetConstructorTemplate(isolate_data));
+  SetProtoMethod(isolate, cpj, "run", CpDirJob::Run);
+  SetConstructorFunction(isolate, target, "CpDirJob", cpj);
+
   StatWatcher::CreatePerIsolateProperties(isolate_data, target);
   BindingData::CreatePerIsolateProperties(isolate_data, target);
 
@@ -4613,11 +5580,19 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
   SetProtoMethod(isolate, rfj, "run", ReadFileJob::Run);
   SetConstructorFunction(isolate, target, "ReadFileJob", rfj);
 
+  Local<FunctionTemplate> wfj = NewFunctionTemplate(isolate, WriteFileJob::New);
+  wfj->InstanceTemplate()->SetInternalFieldCount(
+      WriteFileJob::kInternalFieldCount);
+  wfj->Inherit(AsyncWrap::GetConstructorTemplate(isolate_data));
+  SetProtoMethod(isolate, wfj, "run", WriteFileJob::Run);
+  SetConstructorFunction(isolate, target, "WriteFileJob", wfj);
+
   // Create FunctionTemplate for FSReqCallback
   Local<FunctionTemplate> fst = NewFunctionTemplate(isolate, NewFSReqCallback);
   fst->InstanceTemplate()->SetInternalFieldCount(
       FSReqBase::kInternalFieldCount);
   fst->Inherit(AsyncWrap::GetConstructorTemplate(isolate_data));
+  SetProtoMethod(isolate, fst, "cancel", CancelFSReq);
   SetConstructorFunction(isolate, target, "FSReqCallback", fst);
 
   // Create FunctionTemplate for FileHandleReadWrap. There’s no need
@@ -4686,6 +5661,8 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(Open);
   registry->Register(ReadFileJob::New);
   registry->Register(ReadFileJob::Run);
+  registry->Register(WriteFileJob::New);
+  registry->Register(WriteFileJob::Run);
   registry->Register(OpenFileHandle);
   registry->Register(Read);
   registry->Register(ReadFileUtf8);
@@ -4698,6 +5675,7 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(RmSync);
   registry->Register(MKDir);
   registry->Register(ReadDir);
+  registry->Register(ReadDirRecursive);
   registry->Register(InternalModuleStat);
   registry->Register(Stat);
   registry->Register(LStat);
@@ -4717,6 +5695,8 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(CpSyncCheckPaths);
   registry->Register(CpSyncOverrideFile);
   registry->Register(CpSyncCopyDir);
+  registry->Register(CpDirJob::New);
+  registry->Register(CpDirJob::Run);
 
   registry->Register(Chmod);
   registry->Register(FChmod);
@@ -4734,6 +5714,7 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(HandleToFd);
 #endif
   registry->Register(NewFSReqCallback);
+  registry->Register(CancelFSReq);
 
   registry->Register(FileHandle::New);
   registry->Register(FileHandle::Close);
diff --git a/src/node_http2.cc b/src/node_http2.cc
index bbb088943b01..d6edcd28d117 100644
--- a/src/node_http2.cc
+++ b/src/node_http2.cc
@@ -970,45 +970,24 @@ ssize_t Http2Session::OnMaxFrameSizePadding(size_t frameLen,
 // quite expensive. This is a potential performance optimization target later.
 void Http2Session::ConsumeHTTP2Data() {
   CHECK_NOT_NULL(stream_buf_.base);
-  CHECK_LE(stream_buf_offset_, stream_buf_.len);
-  size_t read_len = stream_buf_.len - stream_buf_offset_;
 
   // multiple side effects.
-  Debug(this, "receiving %d bytes [wants data? %d]",
-        read_len,
+  Debug(this,
+        "receiving %d bytes [wants data? %d]",
+        stream_buf_.len,
         nghttp2_session_want_read(session_.get()));
-  set_receive_paused(false);
   custom_recv_error_code_ = nullptr;
   set_receiving();
   ssize_t ret =
-    nghttp2_session_mem_recv(session_.get(),
-                             reinterpret_cast<uint8_t*>(stream_buf_.base) +
-                                 stream_buf_offset_,
-                             read_len);
+      nghttp2_session_mem_recv(session_.get(),
+                               reinterpret_cast<uint8_t*>(stream_buf_.base),
+                               stream_buf_.len);
   set_receiving(false);
   CHECK_NE(ret, NGHTTP2_ERR_NOMEM);
   CHECK_IMPLIES(custom_recv_error_code_ != nullptr, ret < 0);
 
-  if (is_receive_paused()) {
-    CHECK(is_reading_stopped());
-
-    CHECK_GT(ret, 0);
-    CHECK_LE(static_cast<size_t>(ret), read_len);
-
-    // Mark the remainder of the data as available for later consumption.
-    // Even if all bytes were received, a paused stream may delay the
-    // nghttp2_on_frame_recv_callback which may have an END_STREAM flag.
-    stream_buf_offset_ += ret;
-    // Still complete a Close() deferred during mem_recv; do not fall through
-    // to SendPendingData() here (paused receives historically skip that flush
-    // because a write may already be in progress).
-    MaybeFinishPendingClose();
-    goto done;
-  }
-
   // We are done processing the current input chunk.
   DecrementCurrentSessionMemory(stream_buf_.len);
-  stream_buf_offset_ = 0;
   stream_buf_ab_.Reset();
   stream_buf_allocation_.reset();
   stream_buf_ = uv_buf_init(nullptr, 0);
@@ -1017,14 +996,6 @@ void Http2Session::ConsumeHTTP2Data() {
   // not written after pending RST_STREAM frames.
   MaybeFinishPendingClose();
 
-done:
-  // Finish a Close() deferred above before flushing, so GOAWAY is not written
-  // after pending RST_STREAM frames.
-  if (is_close_pending() && !is_destroyed()) {
-    set_close_pending(false);
-    FinishClose(pending_close_code_, pending_close_socket_closed_);
-  }
-
   // Send any data that was queued up while processing the received data.
   if (ret >= 0 && !is_destroyed()) {
     SendPendingData();
@@ -1147,6 +1118,13 @@ int Http2Session::OnFrameReceive(nghttp2_session* handle,
     case NGHTTP2_HEADERS:
       session->HandleHeadersFrame(frame);
       break;
+    case NGHTTP2_RST_STREAM:
+      // Distinguish a peer reset from a natural close with the same code.
+      if (BaseObjectPtr<Http2Stream> stream =
+              session->FindStream(frame->hd.stream_id)) {
+        stream->set_peer_reset();
+      }
+      break;
     case NGHTTP2_SETTINGS:
       session->HandleSettingsFrame(frame);
       break;
@@ -1356,9 +1334,12 @@ int Http2Session::OnStreamClose(nghttp2_session* handle,
   // ever passed on to the javascript side. If that happens, the callback
   // will return false.
   if (env->can_call_into_js()) {
-    Local<Value> arg = Integer::NewFromUnsigned(isolate, code);
+    Local<Value> argv[] = {
+        Integer::NewFromUnsigned(isolate, code),
+        Boolean::New(isolate, stream->peer_reset()),
+    };
     MaybeLocal<Value> answer = stream->MakeCallback(
-        env->http2session_on_stream_close_function(), 1, &arg);
+        env->http2session_on_stream_close_function(), arraysize(argv), argv);
     if (answer.IsEmpty() || answer.ToLocalChecked()->IsFalse()) {
       // Skip to destroy
       stream->Destroy();
@@ -1461,15 +1442,6 @@ int Http2Session::OnDataChunkReceived(nghttp2_session* handle,
     }
   } while (len != 0);
 
-  // If we are currently waiting for a write operation to finish, we should
-  // tell nghttp2 that we want to wait before we process more input data.
-  if (session->is_write_in_progress()) {
-    CHECK(session->is_reading_stopped());
-    session->set_receive_paused();
-    Debug(session, "receive paused");
-    return NGHTTP2_ERR_PAUSE;
-  }
-
   return 0;
 }
 
@@ -1552,7 +1524,6 @@ void Http2StreamListener::OnStreamRead(ssize_t nread, const uv_buf_t& buf) {
   size_t offset = buf.base - session->stream_buf_.base;
 
   // Verify that the data offset is inside the current read buffer.
-  CHECK_GE(offset, session->stream_buf_offset_);
   CHECK_LE(offset, session->stream_buf_.len);
   CHECK_LE(offset + buf.len, session->stream_buf_.len);
 
@@ -1867,11 +1838,6 @@ void Http2Session::OnStreamAfterWrite(WriteWrap* w, int status) {
     return;
   }
 
-  // If there is more incoming data queued up, consume it.
-  if (stream_buf_offset_ > 0) {
-    ConsumeHTTP2Data();
-  }
-
   if (!is_write_scheduled() && !is_destroyed()) {
     // Schedule a new write if nghttp2 wants to send data.
     MaybeScheduleWrite();
@@ -1918,7 +1884,7 @@ void Http2Session::MaybeStopReading() {
   if (is_reading_stopped() || is_closing()) return;
   int want_read = nghttp2_session_want_read(session_.get());
   Debug(this, "wants read? %d", want_read);
-  if (want_read == 0 || is_write_in_progress()) {
+  if (want_read == 0) {
     set_reading_stopped();
     stream_->ReadStop();
   }
@@ -2178,7 +2144,7 @@ void Http2Session::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
   Context::Scope context_scope(env()->context());
   Http2Scope h2scope(this);
   CHECK_NOT_NULL(stream_);
-  Debug(this, "receiving %d bytes, offset %d", nread, stream_buf_offset_);
+  Debug(this, "receiving %d bytes", nread);
   std::unique_ptr<BackingStore> bs = env()->release_managed_buffer(buf_);
 
   // Only pass data on if nread > 0
@@ -2193,8 +2159,11 @@ void Http2Session::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
 
   statistics_.data_received += nread;
 
-  if (stream_buf_offset_ == 0 && static_cast<size_t>(nread) != bs->ByteLength())
-      [[likely]] {
+  // ConsumeHTTP2Data() always consumes the whole chunk, so there is never a
+  // partially processed buffer left over from a previous read.
+  DCHECK_NULL(stream_buf_.base);
+
+  if (static_cast<size_t>(nread) != bs->ByteLength()) [[likely]] {
     // Shrink to the actual amount of used data.
     std::unique_ptr<BackingStore> old_bs = std::move(bs);
     bs = ArrayBuffer::NewBackingStore(
@@ -2202,31 +2171,6 @@ void Http2Session::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
         nread,
         BackingStoreInitializationMode::kUninitialized);
     memcpy(bs->Data(), old_bs->Data(), nread);
-  } else {
-    // This is a very unlikely case, and should only happen if the ReadStart()
-    // call in OnStreamAfterWrite() immediately provides data. If that does
-    // happen, we concatenate the data we received with the already-stored
-    // pending input data, slicing off the already processed part.
-    size_t pending_len = stream_buf_.len - stream_buf_offset_;
-    std::unique_ptr<BackingStore> new_bs = ArrayBuffer::NewBackingStore(
-        env()->isolate(),
-        pending_len + nread,
-        BackingStoreInitializationMode::kUninitialized);
-    memcpy(static_cast<char*>(new_bs->Data()),
-           stream_buf_.base + stream_buf_offset_,
-           pending_len);
-    memcpy(static_cast<char*>(new_bs->Data()) + pending_len,
-           bs->Data(),
-           nread);
-
-    bs = std::move(new_bs);
-    nread = bs->ByteLength();
-    stream_buf_offset_ = 0;
-    stream_buf_ab_.Reset();
-
-    // We have now fully processed the stream_buf_ input chunk (by moving the
-    // remaining part into buf, which will be accounted for below).
-    DecrementCurrentSessionMemory(stream_buf_.len);
   }
 
   IncrementCurrentSessionMemory(nread);
diff --git a/src/node_http2.h b/src/node_http2.h
index f321bf0c1601..94e77cbc6fa6 100644
--- a/src/node_http2.h
+++ b/src/node_http2.h
@@ -65,6 +65,7 @@ constexpr int kStreamStateReadPaused = 0x4;
 constexpr int kStreamStateClosed = 0x8;
 constexpr int kStreamStateDestroyed = 0x10;
 constexpr int kStreamStateTrailers = 0x20;
+constexpr int kStreamStatePeerReset = 0x40;
 
 // Http2Session internal states
 constexpr int kSessionStateNone = 0x0;
@@ -75,9 +76,8 @@ constexpr int kSessionStateClosing = 0x8;
 constexpr int kSessionStateSending = 0x10;
 constexpr int kSessionStateWriteInProgress = 0x20;
 constexpr int kSessionStateReadingStopped = 0x40;
-constexpr int kSessionStateReceivePaused = 0x80;
-constexpr int kSessionStateReceiving = 0x100;
-constexpr int kSessionStateClosePending = 0x200;
+constexpr int kSessionStateReceiving = 0x80;
+constexpr int kSessionStateClosePending = 0x100;
 
 // The Padding Strategy determines the method by which extra padding is
 // selected for HEADERS and DATA frames. These are configurable via the
@@ -353,6 +353,10 @@ class Http2Stream : public AsyncWrap,
     return flags_ & kStreamStateClosed;
   }
 
+  bool peer_reset() const { return flags_ & kStreamStatePeerReset; }
+
+  void set_peer_reset() { flags_ |= kStreamStatePeerReset; }
+
   bool has_trailers() const {
     return flags_ & kStreamStateTrailers;
   }
@@ -664,7 +668,6 @@ class Http2Session : public AsyncWrap,
   IS_FLAG(sending, kSessionStateSending)
   IS_FLAG(write_in_progress, kSessionStateWriteInProgress)
   IS_FLAG(reading_stopped, kSessionStateReadingStopped)
-  IS_FLAG(receive_paused, kSessionStateReceivePaused)
   IS_FLAG(receiving, kSessionStateReceiving)
   IS_FLAG(close_pending, kSessionStateClosePending)
 
@@ -945,7 +948,6 @@ class Http2Session : public AsyncWrap,
   // will be set. stream_buf_ab_ is lazily created from stream_buf_allocation_.
   v8::Global<v8::ArrayBuffer> stream_buf_ab_;
   std::unique_ptr<v8::BackingStore> stream_buf_allocation_;
-  size_t stream_buf_offset_ = 0;
   // Custom error code for errors that originated inside one of the callbacks
   // called by nghttp2_session_mem_recv.
   const char* custom_recv_error_code_ = nullptr;
diff --git a/src/node_http_common.h b/src/node_http_common.h
index 5afb6b97becc..de2fdb2aa810 100644
--- a/src/node_http_common.h
+++ b/src/node_http_common.h
@@ -6,6 +6,7 @@
 #include "v8.h"
 #include "node_mem.h"
 
+#include <memory>
 #include <string>
 
 namespace node {
@@ -439,11 +440,10 @@ class NgRcBufPointer : public MemoryRetainer {
       }
 
       allocator->StopTrackingMemory(ptr.get());
-      External* h_str = new External(std::move(ptr));
+      auto h_str = std::make_unique<External>(std::move(ptr));
       v8::MaybeLocal<v8::String> str =
-          v8::String::NewExternalOneByte(env->isolate(), h_str);
-      if (str.IsEmpty())
-        delete h_str;
+          v8::String::NewExternalOneByte(env->isolate(), h_str.get());
+      if (!str.IsEmpty()) h_str.release();
 
       return str;
     }
diff --git a/src/node_internals.h b/src/node_internals.h
index 631a8d7ccdd9..17e23ce61d64 100644
--- a/src/node_internals.h
+++ b/src/node_internals.h
@@ -380,7 +380,6 @@ class InitializationResultImpl final : public InitializationResult {
   MultiIsolatePlatform* platform_ = nullptr;
 };
 
-void SetIsolateErrorHandlers(v8::Isolate* isolate, const IsolateSettings& s);
 void SetIsolateMiscHandlers(v8::Isolate* isolate, const IsolateSettings& s);
 void SetIsolateCreateParamsForNode(v8::Isolate::CreateParams* params);
 
diff --git a/src/node_locks.cc b/src/node_locks.cc
index 26fac6b62c4c..4fca3a7df94e 100644
--- a/src/node_locks.cc
+++ b/src/node_locks.cc
@@ -2,6 +2,7 @@
 
 #include "base_object-inl.h"
 #include "env-inl.h"
+#include "node_debug.h"
 #include "node_errors.h"
 #include "node_external_reference.h"
 #include "node_internals.h"
@@ -237,8 +238,8 @@ void LockManager::ProcessQueue(Environment* env) {
      * 1- Build first_seen_for_resource: the oldest pending request
      *   for every resource name we encounter
      * 2- Decide what to do with each entry:
-     *     – If it belongs to another Environment, remember that env so we
-     *       can wake it later
+     *     – If it belongs to another Environment, remember that env only if
+     *       the request can make progress
      *     – For our Environment, pick one of:
      *         * grantable_request  – can be granted now
      *         * if_available_request – user asked for ifAvailable and the
@@ -255,11 +256,6 @@ void LockManager::ProcessQueue(Environment* env) {
            ++queue_iter) {
         LockRequest* request = queue_iter->get();
 
-        // Collect unique environments to wake up later
-        if (request->env() != env) {
-          other_envs_to_wake.insert(request->env());
-        }
-
         // During a single pass, the first time we see a resource name is the
         // earliest pending request
         auto& first_for_resource = first_seen_for_resource[request->name()];
@@ -283,12 +279,21 @@ void LockManager::ProcessQueue(Environment* env) {
           // If both are shared, they're compatible and can proceed
         }
 
-        // Only process requests from the current environment
+        bool is_grantable =
+            !should_wait_for_earlier_requests && IsGrantable(request);
+
+        // Requests must be processed on their Environment's event loop. Wake
+        // another Environment only when it has a request that can make
+        // progress; otherwise blocked Environments would continuously wake
+        // each other.
         if (request->env() != env) {
+          if (is_grantable || request->if_available()) {
+            other_envs_to_wake.insert(request->env());
+          }
           continue;
         }
 
-        if (should_wait_for_earlier_requests || !IsGrantable(request)) {
+        if (!is_grantable) {
           if (request->if_available()) {
             // ifAvailable request when resource not available: grant with null
             if_available_request = std::move(*queue_iter);
@@ -754,6 +759,8 @@ void LockManager::ReleaseLock(Lock* lock) {
 void LockManager::WakeEnvironment(Environment* target_env) {
   if (target_env == nullptr || target_env->is_stopping()) return;
 
+  COUNT_GENERIC_USAGE("LockManager.WakeEnvironment");
+
   // Schedule ProcessQueue in the target Environment on its event loop.
   target_env->SetImmediateThreadsafe([](Environment* env_to_wake) {
     if (env_to_wake != nullptr && !env_to_wake->is_stopping()) {
diff --git a/src/node_modules.cc b/src/node_modules.cc
index 3a786158afea..ec4f6bdd79a8 100644
--- a/src/node_modules.cc
+++ b/src/node_modules.cc
@@ -91,53 +91,16 @@ Local<Array> BindingData::PackageConfig::Serialize(Realm* realm) const {
   return Array::New(isolate, values, 6);
 }
 
-const BindingData::PackageConfig* BindingData::GetPackageJSON(
-    Realm* realm, std::string_view path, ErrorContext* error_context) {
+bool BindingData::ParsePackageJSON(Realm* realm,
+                                   PackageConfig* package_config,
+                                   ErrorContext* error_context) {
   auto binding_data = realm->GetBindingData<BindingData>();
-
-  auto cache_entry = binding_data->package_configs_.find(path.data());
-  if (cache_entry != binding_data->package_configs_.end()) {
-    auto& cache_value = cache_entry->second;
-    if (cache_value) {
-      return &*cache_value;
-    }
-
-    // If we have a cache entry without a value, we've already
-    // attempted to open and read this path and couldn't (it most
-    // likely doesn't exist)
-    return nullptr;
-  }
-
-  PackageConfig package_config{};
-  package_config.file_path = path;
-  // No need to exclude BOM since simdjson will skip it.
-  int read_error = ReadFileSync(&package_config.raw_json, path.data());
-  if (read_error < 0) {
-    // No file at this path, a path component that is not a directory, or a
-    // "package.json" that is itself a directory all mean there is no package
-    // config here. Any other failure means a package.json is present but
-    // could not be read. Treating that as absent silently drops fields such
-    // as "exports" and "type", which can resolve a specifier to a different
-    // file, so surface the read error instead of continuing.
-    if (read_error != UV_ENOENT && read_error != UV_ENOTDIR &&
-        read_error != UV_EISDIR) {
-      THROW_ERR_INVALID_PACKAGE_CONFIG(realm->isolate(),
-                                       "Cannot read package config %s: %s.",
-                                       path.data(),
-                                       uv_strerror(read_error));
-      return nullptr;
-    }
-
-    // Add `nullopt` to the package config cache so that we don't
-    // need to open and attempt to read this path again
-    binding_data->package_configs_.insert({std::string(path), std::nullopt});
-    return nullptr;
-  }
+  const std::string_view path = package_config->file_path;
 
   simdjson::ondemand::document document;
   simdjson::ondemand::object main_object;
   simdjson::error_code error =
-      binding_data->json_parser.iterate(simdjson::pad(package_config.raw_json))
+      binding_data->json_parser.iterate(simdjson::pad(package_config->raw_json))
           .get(document);
 
   const auto throw_invalid_package_config = [error_context, path, realm]() {
@@ -160,7 +123,7 @@ const BindingData::PackageConfig* BindingData::GetPackageJSON(
           realm->isolate(), "Invalid package config %s.", path.data());
     }
 
-    return nullptr;
+    return false;
   };
 
   if (error || document.get_object().get(main_object)) {
@@ -185,12 +148,12 @@ const BindingData::PackageConfig* BindingData::GetPackageJSON(
     if (key == "name") {
       // Though there is a key "name" with a corresponding value,
       // the value may not be a string or could be an invalid JSON string
-      if (value.get_string(package_config.name)) {
+      if (value.get_string(package_config->name)) {
         return throw_invalid_package_config();
       }
     } else if (key == "main") {
       // Omit all non-string values
-      USE(value.get_string(package_config.main));
+      USE(value.get_string(package_config->main));
     } else if (key == "exports") {
       if (value.type().get(field_type)) {
         return throw_invalid_package_config();
@@ -201,11 +164,11 @@ const BindingData::PackageConfig* BindingData::GetPackageJSON(
           if (value.raw_json().get(field_value)) {
             return throw_invalid_package_config();
           }
-          package_config.exports = field_value;
+          package_config->exports = field_value;
           break;
         }
         case simdjson::ondemand::json_type::string: {
-          if (value.get_string(package_config.exports)) {
+          if (value.get_string(package_config->exports)) {
             return throw_invalid_package_config();
           }
           break;
@@ -223,11 +186,11 @@ const BindingData::PackageConfig* BindingData::GetPackageJSON(
           if (value.raw_json().get(field_value)) {
             return throw_invalid_package_config();
           }
-          package_config.imports = field_value;
+          package_config->imports = field_value;
           break;
         }
         case simdjson::ondemand::json_type::string: {
-          if (value.get_string(package_config.imports)) {
+          if (value.get_string(package_config->imports)) {
             return throw_invalid_package_config();
           }
           break;
@@ -242,7 +205,7 @@ const BindingData::PackageConfig* BindingData::GetPackageJSON(
       // Only update type if it is "commonjs" or "module"
       // The default value is "none" for backward compatibility.
       if (field_value == "commonjs" || field_value == "module") {
-        package_config.type = field_value;
+        package_config->type = field_value;
       }
     } else if (key == "scripts") {
       if (value.type().get(field_type)) {
@@ -253,7 +216,7 @@ const BindingData::PackageConfig* BindingData::GetPackageJSON(
           if (value.raw_json().get(field_value)) {
             return throw_invalid_package_config();
           }
-          package_config.scripts = field_value;
+          package_config->scripts = field_value;
           break;
         }
         default:
@@ -261,6 +224,56 @@ const BindingData::PackageConfig* BindingData::GetPackageJSON(
       }
     }
   }
+  return true;
+}
+
+const BindingData::PackageConfig* BindingData::GetPackageJSON(
+    Realm* realm, std::string_view path, ErrorContext* error_context) {
+  auto binding_data = realm->GetBindingData<BindingData>();
+
+  auto cache_entry = binding_data->package_configs_.find(path.data());
+  if (cache_entry != binding_data->package_configs_.end()) {
+    auto& cache_value = cache_entry->second;
+    if (cache_value) {
+      return &*cache_value;
+    }
+
+    // If we have a cache entry without a value, we've already
+    // attempted to open and read this path and couldn't (it most
+    // likely doesn't exist)
+    return nullptr;
+  }
+
+  PackageConfig package_config{};
+  package_config.file_path = path;
+  // No need to exclude BOM since simdjson will skip it.
+  int read_error = ReadFileSync(&package_config.raw_json, path.data());
+  if (read_error < 0) {
+    // No file at this path, a path component that is not a directory, or a
+    // "package.json" that is itself a directory all mean there is no package
+    // config here. Any other failure means a package.json is present but
+    // could not be read. Treating that as absent silently drops fields such
+    // as "exports" and "type", which can resolve a specifier to a different
+    // file, so surface the read error instead of continuing.
+    if (read_error != UV_ENOENT && read_error != UV_ENOTDIR &&
+        read_error != UV_EISDIR) {
+      THROW_ERR_INVALID_PACKAGE_CONFIG(realm->isolate(),
+                                       "Cannot read package config %s: %s.",
+                                       path.data(),
+                                       uv_strerror(read_error));
+      return nullptr;
+    }
+
+    // Add `nullopt` to the package config cache so that we don't
+    // need to open and attempt to read this path again
+    binding_data->package_configs_.insert({std::string(path), std::nullopt});
+    return nullptr;
+  }
+
+  if (!ParsePackageJSON(realm, &package_config, error_context)) {
+    return nullptr;
+  }
+
   // package_config could be quite large, so we should move it instead of
   // copying it.
   auto cached = binding_data->package_configs_.insert(
@@ -307,6 +320,49 @@ void BindingData::ReadPackageJSON(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(package_json->Serialize(realm));
 }
 
+void BindingData::ParsePackageJSONBinding(
+    const FunctionCallbackInfo<Value>& args) {
+  // parsePackageJSON(source, jsonPath, isESM, base, specifier)
+  CHECK_GE(args.Length(), 2);
+  CHECK(args[0]->IsString() || args[0]->IsArrayBufferView());  // source
+  CHECK(args[1]->IsString());                                  // jsonPath
+
+  Realm* realm = Realm::GetCurrent(args);
+  auto isolate = realm->isolate();
+
+  BufferValue json_path(isolate, args[1]);
+  bool is_esm = args.Length() >= 3 && args[2]->IsTrue();
+  auto error_context = ErrorContext();
+  if (is_esm) {
+    CHECK(args[3]->IsUndefined() || args[3]->IsString());  // base
+    CHECK(args[4]->IsString());                            // specifier
+
+    if (args[3]->IsString()) {
+      Utf8Value base_value(isolate, args[3]);
+      error_context.base = base_value.ToString();
+    }
+    Utf8Value specifier(isolate, args[4]);
+    error_context.specifier = specifier.ToString();
+  }
+
+  PackageConfig package_config{};
+  package_config.file_path = json_path.ToStringView();
+  if (args[0]->IsString()) {
+    Utf8Value source(isolate, args[0]);
+    package_config.raw_json = source.ToString();
+  } else {
+    ArrayBufferViewContents<char> view(args[0]);
+    package_config.raw_json = std::string(view.data(), view.length());
+  }
+
+  if (!ParsePackageJSON(
+          realm, &package_config, is_esm ? &error_context : nullptr)) {
+    return;  // ParsePackageJSON already threw
+  }
+
+  args.GetReturnValue().Set(package_config.Serialize(realm));
+}
+
 const BindingData::PackageConfig* BindingData::TraverseParent(
     Realm* realm, const std::filesystem::path& check_path) {
   std::filesystem::path current_path = check_path;
@@ -631,6 +687,7 @@ void BindingData::CreatePerIsolateProperties(IsolateData* isolate_data,
                                              Local<ObjectTemplate> target) {
   Isolate* isolate = isolate_data->isolate();
   SetMethod(isolate, target, "readPackageJSON", ReadPackageJSON);
+  SetMethod(isolate, target, "parsePackageJSON", ParsePackageJSONBinding);
   SetMethod(isolate,
             target,
             "getNearestParentPackageJSONType",
@@ -709,6 +766,7 @@ void BindingData::CreatePerContextProperties(Local<Object> target,
 void BindingData::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
   registry->Register(ReadPackageJSON);
+  registry->Register(ParsePackageJSONBinding);
   registry->Register(GetNearestParentPackageJSONType);
   registry->Register(GetNearestParentPackageJSON);
   registry->Register(GetPackageScopeConfig<false>);
diff --git a/src/node_modules.h b/src/node_modules.h
index d610306a3a31..544177312652 100644
--- a/src/node_modules.h
+++ b/src/node_modules.h
@@ -55,6 +55,11 @@ class BindingData : public SnapshotableObject {
   SET_MEMORY_INFO_NAME(BindingData)
 
   static void ReadPackageJSON(const v8::FunctionCallbackInfo<v8::Value>& args);
+  // Like ReadPackageJSON but the caller supplies the raw JSON body.
+  // Does not populate the C++ `package_configs_` cache.
+  // Signature: parsePackageJSON(source, jsonPath, isESM, base, specifier)
+  static void ParsePackageJSONBinding(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetNearestParentPackageJSON(
       const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetNearestParentPackageJSONType(
@@ -90,6 +95,12 @@ class BindingData : public SnapshotableObject {
       Realm* realm,
       std::string_view path,
       ErrorContext* error_context = nullptr);
+  // Parses `package_config->raw_json` into `package_config`; caller
+  // must set raw_json and file_path first. Returns false and throws
+  // ERR_INVALID_PACKAGE_CONFIG on a syntactic error.
+  static bool ParsePackageJSON(Realm* realm,
+                               PackageConfig* package_config,
+                               ErrorContext* error_context);
   static const PackageConfig* TraverseParent(
       Realm* realm, const std::filesystem::path& check_path);
 };
diff --git a/src/node_options-inl.h b/src/node_options-inl.h
index 877e8ce4ded9..dac206791c35 100644
--- a/src/node_options-inl.h
+++ b/src/node_options-inl.h
@@ -4,8 +4,10 @@
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
 #include <algorithm>
+#include <charconv>
 #include <cstdlib>
 #include <ranges>
+#include <type_traits>
 #include "node_options.h"
 #include "util.h"
 
@@ -31,17 +33,19 @@ namespace options_parser {
 template <typename Options>
 void OptionsParser<Options>::AddOption(const char* name,
                                        const char* help_text,
-                                       bool Options::*field,
+                                       bool (*getter)(Options*),
+                                       void (*setter)(Options*, bool),
                                        OptionEnvvarSettings env_setting,
                                        bool default_is_true,
                                        OptionNamespaces namespace_id) {
-  options_.emplace(name,
-                   OptionInfo{kBoolean,
-                              std::make_shared<SimpleOptionField<bool>>(field),
-                              env_setting,
-                              help_text,
-                              default_is_true,
-                              NamespaceEnumToString(namespace_id)});
+  options_.emplace(
+      name,
+      OptionInfo{kBoolean,
+                 std::make_shared<BitFieldOptionField>(getter, setter),
+                 env_setting,
+                 help_text,
+                 default_is_true,
+                 NamespaceEnumToString(namespace_id)});
 }
 
 template <typename Options>
@@ -49,7 +53,8 @@ void OptionsParser<Options>::AddOption(const char* name,
                                        const char* help_text,
                                        uint64_t Options::*field,
                                        OptionEnvvarSettings env_setting,
-                                       OptionNamespaces namespace_id) {
+                                       OptionNamespaces namespace_id,
+                                       bool strict) {
   options_.emplace(
       name,
       OptionInfo{kUInteger,
@@ -57,7 +62,8 @@ void OptionsParser<Options>::AddOption(const char* name,
                  env_setting,
                  help_text,
                  false,
-                 NamespaceEnumToString(namespace_id)});
+                 NamespaceEnumToString(namespace_id),
+                 strict});
 }
 
 template <typename Options>
@@ -207,6 +213,13 @@ auto OptionsParser<Options>::Convert(
       return original->LookupImpl((options->*get_child)());
     }
 
+    bool GetBool(Options* options) const override {
+      return original->GetBool((options->*get_child)());
+    }
+    void SetBool(Options* options, bool value) override {
+      original->SetBool((options->*get_child)(), value);
+    }
+
     AdaptedField(
         std::shared_ptr<OriginalField> original,
         ChildOptions* (Options::* get_child)())
@@ -229,7 +242,8 @@ auto OptionsParser<Options>::Convert(
                     original.env_setting,
                     original.help_text,
                     original.default_is_true,
-                    original.namespace_id};
+                    original.namespace_id,
+                    original.strict};
 }
 
 template <typename Options>
@@ -432,8 +446,8 @@ void OptionsParser<Options>::Parse(
                               if (value.type == kV8Option) {
                                 v8_args->push_back(value.name);
                               } else {
-                                *value.target_field->template Lookup<bool>(
-                                    options) = value.target_value;
+                                value.target_field->SetBool(options,
+                                                            value.target_value);
                               }
                             });
     }
@@ -453,18 +467,21 @@ void OptionsParser<Options>::Parse(
 
     std::string value;
     if (info.type != kBoolean && info.type != kNoOp && info.type != kV8Option) {
+      // `--run` may be passed without a script name to list available scripts,
+      // so an omitted value is not an error and must not swallow a later flag.
+      const bool optional_value = name == "--run";
       if (equals_index != std::string::npos) {
         value = arg.substr(equals_index + 1);
-        if (value.empty()) {
+        if (value.empty() && !optional_value) {
           missing_argument();
           break;
         }
-      } else {
-        if (args.empty()) {
+      } else if (args.empty() || (optional_value && args.first()[0] == '-')) {
+        if (!optional_value) {
           missing_argument();
           break;
         }
-
+      } else {
         value = args.pop_first();
 
         if (!value.empty() && value[0] == '-') {
@@ -479,7 +496,7 @@ void OptionsParser<Options>::Parse(
 
     switch (info.type) {
       case kBoolean:
-        *Lookup<bool>(info.field, options) = !is_negation;
+        info.field->SetBool(options, !is_negation);
         break;
       case kInteger: {
         // Special case to pass --stack-trace-limit down to V8.
@@ -489,10 +506,22 @@ void OptionsParser<Options>::Parse(
         *Lookup<int64_t>(info.field, options) = std::atoll(value.c_str());
         break;
       }
-      case kUInteger:
-        *Lookup<uint64_t>(info.field, options) =
-            std::strtoull(value.c_str(), nullptr, 10);
+      case kUInteger: {
+        if (!info.strict) {
+          *Lookup<uint64_t>(info.field, options) =
+              std::strtoull(value.c_str(), nullptr, 10);
+          break;
+        }
+        uint64_t parsed;
+        const char* end = value.data() + value.size();
+        const auto result = std::from_chars(value.data(), end, parsed);
+        if (result.ec != std::errc() || result.ptr != end) {
+          errors->push_back("invalid value for " + name);
+          break;
+        }
+        *Lookup<uint64_t>(info.field, options) = parsed;
         break;
+      }
       case kString:
         *Lookup<std::string>(info.field, options) = value;
         break;
@@ -512,6 +541,12 @@ void OptionsParser<Options>::Parse(
       default:
         UNREACHABLE();
     }
+
+    // Record that `--run` was seen so an empty value can be distinguished from
+    // the option being absent. Guarded so it only compiles for the owning type.
+    if constexpr (std::is_same_v<Options, PerProcessOptions>) {
+      if (name == "--run") options->has_run = true;
+    }
   }
   options->CheckOptions(errors, orig_args);
 }
diff --git a/src/node_options.cc b/src/node_options.cc
index 1a9302220db2..54961361a1c9 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -9,7 +9,7 @@
 #include "node_sea.h"
 #include "uv.h"
 #if HAVE_OPENSSL
-#include "openssl/opensslv.h"
+#include "ncrypto.h"  // Defines OPENSSL_VERSION_PREREQ for BoringSSL.
 #include "quic/guard.h"
 #endif
 
@@ -39,6 +39,8 @@ using v8::Undefined;
 using v8::Value;
 namespace node {
 
+constexpr bool kStrictOptionParsing = true;
+
 namespace per_process {
 Mutex cli_options_mutex;
 std::shared_ptr<PerProcessOptions> cli_options{new PerProcessOptions()};
@@ -84,6 +86,23 @@ void PerProcessOptions::CheckOptions(std::vector<std::string>* errors,
                       "used, not both");
   }
 
+  if (force_fips_crypto_policy != "provider" &&
+      force_fips_crypto_policy != "strict") {
+    errors->push_back(
+        "invalid value for --force-fips; expected 'provider' or 'strict'");
+  }
+
+#if defined(OPENSSL_IS_BORINGSSL) || !OPENSSL_VERSION_PREREQ(3, 4)
+  if (enable_fips_indicator_events) {
+    errors->push_back(
+        "--enable-fips-indicator-events requires OpenSSL 3.4 or later");
+  }
+
+  if (force_fips_crypto && force_fips_crypto_policy == "strict") {
+    errors->push_back("--force-fips=strict requires OpenSSL 3.4 or later");
+  }
+#endif
+
   // Any value less than 2 disables use of the secure heap.
 #ifndef V8_ENABLE_SANDBOX
   // The secure heap is not supported when V8_ENABLE_SANDBOX is enabled.
@@ -224,6 +243,42 @@ void EnvironmentOptions::CheckOptions(std::vector<std::string>* errors,
     errors->push_back("invalid value for --trace-require-module");
   }
 
+  // NOTE: `has_bench_options` is deliberately *not* validated against
+  // `experimental_bench` here; see CheckBenchOptions(), which callers invoke
+  // once every option source has been parsed.
+
+  if (bench_runner && test_runner) {
+    errors->push_back("either --bench or --test can be used, not both");
+  }
+
+  if (bench_runner) {
+    if (bench_isolation == "none") {
+      debug_options_.allow_attaching_debugger = true;
+    } else {
+      if (bench_isolation != "process") {
+        errors->push_back("invalid value for --bench-isolation");
+      }
+
+      debug_options_.allow_attaching_debugger = false;
+    }
+    if (has_bench_samples && bench_samples == 0) {
+      errors->push_back("--bench-samples must be greater than 0");
+    }
+    if (syntax_check_only) {
+      errors->push_back("either --bench or --check can be used, not both");
+    }
+    if (has_eval_string) {
+      errors->push_back("either --bench or --eval can be used, not both");
+    }
+    if (force_repl) {
+      errors->push_back(
+          "either --bench or --interactive can be used, not both");
+    }
+    if (watch_mode || !watch_mode_paths.empty()) {
+      errors->push_back("either --bench or --watch can be used, not both");
+    }
+  }
+
   if (test_runner) {
     if (test_isolation == "none") {
       debug_options_.allow_attaching_debugger = true;
@@ -316,6 +371,14 @@ void EnvironmentOptions::CheckOptions(std::vector<std::string>* errors,
 #endif  // HAVE_INSPECTOR
 }
 
+void EnvironmentOptions::CheckBenchOptions(
+    std::vector<std::string>* errors) const {
+  if (has_bench_options && !experimental_bench) {
+    errors->push_back(
+        "--experimental-bench is required to use --bench or related options");
+  }
+}
+
 namespace options_parser {
 
 // Helper function to convert option types to their string representation
@@ -474,30 +537,30 @@ DebugOptionsParser::DebugOptionsParser() {
 
   AddOption("--inspect",
             "activate inspector on host:port (default: 127.0.0.1:9229)",
-            &DebugOptions::inspector_enabled,
+            BOOL_FIELD(inspector_enabled),
             kAllowedInEnvvar);
   AddAlias("--inspect=", { "--inspect-port", "--inspect" });
 
-  AddOption("--debug", "", &DebugOptions::deprecated_debug);
+  AddOption("--debug", "", BOOL_FIELD(deprecated_debug));
   AddAlias("--debug=", "--debug");
-  AddOption("--debug-brk", "", &DebugOptions::deprecated_debug);
+  AddOption("--debug-brk", "", BOOL_FIELD(deprecated_debug));
   AddAlias("--debug-brk=", "--debug-brk");
 
   AddOption("--inspect-brk",
             "activate inspector on host:port and break at start of user script",
-            &DebugOptions::break_first_line,
+            BOOL_FIELD(break_first_line),
             kAllowedInEnvvar);
   Implies("--inspect-brk", "--inspect");
   AddAlias("--inspect-brk=", { "--inspect-port", "--inspect-brk" });
 
-  AddOption("--inspect-brk-node", "", &DebugOptions::break_node_first_line);
+  AddOption("--inspect-brk-node", "", BOOL_FIELD(break_node_first_line));
   Implies("--inspect-brk-node", "--inspect");
   AddAlias("--inspect-brk-node=", { "--inspect-port", "--inspect-brk-node" });
 
   AddOption(
       "--inspect-wait",
       "activate inspector on host:port and wait for debugger to be attached",
-      &DebugOptions::inspect_wait,
+      BOOL_FIELD(inspect_wait),
       kAllowedInEnvvar);
   Implies("--inspect-wait", "--inspect");
   AddAlias("--inspect-wait=", {"--inspect-port", "--inspect-wait"});
@@ -518,7 +581,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
   AddOption("--experimental-detect-module",
             "when ambiguous modules fail to evaluate because they contain "
             "ES module syntax, try again to evaluate them as ES modules",
-            &EnvironmentOptions::detect_module,
+            BOOL_FIELD(detect_module),
             kAllowedInEnvvar,
             true);
   AddOption("--experimental-print-required-tla",
@@ -526,16 +589,16 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "is true, evaluate asynchronous graphs loaded by `require()` but "
             "do not run the microtasks, in order to find and print "
             "top-level await in the graph",
-            &EnvironmentOptions::print_required_tla,
+            BOOL_FIELD(print_required_tla),
             kAllowedInEnvvar);
   AddOption("--require-module",
             "Allow loading synchronous ES Modules in require().",
-            &EnvironmentOptions::require_module,
+            BOOL_FIELD(require_module),
             kAllowedInEnvvar,
             true);
   AddOption("--experimental-require-module",
             "Legacy alias for --require-module",
-            &EnvironmentOptions::require_module,
+            BOOL_FIELD(require_module),
             kAllowedInEnvvar,
             true);
   Implies("--experimental-require-module", "--require-module");
@@ -546,7 +609,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar);
   AddOption("--disable-sigusr1",
             "Disable inspector thread to be listening for SIGUSR1 signal",
-            &EnvironmentOptions::disable_sigusr1,
+            BOOL_FIELD(disable_sigusr1),
             kAllowedInEnvvar,
             false);
   AddOption("--dns-result-order",
@@ -559,7 +622,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar);
   AddOption("--network-family-autoselection",
             "Disable network address family autodetection algorithm",
-            &EnvironmentOptions::network_family_autoselection,
+            BOOL_FIELD(network_family_autoselection),
             kAllowedInEnvvar,
             true);
   AddOption("--network-family-autoselection-attempt-timeout",
@@ -571,53 +634,71 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
            "--network-family-autoselection");
   AddOption("--enable-source-maps",
             "Source Map V3 support for stack traces",
-            &EnvironmentOptions::enable_source_maps,
+            BOOL_FIELD(enable_source_maps),
             kAllowedInEnvvar);
   AddOption("--entry-url",
             "Treat the entrypoint as a URL",
-            &EnvironmentOptions::entry_is_url,
+            BOOL_FIELD(entry_is_url),
             kAllowedInEnvvar);
   AddOption("--experimental-addon-modules",
             "experimental import support for addons",
-            &EnvironmentOptions::experimental_addon_modules,
+            BOOL_FIELD(experimental_addon_modules),
+            kAllowedInEnvvar);
+  AddOption("--experimental-bench",
+            "experimental node:bench module and benchmark runner",
+            BOOL_FIELD(experimental_bench),
             kAllowedInEnvvar);
   AddOption("--experimental-abortcontroller", "", NoOp{}, kAllowedInEnvvar);
   AddOption("--experimental-eventsource",
             "experimental EventSource API",
-            &EnvironmentOptions::experimental_eventsource,
+            BOOL_FIELD(experimental_eventsource),
             kAllowedInEnvvar,
             false);
   AddOption("--experimental-fetch", "", NoOp{}, kAllowedInEnvvar);
 #if HAVE_FFI
   AddOption("--experimental-ffi",
             "experimental node:ffi module",
-            &EnvironmentOptions::experimental_ffi,
+            BOOL_FIELD(experimental_ffi),
             kAllowedInEnvvar,
-            false);
+            HAVE_FFI);
 #endif  // HAVE_FFI
+  AddOption("--experimental-web-worker",
+            "experimental Web Worker API",
+            BOOL_FIELD(experimental_web_worker),
+            kAllowedInEnvvar,
+            false);
   AddOption("--experimental-websocket",
             "experimental WebSocket API",
-            &EnvironmentOptions::experimental_websocket,
+            BOOL_FIELD(experimental_websocket),
             kAllowedInEnvvar,
             true);
   AddOption("--experimental-global-customevent", "", NoOp{}, kAllowedInEnvvar);
   AddOption("--experimental-sqlite",
             "experimental node:sqlite module",
-            &EnvironmentOptions::experimental_sqlite,
+            BOOL_FIELD(experimental_sqlite),
             kAllowedInEnvvar,
             HAVE_SQLITE);
   AddOption("--experimental-stream-iter",
             "experimental iterable streams API (node:stream/iter)",
-            &EnvironmentOptions::experimental_stream_iter,
+            BOOL_FIELD(experimental_stream_iter),
+            kAllowedInEnvvar);
+  AddOption("--experimental-dtls",
+#if HAVE_DTLS
+            "experimental DTLS support",
+            BOOL_FIELD(experimental_dtls),
+#else
+            "" /* undocumented when no-op */,
+            NoOp{},
+#endif
             kAllowedInEnvvar);
   AddOption("--experimental-vfs",
             "experimental node:vfs module",
-            &EnvironmentOptions::experimental_vfs,
+            BOOL_FIELD(experimental_vfs),
             kAllowedInEnvvar);
   AddOption("--experimental-quic",
 #ifndef OPENSSL_NO_QUIC
             "experimental QUIC support",
-            &EnvironmentOptions::experimental_quic,
+            BOOL_FIELD(experimental_quic),
 #else
             "" /* undocumented when no-op */,
             NoOp{},
@@ -625,7 +706,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar);
   AddOption("--experimental-webstorage",
             "experimental Web Storage API",
-            &EnvironmentOptions::webstorage,
+            BOOL_FIELD(webstorage),
             kAllowedInEnvvar,
             HAVE_SQLITE);
   AddAlias("--webstorage", "--experimental-webstorage");
@@ -635,7 +716,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar);
   AddOption("--experimental-global-navigator",
             "expose experimental Navigator API on the global scope",
-            &EnvironmentOptions::experimental_global_navigator,
+            BOOL_FIELD(experimental_global_navigator),
             kAllowedInEnvvar,
             true);
   AddOption("--experimental-global-webcrypto", "", NoOp{}, kAllowedInEnvvar);
@@ -650,21 +731,21 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
   AddOption("--experimental-import-text",
             "experimental support for importing source as text with import "
             "attributes",
-            &EnvironmentOptions::experimental_import_text,
+            BOOL_FIELD(experimental_import_text),
             kAllowedInEnvvar);
   AddOption("--experimental-import-meta-resolve",
             "experimental ES Module import.meta.resolve() parentURL support",
-            &EnvironmentOptions::experimental_import_meta_resolve,
+            BOOL_FIELD(experimental_import_meta_resolve),
             kAllowedInEnvvar);
   AddOption("--permission",
             "enable the permission system",
-            &EnvironmentOptions::permission,
+            BOOL_FIELD(permission),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
   AddOption("--permission-audit",
             "enable audit only for the permission system",
-            &EnvironmentOptions::permission_audit,
+            BOOL_FIELD(permission_audit),
             kAllowedInEnvvar,
             false);
   AddOption("--allow-fs-read",
@@ -677,64 +758,70 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             &EnvironmentOptions::allow_fs_write,
             kAllowedInEnvvar,
             OptionNamespaces::kPermissionNamespace);
+  AddOption("--allow-fs-vfs",
+            "allow mounting a virtual file system when any permissions are set",
+            BOOL_FIELD(allow_fs_vfs),
+            kAllowedInEnvvar,
+            false,
+            OptionNamespaces::kPermissionNamespace);
   AddOption("--allow-addons",
             "allow use of addons when any permissions are set",
-            &EnvironmentOptions::allow_addons,
+            BOOL_FIELD(allow_addons),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
   AddOption("--allow-child-process",
             "allow use of child process when any permissions are set",
-            &EnvironmentOptions::allow_child_process,
+            BOOL_FIELD(allow_child_process),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
 #if HAVE_FFI
   AddOption("--allow-ffi",
             "allow use of FFI when any permissions are set",
-            &EnvironmentOptions::allow_ffi,
+            BOOL_FIELD(allow_ffi),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
 #endif  // HAVE_FFI
   AddOption("--allow-inspector",
             "allow use of inspector when any permissions are set",
-            &EnvironmentOptions::allow_inspector,
+            BOOL_FIELD(allow_inspector),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
   AddOption("--allow-net",
             "allow use of network when any permissions are set",
-            &EnvironmentOptions::allow_net,
+            BOOL_FIELD(allow_net),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
   AddOption("--allow-wasi",
             "allow wasi when any permissions are set",
-            &EnvironmentOptions::allow_wasi,
+            BOOL_FIELD(allow_wasi),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
   AddOption("--allow-worker",
             "allow worker threads when any permissions are set",
-            &EnvironmentOptions::allow_worker_threads,
+            BOOL_FIELD(allow_worker_threads),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
   AddOption("--experimental-repl-await",
             "experimental await keyword support in REPL",
-            &EnvironmentOptions::experimental_repl_await,
+            BOOL_FIELD(experimental_repl_await),
             kAllowedInEnvvar,
             true);
   AddOption("--allow-openssl-store",
             "allow use of OpenSSL STORE loaders when any permissions are set",
-            &EnvironmentOptions::allow_openssl_store,
+            BOOL_FIELD(allow_openssl_store),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
   AddOption("--experimental-vm-modules",
             "experimental ES Module support in vm module",
-            &EnvironmentOptions::experimental_vm_modules,
+            BOOL_FIELD(experimental_vm_modules),
             kAllowedInEnvvar);
   AddOption("--experimental-worker", "", NoOp{}, kAllowedInEnvvar);
   AddOption("--experimental-report", "", NoOp{}, kAllowedInEnvvar);
@@ -743,13 +830,13 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
   AddOption("--expose-gc", "expose gc extension", V8Option{}, kAllowedInEnvvar);
   AddOption("--async-context-frame",
             "Improve AsyncLocalStorage performance with AsyncContextFrame",
-            &EnvironmentOptions::async_context_frame,
+            BOOL_FIELD(async_context_frame),
             kAllowedInEnvvar,
             true);
-  AddOption("--expose-internals", "", &EnvironmentOptions::expose_internals);
+  AddOption("--expose-internals", "", BOOL_FIELD(expose_internals));
   AddOption("--frozen-intrinsics",
             "experimental frozen intrinsics support",
-            &EnvironmentOptions::frozen_intrinsics,
+            BOOL_FIELD(frozen_intrinsics),
             kAllowedInEnvvar);
   AddOption("--heapsnapshot-signal",
             "Generate heap snapshot on specified signal",
@@ -764,7 +851,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
   AddOption("--http-parser", "", NoOp{}, kAllowedInEnvvar);
   AddOption("--insecure-http-parser",
             "use an insecure HTTP parser that accepts invalid HTTP headers",
-            &EnvironmentOptions::insecure_http_parser,
+            BOOL_FIELD(insecure_http_parser),
             kAllowedInEnvvar);
   AddOption("--input-type",
             "set module type for string input",
@@ -776,33 +863,33 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
            "--experimental-specifier-resolution");
   AddOption("--deprecation",
             "silence deprecation warnings",
-            &EnvironmentOptions::deprecation,
+            BOOL_FIELD(deprecation),
             kAllowedInEnvvar,
             true);
   AddOption("--force-async-hooks-checks",
             "disable checks for async_hooks",
-            &EnvironmentOptions::force_async_hooks_checks,
+            BOOL_FIELD(force_async_hooks_checks),
             kAllowedInEnvvar,
             true);
   AddOption(
       "--force-node-api-uncaught-exceptions-policy",
       "enforces 'uncaughtException' event on Node API asynchronous callbacks",
-      &EnvironmentOptions::force_node_api_uncaught_exceptions_policy,
+      BOOL_FIELD(force_node_api_uncaught_exceptions_policy),
       kAllowedInEnvvar,
       false);
   AddOption("--addons",
             "disable loading native addons",
-            &EnvironmentOptions::allow_native_addons,
+            BOOL_FIELD(allow_native_addons),
             kAllowedInEnvvar,
             true);
   AddOption("--global-search-paths",
             "disable global module search paths",
-            &EnvironmentOptions::global_search_paths,
+            BOOL_FIELD(global_search_paths),
             kAllowedInEnvvar,
             true);
   AddOption("--warnings",
             "silence all process warnings",
-            &EnvironmentOptions::warnings,
+            BOOL_FIELD(warnings),
             kAllowedInEnvvar,
             true);
   AddOption("--disable-warning",
@@ -811,32 +898,32 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar);
   AddOption("--force-context-aware",
             "disable loading non-context-aware addons",
-            &EnvironmentOptions::force_context_aware,
+            BOOL_FIELD(force_context_aware),
             kAllowedInEnvvar);
   AddOption("--pending-deprecation",
             "emit pending deprecation warnings",
-            &EnvironmentOptions::pending_deprecation,
+            BOOL_FIELD(pending_deprecation),
             kAllowedInEnvvar);
   AddOption("--use-env-proxy",
             "parse proxy settings from HTTP_PROXY/HTTPS_PROXY/NO_PROXY"
             "environment variables and apply the setting in global HTTP/HTTPS "
             "clients",
-            &EnvironmentOptions::use_env_proxy,
+            BOOL_FIELD(use_env_proxy),
             kAllowedInEnvvar);
   AddOption("--preserve-symlinks",
             "preserve symbolic links when resolving",
-            &EnvironmentOptions::preserve_symlinks,
+            BOOL_FIELD(preserve_symlinks),
             kAllowedInEnvvar);
   AddOption("--preserve-symlinks-main",
             "preserve symbolic links when resolving the main module",
-            &EnvironmentOptions::preserve_symlinks_main,
+            BOOL_FIELD(preserve_symlinks_main),
             kAllowedInEnvvar);
   AddOption("--prof",
             "Generate V8 profiler output.",
             V8Option{});
   AddOption("--prof-process",
             "process V8 profiler output generated using --prof",
-            &EnvironmentOptions::prof_process);
+            BOOL_FIELD(prof_process));
   // Options after --prof-process are passed through to the prof processor.
   AddAlias("--prof-process", {"--prof-process", "--"});
 #if HAVE_INSPECTOR
@@ -844,7 +931,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "Start the V8 CPU profiler on start up, and write the CPU profile "
             "to disk before exit. If --cpu-prof-dir is not specified, write "
             "the profile to the current working directory.",
-            &EnvironmentOptions::cpu_prof,
+            BOOL_FIELD(cpu_prof),
             kAllowedInEnvvar);
   AddOption("--cpu-prof-name",
             "specified file name of the V8 CPU profile generated with "
@@ -863,22 +950,22 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar);
   AddOption("--experimental-network-inspection",
             "experimental network inspection support",
-            &EnvironmentOptions::experimental_network_inspection);
+            BOOL_FIELD(experimental_network_inspection));
   AddOption("--experimental-storage-inspection",
             "experimental storage inspection support",
-            &EnvironmentOptions::experimental_storage_inspection);
+            BOOL_FIELD(experimental_storage_inspection));
   AddOption("--experimental-worker-inspection",
             "experimental worker inspection support",
-            &EnvironmentOptions::experimental_worker_inspection);
+            BOOL_FIELD(experimental_worker_inspection));
   AddOption("--experimental-inspector-network-resource",
             "experimental load network resources via the inspector",
-            &EnvironmentOptions::experimental_inspector_network_resource);
+            BOOL_FIELD(experimental_inspector_network_resource));
   AddOption(
       "--heap-prof",
       "Start the V8 heap profiler on start up, and write the heap profile "
       "to disk before exit. If --heap-prof-dir is not specified, write "
       "the profile to the current working directory.",
-      &EnvironmentOptions::heap_prof,
+      BOOL_FIELD(heap_prof),
       kAllowedInEnvvar);
   AddOption("--heap-prof-name",
             "specified file name of the V8 heap profile generated with "
@@ -904,8 +991,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "write warnings to file instead of stderr",
             &EnvironmentOptions::redirect_warnings,
             kAllowedInEnvvar);
-  AddOption(
-      "[has_env_file_string]", "", &EnvironmentOptions::has_env_file_string);
+  AddOption("[has_env_file_string]", "", BOOL_FIELD(has_env_file_string));
   AddOption("--env-file",
             "set environment variables from supplied file",
             &EnvironmentOptions::env_file);
@@ -923,9 +1009,60 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "use the specified file for package map resolution",
             &EnvironmentOptions::experimental_package_map_path,
             kAllowedInEnvvar);
+  AddOption("[has_bench_options]", "", BOOL_FIELD(has_bench_options));
+  AddOption("--bench",
+            "launch benchmark runner on startup",
+            BOOL_FIELD(bench_runner),
+            kDisallowedInEnvvar,
+            false,
+            OptionNamespaces::kBenchRunnerNamespace);
+  Implies("--bench", "[has_bench_options]");
+  AddOption("--bench-isolation",
+            "configures the type of benchmark isolation used in the benchmark "
+            "runner",
+            &EnvironmentOptions::bench_isolation,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace);
+  Implies("--bench-isolation", "[has_bench_options]");
+  AddOption("--bench-name-pattern",
+            "run benchmarks whose name matches this regular expression",
+            &EnvironmentOptions::bench_name_pattern,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace);
+  Implies("--bench-name-pattern", "[has_bench_options]");
+  AddOption("--bench-reporter",
+            "report benchmark output using the given reporter",
+            &EnvironmentOptions::bench_reporter,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace);
+  Implies("--bench-reporter", "[has_bench_options]");
+  AddOption("--bench-reporter-destination",
+            "report the given benchmark reporter to the given destination",
+            &EnvironmentOptions::bench_reporter_destination,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace);
+  Implies("--bench-reporter-destination", "[has_bench_options]");
+  AddOption("[has_bench_samples]", "", BOOL_FIELD(has_bench_samples));
+  AddOption("--bench-samples",
+            "specify the number of measured benchmark samples",
+            &EnvironmentOptions::bench_samples,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace,
+            kStrictOptionParsing);
+  Implies("--bench-samples", "[has_bench_options]");
+  Implies("--bench-samples", "[has_bench_samples]");
+  AddOption("[has_bench_warmup]", "", BOOL_FIELD(has_bench_warmup));
+  AddOption("--bench-warmup",
+            "specify the number of unreported benchmark warmup samples",
+            &EnvironmentOptions::bench_warmup,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace,
+            kStrictOptionParsing);
+  Implies("--bench-warmup", "[has_bench_options]");
+  Implies("--bench-warmup", "[has_bench_warmup]");
   AddOption("--test",
             "launch test runner on startup",
-            &EnvironmentOptions::test_runner,
+            BOOL_FIELD(test_runner),
             kDisallowedInEnvvar,
             false,
             OptionNamespaces::kTestRunnerNamespace);
@@ -936,7 +1073,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             OptionNamespaces::kTestRunnerNamespace);
   AddOption("--test-force-exit",
             "force test runner to exit upon completion",
-            &EnvironmentOptions::test_runner_force_exit,
+            BOOL_FIELD(test_runner_force_exit),
             kDisallowedInEnvvar,
             false,
             OptionNamespaces::kTestRunnerNamespace);
@@ -947,13 +1084,13 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             OptionNamespaces::kTestRunnerNamespace);
   AddOption("--test-update-snapshots",
             "regenerate test snapshots",
-            &EnvironmentOptions::test_runner_update_snapshots,
+            BOOL_FIELD(test_runner_update_snapshots),
             kDisallowedInEnvvar,
             false,
             OptionNamespaces::kTestRunnerNamespace);
   AddOption("--experimental-test-coverage",
             "enable code coverage in the test runner",
-            &EnvironmentOptions::test_runner_coverage,
+            BOOL_FIELD(test_runner_coverage),
             kDisallowedInEnvvar,
             false,
             OptionNamespaces::kTestRunnerNamespace);
@@ -981,7 +1118,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
   AddAlias("--experimental-test-isolation", "--test-isolation");
   AddOption("--experimental-test-module-mocks",
             "enable module mocking in the test runner",
-            &EnvironmentOptions::test_runner_module_mocks,
+            BOOL_FIELD(test_runner_module_mocks),
             kDisallowedInEnvvar,
             false,
             OptionNamespaces::kTestRunnerNamespace);
@@ -1007,7 +1144,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             OptionNamespaces::kTestRunnerNamespace);
   AddOption("--test-only",
             "run tests with 'only' option set",
-            &EnvironmentOptions::test_only,
+            BOOL_FIELD(test_only),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kTestRunnerNamespace);
@@ -1034,7 +1171,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
   AddOption("--test-coverage-include-all",
             "include source files that were never loaded in the coverage "
             "report",
-            &EnvironmentOptions::coverage_include_all,
+            BOOL_FIELD(coverage_include_all),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kTestRunnerNamespace);
@@ -1050,12 +1187,11 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             OptionNamespaces::kTestRunnerNamespace);
   AddOption("--test-randomize",
             "run tests in a random order",
-            &EnvironmentOptions::test_randomize,
+            BOOL_FIELD(test_randomize),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kTestRunnerNamespace);
-  AddOption(
-      "[has_test_random_seed]", "", &EnvironmentOptions::has_test_random_seed);
+  AddOption("[has_test_random_seed]", "", BOOL_FIELD(has_test_random_seed));
   AddOption("--test-random-seed",
             "seed used to randomize test execution order",
             &EnvironmentOptions::test_random_seed,
@@ -1069,63 +1205,63 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             OptionNamespaces::kTestRunnerNamespace);
   AddOption("--test-udp-no-try-send",
             "",  // For testing only.
-            &EnvironmentOptions::test_udp_no_try_send,
+            BOOL_FIELD(test_udp_no_try_send),
             kDisallowedInEnvvar);
   AddOption("--throw-deprecation",
             "throw an exception on deprecations",
-            &EnvironmentOptions::throw_deprecation,
+            BOOL_FIELD(throw_deprecation),
             kAllowedInEnvvar);
   AddOption("--trace-deprecation",
             "show stack traces on deprecations",
-            &EnvironmentOptions::trace_deprecation,
+            BOOL_FIELD(trace_deprecation),
             kAllowedInEnvvar);
   AddOption("--trace-exit",
             "show stack trace when an environment exits",
-            &EnvironmentOptions::trace_exit,
+            BOOL_FIELD(trace_exit),
             kAllowedInEnvvar);
   AddOption("--trace-sync-io",
             "show stack trace when use of sync IO is detected after the "
             "first tick",
-            &EnvironmentOptions::trace_sync_io,
+            BOOL_FIELD(trace_sync_io),
             kAllowedInEnvvar);
   AddOption("--trace-tls",
             "prints TLS packet trace information to stderr",
-            &EnvironmentOptions::trace_tls,
+            BOOL_FIELD(trace_tls),
             kAllowedInEnvvar);
   AddOption("--trace-uncaught",
             "show stack traces for the `throw` behind uncaught exceptions",
-            &EnvironmentOptions::trace_uncaught,
+            BOOL_FIELD(trace_uncaught),
             kAllowedInEnvvar);
   AddOption("--trace-warnings",
             "show stack traces on process warnings",
-            &EnvironmentOptions::trace_warnings,
+            BOOL_FIELD(trace_warnings),
             kAllowedInEnvvar);
   AddOption("--trace-promises",
             "show stack traces on promise initialization and resolution",
-            &EnvironmentOptions::trace_promises,
+            BOOL_FIELD(trace_promises),
             kAllowedInEnvvar);
 
   AddOption("--trace-env",
             "Print accesses to the environment variables",
-            &EnvironmentOptions::trace_env,
+            BOOL_FIELD(trace_env),
             kAllowedInEnvvar);
   Implies("--trace-env-js-stack", "--trace-env");
   Implies("--trace-env-native-stack", "--trace-env");
   AddOption("--trace-env-js-stack",
             "Print accesses to the environment variables and the JavaScript "
             "stack trace",
-            &EnvironmentOptions::trace_env_js_stack,
+            BOOL_FIELD(trace_env_js_stack),
             kAllowedInEnvvar);
   AddOption(
       "--trace-env-native-stack",
       "Print accesses to the environment variables and the native stack trace",
-      &EnvironmentOptions::trace_env_native_stack,
+      BOOL_FIELD(trace_env_native_stack),
       kAllowedInEnvvar);
 
 #if HAVE_OPENSSL
   AddOption("--use-system-ca",
             "use system's CA store",
-            &EnvironmentOptions::use_system_ca,
+            BOOL_FIELD(use_system_ca),
             kAllowedInEnvvar);
 #endif  // HAVE_OPENSSL
 
@@ -1138,7 +1274,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
 
   AddOption("--extra-info-on-fatal-exception",
             "hide extra information on fatal exception that causes exit",
-            &EnvironmentOptions::extra_info_on_fatal_exception,
+            BOOL_FIELD(extra_info_on_fatal_exception),
             kAllowedInEnvvar,
             true);
   AddOption("--unhandled-rejections",
@@ -1152,11 +1288,11 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar);
   AddOption("--verify-base-objects",
             "", /* undocumented, only for debugging */
-            &EnvironmentOptions::verify_base_objects,
+            BOOL_FIELD(verify_base_objects),
             kAllowedInEnvvar);
   AddOption("--watch",
             "run in watch mode",
-            &EnvironmentOptions::watch_mode,
+            BOOL_FIELD(watch_mode),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kWatchNamespace);
@@ -1173,14 +1309,14 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             OptionNamespaces::kWatchNamespace);
   AddOption("--watch-preserve-output",
             "preserve outputs on watch mode restart",
-            &EnvironmentOptions::watch_mode_preserve_output,
+            BOOL_FIELD(watch_mode_preserve_output),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kWatchNamespace);
   Implies("--watch-path", "--watch");
   AddOption("--check",
             "syntax check script without executing",
-            &EnvironmentOptions::syntax_check_only);
+            BOOL_FIELD(syntax_check_only));
   AddAlias("-c", "--check");
   // This option is only so that we can tell --eval with an empty string from
   // no eval at all. Having it not start with a dash makes it inaccessible
@@ -1188,12 +1324,11 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
   // TODO(addaleax): When moving --help over to something generated from the
   // programmatic descriptions, this will need some special care.
   // (See also [ssl_openssl_cert_store] below.)
-  AddOption("[has_eval_string]", "", &EnvironmentOptions::has_eval_string);
+  AddOption("[has_eval_string]", "", BOOL_FIELD(has_eval_string));
   AddOption("--eval", "evaluate script", &EnvironmentOptions::eval_string);
   Implies("--eval", "[has_eval_string]");
-  AddOption("--print",
-            "evaluate script and print result",
-            &EnvironmentOptions::print_eval);
+  AddOption(
+      "--print", "evaluate script and print result", BOOL_FIELD(print_eval));
   AddAlias("-e", "--eval");
   AddAlias("--print <arg>", "-pe");
   AddAlias("-pe", { "--print", "--eval" });
@@ -1209,14 +1344,14 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar);
   AddOption("--strip-types",
             "Type-stripping for TypeScript files.",
-            &EnvironmentOptions::strip_types,
+            BOOL_FIELD(strip_types),
             kAllowedInEnvvar,
             HAVE_AMARO);
   AddAlias("--experimental-strip-types", "--strip-types");
   AddOption("--interactive",
             "always enter the REPL even if stdin does not appear "
             "to be a terminal",
-            &EnvironmentOptions::force_repl);
+            BOOL_FIELD(force_repl));
   AddAlias("-i", "--interactive");
 
   AddOption("--napi-modules", "", NoOp{}, kAllowedInEnvvar);
@@ -1228,23 +1363,23 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
 
   AddOption("--tls-min-v1.0",
             "set default TLS minimum to TLSv1.0 (default: TLSv1.2)",
-            &EnvironmentOptions::tls_min_v1_0,
+            BOOL_FIELD(tls_min_v1_0),
             kAllowedInEnvvar);
   AddOption("--tls-min-v1.1",
             "set default TLS minimum to TLSv1.1 (default: TLSv1.2)",
-            &EnvironmentOptions::tls_min_v1_1,
+            BOOL_FIELD(tls_min_v1_1),
             kAllowedInEnvvar);
   AddOption("--tls-min-v1.2",
             "set default TLS minimum to TLSv1.2 (default: TLSv1.2)",
-            &EnvironmentOptions::tls_min_v1_2,
+            BOOL_FIELD(tls_min_v1_2),
             kAllowedInEnvvar);
   AddOption("--tls-min-v1.3",
             "set default TLS minimum to TLSv1.3 (default: TLSv1.2)",
-            &EnvironmentOptions::tls_min_v1_3,
+            BOOL_FIELD(tls_min_v1_3),
             kAllowedInEnvvar);
   AddOption("--tls-max-v1.2",
             "set default TLS maximum to TLSv1.2 (default: TLSv1.3)",
-            &EnvironmentOptions::tls_max_v1_2,
+            BOOL_FIELD(tls_max_v1_2),
             kAllowedInEnvvar);
   // Current plan is:
   // - 11.x and below: TLS1.3 is opt-in with --tls-max-v1.3
@@ -1252,26 +1387,32 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
   // In either case, support both options they are uniformly available.
   AddOption("--tls-max-v1.3",
             "set default TLS maximum to TLSv1.3 (default: TLSv1.3)",
-            &EnvironmentOptions::tls_max_v1_3,
+            BOOL_FIELD(tls_max_v1_3),
             kAllowedInEnvvar);
 
   AddOption("--report-exclude-env",
             "Exclude environment variables when generating report"
             " (default: false)",
-            &EnvironmentOptions::report_exclude_env,
+            BOOL_FIELD(report_exclude_env),
             kAllowedInEnvvar);
   AddOption("--report-exclude-network",
             "exclude network interface diagnostics."
             " (default: false)",
-            &EnvironmentOptions::report_exclude_network,
+            BOOL_FIELD(report_exclude_network),
             kAllowedInEnvvar);
 }
 
 PerIsolateOptionsParser::PerIsolateOptionsParser(
   const EnvironmentOptionsParser& eop) {
+  AddOption("--worker-snapshot",
+            "start worker threads from the bootstrapped context in the "
+            "built-in startup snapshot",
+            BOOL_FIELD(worker_snapshot),
+            kAllowedInEnvvar,
+            true);
   AddOption("--track-heap-objects",
             "track heap object allocations for heap snapshots",
-            &PerIsolateOptions::track_heap_objects,
+            BOOL_FIELD(track_heap_objects),
             kAllowedInEnvvar);
 
   // Explicitly add some V8 flags to mark them as allowed in NODE_OPTIONS.
@@ -1311,11 +1452,11 @@ PerIsolateOptionsParser::PerIsolateOptionsParser(
             kAllowedInEnvvar);
   AddOption("--report-uncaught-exception",
             "generate diagnostic report on uncaught exceptions",
-            &PerIsolateOptions::report_uncaught_exception,
+            BOOL_FIELD(report_uncaught_exception),
             kAllowedInEnvvar);
   AddOption("--report-on-signal",
             "generate diagnostic report upon receiving signals",
-            &PerIsolateOptions::report_on_signal,
+            BOOL_FIELD(report_on_signal),
             kAllowedInEnvvar);
   AddOption("--report-signal",
             "causes diagnostic report to be produced on provided signal,"
@@ -1332,7 +1473,7 @@ PerIsolateOptionsParser::PerIsolateOptionsParser(
 
   AddOption("--experimental-shadow-realm",
             "",
-            &PerIsolateOptions::experimental_shadow_realm,
+            BOOL_FIELD(experimental_shadow_realm),
             kAllowedInEnvvar);
   AddOption("--harmony-shadow-realm", "", V8Option{});
   Implies("--experimental-shadow-realm", "--harmony-shadow-realm");
@@ -1340,7 +1481,7 @@ PerIsolateOptionsParser::PerIsolateOptionsParser(
   ImpliesNot("--no-harmony-shadow-realm", "--experimental-shadow-realm");
   AddOption("--build-snapshot",
             "Generate a snapshot blob when the process exits.",
-            &PerIsolateOptions::build_snapshot,
+            BOOL_FIELD(build_snapshot),
             kDisallowedInEnvvar);
   AddOption("--build-snapshot-config",
             "Generate a snapshot blob when the process exits using a"
@@ -1375,11 +1516,11 @@ PerProcessOptionsParser::PerProcessOptionsParser(
             kAllowedInEnvvar);
   AddOption("--zero-fill-buffers",
             "automatically zero-fill all newly allocated Buffer instances",
-            &PerProcessOptions::zero_fill_all_buffers,
+            BOOL_FIELD(zero_fill_all_buffers),
             kAllowedInEnvvar);
   AddOption("--debug-arraybuffer-allocations",
             "", /* undocumented, only for debugging */
-            &PerProcessOptions::debug_arraybuffer_allocations,
+            BOOL_FIELD(debug_arraybuffer_allocations),
             kAllowedInEnvvar);
   AddOption("--disable-proto",
             "disable Object.prototype.__proto__",
@@ -1387,7 +1528,7 @@ PerProcessOptionsParser::PerProcessOptionsParser(
             kAllowedInEnvvar);
   AddOption("--node-snapshot",
             "",  // It's a debug-only option.
-            &PerProcessOptions::node_snapshot,
+            BOOL_FIELD(node_snapshot),
             kAllowedInEnvvar);
   AddOption("--snapshot-blob",
             "Path to the snapshot blob that's either the result of snapshot"
@@ -1403,20 +1544,18 @@ PerProcessOptionsParser::PerProcessOptionsParser(
   AddAlias("--security-reverts", "--security-revert");
   AddOption("--completion-bash",
             "print source-able bash completion script",
-            &PerProcessOptions::print_bash_completion);
-  AddOption("--help",
-            "print node command line options",
-            &PerProcessOptions::print_help);
-  AddAlias("-h", "--help");
+            BOOL_FIELD(print_bash_completion));
   AddOption(
-      "--version", "print Node.js version", &PerProcessOptions::print_version);
+      "--help", "print node command line options", BOOL_FIELD(print_help));
+  AddAlias("-h", "--help");
+  AddOption("--version", "print Node.js version", BOOL_FIELD(print_version));
   AddAlias("-v", "--version");
   AddOption("--v8-options",
             "print V8 command line options",
-            &PerProcessOptions::print_v8_help);
+            BOOL_FIELD(print_v8_help));
   AddOption("--report-compact",
             "output compact single-line JSON",
-            &PerProcessOptions::report_compact,
+            BOOL_FIELD(report_compact),
             kAllowedInEnvvar);
   AddOption("--report-dir",
             "define custom report pathname."
@@ -1431,7 +1570,7 @@ PerProcessOptionsParser::PerProcessOptionsParser(
             kAllowedInEnvvar);
   AddOption("--report-on-fatalerror",
             "generate diagnostic report on fatal (internal) errors",
-            &PerProcessOptions::report_on_fatalerror,
+            BOOL_FIELD(report_on_fatalerror),
             kAllowedInEnvvar);
 
 #ifdef NODE_HAVE_I18N_SUPPORT
@@ -1461,7 +1600,7 @@ PerProcessOptionsParser::PerProcessOptionsParser(
             " (default)"
 #endif
             ,
-            &PerProcessOptions::use_openssl_ca,
+            BOOL_FIELD(use_openssl_ca),
             kAllowedInEnvvar);
   AddOption("--use-bundled-ca",
             "use bundled CA store"
@@ -1469,24 +1608,32 @@ PerProcessOptionsParser::PerProcessOptionsParser(
             " (default)"
 #endif
             ,
-            &PerProcessOptions::use_bundled_ca,
+            BOOL_FIELD(use_bundled_ca),
             kAllowedInEnvvar);
   // Similar to [has_eval_string] above, except that the separation between
   // this and use_openssl_ca only exists for option validation after parsing.
   // This is not ideal.
-  AddOption("[ssl_openssl_cert_store]",
-            "",
-            &PerProcessOptions::ssl_openssl_cert_store);
+  AddOption("[ssl_openssl_cert_store]", "", BOOL_FIELD(ssl_openssl_cert_store));
   Implies("--use-openssl-ca", "[ssl_openssl_cert_store]");
   ImpliesNot("--use-bundled-ca", "[ssl_openssl_cert_store]");
   AddOption("--enable-fips",
             "enable FIPS crypto at startup",
-            &PerProcessOptions::enable_fips_crypto,
+            BOOL_FIELD(enable_fips_crypto),
+            kAllowedInEnvvar);
+  AddOption("--enable-fips-indicator-events",
+            "publish FIPS indicator results to the "
+            "crypto.fips.indicator diagnostics channel",
+            BOOL_FIELD(enable_fips_indicator_events),
             kAllowedInEnvvar);
   AddOption("--force-fips",
-            "force FIPS crypto (cannot be disabled)",
-            &PerProcessOptions::force_fips_crypto,
+            "force FIPS crypto (optional mode: provider or strict)",
+            BOOL_FIELD(force_fips_crypto),
             kAllowedInEnvvar);
+  AddOption("[force_fips_crypto_policy]",
+            "",
+            &PerProcessOptions::force_fips_crypto_policy,
+            kAllowedInEnvvar);
+  AddAlias("--force-fips=", {"[force_fips_crypto_policy]", "--force-fips"});
 #ifndef V8_ENABLE_SANDBOX
   AddOption("--secure-heap",
             "total size of the OpenSSL secure heap",
@@ -1501,25 +1648,24 @@ PerProcessOptionsParser::PerProcessOptionsParser(
 #if OPENSSL_VERSION_MAJOR >= 3
   AddOption("--openssl-legacy-provider",
             "enable OpenSSL 3.0 legacy provider",
-            &PerProcessOptions::openssl_legacy_provider,
+            BOOL_FIELD(openssl_legacy_provider),
             kAllowedInEnvvar);
   AddOption("--openssl-shared-config",
             "enable OpenSSL shared configuration",
-            &PerProcessOptions::openssl_shared_config,
+            BOOL_FIELD(openssl_shared_config),
             kAllowedInEnvvar);
 
 #endif  // OPENSSL_VERSION_MAJOR
   AddOption("--use-largepages",
-            "Map the Node.js static code to large pages. Options are "
-            "'off' (the default value, meaning do not map), "
-            "'on' (map and ignore failure, reporting it to stderr), "
-            "or 'silent' (map and silently ignore failure)",
+            "This option is no longer supported and a no-op. It still accepts"
+            " these values for compatibility: 'off' (default), 'on' (report a "
+            "warning to stderr), or 'silent' (same as 'off').",
             &PerProcessOptions::use_largepages,
             kAllowedInEnvvar);
 
   AddOption("--trace-sigint",
             "enable printing JavaScript stacktrace on SIGINT",
-            &PerProcessOptions::trace_sigint,
+            BOOL_FIELD(trace_sigint),
             kAllowedInEnvvar);
 
   Insert(iop, &PerProcessOptions::get_per_isolate_options);
@@ -1544,7 +1690,7 @@ PerProcessOptionsParser::PerProcessOptionsParser(
       "Disable trap-handler-based WebAssembly bound checks. V8 will insert "
       "inline bound checks when compiling WebAssembly which may slow down "
       "performance.",
-      &PerProcessOptions::disable_wasm_trap_handler,
+      BOOL_FIELD(disable_wasm_trap_handler),
       kAllowedInEnvvar);
 
   AddOption("--build-sea",
@@ -1769,7 +1915,7 @@ void GetCLIOptionsValues(const FunctionCallbackInfo<Value>& args) {
         }
         break;
       case kBoolean: {
-        bool original_value = *_ppop_instance.Lookup<bool>(field, opts);
+        bool original_value = field->GetBool(opts);
         value = Boolean::New(isolate, original_value);
 
         // Add --no-* entries.
@@ -2073,6 +2219,12 @@ void GetOptionsAsFlags(const FunctionCallbackInfo<Value>& args) {
     const auto& option_info = item.second;
     auto field = option_info.field;
 
+    if (option_info.namespace_id ==
+            NamespaceEnumToString(OptionNamespaces::kBenchRunnerNamespace) &&
+        !opts->per_isolate->per_env->experimental_bench) {
+      continue;
+    }
+
     // TODO(pmarchini): Skip internal options for the moment as probably not
     // required
     if (option_name.empty() || option_name.starts_with('[')) {
@@ -2086,7 +2238,13 @@ void GetOptionsAsFlags(const FunctionCallbackInfo<Value>& args) {
 
     switch (option_info.type) {
       case kBoolean: {
-        bool current_value = *_ppop_instance.Lookup<bool>(field, opts);
+        bool current_value = field->GetBool(opts);
+#if HAVE_OPENSSL
+        if (option_name == "--force-fips" && current_value) {
+          flags.push_back(option_name + "=" + opts->force_fips_crypto_policy);
+          break;
+        }
+#endif
         // For boolean options with default_is_true, we want the opposite logic
         if (option_info.default_is_true) {
           if (!current_value) {
diff --git a/src/node_options.h b/src/node_options.h
index 24df9254cd49..af4da96c6be9 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -18,6 +18,9 @@
 
 namespace node {
 
+// Helper macro for defining a 1-bit boolean field in a struct.
+#define DEFINE_BOOL_FIELD(field) bool field : 1
+
 class HostPort {
  public:
   HostPort(const std::string& host_name, int port)
@@ -53,8 +56,8 @@ class Options {
 };
 
 struct InspectPublishUid {
-  bool console;
-  bool http;
+  DEFINE_BOOL_FIELD(console);
+  DEFINE_BOOL_FIELD(http);
 };
 
 // These options are currently essentially per-Environment, but it can be nice
@@ -69,19 +72,20 @@ class DebugOptions : public Options {
   DebugOptions(DebugOptions&&) = default;
   DebugOptions& operator=(DebugOptions&&) = default;
 
-  bool allow_attaching_debugger = true;
+  // --inspect-publish-uid
+  std::string inspect_publish_uid_string = "stderr,http";
+
+  DEFINE_BOOL_FIELD(allow_attaching_debugger) = true;
   // --inspect
-  bool inspector_enabled = false;
+  DEFINE_BOOL_FIELD(inspector_enabled) = false;
   // --inspect-wait
-  bool inspect_wait = false;
+  DEFINE_BOOL_FIELD(inspect_wait) = false;
   // --debug
-  bool deprecated_debug = false;
+  DEFINE_BOOL_FIELD(deprecated_debug) = false;
   // --inspect-brk
-  bool break_first_line = false;
+  DEFINE_BOOL_FIELD(break_first_line) = false;
   // --inspect-brk-node
-  bool break_node_first_line = false;
-  // --inspect-publish-uid
-  std::string inspect_publish_uid_string = "stderr,http";
+  DEFINE_BOOL_FIELD(break_node_first_line) = false;
 
   InspectPublishUid inspect_publish_uid;
 
@@ -118,170 +122,194 @@ class DebugOptions : public Options {
 
 class EnvironmentOptions : public Options {
  public:
-  bool abort_on_uncaught_exception = false;
-  std::vector<std::string> conditions;
-  bool detect_module = true;
-  bool disable_sigusr1 = false;
-  bool print_required_tla = false;
-  bool require_module = true;
+#if HAVE_INSPECTOR
+  static constexpr uint64_t kDefaultCpuProfInterval = 1000;
+  static constexpr uint64_t kDefaultHeapProfInterval = 512 * 1024;
+#endif
+  static constexpr bool IS_DEBUG =
+#ifdef DEBUG
+      true;
+#else
+      false;
+#endif  // DEBUG
+
   std::string dns_result_order;
-  bool enable_source_maps = false;
-  bool experimental_addon_modules = true;
-  bool experimental_eventsource = EXPERIMENTALS_DEFAULT_VALUE;
-  bool experimental_ffi = EXPERIMENTALS_DEFAULT_VALUE;
-  bool experimental_websocket = true;
-  bool experimental_sqlite = HAVE_SQLITE;
-  bool experimental_stream_iter = EXPERIMENTALS_DEFAULT_VALUE;
-  bool experimental_vfs = EXPERIMENTALS_DEFAULT_VALUE;
-  bool webstorage = HAVE_SQLITE;
-  bool experimental_quic = EXPERIMENTALS_DEFAULT_VALUE;
   std::string localstorage_file;
-  bool experimental_global_navigator = true;
-  bool experimental_global_web_crypto = true;
-  bool experimental_import_text = EXPERIMENTALS_DEFAULT_VALUE;
-  bool experimental_import_meta_resolve = EXPERIMENTALS_DEFAULT_VALUE;
   std::string input_type;  // Value of --input-type
-  bool entry_is_url = false;
-  bool permission = false;
-  bool permission_audit = false;
-  std::vector<std::string> allow_fs_read;
-  std::vector<std::string> allow_fs_write;
-  bool allow_addons = false;
-  bool allow_inspector = false;
-  bool allow_child_process = false;
-  bool allow_net = false;
-  bool allow_wasi = false;
-  bool allow_ffi = false;
-  bool allow_openssl_store = false;
-  bool allow_worker_threads = false;
-  bool experimental_repl_await = true;
-  bool experimental_vm_modules = EXPERIMENTALS_DEFAULT_VALUE;
-  bool async_context_frame = true;
-  bool expose_internals = false;
-  bool force_node_api_uncaught_exceptions_policy = false;
-  bool frozen_intrinsics = false;
-  int64_t heap_snapshot_near_heap_limit = 0;
   std::string heap_snapshot_signal;
-  bool network_family_autoselection = true;
-  uint64_t network_family_autoselection_attempt_timeout = 500;
-  uint64_t max_http_header_size = 16 * 1024;
-  bool deprecation = true;
-  bool force_async_hooks_checks = true;
-  bool allow_native_addons = true;
-  bool global_search_paths = true;
-  bool warnings = true;
-  std::vector<std::string> disable_warnings;
-  bool force_context_aware = false;
-  bool pending_deprecation = false;
-  bool preserve_symlinks = false;
-  bool preserve_symlinks_main = false;
-  bool prof_process = false;
+  std::string redirect_warnings;
+  std::string diagnostic_dir;
+  std::string bench_isolation = "process";
+  std::string bench_name_pattern;
+  std::string test_rerun_failures_path;
+  std::string test_global_setup_path;
+  std::string test_isolation = "process";
+  std::string test_shard;
+  std::string trace_require_module;
+  std::string unhandled_rejections;
+  std::string watch_mode_kill_signal = "SIGTERM";
+  std::string eval_string;
+  std::string tls_keylog;
+  std::string experimental_config_file_path;
+  std::string experimental_package_map_path;
 #if HAVE_INSPECTOR
   std::string cpu_prof_dir;
-  static const uint64_t kDefaultCpuProfInterval = 1000;
-  uint64_t cpu_prof_interval = kDefaultCpuProfInterval;
   std::string cpu_prof_name;
-  bool cpu_prof = false;
-  bool experimental_network_inspection = EXPERIMENTALS_DEFAULT_VALUE;
-  bool experimental_worker_inspection = EXPERIMENTALS_DEFAULT_VALUE;
-  bool experimental_storage_inspection = EXPERIMENTALS_DEFAULT_VALUE;
-  bool experimental_inspector_network_resource = EXPERIMENTALS_DEFAULT_VALUE;
   std::string heap_prof_dir;
   std::string heap_prof_name;
-  static const uint64_t kDefaultHeapProfInterval = 512 * 1024;
-  uint64_t heap_prof_interval = kDefaultHeapProfInterval;
-  bool heap_prof = false;
 #endif  // HAVE_INSPECTOR
-  std::string redirect_warnings;
-  std::string diagnostic_dir;
+
+  std::vector<std::string> conditions;
+  std::vector<std::string> allow_fs_read;
+  std::vector<std::string> allow_fs_write;
+  std::vector<std::string> disable_warnings;
+  std::vector<std::string> bench_reporter;
+  std::vector<std::string> bench_reporter_destination;
   std::vector<std::string> env_file;
   std::vector<std::string> optional_env_file;
-  bool has_env_file_string = false;
-  bool test_runner = false;
-  uint64_t test_runner_concurrency = 0;
-  uint64_t test_runner_timeout = 0;
-  bool test_runner_coverage = false;
-  bool test_runner_force_exit = false;
-  uint64_t test_coverage_branches = 0;
-  uint64_t test_coverage_functions = 0;
-  uint64_t test_coverage_lines = 0;
-  bool test_runner_module_mocks = false;
-  bool test_runner_update_snapshots = false;
   std::vector<std::string> test_name_pattern;
   std::vector<std::string> test_reporter;
-  std::string test_rerun_failures_path;
   std::vector<std::string> test_reporter_destination;
-  std::string test_global_setup_path;
-  bool test_randomize = false;
-  bool has_test_random_seed = false;
-  uint64_t test_random_seed = 0;
-  bool test_only = false;
-  bool test_udp_no_try_send = false;
-  std::string test_isolation = "process";
-  std::string test_shard;
   std::vector<std::string> test_skip_pattern;
   std::vector<std::string> experimental_test_tag_filter;
   std::vector<std::string> coverage_include_pattern;
-  bool coverage_include_all = false;
   std::vector<std::string> coverage_exclude_pattern;
-  bool throw_deprecation = false;
-  bool trace_deprecation = false;
-  bool trace_exit = false;
-  bool trace_sync_io = false;
-  bool trace_tls = false;
-  bool trace_uncaught = false;
-  bool trace_warnings = false;
-  bool trace_promises = false;
-  bool trace_env = false;
-  bool trace_env_js_stack = false;
-  bool trace_env_native_stack = false;
-  bool use_system_ca = false;
-  std::string trace_require_module;
-  bool extra_info_on_fatal_exception = true;
-  std::string unhandled_rejections;
   std::vector<std::string> userland_loaders;
-  bool verify_base_objects =
-#ifdef DEBUG
-      true;
-#else
-      false;
-#endif  // DEBUG
-
-  bool watch_mode = false;
-  bool watch_mode_report_to_parent = false;
-  bool watch_mode_preserve_output = false;
-  std::string watch_mode_kill_signal = "SIGTERM";
   std::vector<std::string> watch_mode_paths;
-
-  bool syntax_check_only = false;
-  bool has_eval_string = false;
-  std::string eval_string;
-  bool print_eval = false;
-  bool force_repl = false;
-
-  bool insecure_http_parser = false;
-  bool use_env_proxy = false;
-
-  bool tls_min_v1_0 = false;
-  bool tls_min_v1_1 = false;
-  bool tls_min_v1_2 = false;
-  bool tls_min_v1_3 = false;
-  bool tls_max_v1_2 = false;
-  bool tls_max_v1_3 = false;
-  std::string tls_keylog;
-
   std::vector<std::string> preload_cjs_modules;
-
   std::vector<std::string> preload_esm_modules;
-
-  bool strip_types = HAVE_AMARO;
-
   std::vector<std::string> user_argv;
 
-  bool report_exclude_env = false;
-  bool report_exclude_network = false;
-  std::string experimental_config_file_path;
-  std::string experimental_package_map_path;
+  int64_t heap_snapshot_near_heap_limit = 0;
+  uint64_t network_family_autoselection_attempt_timeout = 500;
+  uint64_t max_http_header_size = 16 * 1024;
+  uint64_t bench_samples = 0;
+  uint64_t bench_warmup = 0;
+  uint64_t test_runner_concurrency = 0;
+  uint64_t test_runner_timeout = 0;
+  uint64_t test_coverage_branches = 0;
+  uint64_t test_coverage_functions = 0;
+  uint64_t test_coverage_lines = 0;
+  uint64_t test_random_seed = 0;
+#if HAVE_INSPECTOR
+  uint64_t cpu_prof_interval = kDefaultCpuProfInterval;
+  uint64_t heap_prof_interval = kDefaultHeapProfInterval;
+#endif  // HAVE_INSPECTOR
+
+  // These are intentionally not bools. They are 1 bit packed flags in
+  // order to reduce the overall size of the struct.
+
+  DEFINE_BOOL_FIELD(abort_on_uncaught_exception) = false;
+  DEFINE_BOOL_FIELD(detect_module) = true;
+  DEFINE_BOOL_FIELD(disable_sigusr1) = false;
+  DEFINE_BOOL_FIELD(print_required_tla) = false;
+  DEFINE_BOOL_FIELD(require_module) = true;
+  DEFINE_BOOL_FIELD(enable_source_maps) = false;
+  DEFINE_BOOL_FIELD(experimental_addon_modules) = true;
+  DEFINE_BOOL_FIELD(experimental_bench) = EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_eventsource) = EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_ffi) = HAVE_FFI;
+  DEFINE_BOOL_FIELD(experimental_web_worker) = EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_websocket) = true;
+  DEFINE_BOOL_FIELD(experimental_sqlite) = HAVE_SQLITE;
+  DEFINE_BOOL_FIELD(experimental_stream_iter) = EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_vfs) = EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(webstorage) = HAVE_SQLITE;
+  DEFINE_BOOL_FIELD(experimental_dtls) = EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_quic) = EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_global_navigator) = true;
+  DEFINE_BOOL_FIELD(experimental_global_web_crypto) = true;
+  DEFINE_BOOL_FIELD(experimental_import_text) = EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_import_meta_resolve) =
+      EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(entry_is_url) = false;
+  DEFINE_BOOL_FIELD(permission) = false;
+  DEFINE_BOOL_FIELD(permission_audit) = false;
+  DEFINE_BOOL_FIELD(allow_addons) = false;
+  DEFINE_BOOL_FIELD(allow_fs_vfs) = false;
+  DEFINE_BOOL_FIELD(allow_inspector) = false;
+  DEFINE_BOOL_FIELD(allow_child_process) = false;
+  DEFINE_BOOL_FIELD(allow_net) = false;
+  DEFINE_BOOL_FIELD(allow_wasi) = false;
+  DEFINE_BOOL_FIELD(allow_ffi) = false;
+  DEFINE_BOOL_FIELD(allow_openssl_store) = false;
+  DEFINE_BOOL_FIELD(allow_worker_threads) = false;
+  DEFINE_BOOL_FIELD(experimental_repl_await) = true;
+  DEFINE_BOOL_FIELD(experimental_vm_modules) = EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(async_context_frame) = true;
+  DEFINE_BOOL_FIELD(expose_internals) = false;
+  DEFINE_BOOL_FIELD(force_node_api_uncaught_exceptions_policy) = false;
+  DEFINE_BOOL_FIELD(frozen_intrinsics) = false;
+  DEFINE_BOOL_FIELD(network_family_autoselection) = true;
+  DEFINE_BOOL_FIELD(deprecation) = true;
+  DEFINE_BOOL_FIELD(force_async_hooks_checks) = true;
+  DEFINE_BOOL_FIELD(allow_native_addons) = true;
+  DEFINE_BOOL_FIELD(global_search_paths) = true;
+  DEFINE_BOOL_FIELD(warnings) = true;
+  DEFINE_BOOL_FIELD(force_context_aware) = false;
+  DEFINE_BOOL_FIELD(pending_deprecation) = false;
+  DEFINE_BOOL_FIELD(preserve_symlinks) = false;
+  DEFINE_BOOL_FIELD(preserve_symlinks_main) = false;
+  DEFINE_BOOL_FIELD(prof_process) = false;
+  DEFINE_BOOL_FIELD(has_env_file_string) = false;
+  DEFINE_BOOL_FIELD(bench_runner) = false;
+  DEFINE_BOOL_FIELD(has_bench_options) = false;
+  DEFINE_BOOL_FIELD(has_bench_samples) = false;
+  DEFINE_BOOL_FIELD(has_bench_warmup) = false;
+  DEFINE_BOOL_FIELD(test_runner) = false;
+  DEFINE_BOOL_FIELD(test_runner_coverage) = false;
+  DEFINE_BOOL_FIELD(test_runner_force_exit) = false;
+  DEFINE_BOOL_FIELD(test_runner_module_mocks) = false;
+  DEFINE_BOOL_FIELD(test_runner_update_snapshots) = false;
+  DEFINE_BOOL_FIELD(test_randomize) = false;
+  DEFINE_BOOL_FIELD(has_test_random_seed) = false;
+  DEFINE_BOOL_FIELD(test_only) = false;
+  DEFINE_BOOL_FIELD(test_udp_no_try_send) = false;
+  DEFINE_BOOL_FIELD(coverage_include_all) = false;
+  DEFINE_BOOL_FIELD(throw_deprecation) = false;
+  DEFINE_BOOL_FIELD(trace_deprecation) = false;
+  DEFINE_BOOL_FIELD(trace_exit) = false;
+  DEFINE_BOOL_FIELD(trace_sync_io) = false;
+  DEFINE_BOOL_FIELD(trace_tls) = false;
+  DEFINE_BOOL_FIELD(trace_uncaught) = false;
+  DEFINE_BOOL_FIELD(trace_warnings) = false;
+  DEFINE_BOOL_FIELD(trace_promises) = false;
+  DEFINE_BOOL_FIELD(trace_env) = false;
+  DEFINE_BOOL_FIELD(trace_env_js_stack) = false;
+  DEFINE_BOOL_FIELD(trace_env_native_stack) = false;
+  DEFINE_BOOL_FIELD(use_system_ca) = false;
+  DEFINE_BOOL_FIELD(extra_info_on_fatal_exception) = true;
+  DEFINE_BOOL_FIELD(verify_base_objects) = IS_DEBUG;
+  DEFINE_BOOL_FIELD(watch_mode) = false;
+  DEFINE_BOOL_FIELD(watch_mode_report_to_parent) = false;
+  DEFINE_BOOL_FIELD(watch_mode_preserve_output) = false;
+  DEFINE_BOOL_FIELD(syntax_check_only) = false;
+  DEFINE_BOOL_FIELD(has_eval_string) = false;
+  DEFINE_BOOL_FIELD(print_eval) = false;
+  DEFINE_BOOL_FIELD(force_repl) = false;
+  DEFINE_BOOL_FIELD(insecure_http_parser) = false;
+  DEFINE_BOOL_FIELD(use_env_proxy) = false;
+  DEFINE_BOOL_FIELD(tls_min_v1_0) = false;
+  DEFINE_BOOL_FIELD(tls_min_v1_1) = false;
+  DEFINE_BOOL_FIELD(tls_min_v1_2) = false;
+  DEFINE_BOOL_FIELD(tls_min_v1_3) = false;
+  DEFINE_BOOL_FIELD(tls_max_v1_2) = false;
+  DEFINE_BOOL_FIELD(tls_max_v1_3) = false;
+  DEFINE_BOOL_FIELD(strip_types) = HAVE_AMARO;
+  DEFINE_BOOL_FIELD(report_exclude_env) = false;
+  DEFINE_BOOL_FIELD(report_exclude_network) = false;
+#if HAVE_INSPECTOR
+  DEFINE_BOOL_FIELD(cpu_prof) = false;
+  DEFINE_BOOL_FIELD(experimental_network_inspection) =
+      EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_worker_inspection) =
+      EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_storage_inspection) =
+      EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_inspector_network_resource) =
+      EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(heap_prof) = false;
+#endif  // HAVE_INSPECTOR
 
   inline DebugOptions* get_debug_options() { return &debug_options_; }
   inline const DebugOptions& debug_options() const { return debug_options_; }
@@ -289,26 +317,40 @@ class EnvironmentOptions : public Options {
   void CheckOptions(std::vector<std::string>* errors,
                     std::vector<std::string>* argv) override;
 
+  // `--bench` and the other benchmark runner options are gated behind
+  // `--experimental-bench`, but the gate and the options it guards can come
+  // from different option sources, each of which is parsed in its own
+  // options_parser::Parse() pass. CheckOptions() runs at the end of every
+  // pass, so this constraint cannot be validated there: the gate may still
+  // arrive in a later pass. Callers must invoke this once all of their option
+  // sources have been parsed.
+  void CheckBenchOptions(std::vector<std::string>* errors) const;
+
  private:
   DebugOptions debug_options_;
 };
 
 class PerIsolateOptions : public Options {
  public:
+  bool worker_snapshot = true;  // --[no-]worker-snapshot
   PerIsolateOptions() = default;
   PerIsolateOptions(PerIsolateOptions&&) = default;
 
   std::shared_ptr<EnvironmentOptions> per_env{new EnvironmentOptions()};
-  bool track_heap_objects = false;
-  bool report_uncaught_exception = false;
-  bool report_on_signal = false;
-  bool experimental_shadow_realm = false;
+
   std::string max_old_space_size_percentage;
   std::string max_old_space_size;
-  int64_t stack_trace_limit = 10;
   std::string report_signal = "SIGUSR2";
-  bool build_snapshot = false;
   std::string build_snapshot_config;
+
+  int64_t stack_trace_limit = 10;
+
+  DEFINE_BOOL_FIELD(track_heap_objects) = false;
+  DEFINE_BOOL_FIELD(report_uncaught_exception) = false;
+  DEFINE_BOOL_FIELD(report_on_signal) = false;
+  DEFINE_BOOL_FIELD(experimental_shadow_realm) = false;
+  DEFINE_BOOL_FIELD(build_snapshot) = false;
+
   inline EnvironmentOptions* get_per_env_options();
   void CheckOptions(std::vector<std::string>* errors,
                     std::vector<std::string>* argv) override;
@@ -340,63 +382,72 @@ class PerProcessOptions : public Options {
 #else
   std::string trace_event_file_pattern = "node_trace.${rotation}.log";
 #endif
-  int64_t v8_thread_pool_size = 4;
-  bool zero_fill_all_buffers = false;
-  bool debug_arraybuffer_allocations = false;
   std::string disable_proto;
-  // We enable the shared read-only heap which currently requires that the
-  // snapshot used in different isolates in the same process to be the same.
-  // Therefore --node-snapshot is a per-process option.
-  bool node_snapshot = true;
   std::string snapshot_blob;
-
-  std::vector<std::string> security_reverts;
-  bool print_bash_completion = false;
-  bool print_help = false;
-  bool print_v8_help = false;
-  bool print_version = false;
   std::string experimental_sea_config;
   std::string run;
-
   std::string build_sea;
 #ifdef NODE_HAVE_I18N_SUPPORT
   std::string icu_data_dir;
 #endif
-
-  // Per-process because they affect singleton OpenSSL shared library state,
-  // or are used once during process initialization.
+// Per-process because they affect singleton OpenSSL shared library state,
+// or are used once during process initialization.
 #if HAVE_OPENSSL
   std::string openssl_config;
   std::string tls_cipher_list = DEFAULT_CIPHER_LIST_CORE;
+#endif  // HAVE_OPENSSL
+  std::string report_directory;
+  std::string report_filename;
+  // TODO(addaleax): Some of these could probably be per-Environment.
+  std::string use_largepages = "off";
+
+  std::vector<std::string> security_reverts;
+  std::vector<std::string> cmdline;
+
+  int64_t v8_thread_pool_size = 4;
+#if HAVE_OPENSSL
   int64_t secure_heap = 0;
   int64_t secure_heap_min = 2;
+#endif  // HAVE_OPENSSL
+
+  DEFINE_BOOL_FIELD(zero_fill_all_buffers) = false;
+  DEFINE_BOOL_FIELD(debug_arraybuffer_allocations) = false;
+
+  // We enable the shared read-only heap which currently requires that the
+  // snapshot used in different isolates in the same process to be the same.
+  // Therefore --node-snapshot is a per-process option.
+  DEFINE_BOOL_FIELD(node_snapshot) = true;
+
+  DEFINE_BOOL_FIELD(print_bash_completion) = false;
+  DEFINE_BOOL_FIELD(print_help) = false;
+  DEFINE_BOOL_FIELD(print_v8_help) = false;
+  DEFINE_BOOL_FIELD(print_version) = false;
+
+#if HAVE_OPENSSL
 #ifdef NODE_OPENSSL_CERT_STORE
-  bool ssl_openssl_cert_store = true;
+  DEFINE_BOOL_FIELD(ssl_openssl_cert_store) = true;
 #else
-  bool ssl_openssl_cert_store = false;
-#endif
-  bool use_openssl_ca = false;
-  bool use_bundled_ca = false;
-  bool enable_fips_crypto = false;
-  bool force_fips_crypto = false;
-#endif
+  DEFINE_BOOL_FIELD(ssl_openssl_cert_store) = false;
+#endif  // NODE_OPENSSL_CERT_STORE
+  DEFINE_BOOL_FIELD(use_openssl_ca) = false;
+  DEFINE_BOOL_FIELD(use_bundled_ca) = false;
+  DEFINE_BOOL_FIELD(enable_fips_crypto) = false;
+  DEFINE_BOOL_FIELD(enable_fips_indicator_events) = false;
+  DEFINE_BOOL_FIELD(force_fips_crypto) = false;
+  std::string force_fips_crypto_policy = "provider";
+#endif  // HAVE_OPENSSL
 #if OPENSSL_VERSION_MAJOR >= 3
-  bool openssl_legacy_provider = false;
-  bool openssl_shared_config = false;
+  DEFINE_BOOL_FIELD(openssl_legacy_provider) = false;
+  DEFINE_BOOL_FIELD(openssl_shared_config) = false;
 #endif
 
-  bool disable_wasm_trap_handler = false;
-
-  // Per-process because reports can be triggered outside a known V8 context.
-  bool report_on_fatalerror = false;
-  bool report_compact = false;
-  std::string report_directory;
-  std::string report_filename;
-
-  // TODO(addaleax): Some of these could probably be per-Environment.
-  std::string use_largepages = "off";
-  bool trace_sigint = false;
-  std::vector<std::string> cmdline;
+  DEFINE_BOOL_FIELD(disable_wasm_trap_handler) = false;
+  DEFINE_BOOL_FIELD(report_on_fatalerror) = false;
+  DEFINE_BOOL_FIELD(report_compact) = false;
+  DEFINE_BOOL_FIELD(trace_sigint) = false;
+  // Tracks whether `--run` was passed, since an empty `run` is ambiguous
+  // between "not passed" and "passed without a script name" (lists scripts).
+  DEFINE_BOOL_FIELD(has_run) = false;
 
   inline PerIsolateOptions* get_per_isolate_options();
   void CheckOptions(std::vector<std::string>* errors,
@@ -439,6 +490,7 @@ std::vector<std::string> MapAvailableNamespaces();
 // Define all namespace entries
 #define OPTION_NAMESPACE_LIST(V)                                               \
   V(kNoNamespace, "")                                                          \
+  V(kBenchRunnerNamespace, "bench")                                            \
   V(kTestRunnerNamespace, "test")                                              \
   V(kWatchNamespace, "watch")                                                  \
   V(kPermissionNamespace, "permission")
@@ -489,16 +541,17 @@ class OptionsParser {
   void AddOption(
       const char* name,
       const char* help_text,
-      bool Options::*field,
+      bool (*getter)(Options*),
+      void (*setter)(Options*, bool),
       OptionEnvvarSettings env_setting = kDisallowedInEnvvar,
       bool default_is_true = false,
       OptionNamespaces namespace_id = OptionNamespaces::kNoNamespace);
-  void AddOption(
-      const char* name,
-      const char* help_text,
-      uint64_t Options::*field,
-      OptionEnvvarSettings env_setting = kDisallowedInEnvvar,
-      OptionNamespaces namespace_id = OptionNamespaces::kNoNamespace);
+  void AddOption(const char* name,
+                 const char* help_text,
+                 uint64_t Options::*field,
+                 OptionEnvvarSettings env_setting = kDisallowedInEnvvar,
+                 OptionNamespaces namespace_id = OptionNamespaces::kNoNamespace,
+                 bool strict = false);
   void AddOption(
       const char* name,
       const char* help_text,
@@ -593,6 +646,16 @@ class OptionsParser {
     virtual ~BaseOptionField() = default;
     virtual void* LookupImpl(Options* options) const = 0;
 
+    // For boolean bit-field options, we can't return a pointer so we
+    // use virtual getter/setter methods instead. The default
+    // implementations go through LookupImpl for non-bit-field types.
+    virtual bool GetBool(Options* options) const {
+      return *static_cast<bool*>(LookupImpl(options));
+    }
+    virtual void SetBool(Options* options, bool value) {
+      *static_cast<bool*>(LookupImpl(options)) = value;
+    }
+
     template <typename T>
     inline T* Lookup(Options* options) const {
       return static_cast<T*>(LookupImpl(options));
@@ -613,6 +676,28 @@ class OptionsParser {
     T Options::* field_;
   };
 
+  // Represents a boolean bit-field within `Options`. Bit-fields cannot
+  // have their address taken, so we use getter/setter function pointers
+  // instead of a pointer-to-member.
+  class BitFieldOptionField : public BaseOptionField {
+   public:
+    using Getter = bool (*)(Options*);
+    using Setter = void (*)(Options*, bool);
+
+    BitFieldOptionField(Getter get, Setter set) : get_(get), set_(set) {}
+
+    void* LookupImpl(Options* options) const override { UNREACHABLE(); }
+
+    bool GetBool(Options* options) const override { return get_(options); }
+    void SetBool(Options* options, bool value) override {
+      set_(options, value);
+    }
+
+   private:
+    Getter get_;
+    Setter set_;
+  };
+
   template <typename T>
   inline T* Lookup(std::shared_ptr<BaseOptionField> field,
                    Options* options) const {
@@ -632,6 +717,7 @@ class OptionsParser {
     std::string help_text;
     bool default_is_true = false;
     std::string namespace_id;
+    bool strict = false;
   };
 
   // An implied option is composed of the information on where to store a
@@ -690,6 +776,14 @@ void Parse(StringVector* const args,
 
 }  // namespace options_parser
 
+// Helper macro for passing bit-field members to AddOption(). Expands to a
+// getter and setter function pointer pair that can read/write the named
+// bit-field without requiring a pointer-to-member (which is illegal for
+// bit-fields).
+#define BOOL_FIELD(field)                                                      \
+  +[](TargetType* opts) -> bool { return opts->field; },                       \
+      +[](TargetType* opts, bool v) { opts->field = v; }
+
 namespace per_process {
 
 extern Mutex cli_options_mutex;
@@ -703,6 +797,8 @@ void HandleEnvOptions(std::shared_ptr<EnvironmentOptions> env_options,
 
 std::vector<std::string> ParseNodeOptionsEnvVar(
     const std::string& node_options, std::vector<std::string>* errors);
+
+#undef DEFINE_BOOL_FIELD
 }  // namespace node
 
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/node_platform.cc b/src/node_platform.cc
index 71a4e3d5ee83..2deccdcdf686 100644
--- a/src/node_platform.cc
+++ b/src/node_platform.cc
@@ -254,18 +254,19 @@ WorkerThreadsTaskRunner::WorkerThreadsTaskRunner(
   threads_.push_back(delayed_task_scheduler_->Start());
 
   for (int i = 0; i < thread_pool_size; i++) {
-    PlatformWorkerData* worker_data =
-        new PlatformWorkerData{&pending_worker_tasks_,
-                               &platform_workers_mutex,
-                               &platform_workers_ready,
-                               &pending_platform_workers,
-                               i,
-                               debug_log_level_};
+    auto worker_data = std::make_unique<PlatformWorkerData>(
+        PlatformWorkerData{&pending_worker_tasks_,
+                           &platform_workers_mutex,
+                           &platform_workers_ready,
+                           &pending_platform_workers,
+                           i,
+                           debug_log_level_});
     std::unique_ptr<uv_thread_t> t { new uv_thread_t() };
-    if (uv_thread_create(t.get(), PlatformWorkerThread,
-                         worker_data) != 0) {
+    if (uv_thread_create(t.get(), PlatformWorkerThread, worker_data.get()) !=
+        0) {
       break;
     }
+    worker_data.release();
     threads_.push_back(std::move(t));
   }
 
diff --git a/src/node_process_methods.cc b/src/node_process_methods.cc
index 8f800be35431..6a35e5c5e4c4 100644
--- a/src/node_process_methods.cc
+++ b/src/node_process_methods.cc
@@ -807,6 +807,7 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
 
   SetMethodNoSideEffect(isolate, target, "cwd", Cwd);
   SetMethod(isolate, target, "dlopen", binding::DLOpen);
+  SetMethod(isolate, target, "dlopenBinary", binding::DLOpenBinary);
   SetMethod(isolate, target, "reallyExit", ReallyExit);
 
 #if defined __POSIX__ && !defined(__PASE__)
@@ -854,6 +855,7 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
 
   registry->Register(Cwd);
   registry->Register(binding::DLOpen);
+  registry->Register(binding::DLOpenBinary);
   registry->Register(ReallyExit);
 
 #if defined __POSIX__ && !defined(__PASE__)
diff --git a/src/node_profiling.cc b/src/node_profiling.cc
index b6c42b286908..c4725d16e816 100644
--- a/src/node_profiling.cc
+++ b/src/node_profiling.cc
@@ -48,7 +48,6 @@ bool SerializeHeapProfile(Isolate* isolate, std::ostringstream& out_stream) {
   if (!profile) {
     return false;
   }
-  profiler->StopSamplingHeapProfiler();
   JSONWriter writer(out_stream, true);
   writer.json_start();
 
diff --git a/src/node_sea.cc b/src/node_sea.cc
index 03d487f1dba7..d17ed779399c 100644
--- a/src/node_sea.cc
+++ b/src/node_sea.cc
@@ -263,6 +263,15 @@ void IsSea(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(IsSingleExecutable());
 }
 
+void IsVfsEnabled(const FunctionCallbackInfo<Value>& args) {
+  bool enabled = false;
+  if (IsSingleExecutable()) {
+    SeaResource sea_resource = FindSingleExecutableResource();
+    enabled = static_cast<bool>(sea_resource.flags & SeaFlags::kEnableVfs);
+  }
+  args.GetReturnValue().Set(enabled);
+}
+
 void IsExperimentalSeaWarningNeeded(const FunctionCallbackInfo<Value>& args) {
   bool is_building_sea =
       !per_process::cli_options->experimental_sea_config.empty();
@@ -447,6 +456,16 @@ std::optional<SeaConfig> ParseSingleExecutableConfig(
       if (use_code_cache_value) {
         result.flags |= SeaFlags::kUseCodeCache;
       }
+    } else if (key == "useVfs") {
+      bool use_vfs;
+      if (field.value().get_bool().get(use_vfs)) {
+        FPrintF(
+            stderr, "\"useVfs\" field of %s is not a Boolean\n", config_path);
+        return std::nullopt;
+      }
+      if (use_vfs) {
+        result.flags |= SeaFlags::kEnableVfs;
+      }
     } else if (key == "assets") {
       simdjson::ondemand::object assets_object;
       if (field.value().get_object().get(assets_object)) {
@@ -565,6 +584,19 @@ std::optional<SeaConfig> ParseSingleExecutableConfig(
     return std::nullopt;
   }
 
+  if (static_cast<bool>(result.flags & SeaFlags::kEnableVfs)) {
+    if (static_cast<bool>(result.flags & SeaFlags::kUseSnapshot)) {
+      FPrintF(stderr,
+              "\"useVfs\" is not supported when \"useSnapshot\" is true\n");
+      return std::nullopt;
+    }
+    if (static_cast<bool>(result.flags & SeaFlags::kUseCodeCache)) {
+      FPrintF(stderr,
+              "\"useVfs\" is not supported when \"useCodeCache\" is true\n");
+      return std::nullopt;
+    }
+  }
+
   if (result.main_path.empty()) {
     FPrintF(stderr,
             "\"main\" field of %s is not a non-empty string\n",
@@ -924,7 +956,31 @@ void Initialize(Local<Object> target,
                 Local<Value> unused,
                 Local<Context> context,
                 void* priv) {
+  Environment* env = Environment::GetCurrent(context);
+  Isolate* isolate = env->isolate();
+
+  if (IsSingleExecutable()) {
+    SeaResource sea_resource = FindSingleExecutableResource();
+    // Expose the main script path recorded in the SEA config so the VFS
+    // integration can place the main script at the mount point root.
+    if (static_cast<bool>(sea_resource.flags & SeaFlags::kEnableVfs)) {
+      Local<String> code_path_str;
+      if (String::NewFromUtf8(isolate,
+                              sea_resource.code_path.data(),
+                              NewStringType::kNormal,
+                              sea_resource.code_path.length())
+              .ToLocal(&code_path_str)) {
+        target
+            ->Set(context,
+                  FIXED_ONE_BYTE_STRING(isolate, "mainCodePath"),
+                  code_path_str)
+            .Check();
+      }
+    }
+  }
+
   SetMethod(context, target, "isSea", IsSea);
+  SetMethod(context, target, "isVfsEnabled", IsVfsEnabled);
   SetMethod(context,
             target,
             "isExperimentalSeaWarningNeeded",
@@ -935,6 +991,7 @@ void Initialize(Local<Object> target,
 
 void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(IsSea);
+  registry->Register(IsVfsEnabled);
   registry->Register(IsExperimentalSeaWarningNeeded);
   registry->Register(GetAsset);
   registry->Register(GetAssetKeys);
diff --git a/src/node_sea.h b/src/node_sea.h
index b147caefa5e5..cd633c2f43b7 100644
--- a/src/node_sea.h
+++ b/src/node_sea.h
@@ -30,6 +30,7 @@ enum class SeaFlags : uint32_t {
   kUseCodeCache = 1 << 2,
   kIncludeAssets = 1 << 3,
   kIncludeExecArgv = 1 << 4,
+  kEnableVfs = 1 << 5,
 };
 
 enum class SeaExecArgvExtension : uint8_t {
diff --git a/src/node_sea_bin.cc b/src/node_sea_bin.cc
index ef5dab3a25c0..30197b9bc3c3 100644
--- a/src/node_sea_bin.cc
+++ b/src/node_sea_bin.cc
@@ -126,6 +126,16 @@ InjectOutput InjectIntoELF(const std::vector<uint8_t>& executable,
             {},
             SPrintF("Failed to create new ELF note %s", note_name)};
   }
+  // Left to itself LIEF moves a non-PIE executable's program headers into
+  // the largest gap between two PT_LOADs and extends the earlier one over it,
+  // which can leave that segment sharing a page with the next; kernels that
+  // map segments with MAP_FIXED_NOREPLACE (Linux < 5.4, RHEL 8) then refuse
+  // to run the file. After .bss every segment keeps its own pages.
+  if (binary->header().file_type() == LIEF::ELF::Header::FILE_TYPE::EXEC &&
+      binary->relocate_phdr_table(LIEF::ELF::Binary::PHDR_RELOC::BSS_END) ==
+          0) {
+    return {InjectResult::kError, {}, "Failed to relocate ELF program headers"};
+  }
   binary->add(*new_note);
 
   LIEF::ELF::Builder::config_t cfg;
diff --git a/src/node_snapshotable.cc b/src/node_snapshotable.cc
index 7f5d9b9e1821..e861e499534c 100644
--- a/src/node_snapshotable.cc
+++ b/src/node_snapshotable.cc
@@ -1571,17 +1571,17 @@ void CompileSerializeMain(const FunctionCallbackInfo<Value>& args) {
   CHECK(args[0]->IsString());
   Local<String> filename = args[0].As<String>();
   Local<String> source = args[1].As<String>();
+  Environment* env = Environment::GetCurrent(args);
   Isolate* isolate = args.GetIsolate();
   Local<Context> context = isolate->GetCurrentContext();
   // TODO(joyeecheung): do we need all of these? Maybe we would want a less
   // internal version of them.
-  LocalVector<String> parameters(
-      isolate,
-      {
-          FIXED_ONE_BYTE_STRING(isolate, "require"),
-          FIXED_ONE_BYTE_STRING(isolate, "__filename"),
-          FIXED_ONE_BYTE_STRING(isolate, "__dirname"),
-      });
+  LocalVector<String> parameters(isolate,
+                                 {
+                                     env->require_string(),
+                                     env->__filename_string(),
+                                     env->__dirname_string(),
+                                 });
 
   ScriptOrigin script_origin(filename, 0, 0, true);
   ScriptCompiler::Source script_source(source, script_origin);
diff --git a/src/node_snapshotable.h b/src/node_snapshotable.h
index 18ef5fbd43fd..a9050877a04d 100644
--- a/src/node_snapshotable.h
+++ b/src/node_snapshotable.h
@@ -44,8 +44,11 @@ struct InternalFieldInfoBase {
   template <std::derived_from<InternalFieldInfoBase> T>
   static T* New(EmbedderObjectType type) {
     void* buf = ::operator new[](sizeof(T));
-    memset(buf, 0, sizeof(T));  // Make the padding reproducible.
     T* result = new (buf) T;
+    // Zero the padding to make the bytes handed to V8 reproducible. Must come
+    // after the placement new, or -flifetime-dse drops it as a dead store.
+    // https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-fno-lifetime-dse
+    memset(static_cast<void*>(result), 0, sizeof(T));
     result->type = type;
     result->length = sizeof(T);
     return result;
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 5775824a1f67..76accf1c2731 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -25,6 +25,7 @@ namespace sqlite {
 
 using v8::Array;
 using v8::ArrayBuffer;
+using v8::BackingStore;
 using v8::BackingStoreInitializationMode;
 using v8::BackingStoreOnFailureMode;
 using v8::BigInt;
@@ -169,6 +170,16 @@ inline MaybeLocal<Value> IntegerToValue(Isolate* isolate,
           sqlite3_stmt_busy((stmt)->statement_.get()),                         \
       "database cannot be accessed from an authorizer callback")
 
+// SQLite's session module reaches back into JavaScript from inside the
+// pre-update hook, while it is still walking the connection's session list and
+// reading the table it found there. Deleting a session frees memory that walk
+// is still using, so no callback may close one.
+#define THROW_AND_RETURN_IF_SESSION_IN_CALLBACK(env, session)                  \
+  THROW_AND_RETURN_ON_BAD_STATE(                                               \
+      (env),                                                                   \
+      (session)->database_->IsInCallback(),                                    \
+      "session cannot be closed while in a callback")
+
 // A statement's virtual machine cannot be reentered while sqlite3_step() is
 // running it. Finalizing it frees the VM outright, and re-running it resets the
 // VM mid-execution; both are use-after-free rather than merely a contract
@@ -593,11 +604,13 @@ class BackupJob : public ThreadPoolWork {
   void ScheduleBackup() {
     Isolate* isolate = env()->isolate();
     HandleScope handle_scope(isolate);
+    sqlite3* dest_raw = nullptr;
     backup_status_ = sqlite3_open_v2(
         destination_name_.c_str(),
-        &dest_,
+        &dest_raw,
         SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_URI,
         nullptr);
+    dest_.reset(dest_raw);
     Local<Promise::Resolver> resolver =
         Local<Promise::Resolver>::New(env()->isolate(), resolver_);
     if (backup_status_ != SQLITE_OK) {
@@ -605,9 +618,11 @@ class BackupJob : public ThreadPoolWork {
       return;
     }
 
-    backup_ = sqlite3_backup_init(
-        dest_, dest_db_.c_str(), source_->Connection(), source_db_.c_str());
-    if (backup_ == nullptr) {
+    backup_.reset(sqlite3_backup_init(dest_.get(),
+                                      dest_db_.c_str(),
+                                      source_->Connection(),
+                                      source_db_.c_str()));
+    if (!backup_) {
       HandleBackupError(resolver);
       return;
     }
@@ -616,13 +631,17 @@ class BackupJob : public ThreadPoolWork {
   }
 
   void DoThreadPoolWork() override {
-    backup_status_ = sqlite3_backup_step(backup_, pages_);
+    backup_status_ = sqlite3_backup_step(backup_.get(), pages_);
   }
 
   void AfterThreadPoolWork(int status) override {
-    HandleScope handle_scope(env()->isolate());
+    Isolate* isolate = env()->isolate();
+    HandleScope handle_scope(isolate);
+    Context::Scope context_scope(env()->context());
+    InternalCallbackScope callback_scope(
+        env(), Object::New(isolate), {0, 0}, InternalCallbackScope::kNoFlags);
     Local<Promise::Resolver> resolver =
-        Local<Promise::Resolver>::New(env()->isolate(), resolver_);
+        Local<Promise::Resolver>::New(isolate, resolver_);
 
     if (!(backup_status_ == SQLITE_OK || backup_status_ == SQLITE_DONE ||
           backup_status_ == SQLITE_BUSY || backup_status_ == SQLITE_LOCKED)) {
@@ -630,8 +649,8 @@ class BackupJob : public ThreadPoolWork {
       return;
     }
 
-    int total_pages = sqlite3_backup_pagecount(backup_);
-    int remaining_pages = sqlite3_backup_remaining(backup_);
+    int total_pages = sqlite3_backup_pagecount(backup_.get());
+    int remaining_pages = sqlite3_backup_remaining(backup_.get());
     if (remaining_pages != 0) {
       Local<Function> fn =
           Local<Function>::New(env()->isolate(), progressFunc_);
@@ -689,21 +708,19 @@ class BackupJob : public ThreadPoolWork {
 
   void Cleanup() {
     if (backup_) {
-      sqlite3_backup_finish(backup_);
-      backup_ = nullptr;
+      sqlite3_backup_finish(backup_.release());
     }
 
     if (dest_) {
-      backup_status_ = sqlite3_errcode(dest_);
-      sqlite3_close_v2(dest_);
-      dest_ = nullptr;
+      backup_status_ = sqlite3_errcode(dest_.get());
+      dest_.reset();
     }
   }
 
  private:
   void HandleBackupError(Local<Promise::Resolver> resolver) {
     Local<Object> e;
-    if (!CreateSQLiteError(env()->isolate(), dest_).ToLocal(&e)) {
+    if (!CreateSQLiteError(env()->isolate(), dest_.get()).ToLocal(&e)) {
       Finalize();
       delete this;
       return;
@@ -733,8 +750,14 @@ class BackupJob : public ThreadPoolWork {
   BaseObjectPtr<DatabaseSync> source_;
   Global<Promise::Resolver> resolver_;
   Global<Function> progressFunc_;
-  sqlite3* dest_ = nullptr;
-  sqlite3_backup* backup_ = nullptr;
+  struct Sqlite3Deleter {
+    void operator()(sqlite3* db) const { sqlite3_close_v2(db); }
+  };
+  struct BackupDeleter {
+    void operator()(sqlite3_backup* b) const { sqlite3_backup_finish(b); }
+  };
+  std::unique_ptr<sqlite3, Sqlite3Deleter> dest_;
+  std::unique_ptr<sqlite3_backup, BackupDeleter> backup_;
   int pages_;
   int backup_status_ = SQLITE_OK;
   std::string source_db_;
@@ -996,7 +1019,6 @@ DatabaseSync::DatabaseSync(Environment* env,
                            bool allow_load_extension)
     : BaseObject(env, object), open_config_(std::move(open_config)) {
   MakeWeak();
-  connection_ = nullptr;
   allow_load_extension_ = allow_load_extension;
   enable_load_extension_ = allow_load_extension;
   ignore_next_sqlite_error_ = false;
@@ -1017,6 +1039,15 @@ void DatabaseSync::RemoveBackup(BackupJob* job) {
   backups_.erase(job);
 }
 
+std::vector<BaseObjectPtr<Session>> DatabaseSync::PinSessions() const {
+  std::vector<BaseObjectPtr<Session>> pinned;
+  pinned.reserve(sessions_.size());
+  for (Session* session : sessions_) {
+    pinned.emplace_back(session);
+  }
+  return pinned;
+}
+
 void DatabaseSync::DeleteSessions() {
   // all attached sessions need to be deleted before the database is closed
   // https://www.sqlite.org/session/sqlite3session_create.html
@@ -1035,8 +1066,7 @@ DatabaseSync::~DatabaseSync() {
   if (IsOpen()) {
     FinalizeStatements();
     DeleteSessions();
-    sqlite3_close_v2(connection_);
-    connection_ = nullptr;
+    connection_.reset();
   }
 }
 
@@ -1059,9 +1089,8 @@ bool DatabaseSync::Open() {
   // database in an open state.
   bool opened = false;
   auto reset_connection_on_failure = OnScopeLeave([&]() {
-    if (!opened && connection_ != nullptr) {
-      sqlite3_close_v2(connection_);
-      connection_ = nullptr;
+    if (!opened) {
+      connection_.reset();
     }
   });
 
@@ -1070,18 +1099,20 @@ bool DatabaseSync::Open() {
   int flags = open_config_.get_read_only()
                   ? SQLITE_OPEN_READONLY
                   : SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE;
+  sqlite3* raw_conn = nullptr;
   int r = sqlite3_open_v2(open_config_.location().c_str(),
-                          &connection_,
+                          &raw_conn,
                           flags | default_flags,
                           nullptr);
+  connection_.reset(raw_conn);
   CHECK_ERROR_OR_THROW(env()->isolate(), this, r, SQLITE_OK, false);
 
-  r = sqlite3_db_config(connection_,
+  r = sqlite3_db_config(connection_.get(),
                         SQLITE_DBCONFIG_DQS_DML,
                         static_cast<int>(open_config_.get_enable_dqs()),
                         nullptr);
   CHECK_ERROR_OR_THROW(env()->isolate(), this, r, SQLITE_OK, false);
-  r = sqlite3_db_config(connection_,
+  r = sqlite3_db_config(connection_.get(),
                         SQLITE_DBCONFIG_DQS_DDL,
                         static_cast<int>(open_config_.get_enable_dqs()),
                         nullptr);
@@ -1089,7 +1120,7 @@ bool DatabaseSync::Open() {
 
   int foreign_keys_enabled;
   r = sqlite3_db_config(
-      connection_,
+      connection_.get(),
       SQLITE_DBCONFIG_ENABLE_FKEY,
       static_cast<int>(open_config_.get_enable_foreign_keys()),
       &foreign_keys_enabled);
@@ -1097,20 +1128,20 @@ bool DatabaseSync::Open() {
   CHECK_EQ(foreign_keys_enabled, open_config_.get_enable_foreign_keys());
 
   int defensive_enabled;
-  r = sqlite3_db_config(connection_,
+  r = sqlite3_db_config(connection_.get(),
                         SQLITE_DBCONFIG_DEFENSIVE,
                         static_cast<int>(open_config_.get_enable_defensive()),
                         &defensive_enabled);
   CHECK_ERROR_OR_THROW(env()->isolate(), this, r, SQLITE_OK, false);
   CHECK_EQ(defensive_enabled, open_config_.get_enable_defensive());
 
-  sqlite3_busy_timeout(connection_, open_config_.get_timeout());
+  sqlite3_busy_timeout(connection_.get(), open_config_.get_timeout());
 
   // Apply initial limits
   for (const auto& [js_name, sqlite_limit_id] : kLimitMapping) {
     const auto& limit_value = open_config_.initial_limits()[sqlite_limit_id];
     if (limit_value.has_value()) {
-      sqlite3_limit(connection_, sqlite_limit_id, *limit_value);
+      sqlite3_limit(connection_.get(), sqlite_limit_id, *limit_value);
     }
   }
 
@@ -1122,14 +1153,15 @@ bool DatabaseSync::Open() {
       return false;
     }
     const int load_extension_ret = sqlite3_db_config(
-        connection_, SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION, 1, nullptr);
+        connection_.get(), SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION, 1, nullptr);
     CHECK_ERROR_OR_THROW(
         env()->isolate(), this, load_extension_ret, SQLITE_OK, false);
   }
 
   trace_channel_ = diagnostics_channel::Channel::Get(env(), "sqlite.db.query");
   if (trace_channel_ && trace_channel_->HasSubscribers()) {
-    sqlite3_trace_v2(connection_, SQLITE_TRACE_PROFILE, TraceCallback, this);
+    sqlite3_trace_v2(
+        connection_.get(), SQLITE_TRACE_PROFILE, TraceCallback, this);
   }
 
   opened = true;
@@ -1142,12 +1174,13 @@ void DatabaseSync::EnableTracing() {
     trace_channel_ =
         diagnostics_channel::Channel::Get(env(), "sqlite.db.query");
   }
-  sqlite3_trace_v2(connection_, SQLITE_TRACE_PROFILE, TraceCallback, this);
+  sqlite3_trace_v2(
+      connection_.get(), SQLITE_TRACE_PROFILE, TraceCallback, this);
 }
 
 void DatabaseSync::DisableTracing() {
   if (!IsOpen()) return;
-  sqlite3_trace_v2(connection_, 0, nullptr, nullptr);
+  sqlite3_trace_v2(connection_.get(), 0, nullptr, nullptr);
 }
 
 void DatabaseSync::FinalizeBackups() {
@@ -1175,7 +1208,7 @@ inline bool DatabaseSync::IsOpen() {
 }
 
 inline sqlite3* DatabaseSync::Connection() {
-  return connection_;
+  return connection_.get();
 }
 
 void DatabaseSync::SetIgnoreNextSQLiteError(bool ignore) {
@@ -1547,7 +1580,7 @@ void DatabaseSync::IsTransactionGetter(
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
-  args.GetReturnValue().Set(sqlite3_get_autocommit(db->connection_) == 0);
+  args.GetReturnValue().Set(sqlite3_get_autocommit(db->connection_.get()) == 0);
 }
 
 void DatabaseSync::LimitsGetter(const FunctionCallbackInfo<Value>& args) {
@@ -1579,9 +1612,9 @@ void DatabaseSync::Close(const FunctionCallbackInfo<Value>& args) {
       env, db->IsInCallback(), "database cannot be closed while in a callback");
   db->FinalizeStatements();
   db->DeleteSessions();
-  int r = sqlite3_close_v2(db->connection_);
+  int r = sqlite3_close_v2(db->connection_.get());
   CHECK_ERROR_OR_THROW(env->isolate(), db, r, SQLITE_OK, void());
-  db->connection_ = nullptr;
+  db->connection_.release();
 }
 
 void DatabaseSync::Dispose(const v8::FunctionCallbackInfo<v8::Value>& args) {
@@ -1709,14 +1742,18 @@ void DatabaseSync::Prepare(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
+  // Reading the options bag above can run user JavaScript through a property
+  // getter, which may have closed the database since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   Utf8Value sql(env->isolate(), args[0].As<String>());
   sqlite3_stmt* s = nullptr;
 
   unsigned int prep_flags =
       persistent.value_or(false) ? SQLITE_PREPARE_PERSISTENT : 0;
 
-  int r =
-      sqlite3_prepare_v3(db->connection_, *sql, -1, prep_flags, &s, nullptr);
+  int r = sqlite3_prepare_v3(
+      db->connection_.get(), *sql, -1, prep_flags, &s, nullptr);
 
   StatementPtr stmt_ptr(s);
 
@@ -1775,7 +1812,7 @@ void DatabaseSync::Exec(const FunctionCallbackInfo<Value>& args) {
   BaseObjectPtr<DatabaseSync> guard(db);
 
   Utf8Value sql(env->isolate(), args[0].As<String>());
-  int r = sqlite3_exec(db->connection_, *sql, nullptr, nullptr, nullptr);
+  int r = sqlite3_exec(db->connection_.get(), *sql, nullptr, nullptr, nullptr);
   CHECK_ERROR_OR_THROW(env->isolate(), db, r, SQLITE_OK, void());
 }
 
@@ -1896,9 +1933,22 @@ void DatabaseSync::CustomFunction(const FunctionCallbackInfo<Value>& args) {
     if (!fn->Get(env->context(), env->length_string()).ToLocal(&js_len)) {
       return;
     }
+
+    if (!js_len->IsInt32()) {
+      THROW_ERR_INVALID_ARG_TYPE(
+          env->isolate(),
+          "The \"function.length\" property must be an integer.");
+      return;
+    }
+
     argc = js_len.As<Int32>()->Value();
   }
 
+  // Reading the options bag and "function.length" above can run user
+  // JavaScript through a property getter, which may have closed the database
+  // since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   UserDefinedFunction* user_data = new UserDefinedFunction(
       env, fn, BaseObjectWeakPtr<DatabaseSync>(db), use_bigint_args);
   int text_rep = SQLITE_UTF8;
@@ -1911,7 +1961,7 @@ void DatabaseSync::CustomFunction(const FunctionCallbackInfo<Value>& args) {
     text_rep |= SQLITE_DIRECTONLY;
   }
 
-  int r = sqlite3_create_function_v2(db->connection_,
+  int r = sqlite3_create_function_v2(db->connection_.get(),
                                      *name,
                                      argc,
                                      text_rep,
@@ -1941,7 +1991,7 @@ void DatabaseSync::Location(const FunctionCallbackInfo<Value>& args) {
   }
 
   const char* db_filename =
-      sqlite3_db_filename(db->connection_, db_name.c_str());
+      sqlite3_db_filename(db->connection_.get(), db_name.c_str());
   if (!db_filename || db_filename[0] == '\0') {
     args.GetReturnValue().Set(Null(env->isolate()));
     return;
@@ -1972,7 +2022,7 @@ void DatabaseSync::Serialize(const FunctionCallbackInfo<Value>& args) {
 
   sqlite3_int64 size = 0;
   unsigned char* data =
-      sqlite3_serialize(db->connection_, db_name.c_str(), &size, 0);
+      sqlite3_serialize(db->connection_.get(), db_name.c_str(), &size, 0);
 
   if (data == nullptr) {
     if (size == 0) {
@@ -2061,6 +2111,10 @@ void DatabaseSync::Deserialize(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
+  // Reading the options bag above can run user JavaScript through a property
+  // getter, which may have closed the database since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   // sqlite3_malloc64 is required because SQLITE_DESERIALIZE_FREEONCLOSE
   // transfers ownership to SQLite, which calls sqlite3_free() on close.
   // See: https://www.sqlite.org/c3ref/deserialize.html
@@ -2071,12 +2125,21 @@ void DatabaseSync::Deserialize(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  input->CopyContents(buf, byte_length);
+  // The same user JavaScript may also have shrunk or detached the backing
+  // store, in which case byte_length is stale and CopyContents() leaves the
+  // remainder of buf uninitialized. Handing that to SQLite would disclose it
+  // through serialize().
+  if (input->CopyContents(buf, byte_length) != byte_length) {
+    sqlite3_free(buf);
+    THROW_ERR_INVALID_STATE(
+        env, "The \"buffer\" argument was resized while reading \"options\"");
+    return;
+  }
 
   db->FinalizeStatements();
 
   int r = sqlite3_deserialize(
-      db->connection_,
+      db->connection_.get(),
       db_name.c_str(),
       buf,
       byte_length,
@@ -2209,17 +2272,37 @@ void DatabaseSync::AggregateFunction(const FunctionCallbackInfo<Value>& args) {
       return;
     }
 
+    if (!js_len->IsInt32()) {
+      THROW_ERR_INVALID_ARG_TYPE(
+          env->isolate(),
+          "The \"options.step.length\" property must be an integer.");
+      return;
+    }
+
     // Subtract 1 because the first argument is the aggregate value.
     argc = js_len.As<Int32>()->Value() - 1;
-    if (!inverseFunc.IsEmpty() &&
-        !inverseFunc->Get(env->context(), env->length_string())
-             .ToLocal(&js_len)) {
-      return;
+    if (!inverseFunc.IsEmpty()) {
+      if (!inverseFunc->Get(env->context(), env->length_string())
+               .ToLocal(&js_len)) {
+        return;
+      }
+
+      if (!js_len->IsInt32()) {
+        THROW_ERR_INVALID_ARG_TYPE(
+            env->isolate(),
+            "The \"options.inverse.length\" property must be an integer.");
+        return;
+      }
     }
 
     argc = std::max({argc, js_len.As<Int32>()->Value() - 1, 0});
   }
 
+  // Reading the options bag and the step/inverse "length" properties above can
+  // run user JavaScript through a property getter, which may have closed the
+  // database since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   int text_rep = SQLITE_UTF8;
   if (direct_only) {
     text_rep |= SQLITE_DIRECTONLY;
@@ -2228,7 +2311,7 @@ void DatabaseSync::AggregateFunction(const FunctionCallbackInfo<Value>& args) {
   auto xInverse = !inverseFunc.IsEmpty() ? CustomAggregate::xInverse : nullptr;
   auto xValue = xInverse ? CustomAggregate::xValue : nullptr;
   int r = sqlite3_create_window_function(
-      db->connection_,
+      db->connection_.get(),
       *name,
       argc,
       text_rep,
@@ -2248,10 +2331,15 @@ void DatabaseSync::AggregateFunction(const FunctionCallbackInfo<Value>& args) {
 }
 
 void DatabaseSync::CreateSession(const FunctionCallbackInfo<Value>& args) {
+  DatabaseSync* db;
+  ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
+  Environment* env = Environment::GetCurrent(args);
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
+
   std::string table;
   std::string db_name = "main";
 
-  Environment* env = Environment::GetCurrent(args);
   if (args.Length() > 0) {
     if (!args[0]->IsObject()) {
       THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
@@ -2302,13 +2390,13 @@ void DatabaseSync::CreateSession(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
-  DatabaseSync* db;
-  ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
+  // Reading the options bag above can run user JavaScript through a property
+  // getter, which may have closed the database since it was checked.
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
-  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   sqlite3_session* pSession;
-  int r = sqlite3session_create(db->connection_, db_name.c_str(), &pSession);
+  int r =
+      sqlite3session_create(db->connection_.get(), db_name.c_str(), &pSession);
   CHECK_ERROR_OR_THROW(env->isolate(), db, r, SQLITE_OK, void());
   bool wrapper_owns_session = false;
   auto delete_session_on_failure = OnScopeLeave([&]() {
@@ -2431,6 +2519,11 @@ void Backup(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
+  // Reading the destination path and the options bag above can run user
+  // JavaScript through a property getter, which may have closed the database
+  // since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   Local<Promise::Resolver> resolver;
   if (!Promise::Resolver::New(env->context()).ToLocal(&resolver)) {
     return;
@@ -2574,21 +2667,46 @@ void DatabaseSync::ApplyChangeset(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
-  // Keep the database alive during sqlite3changeset_apply(), which may
-  // call conflict or filter callbacks that trigger JavaScript execution.
-  // If the JavaScript callback drops all references to the database,
-  // the DatabaseSync could otherwise be garbage-collected while the
-  // callback is still executing, causing a use-after-free.
+  // Reading the options bag above can run user JavaScript through a property
+  // getter, which may have closed the database since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
+  // Keep the database alive in case a callback drops all references to it,
+  // which could otherwise let it be garbage-collected mid-callback.
   BaseObjectPtr<DatabaseSync> guard(db);
 
   ArrayBufferViewContents<uint8_t> buf(args[0]);
+  if (buf.length() > std::numeric_limits<int>::max()) {
+    THROW_ERR_OUT_OF_RANGE(env, "The changeset is too large.");
+    return;
+  }
+
+  // A callback may detach/modify the input buffer mid-apply, so copy it.
+  // With no callbacks, no JS runs during sqlite3changeset_apply(), so no
+  // copy is needed.
+  std::unique_ptr<BackingStore> changeset;
+  if (buf.length() > 0 &&
+      (context.filterCallback || context.conflictCallback)) {
+    changeset = ArrayBuffer::NewBackingStore(
+        env->isolate(),
+        buf.length(),
+        BackingStoreInitializationMode::kUninitialized,
+        BackingStoreOnFailureMode::kReturnNull);
+    if (!changeset) {
+      THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+      return;
+    }
+    std::memcpy(changeset->Data(), buf.data(), buf.length());
+  }
+
   int r;
   {
     CallbackDepthGuard guard(db);
     r = sqlite3changeset_apply(
-        db->connection_,
-        buf.length(),
-        const_cast<void*>(static_cast<const void*>(buf.data())),
+        db->connection_.get(),
+        static_cast<int>(buf.length()),
+        changeset ? changeset->Data()
+                  : const_cast<void*>(static_cast<const void*>(buf.data())),
         context.filterCallback ? xFilter : nullptr,
         xConflict,
         static_cast<void*>(&context));
@@ -2630,8 +2748,11 @@ void DatabaseSync::EnableLoadExtension(
     return;
   }
   db->enable_load_extension_ = enable;
-  const int load_extension_ret = sqlite3_db_config(
-      db->connection_, SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION, enable, nullptr);
+  const int load_extension_ret =
+      sqlite3_db_config(db->connection_.get(),
+                        SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION,
+                        enable,
+                        nullptr);
   CHECK_ERROR_OR_THROW(isolate, db, load_extension_ret, SQLITE_OK, void());
 }
 
@@ -2651,8 +2772,10 @@ void DatabaseSync::EnableDefensive(const FunctionCallbackInfo<Value>& args) {
 
   const int enable = args[0].As<Boolean>()->Value();
   int defensive_enabled;
-  const int defensive_ret = sqlite3_db_config(
-      db->connection_, SQLITE_DBCONFIG_DEFENSIVE, enable, &defensive_enabled);
+  const int defensive_ret = sqlite3_db_config(db->connection_.get(),
+                                              SQLITE_DBCONFIG_DEFENSIVE,
+                                              enable,
+                                              &defensive_enabled);
   CHECK_ERROR_OR_THROW(isolate, db, defensive_ret, SQLITE_OK, void());
 }
 
@@ -2661,7 +2784,7 @@ void DatabaseSync::LoadExtension(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(
-      env, db->connection_ == nullptr, "database is not open");
+      env, !db->connection_.get(), "database is not open");
   THROW_AND_RETURN_ON_BAD_STATE(
       env, !db->allow_load_extension_, "extension loading is not allowed");
   THROW_AND_RETURN_ON_BAD_STATE(
@@ -2683,8 +2806,8 @@ void DatabaseSync::LoadExtension(const FunctionCallbackInfo<Value>& args) {
   THROW_IF_INSUFFICIENT_PERMISSIONS(
       env, permission::PermissionScope::kFileSystemRead, path.ToStringView());
   char* errmsg = nullptr;
-  const int r =
-      sqlite3_load_extension(db->connection_, *path, *entryPoint, &errmsg);
+  const int r = sqlite3_load_extension(
+      db->connection_.get(), *path, *entryPoint, &errmsg);
   if (r != SQLITE_OK) {
     isolate->ThrowException(ERR_LOAD_SQLITE_EXTENSION(isolate, errmsg));
   }
@@ -2701,7 +2824,7 @@ void DatabaseSync::SetAuthorizer(const FunctionCallbackInfo<Value>& args) {
 
   if (args[0]->IsNull()) {
     // Clear the authorizer
-    sqlite3_set_authorizer(db->connection_, nullptr, nullptr);
+    sqlite3_set_authorizer(db->connection_.get(), nullptr, nullptr);
     db->object()->SetInternalField(kAuthorizerCallback, Null(isolate));
     return;
   }
@@ -2717,7 +2840,7 @@ void DatabaseSync::SetAuthorizer(const FunctionCallbackInfo<Value>& args) {
   db->object()->SetInternalField(kAuthorizerCallback, fn);
 
   int r = sqlite3_set_authorizer(
-      db->connection_, DatabaseSync::AuthorizerCallback, db);
+      db->connection_.get(), DatabaseSync::AuthorizerCallback, db);
 
   if (r != SQLITE_OK) {
     CHECK_ERROR_OR_THROW(isolate, db, r, SQLITE_OK, void());
@@ -2817,6 +2940,10 @@ int DatabaseSync::TraceCallback(unsigned int type,
     return 0;
   }
 
+  // Entered before building the payload below, because allocating it can
+  // trigger a garbage collection that SQLite is not prepared for.
+  CallbackDepthGuard guard(db);
+
   Isolate* isolate = env->isolate();
   HandleScope handle_scope(isolate);
 
@@ -2855,7 +2982,6 @@ int DatabaseSync::TraceCallback(unsigned int type,
 
   Local<Object> payload = Object::New(isolate, Null(isolate), keys, values, 3);
 
-  CallbackDepthGuard guard(db);
   ch->Publish(env, payload);
 
   return 0;
@@ -3964,7 +4090,7 @@ BaseObjectPtr<StatementSync> SQLTagStore::PrepareStatement(
 
   if (stmt == nullptr) {
     sqlite3_stmt* s = nullptr;
-    int r = sqlite3_prepare_v3(session->database_->connection_,
+    int r = sqlite3_prepare_v3(session->database_->connection_.get(),
                                sql.data(),
                                sql.size(),
                                SQLITE_PREPARE_PERSISTENT,
@@ -4240,7 +4366,7 @@ Session::Session(Environment* env,
                  BaseObjectPtr<DatabaseSync> database,
                  sqlite3_session* session)
     : BaseObject(env, object),
-      session_(session),
+      session_(std::unique_ptr<sqlite3_session, SessionDeleter>(session)),
       database_(std::move(database)) {
   database_->sessions_.insert(this);
   MakeWeak();
@@ -4296,8 +4422,7 @@ void Session::Changeset(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(
       env, !session->database_->IsOpen(), "database is not open");
-  THROW_AND_RETURN_ON_BAD_STATE(
-      env, session->session_ == nullptr, "session is not open");
+  THROW_AND_RETURN_ON_BAD_STATE(env, !session->session_, "session is not open");
   THROW_AND_RETURN_IF_IN_AUTHORIZER(env, session->database_.get());
 
   session->is_generating_changeset_ = true;
@@ -4306,7 +4431,8 @@ void Session::Changeset(const FunctionCallbackInfo<Value>& args) {
 
   int nChangeset;
   void* pChangeset;
-  int r = sqliteChangesetFunc(session->session_, &nChangeset, &pChangeset);
+  int r =
+      sqliteChangesetFunc(session->session_.get(), &nChangeset, &pChangeset);
   CHECK_ERROR_OR_THROW(
       env->isolate(), session->database_.get(), r, SQLITE_OK, void());
 
@@ -4331,22 +4457,30 @@ void Session::Close(const FunctionCallbackInfo<Value>& args) {
       env, session->session_ == nullptr, "session is not open");
   THROW_AND_RETURN_ON_BAD_STATE(
       env, session->is_generating_changeset_, "session is currently in use");
+  // Checked last: changeset generation runs the authorizer, so both conditions
+  // hold in that case and the more specific message above has to win.
+  THROW_AND_RETURN_IF_SESSION_IN_CALLBACK(env, session);
 
   session->Delete();
 }
 
-void Session::Dispose(const v8::FunctionCallbackInfo<v8::Value>& args) {
-  v8::TryCatch try_catch(args.GetIsolate());
-  Close(args);
-  if (try_catch.HasCaught()) {
-    CHECK(try_catch.CanContinue());
+void Session::Dispose(const FunctionCallbackInfo<Value>& args) {
+  Session* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  Environment* env = Environment::GetCurrent(args);
+  if (session->session_ == nullptr) {
+    return;
   }
+  THROW_AND_RETURN_ON_BAD_STATE(
+      env, session->is_generating_changeset_, "session is currently in use");
+  THROW_AND_RETURN_IF_SESSION_IN_CALLBACK(env, session);
+
+  session->Delete();
 }
 
 void Session::Delete() {
-  if (session_ == nullptr) return;
-  sqlite3session_delete(session_);
-  session_ = nullptr;
+  if (!session_) return;
+  session_.reset();
   if (database_) {
     database_->sessions_.erase(this);
   }
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 7b34d4222b4a..306a47f6c47f 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -289,6 +289,13 @@ class DatabaseSync : public BaseObject {
   void DecrementCallbackDepth() { --callback_depth_; }
   bool IsInCallback() const { return callback_depth_ > 0; }
 
+  // SQLite reaches back into JavaScript from inside its pre-update hook, while
+  // it is still walking this connection's session list. Session objects are
+  // weak, so a garbage collection during such a callback could collect one and
+  // free memory SQLite is still using. Returns a strong reference to every
+  // attached session so that a callback can hold them for its duration.
+  std::vector<BaseObjectPtr<Session>> PinSessions() const;
+
   // SQLite forbids an authorizer callback from doing anything that modifies
   // the database connection that invoked it, which includes preparing and
   // stepping statements. See https://www.sqlite.org/c3ref/set_authorizer.html.
@@ -323,7 +330,10 @@ class DatabaseSync : public BaseObject {
   DatabaseOpenConfiguration open_config_;
   bool allow_load_extension_;
   bool enable_load_extension_;
-  sqlite3* connection_;
+  struct ConnectionDeleter {
+    void operator()(sqlite3* db) const { sqlite3_close_v2(db); }
+  };
+  std::unique_ptr<sqlite3, ConnectionDeleter> connection_;
   bool ignore_next_sqlite_error_;
   int callback_depth_ = 0;
   int authorizer_depth_ = 0;
@@ -452,7 +462,10 @@ class Session : public BaseObject {
 
  private:
   void Delete();
-  sqlite3_session* session_;
+  struct SessionDeleter {
+    void operator()(sqlite3_session* s) const { sqlite3session_delete(s); }
+  };
+  std::unique_ptr<sqlite3_session, SessionDeleter> session_;
   BaseObjectPtr<DatabaseSync> database_;  // The Parent Database
   bool is_generating_changeset_ = false;
 
@@ -499,9 +512,13 @@ class SQLTagStore : public BaseObject {
   friend class StatementExecutionHelper;
 };
 
+// Guards a window in which SQLite hands control back to JavaScript. Construct
+// it before allocating anything on the V8 heap, since the pinned sessions
+// below are what keep a garbage collection during that window safe.
 class CallbackDepthGuard {
  public:
-  explicit CallbackDepthGuard(DatabaseSync* db) : db_(db) {
+  explicit CallbackDepthGuard(DatabaseSync* db)
+      : db_(db), pinned_sessions_(db->PinSessions()) {
     db_->IncrementCallbackDepth();
   }
   ~CallbackDepthGuard() { db_->DecrementCallbackDepth(); }
@@ -510,6 +527,7 @@ class CallbackDepthGuard {
 
  private:
   DatabaseSync* db_;
+  std::vector<BaseObjectPtr<Session>> pinned_sessions_;
 };
 
 class TraceEventSuppressionGuard {
diff --git a/src/node_task_runner.cc b/src/node_task_runner.cc
index e7cc9ccf3f13..55f348afc69a 100644
--- a/src/node_task_runner.cc
+++ b/src/node_task_runner.cc
@@ -254,6 +254,27 @@ FindPackageJson(const std::filesystem::path& cwd) {
   return {{package_json_path, raw_content, path_env_var}};
 }
 
+// Prints every "name: command" pair in the scripts object to the given stream.
+static void PrintScripts(FILE* out,
+                         simdjson::ondemand::object& scripts_object) {
+  // Reset the object to iterate from the beginning, in case it was read before.
+  scripts_object.reset();
+  simdjson::ondemand::value value;
+  for (auto field : scripts_object) {
+    std::string_view key_str;
+    std::string_view value_str;
+    if (!field.unescaped_key().get(key_str) && !field.value().get(value) &&
+        !value.get_string().get(value_str)) {
+      fprintf(out,
+              "  %.*s: %.*s\n",
+              static_cast<int>(key_str.size()),
+              key_str.data(),
+              static_cast<int>(value_str.size()),
+              value_str.data());
+    }
+  }
+}
+
 void RunTask(const std::shared_ptr<InitializationResultImpl>& result,
              std::string_view command_id,
              const std::vector<std::string_view>& positional_args) {
@@ -306,6 +327,16 @@ void RunTask(const std::shared_ptr<InitializationResultImpl>& result,
     return;
   }
 
+  // With no command (e.g. bare `node --run`), list the available scripts but
+  // exit non-zero so a script invoking `node --run $CMD` with an unset
+  // variable still fails, as it did before bare `--run` was allowed.
+  if (command_id.empty()) {
+    fprintf(stderr, "Available scripts are:\n");
+    PrintScripts(stderr, scripts_object);
+    result->exit_code_ = ExitCode::kInvalidCommandLineArgument;
+    return;
+  }
+
   // If the command_id is not found in the scripts object, throw an error.
   std::string_view command;
   if (auto command_error =
@@ -323,23 +354,7 @@ void RunTask(const std::shared_ptr<InitializationResultImpl>& result,
               command_id.data(),
               ConvertPathToUTF8(path).c_str());
       fprintf(stderr, "Available scripts are:\n");
-
-      // Reset the object to iterate over it again
-      scripts_object.reset();
-      simdjson::ondemand::value value;
-      for (auto field : scripts_object) {
-        std::string_view key_str;
-        std::string_view value_str;
-        if (!field.unescaped_key().get(key_str) && !field.value().get(value) &&
-            !value.get_string().get(value_str)) {
-          fprintf(stderr,
-                  "  %.*s: %.*s\n",
-                  static_cast<int>(key_str.size()),
-                  key_str.data(),
-                  static_cast<int>(value_str.size()),
-                  value_str.data());
-        }
-      }
+      PrintScripts(stderr, scripts_object);
     }
     result->exit_code_ = ExitCode::kGenericUserError;
     return;
diff --git a/src/node_url_pattern.cc b/src/node_url_pattern.cc
index bc007db47dac..358a102749ca 100644
--- a/src/node_url_pattern.cc
+++ b/src/node_url_pattern.cc
@@ -307,32 +307,21 @@ MaybeLocal<Value> URLPattern::URLPatternInit::ToJsObject(
   auto tmpl = env->urlpatterninit_template();
   if (tmpl.IsEmpty()) {
     static constexpr std::string_view namesVec[] = {
-        "protocol",
-        "username",
-        "password",
+        "baseURL",
+        "hash",
         "hostname",
-        "port",
+        "password",
         "pathname",
+        "port",
+        "protocol",
         "search",
-        "hash",
-        "baseURL",
+        "username",
     };
     tmpl = DictionaryTemplate::New(isolate, namesVec);
     env->set_urlpatterninit_template(tmpl);
   }
 
-  MaybeLocal<Value> values[] = {
-      Undefined(isolate),  // protocol
-      Undefined(isolate),  // username
-      Undefined(isolate),  // password
-      Undefined(isolate),  // hostname
-      Undefined(isolate),  // port
-      Undefined(isolate),  // pathname
-      Undefined(isolate),  // search
-      Undefined(isolate),  // hash
-      Undefined(isolate),  // baseURL
-  };
-
+  MaybeLocal<Value> values[9];
   int idx = 0;
   Local<Value> temp;
   const auto trySet = [&](const std::optional<std::string>& val) {
@@ -346,28 +335,28 @@ MaybeLocal<Value> URLPattern::URLPatternInit::ToJsObject(
     return true;
   };
 
-  if (!trySet(init.protocol) || !trySet(init.username) ||
-      !trySet(init.password) || !trySet(init.hostname) || !trySet(init.port) ||
-      !trySet(init.pathname) || !trySet(init.search) || !trySet(init.hash) ||
-      !trySet(init.base_url)) {
+  if (!trySet(init.base_url) || !trySet(init.hash) || !trySet(init.hostname) ||
+      !trySet(init.password) || !trySet(init.pathname) || !trySet(init.port) ||
+      !trySet(init.protocol) || !trySet(init.search) ||
+      !trySet(init.username)) {
     return {};
   }
-  return NewDictionaryInstance(env->context(), tmpl, values);
+  return tmpl->NewInstance(context, values);
 }
 
 std::optional<ada::url_pattern_init> URLPattern::URLPatternInit::FromJsObject(
     Environment* env, Local<Object> obj) {
   ada::url_pattern_init init{};
   Local<String> components[] = {
-      env->protocol_string(),
-      env->username_string(),
-      env->password_string(),
+      env->base_url_string(),
+      env->hash_string(),
       env->hostname_string(),
-      env->port_string(),
+      env->password_string(),
       env->pathname_string(),
+      env->port_string(),
+      env->protocol_string(),
       env->search_string(),
-      env->hash_string(),
-      env->base_url_string(),
+      env->username_string(),
   };
   auto isolate = env->isolate();
   const auto set_parameter = [&](std::string_view key, std::string_view value) {
diff --git a/src/node_v8.cc b/src/node_v8.cc
index 14ee626c9f3e..14b74f4b6d42 100644
--- a/src/node_v8.cc
+++ b/src/node_v8.cc
@@ -213,6 +213,23 @@ void SetHeapSnapshotNearHeapLimit(const FunctionCallbackInfo<Value>& args) {
   env->set_heap_snapshot_near_heap_limit(limit);
 }
 
+void SetHeapProfileNearHeapLimit(const FunctionCallbackInfo<Value>& args) {
+  CHECK(args[0]->IsUint32());
+  Environment* env = Environment::GetCurrent(args);
+  uint32_t limit = args[0].As<v8::Uint32>()->Value();
+  CHECK_GT(limit, 0);
+
+  std::string dir = env->options()->diagnostic_dir;
+  if (dir.empty()) {
+    dir = Environment::GetCwd(env->exec_path());
+  }
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kFileSystemWrite, dir);
+
+  env->AddHeapProfileNearHeapLimitCallback();
+  env->set_heap_profile_near_heap_limit(limit);
+}
+
 void UpdateHeapStatisticsBuffer(const FunctionCallbackInfo<Value>& args) {
   BindingData* data = Realm::GetBindingData<BindingData>(args);
   HeapStatistics s;
@@ -309,6 +326,7 @@ void StopHeapProfile(const FunctionCallbackInfo<Value>& args) {
   std::ostringstream out_stream;
   bool success = node::SerializeHeapProfile(isolate, out_stream);
   if (success) {
+    isolate->GetHeapProfiler()->StopSamplingHeapProfiler();
     Local<Value> result;
     if (ToV8Value(env->context(), out_stream.str(), isolate).ToLocal(&result)) {
       args.GetReturnValue().Set(result);
@@ -728,6 +746,10 @@ void Initialize(Local<Object> target,
                         target,
                         "setHeapSnapshotNearHeapLimit",
                         SetHeapSnapshotNearHeapLimit);
+  SetMethod(context,
+            target,
+            "setHeapProfileNearHeapLimit",
+            SetHeapProfileNearHeapLimit);
   SetMethod(context,
             target,
             "updateHeapStatisticsBuffer",
@@ -839,6 +861,7 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(SetFlagsFromString);
   registry->Register(GetHashSeed);
   registry->Register(SetHeapSnapshotNearHeapLimit);
+  registry->Register(SetHeapProfileNearHeapLimit);
   registry->Register(GCProfiler::New);
   registry->Register(GCProfiler::Start);
   registry->Register(GCProfiler::Stop);
diff --git a/src/node_v8_platform-inl.h b/src/node_v8_platform-inl.h
index 9e05928e2a57..0538b5feeb59 100644
--- a/src/node_v8_platform-inl.h
+++ b/src/node_v8_platform-inl.h
@@ -26,9 +26,9 @@ struct V8Platform {
       StartTracingAgent();
     }
     // Tracing must be initialized before platform threads are created.
-    platform_ = new NodePlatform(thread_pool_size,
-                                 tracing_agent_->GetTracingController());
-    v8::V8::InitializePlatform(platform_);
+    platform_ = std::make_unique<NodePlatform>(
+        thread_pool_size, tracing_agent_->GetTracingController());
+    v8::V8::InitializePlatform(platform_.get());
   }
   // Make sure V8Platform don not call into Libuv threadpool,
   // see DefaultProcessExitHandlerInternal in environment.cc
@@ -38,8 +38,7 @@ struct V8Platform {
     initialized_ = false;
     StopTracingAgent();
     platform_->Shutdown();
-    delete platform_;
-    platform_ = nullptr;
+    platform_.reset();
     // Destroy tracing after the platform (and platform threads) have been
     // stopped.
     tracing_agent_.reset(nullptr);
@@ -60,10 +59,12 @@ struct V8Platform {
     tracing_agent_->StopTracing();
   }
 
-  inline NodePlatform* Platform() { return platform_; }
+  inline NodePlatform* Platform() {
+    return platform_.get();
+  }
 
   std::unique_ptr<tracing::Agent, tracing::Agent::Deleter> tracing_agent_;
-  NodePlatform* platform_;
+  std::unique_ptr<NodePlatform> platform_;
 #else   // !NODE_USE_V8_PLATFORM
   inline void Initialize(int thread_pool_size) {}
   inline void Dispose() {}
diff --git a/src/node_version.h b/src/node_version.h
index 155e1c461a2b..5c05f45715ed 100644
--- a/src/node_version.h
+++ b/src/node_version.h
@@ -23,13 +23,13 @@
 #define SRC_NODE_VERSION_H_
 
 #define NODE_MAJOR_VERSION 26
-#define NODE_MINOR_VERSION 8
-#define NODE_PATCH_VERSION 3
+#define NODE_MINOR_VERSION 9
+#define NODE_PATCH_VERSION 0
 
 #define NODE_VERSION_IS_LTS 0
 #define NODE_VERSION_LTS_CODENAME ""
 
-#define NODE_VERSION_IS_RELEASE 0
+#define NODE_VERSION_IS_RELEASE 1
 
 #ifndef NODE_STRINGIFY
 #define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n)
diff --git a/src/node_worker.cc b/src/node_worker.cc
index edc21e7e5561..f1a6e96e7f05 100644
--- a/src/node_worker.cc
+++ b/src/node_worker.cc
@@ -16,6 +16,7 @@
 #include "v8-profiler.h"
 
 #include <memory>
+#include <optional>
 #include <string>
 #include <vector>
 
@@ -190,8 +191,6 @@ class WorkerThreadData {
       return;
     }
 
-    SetIsolateUpForNode(isolate);
-
     // Be sure it's called before Environment::InitializeDiagnostics()
     // so that this callback stays when the callback of
     // --heapsnapshot-near-heap-limit gets is popped.
@@ -280,6 +279,7 @@ size_t Worker::NearHeapLimit(void* data, size_t current_heap_limit,
   Environment* env = worker->env();
   if (env != nullptr) {
     DCHECK(!env->is_in_heapsnapshot_heap_limit_callback());
+    DCHECK(!env->is_in_heap_profile_near_heap_limit_callback());
     Debug(env,
           DebugCategory::DIAGNOSTICS,
           "Throwing ERR_WORKER_OUT_OF_MEMORY, "
@@ -293,6 +293,18 @@ size_t Worker::NearHeapLimit(void* data, size_t current_heap_limit,
   return new_limit;
 }
 
+// Can this worker start by deserializing the bootstrapped principal context
+// from the embedded snapshot (plus the worker-side switches) instead of
+// bootstrapping from scratch? Only that snapshot qualifies: an embedder's own
+// or a --snapshot-blob one has run application code in its main context.
+// --no-worker-snapshot opts out; kNoBrowserGlobals changes the bootstrap.
+bool Worker::UseWorkerContextSnapshot() const {
+  return snapshot_data_ != nullptr &&
+         snapshot_data_ == SnapshotBuilder::GetEmbeddedSnapshotData() &&
+         !(environment_flags_ & EnvironmentFlags::kNoBrowserGlobals) &&
+         per_process::cli_options->per_isolate->worker_snapshot;
+}
+
 void Worker::Run() {
   std::string trace_name = "[worker " + std::to_string(thread_id_.id) + "]" +
                            (name_ == "" ? "" : " " + name_);
@@ -341,7 +353,15 @@ void Worker::Run() {
         // resource constraints, we need something in place to handle it,
         // though.
         TryCatch try_catch(isolate_);
-        if (snapshot_data_ != nullptr) {
+        if (UseWorkerContextSnapshot()) {
+          // Leave `context` empty: CreateEnvironment() deserializes the
+          // bootstrapped principal context (kNodeMainContextIndex) and the
+          // Environment state that goes with it, applies the worker-side
+          // switches, and skips RunBootstrapping().
+          Debug(this,
+                "Worker %llu deserializes the bootstrapped context\n",
+                thread_id_.id);
+        } else if (snapshot_data_ != nullptr) {
           Debug(this,
                 "Worker %llu uses context from snapshot %d\n",
                 thread_id_.id,
@@ -358,7 +378,7 @@ void Worker::Run() {
               this, "Worker %llu builds context from scratch\n", thread_id_.id);
           context = NewContext(isolate_);
         }
-        if (context.IsEmpty()) {
+        if (context.IsEmpty() && !UseWorkerContextSnapshot()) {
           // TODO(joyeecheung): maybe this should be kBootstrapFailure instead?
           Exit(ExitCode::kGenericUserError,
                "ERR_WORKER_INIT_FAILED",
@@ -368,8 +388,8 @@ void Worker::Run() {
       }
 
       if (is_stopped()) return;
-      CHECK(!context.IsEmpty());
-      Context::Scope context_scope(context);
+      std::optional<Context::Scope> context_scope;
+      if (!context.IsEmpty()) context_scope.emplace(context);
       {
 #if HAVE_INSPECTOR
         environment_flags_ |= EnvironmentFlags::kNoWaitForInspectorFrontend;
@@ -385,6 +405,7 @@ void Worker::Run() {
             name_));
         if (is_stopped()) return;
         CHECK_NOT_NULL(env_);
+        if (!context_scope) context_scope.emplace(env_->context());
         env_->set_env_vars(std::move(env_vars_));
         SetProcessExitHandler(env_.get(), [this](Environment*, int exit_code) {
           Exit(static_cast<ExitCode>(exit_code));
@@ -660,6 +681,11 @@ void Worker::New(const FunctionCallbackInfo<Value>& args) {
                           kDisallowedInEnvvar,
                           &errors);
 
+    // All of the worker's option sources (the env options, NODE_OPTIONS and
+    // execArgv) have now been parsed, so the benchmark options can be
+    // validated against --experimental-bench.
+    per_isolate_opts->per_env->CheckBenchOptions(&errors);
+
     // The first argument is program name.
     invalid_args.erase(invalid_args.begin());
     // Only fail for explicitly provided execArgv, this protects from failures
@@ -1109,6 +1135,9 @@ void Worker::StopHeapProfile(const FunctionCallbackInfo<Value>& args) {
     std::ostringstream out_stream;
     bool success =
         node::SerializeHeapProfile(worker_env->isolate(), out_stream);
+    if (success) {
+      worker_env->isolate()->GetHeapProfiler()->StopSamplingHeapProfiler();
+    }
     env->SetImmediateThreadsafe(
         [taker = std::move(taker),
          out_stream = std::move(out_stream),
@@ -1414,8 +1443,70 @@ void GetEnvMessagePort(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+// Per-thread values of the `worker` binding are lazy properties of the
+// per-isolate template, so that a bootstrapped context carries none of them
+// and can be deserialized by any thread.
+void ThreadIdGetter(Local<v8::Name>,
+                    const v8::PropertyCallbackInfo<Value>& info) {
+  Environment* env = Environment::GetCurrent(info);
+  info.GetReturnValue().Set(static_cast<double>(env->thread_id()));
+}
+
+void ThreadNameGetter(Local<v8::Name>,
+                      const v8::PropertyCallbackInfo<Value>& info) {
+  Environment* env = Environment::GetCurrent(info);
+  Local<String> name;
+  if (String::NewFromUtf8(info.GetIsolate(),
+                          env->thread_name().data(),
+                          NewStringType::kNormal,
+                          env->thread_name().size())
+          .ToLocal(&name)) {
+    info.GetReturnValue().Set(name);
+  }
+}
+
+void IsMainThreadGetter(Local<v8::Name>,
+                        const v8::PropertyCallbackInfo<Value>& info) {
+  info.GetReturnValue().Set(Environment::GetCurrent(info)->is_main_thread());
+}
+
+void IsInternalThreadGetter(Local<v8::Name>,
+                            const v8::PropertyCallbackInfo<Value>& info) {
+  Worker* worker =
+      Environment::GetCurrent(info)->isolate_data()->worker_context();
+  info.GetReturnValue().Set(worker != nullptr && worker->is_internal());
+}
+
+void OwnsProcessStateGetter(Local<v8::Name>,
+                            const v8::PropertyCallbackInfo<Value>& info) {
+  info.GetReturnValue().Set(
+      Environment::GetCurrent(info)->owns_process_state());
+}
+
+void ResourceLimitsGetter(Local<v8::Name>,
+                          const v8::PropertyCallbackInfo<Value>& info) {
+  Environment* env = Environment::GetCurrent(info);
+  if (env->worker_context() != nullptr) {
+    info.GetReturnValue().Set(
+        env->worker_context()->GetResourceLimits(info.GetIsolate()));
+  }
+}
+
 void CreateWorkerPerIsolateProperties(IsolateData* isolate_data,
                                       Local<ObjectTemplate> target) {
+  {
+    Isolate* isolate = isolate_data->isolate();
+    auto lazy = [&](const char* name, v8::AccessorNameGetterCallback getter) {
+      target->SetLazyDataProperty(OneByteString(isolate, name), getter);
+    };
+    lazy("threadId", ThreadIdGetter);
+    lazy("threadName", ThreadNameGetter);
+    lazy("isMainThread", IsMainThreadGetter);
+    lazy("isInternalThread", IsInternalThreadGetter);
+    lazy("ownsProcessState", OwnsProcessStateGetter);
+    lazy("resourceLimits", ResourceLimitsGetter);
+  }
+
   Isolate* isolate = isolate_data->isolate();
 
   {
@@ -1520,55 +1611,9 @@ void CreateWorkerPerContextProperties(Local<Object> target,
                                       Local<Value> unused,
                                       Local<Context> context,
                                       void* priv) {
-  Environment* env = Environment::GetCurrent(context);
-  Isolate* isolate = env->isolate();
-
-  target
-      ->Set(env->context(),
-            env->thread_id_string(),
-            Number::New(isolate, static_cast<double>(env->thread_id())))
-      .Check();
-
-  target
-      ->Set(env->context(),
-            env->thread_name_string(),
-            String::NewFromUtf8(isolate,
-                                env->thread_name().data(),
-                                NewStringType::kNormal,
-                                env->thread_name().size())
-                .ToLocalChecked())
-      .Check();
-
-  target
-      ->Set(env->context(),
-            FIXED_ONE_BYTE_STRING(isolate, "isMainThread"),
-            Boolean::New(isolate, env->is_main_thread()))
-      .Check();
-
-  Worker* worker = env->isolate_data()->worker_context();
-  bool is_internal = worker != nullptr && worker->is_internal();
-
-  // Set the is_internal property
-  target
-      ->Set(env->context(),
-            FIXED_ONE_BYTE_STRING(isolate, "isInternalThread"),
-            Boolean::New(isolate, is_internal))
-      .Check();
-
-  target
-      ->Set(env->context(),
-            FIXED_ONE_BYTE_STRING(isolate, "ownsProcessState"),
-            Boolean::New(isolate, env->owns_process_state()))
-      .Check();
-
-  if (!env->is_main_thread()) {
-    target
-        ->Set(env->context(),
-              FIXED_ONE_BYTE_STRING(isolate, "resourceLimits"),
-              env->worker_context()->GetResourceLimits(isolate))
-        .Check();
-  }
-
+  // threadId, threadName, isMainThread, isInternalThread, ownsProcessState
+  // and resourceLimits are lazy properties of the per-isolate template (see
+  // CreateWorkerPerIsolateProperties).
   NODE_DEFINE_CONSTANT(target, kMaxYoungGenerationSizeMb);
   NODE_DEFINE_CONSTANT(target, kMaxOldGenerationSizeMb);
   NODE_DEFINE_CONSTANT(target, kCodeRangeSizeMb);
@@ -1578,6 +1623,12 @@ void CreateWorkerPerContextProperties(Local<Object> target,
 
 void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(GetEnvMessagePort);
+  registry->Register(ThreadIdGetter);
+  registry->Register(ThreadNameGetter);
+  registry->Register(IsMainThreadGetter);
+  registry->Register(IsInternalThreadGetter);
+  registry->Register(OwnsProcessStateGetter);
+  registry->Register(ResourceLimitsGetter);
   registry->Register(Worker::New);
   registry->Register(Worker::StartThread);
   registry->Register(Worker::StopThread);
diff --git a/src/node_worker.h b/src/node_worker.h
index fd02b1d381ed..894256053dc0 100644
--- a/src/node_worker.h
+++ b/src/node_worker.h
@@ -42,6 +42,7 @@ class Worker : public AsyncWrap {
 
   // Run the worker. This is only called from the worker thread.
   void Run();
+  bool UseWorkerContextSnapshot() const;
 
   // Forcibly exit the thread with a specified exit code. This may be called
   // from any thread. `error_code` and `error_message` can be used to create
diff --git a/src/permission/fs_permission.cc b/src/permission/fs_permission.cc
index b2f3cbb31a6e..dbd28259f54f 100644
--- a/src/permission/fs_permission.cc
+++ b/src/permission/fs_permission.cc
@@ -30,20 +30,6 @@ std::string WildcardIfDir(const std::string& res) noexcept {
   return res;
 }
 
-void FreeRecursivelyNode(
-    node::permission::FSPermission::RadixTree::Node* node) {
-  if (node == nullptr) {
-    return;
-  }
-
-  for (auto& [label, child] : node->children) {
-    FreeRecursivelyNode(child);
-  }
-
-  delete node->wildcard_child;
-  delete node;
-}
-
 bool is_tree_granted(
     node::Environment* env,
     const node::permission::FSPermission::RadixTree* granted_tree,
@@ -118,7 +104,7 @@ void PrintTree(const node::permission::FSPermission::RadixTree::Node* node,
     for (const auto& [label, child] : node->children) {
       count++;
       bool child_is_last = (count == total);
-      PrintTree(child, depth + 1, next_branch_prefix, child_is_last);
+      PrintTree(child.get(), depth + 1, next_branch_prefix, child_is_last);
     }
   }
 }
@@ -266,25 +252,19 @@ bool FSPermission::is_granted(Environment* env,
   }
 }
 
-FSPermission::RadixTree::RadixTree() : root_node_(new Node("")) {}
+FSPermission::RadixTree::RadixTree() : root_node_(std::make_unique<Node>("")) {}
 
-FSPermission::RadixTree::~RadixTree() {
-  FreeRecursivelyNode(root_node_);
-}
+FSPermission::RadixTree::~RadixTree() = default;
 
 void FSPermission::RadixTree::Clear() {
-  for (auto& [label, child] : root_node_->children) {
-    FreeRecursivelyNode(child);
-  }
   root_node_->children.clear();
-  delete root_node_->wildcard_child;
-  root_node_->wildcard_child = nullptr;
+  root_node_->wildcard_child.reset();
   root_node_->is_leaf = false;
 }
 
 bool FSPermission::RadixTree::Lookup(std::string_view s,
                                      bool when_empty_return) const {
-  FSPermission::RadixTree::Node* current_node = root_node_;
+  FSPermission::RadixTree::Node* current_node = root_node_.get();
   if (current_node->children.empty()) {
     return when_empty_return;
   }
@@ -311,7 +291,7 @@ bool FSPermission::RadixTree::Lookup(std::string_view s,
 }
 
 void FSPermission::RadixTree::Insert(const std::string& path) {
-  FSPermission::RadixTree::Node* current_node = root_node_;
+  FSPermission::RadixTree::Node* current_node = root_node_.get();
 
   size_t parent_node_prefix_len = current_node->prefix.length();
   size_t path_len = path.length();
@@ -334,7 +314,7 @@ void FSPermission::RadixTree::Insert(const std::string& path) {
   if (per_process::enabled_debug_list.enabled(DebugCategory::PERMISSION_MODEL))
       [[unlikely]] {
     per_process::Debug(DebugCategory::PERMISSION_MODEL, "Inserting %s\n", path);
-    PrintTree(root_node_);
+    PrintTree(root_node_.get());
   }
 }
 
diff --git a/src/permission/fs_permission.h b/src/permission/fs_permission.h
index f2e1720ed9bd..ab05623e1db8 100644
--- a/src/permission/fs_permission.h
+++ b/src/permission/fs_permission.h
@@ -3,6 +3,7 @@
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
+#include <memory>
 #include <vector>
 #include "permission/permission_base.h"
 #include "util.h"
@@ -24,8 +25,8 @@ class FSPermission final : public PermissionBase {
   struct RadixTree {
     struct Node {
       std::string prefix;
-      std::vector<std::pair<char, Node*>> children;
-      Node* wildcard_child = nullptr;
+      std::vector<std::pair<char, std::unique_ptr<Node>>> children;
+      std::unique_ptr<Node> wildcard_child;
       bool is_leaf = false;
 
       explicit Node(std::string_view pre) : prefix(pre) {}
@@ -34,19 +35,19 @@ class FSPermission final : public PermissionBase {
 
       Node* FindChild(char label) const {
         for (const auto& [c, node] : children) {
-          if (c == label) return node;
+          if (c == label) return node.get();
         }
         return nullptr;
       }
 
-      void SetChild(char label, Node* node) {
+      void SetChild(char label, std::unique_ptr<Node> node) {
         for (auto& [c, n] : children) {
           if (c == label) {
-            n = node;
+            n = std::move(node);
             return;
           }
         }
-        children.emplace_back(label, node);
+        children.emplace_back(label, std::move(node));
       }
 
       Node* CreateChild(std::string_view path_prefix) {
@@ -60,8 +61,9 @@ class FSPermission final : public PermissionBase {
 
         Node* child = FindChild(label);
         if (child == nullptr) {
-          child = new Node(path_prefix);
-          children.emplace_back(label, child);
+          auto new_child = std::make_unique<Node>(path_prefix);
+          child = new_child.get();
+          children.emplace_back(label, std::move(new_child));
           return child;
         }
         bool child_was_end_node = child->IsEndNode();
@@ -75,11 +77,20 @@ class FSPermission final : public PermissionBase {
             std::string child_prefix(child->prefix.substr(i));
 
             child->prefix = child_prefix;
-            Node* split_child = new Node(parent_prefix);
-            split_child->children.emplace_back(child_prefix[0], child);
-            SetChild(parent_prefix[0], split_child);
+            auto split_child = std::make_unique<Node>(parent_prefix);
+            Node* split_raw = split_child.get();
+            std::unique_ptr<Node> detached;
+            for (auto& [c, n] : children) {
+              if (c == label) {
+                detached = std::move(n);
+                break;
+              }
+            }
+            split_child->children.emplace_back(child_prefix[0],
+                                               std::move(detached));
+            SetChild(parent_prefix[0], std::move(split_child));
 
-            return split_child->CreateChild(path_prefix.substr(i));
+            return split_raw->CreateChild(path_prefix.substr(i));
           }
         }
         if (child_was_end_node) {
@@ -90,10 +101,10 @@ class FSPermission final : public PermissionBase {
 
       Node* CreateWildcardChild() {
         if (wildcard_child != nullptr) {
-          return wildcard_child;
+          return wildcard_child.get();
         }
-        wildcard_child = new Node();
-        return wildcard_child;
+        wildcard_child = std::make_unique<Node>();
+        return wildcard_child.get();
       }
 
       Node* NextNode(std::string_view path, size_t idx) const {
@@ -165,7 +176,7 @@ class FSPermission final : public PermissionBase {
     bool Lookup(std::string_view s, bool when_empty_return) const;
 
    private:
-    Node* root_node_;
+    std::unique_ptr<Node> root_node_;
   };
 
  private:
@@ -179,11 +190,11 @@ class FSPermission final : public PermissionBase {
   std::vector<std::string> granted_paths_in_;
   std::vector<std::string> granted_paths_out_;
 
-  bool deny_all_in_ = true;
-  bool deny_all_out_ = true;
+  bool deny_all_in_ : 1 = true;
+  bool deny_all_out_ : 1 = true;
 
-  bool allow_all_in_ = false;
-  bool allow_all_out_ = false;
+  bool allow_all_in_ : 1 = false;
+  bool allow_all_out_ : 1 = false;
 };
 
 }  // namespace node::permission
diff --git a/src/permission/permission.cc b/src/permission/permission.cc
index 29449c0ec028..da86d6bbb923 100644
--- a/src/permission/permission.cc
+++ b/src/permission/permission.cc
@@ -90,9 +90,12 @@ static void Drop(const FunctionCallbackInfo<Value>& args) {
   }
 
   if (args.Length() > 1 && !args[1]->IsUndefined()) {
-    Utf8Value utf8_arg(env->isolate(), args[1]);
-    if (utf8_arg.length() > 0) {
-      env->permission()->Drop(env, scope, utf8_arg.ToStringView());
+    // BufferValue copies raw bytes out of a Buffer/TypedArray as-is instead
+    // of forcing a (potentially lossy) UTF-8 string conversion, since paths
+    // are not guaranteed to be valid UTF-8.
+    BufferValue resource(env->isolate(), args[1]);
+    if (resource.length() > 0) {
+      env->permission()->Drop(env, scope, resource.ToStringView());
       return;
     }
   }
@@ -113,13 +116,16 @@ static void Has(const FunctionCallbackInfo<Value>& args) {
   }
 
   if (args.Length() > 1 && !args[1]->IsUndefined()) {
-    Utf8Value utf8_arg(env->isolate(), args[1]);
-    if (utf8_arg.length() == 0) {
+    // BufferValue copies raw bytes out of a Buffer/TypedArray as-is instead
+    // of forcing a (potentially lossy) UTF-8 string conversion, since paths
+    // are not guaranteed to be valid UTF-8.
+    BufferValue resource(env->isolate(), args[1]);
+    if (resource.length() == 0) {
       args.GetReturnValue().Set(false);
       return;
     }
     return args.GetReturnValue().Set(
-        env->permission()->is_granted(env, scope, utf8_arg.ToStringView()));
+        env->permission()->is_granted(env, scope, resource.ToStringView()));
   }
 
   return args.GetReturnValue().Set(env->permission()->is_granted(env, scope));
@@ -174,16 +180,22 @@ static bool FastHasResource(
     return false;
   }
 
-  Local<String> res_str;
-  if (!resource_arg->ToString(context).ToLocal(&res_str)) {
-    return false;
+  // The JS wrapper always calls this with 2 arguments, passing undefined
+  // when no resource was given, so this path (unlike Has()) has to check
+  // for that explicitly and fall back to the scope-only check.
+  if (resource_arg->IsUndefined()) {
+    return env->permission()->is_granted(env, scope);
   }
-  Utf8Value utf8_res(isolate, res_str);
-  if (utf8_res.length() == 0) {
+
+  // BufferValue is constructed directly from resource_arg (not from a
+  // pre-converted String) so that a Buffer/TypedArray's raw bytes are
+  // copied as-is instead of going through a lossy UTF-8 string conversion.
+  BufferValue resource(isolate, resource_arg);
+  if (resource.length() == 0) {
     return false;
   }
 
-  return env->permission()->is_granted(env, scope, utf8_res.ToStringView());
+  return env->permission()->is_granted(env, scope, resource.ToStringView());
 }
 
 static CFunction fast_has_methods_[] = {CFunction::Make(FastHas),
diff --git a/src/quic/README.md b/src/quic/README.md
index 3d90cacdbb6c..8c23ed2f4af9 100644
--- a/src/quic/README.md
+++ b/src/quic/README.md
@@ -146,9 +146,9 @@ ALPN-specific behavior to. Two implementations exist:
   server push, and stream prioritization. Manages unidirectional control
   streams internally.
 
-The Application is selected during ALPN negotiation — immediately for
-clients (ALPN known upfront), during the `OnSelectAlpn` TLS callback for
-servers.
+The Application is selected as soon as the ALPN protocol is known:
+immediately for clients, and for servers from the `OnClientHello` TLS
+callback (see [Server handshake ordering](#server-handshake-ordering)).
 
 ### Thread-Local Allocator
 
@@ -183,8 +183,44 @@ succeed but memory tracking is silently skipped.
 
 **Server**: `Endpoint::Receive()` processes an Initial packet through
 address validation (retry tokens, LRU cache), then calls `Session::Create()`
-→ `ngtcp2_conn_server_new()`. The Application is selected later, during ALPN
-negotiation in the TLS handshake.
+→ `ngtcp2_conn_server_new()`. The Application is selected later, once the
+ClientHello names an ALPN protocol.
+
+### Server handshake ordering
+
+A server has to make several decisions from the ClientHello, and the order
+matters: the ALPN protocol depends on which identity SNI selected, the
+Application depends on the ALPN protocol, and JavaScript needs a
+`QuicSession` object before any 0-RTT request arrives on it. TLS is
+therefore stopped at the ClientHello, before the point where a session
+ticket could be accepted and early data could start flowing:
+
+```text
+ngtcp2_conn_read_pkt()
+ → SSL_do_handshake()
+    → TLSContext::OnClientHello()        // SSL_CTX_set_client_hello_cb
+       ├── SelectSNIContext() + SSL_set_SSL_CTX()
+       ├── crypto::SelectNextProtocol()  // against that identity's list
+       ├── Session::InstallApplicationForAlpn()
+       └── return SSL_CLIENT_HELLO_RETRY  // handshake suspended here
+    ← SSL_ERROR_WANT_CLIENT_HELLO_CB     // ngtcp2 treats this as "not done"
+ ← 0
+Session::AfterNgtcp2Read()
+ → Endpoint::EmitNewSession()            // JS sees the session, TLS paused
+ → Session::ResumeHandshake()
+    → ngtcp2_conn_continue_handshake()
+       → OnClientHello() again           // returns success immediately
+       → session ticket, 0-RTT keys, early data, ...
+```
+
+The later servername and ALPN callbacks do not repeat any of this; they
+only hand the cached result back to OpenSSL, which is what OpenSSL needs
+in order to emit the corresponding extensions.
+
+Because nothing application-level can happen before the resume, no event
+deferral is needed. The one exception is qlog: ngtcp2 writes it from the
+first inbound packet, so those chunks are buffered on the Session and
+flushed immediately after the new-session callback returns.
 
 ### The Receive Path
 
@@ -363,10 +399,10 @@ The `Http3ApplicationImpl` wraps `nghttp3_conn` and handles:
   CONNECT protocol, datagrams) are negotiated and enforced. Datagram
   support follows RFC 9297 — when the peer's SETTINGS disable datagrams,
   `sendDatagram()` is blocked.
-* **0-RTT**: Early data settings are validated during ticket extraction
-  (`ValidateTicketData` in `ExtractSessionTicketAppData`). If the server's
-  settings changed incompatibly, the ticket is rejected before TLS accepts
-  it.
+* **0-RTT**: Early data settings are validated in
+  `ExtractSessionTicketAppData`. If the server's settings changed
+  incompatibly, the ticket is rejected before TLS accepts it and the
+  connection falls back to a full 1-RTT handshake.
 
 ## Error Handling
 
diff --git a/src/quic/application.cc b/src/quic/application.cc
index d3c5e2611f5f..f83b64bad49e 100644
--- a/src/quic/application.cc
+++ b/src/quic/application.cc
@@ -195,47 +195,18 @@ void Session::Application::CollectSessionTicketAppData(
 SessionTicket::AppData::Status
 Session::Application::ExtractSessionTicketAppData(
     const SessionTicket::AppData& app_data, Flag flag) {
-  // By default we do not have any application data to retrieve.
+  // CollectSessionTicketAppData writes just the type byte, so all this can
+  // check is that the ticket came from the same application type.
+  auto data = app_data.Get();
+  if (!data || data->len != 1 ||
+      static_cast<uint8_t>(data->base[0]) != static_cast<uint8_t>(type())) {
+    return SessionTicket::AppData::Status::TICKET_IGNORE_RENEW;
+  }
   return flag == Flag::STATUS_RENEW
              ? SessionTicket::AppData::Status::TICKET_USE_RENEW
              : SessionTicket::AppData::Status::TICKET_USE;
 }
 
-std::optional<PendingTicketAppData> Session::Application::ParseTicketData(
-    const uv_buf_t& data) {
-  if (data.len == 0 || data.base == nullptr) return std::nullopt;
-  auto app_type =
-      static_cast<Type>(reinterpret_cast<const uint8_t*>(data.base)[0]);
-  switch (app_type) {
-    case Type::DEFAULT:
-      return DefaultTicketData{};
-    case Type::HTTP3:
-      return ParseHttp3TicketData(data);
-    default:
-      return std::nullopt;
-  }
-}
-
-bool Session::Application::ValidateTicketData(
-    const PendingTicketAppData& data, const Application_Options& options) {
-  if (std::holds_alternative<Http3TicketData>(data)) {
-    // TODO(@jasnell): This validation probably belongs in http3.cc but keeping
-    // it here for now.
-    const auto& ticket = std::get<Http3TicketData>(data);
-    return options.max_field_section_size >= ticket.max_field_section_size &&
-           options.qpack_max_dtable_capacity >=
-               ticket.qpack_max_dtable_capacity &&
-           options.qpack_encoder_max_dtable_capacity >=
-               ticket.qpack_encoder_max_dtable_capacity &&
-           options.qpack_blocked_streams >= ticket.qpack_blocked_streams &&
-           (!ticket.enable_connect_protocol ||
-            options.enable_connect_protocol) &&
-           (!ticket.enable_datagrams || options.enable_datagrams);
-  }
-  // DefaultTicketData always validates.
-  return true;
-}
-
 void Session::Application::ReceiveStreamClose(Stream* stream,
                                               QuicError&& error) {
   DCHECK_NOT_NULL(stream);
@@ -254,6 +225,12 @@ void Session::Application::ReceiveStreamReset(Stream* stream,
   stream->ReceiveStreamReset(final_size, std::move(error));
 }
 
+void Session::Application::ReturnConnectionCredit(size_t datalen) {
+  if (datalen == 0 || session().is_destroyed()) return;
+  Session::SendPendingDataScope send_scope(&session());
+  session().ExtendOffset(datalen);
+}
+
 // ============================================================================
 // The DefaultApplication is the default implementation of Session::Application
 // that is used for all unrecognized ALPN identifiers.
@@ -297,10 +274,6 @@ class DefaultApplication final : public Session::Application {
     }
   }
 
-  bool ApplySessionTicketData(const PendingTicketAppData& data) override {
-    return std::holds_alternative<DefaultTicketData>(data);
-  }
-
   bool ReceiveStreamOpen(stream_id id) override {
     auto stream = session().CreateStream(id);
     if (!stream || session().is_destroyed()) [[unlikely]] {
@@ -316,6 +289,22 @@ class DefaultApplication final : public Session::Application {
                          void* stream_user_data) override {
     BaseObjectPtr<Stream> stream;
     if (stream_user_data == nullptr) {
+      // A locally-initiated stream only exists because we created it, so a
+      // missing Stream means we already destroyed it. Data the peer had put in
+      // flight must not resurrect it as a bogus "incoming" stream. Discard it
+      // and return its credit instead. The is_destroyed() check must come
+      // first: an earlier callback in this same ngtcp2 batch may have
+      // destroyed the session, after which none of this may be touched.
+      if (!session().is_destroyed() &&
+          ngtcp2_conn_is_local_stream(session(), id)) {
+        Debug(&session(),
+              "Discarding %zu bytes for destroyed local stream %" PRIi64,
+              datalen,
+              id);
+        ReturnConnectionCredit(datalen);
+        return true;
+      }
+
       // This is the first time we're seeing this stream. Implicitly create it.
       stream = session().CreateStream(id);
       if (!stream || session().is_destroyed()) [[unlikely]] {
@@ -324,9 +313,11 @@ class DefaultApplication final : public Session::Application {
         return false;
       }
 
-      // The stream was created, but was immediately destroyed because there's
-      // no onstream handler.
+      // The stream was created but immediately destroyed, either because there
+      // is no onstream handler or because the handler destroyed it. Nothing
+      // will consume the data, so discard it and return its credit.
       if (stream->is_destroyed()) [[unlikely]] {
+        ReturnConnectionCredit(datalen);
         return true;
       }
     } else {
diff --git a/src/quic/application.h b/src/quic/application.h
index ace6035a0ab7..df472e0a9fd7 100644
--- a/src/quic/application.h
+++ b/src/quic/application.h
@@ -2,9 +2,6 @@
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
-#include <optional>
-#include <variant>
-
 #include "base_object.h"
 #include "bindingdata.h"
 #include "defs.h"
@@ -14,21 +11,6 @@
 
 namespace node::quic {
 
-// Parsed session ticket application data, produced by
-// Application::ParseTicketData() before ALPN negotiation and consumed
-// by Application::ApplySessionTicketData() after.
-struct DefaultTicketData {};
-struct Http3TicketData {
-  uint64_t max_field_section_size;
-  uint64_t qpack_max_dtable_capacity;
-  uint64_t qpack_encoder_max_dtable_capacity;
-  uint64_t qpack_blocked_streams;
-  bool enable_connect_protocol;
-  bool enable_datagrams;
-};
-using PendingTicketAppData =
-    std::variant<std::monostate, DefaultTicketData, Http3TicketData>;
-
 // An Application implements the ALPN-protocol specific semantics on behalf
 // of a QUIC Session.
 class Session::Application : public MemoryRetainer {
@@ -98,9 +80,11 @@ class Session::Application : public MemoryRetainer {
   virtual bool ReceiveStreamOpen(stream_id id) = 0;
 
   // Session will forward all received stream data immediately on to the
-  // Application. The only additional processing the Session does is to
-  // automatically adjust the session-level flow control window. It is up to
-  // the Application to do the same for the Stream-level flow control.
+  // Application without any additional processing. Every byte delivered here
+  // is charged against both the session-level and the stream-level receive
+  // window, and it is up to the Application to return that credit (see
+  // ReturnConnectionCredit and Stream::ReturnFlowControlCredit) once the
+  // bytes have been consumed or discarded.
   virtual bool ReceiveStreamData(stream_id id,
                                  const uint8_t* data,
                                  size_t datalen,
@@ -164,32 +148,15 @@ class Session::Application : public MemoryRetainer {
   virtual void CollectSessionTicketAppData(
       SessionTicket::AppData* app_data) const;
 
-  // Different Applications may set some application data in the session
-  // ticket (e.g. http/3 would set server settings in the application data).
-  // By default, there's nothing to get.
+  // Validates the application data embedded in a session ticket offered by
+  // a resuming client, and decides whether the ticket may be used. The
+  // Application is always installed by the time a ticket can be decrypted,
+  // so each Application checks its own data here. By default, there's
+  // nothing to get.
   virtual SessionTicket::AppData::Status ExtractSessionTicketAppData(
       const SessionTicket::AppData& app_data,
       SessionTicket::AppData::Source::Flag flag);
 
-  // Validates parsed ticket data against current application options.
-  // Returns false if the stored settings are more permissive than the
-  // current config (e.g., a feature was enabled when the ticket was
-  // issued but is now disabled).
-  static bool ValidateTicketData(const PendingTicketAppData& data,
-                                 const Application_Options& options);
-
-  // Parse session ticket app data before ALPN negotiation. Reads the
-  // type byte and dispatches to the appropriate application-specific
-  // parser. Returns std::nullopt if parsing fails.
-  static std::optional<PendingTicketAppData> ParseTicketData(
-      const uv_buf_t& data);
-
-  // Called after ALPN negotiation to validate and apply previously
-  // parsed session ticket app data. Returns false if the data is
-  // incompatible (e.g., type mismatch or settings downgrade), which
-  // causes the handshake to fail.
-  virtual bool ApplySessionTicketData(const PendingTicketAppData& data) = 0;
-
   // Notifies the Application that the identified stream has been closed.
   virtual void ReceiveStreamClose(Stream* stream,
                                   QuicError&& error = QuicError());
@@ -266,6 +233,12 @@ class Session::Application : public MemoryRetainer {
     return *session_;
   }
 
+  // Returns the connection-level flow control credit for `datalen` bytes that
+  // were delivered to the Application but discarded without ever reaching a
+  // Stream. Dropping them silently would permanently shrink the session's
+  // shared receive window.
+  void ReturnConnectionCredit(size_t datalen);
+
  private:
   Session* session_ = nullptr;
 };
diff --git a/src/quic/endpoint.cc b/src/quic/endpoint.cc
index d83b70ba949f..a6a4109509ae 100644
--- a/src/quic/endpoint.cc
+++ b/src/quic/endpoint.cc
@@ -1999,10 +1999,10 @@ void Endpoint::EmitNewSession(const BaseObjectPtr<Session>& session) {
   // exists but it is in a destroyed state. Care should be taken accessing
   // session after this point.
 
-  // Deliver any stream events that were held until the stream was setup,
-  // e.g. 0-RTT streams from the first flight.
+  // Deliver any qlog written while processing the packets that carried the
+  // ClientHello, which is the only output that can predate this callback.
   if (!session->is_destroyed()) {
-    session->ReplayDeferredEmits();
+    session->FlushPendingQlog();
   }
 }
 
diff --git a/src/quic/http3.cc b/src/quic/http3.cc
index ff54bba0354f..6e1d0c44a048 100644
--- a/src/quic/http3.cc
+++ b/src/quic/http3.cc
@@ -486,21 +486,6 @@ class Http3ApplicationImpl final : public Session::Application {
                : SessionTicket::AppData::Status::TICKET_USE;
   }
 
-  bool ApplySessionTicketData(const PendingTicketAppData& data) override {
-    if (!std::holds_alternative<Http3TicketData>(data)) return false;
-    const auto& ticket = std::get<Http3TicketData>(data);
-    // Validate that current settings are >= stored settings.
-    return options_.max_field_section_size >= ticket.max_field_section_size &&
-           options_.qpack_max_dtable_capacity >=
-               ticket.qpack_max_dtable_capacity &&
-           options_.qpack_encoder_max_dtable_capacity >=
-               ticket.qpack_encoder_max_dtable_capacity &&
-           options_.qpack_blocked_streams >= ticket.qpack_blocked_streams &&
-           (!ticket.enable_connect_protocol ||
-            options_.enable_connect_protocol) &&
-           (!ticket.enable_datagrams || options_.enable_datagrams);
-  }
-
   void ReceiveStreamClose(Stream* stream,
                           QuicError&& error = QuicError()) override {
     Debug(
@@ -877,6 +862,10 @@ class Http3ApplicationImpl final : public Session::Application {
           "HTTP/3 application received end of headers for stream %" PRIi64,
           id);
     stream->EmitHeaders();
+    // EmitHeaders() calls into JavaScript, which can synchronously destroy the
+    // stream. Its arena-backed state is released by Destroy(), so do not touch
+    // the stream again if that happened.
+    if (stream->is_destroyed()) return;
     if (fin) {
       // The stream is done. There's no more data to receive!
       Debug(&session(), "Headers are final for stream %" PRIi64, id);
@@ -919,6 +908,10 @@ class Http3ApplicationImpl final : public Session::Application {
           "HTTP/3 application received end of trailers for stream %" PRIi64,
           id);
     stream->EmitHeaders();
+    // EmitHeaders() calls into JavaScript, which can synchronously destroy the
+    // stream. Its arena-backed state is released by Destroy(), so do not touch
+    // the stream again if that happened.
+    if (stream->is_destroyed()) return;
     if (fin) {
       Debug(&session(), "Trailers are final for stream %" PRIi64, id);
       Stream::ReceiveDataFlags flags{
@@ -1083,6 +1076,13 @@ class Http3ApplicationImpl final : public Session::Application {
     if (auto stream = session->FindStream(id)) {
       return stream;
     }
+    // No record of a locally-initiated stream means we already destroyed it,
+    // and frames still in flight must not bring it back to life. See
+    // DefaultApplication::ReceiveStreamData for the same guard on the raw
+    // QUIC path.
+    if (!session->is_destroyed() && ngtcp2_conn_is_local_stream(*session, id)) {
+      return {};
+    }
     if (auto stream = session->CreateStream(id)) {
       return stream;
     }
@@ -1224,6 +1224,23 @@ class Http3ApplicationImpl final : public Session::Application {
       return NGHTTP3_ERR_CALLBACK_FAILURE;
     }
     auto& session = app.session();
+
+    // DATA frames for a request stream the application already destroyed can
+    // still arrive. Drop the payload rather than resurrecting the stream or
+    // tearing down the connection, but return its credit: unlike framing
+    // bytes, DATA payload is not included in the count nghttp3 reports to
+    // ReceiveStreamData, so we own it. The is_destroyed() check must come
+    // first, see DefaultApplication::ReceiveStreamData.
+    if (!session.is_destroyed() && !session.FindStream(id) &&
+        ngtcp2_conn_is_local_stream(session, id)) {
+      Debug(&session,
+            "HTTP/3 discarding %zu bytes for destroyed local stream %" PRIi64,
+            datalen,
+            id);
+      app.ReturnConnectionCredit(datalen);
+      return NGTCP2_SUCCESS;
+    }
+
     if (auto stream = FindOrCreateStream(conn, &session, id)) [[likely]] {
       stream->ReceiveData(data, datalen, Stream::ReceiveDataFlags{});
       return NGTCP2_SUCCESS;
@@ -1413,7 +1430,7 @@ class Http3ApplicationImpl final : public Session::Application {
 
   static constexpr nghttp3_callbacks kCallbacks = {
       on_acked_stream_data,
-      nullptr,  // nghttp3_stream_close (deprecated)
+      nullptr,  // stream_close (deprecated, use v2 below)
       on_receive_data,
       on_deferred_consume,
       on_begin_headers,
@@ -1426,7 +1443,7 @@ class Http3ApplicationImpl final : public Session::Application {
       on_end_stream,
       on_do_reset_stream,
       on_shutdown,
-      nullptr,  // recv_settings (deprecated)
+      nullptr,  // recv_settings (deprecated, use v2 below)
       on_receive_origin,
       on_end_origin,
       on_rand,
@@ -1434,30 +1451,6 @@ class Http3ApplicationImpl final : public Session::Application {
       on_stream_close};
 };
 
-std::optional<PendingTicketAppData> ParseHttp3TicketData(const uv_buf_t& data) {
-  if (data.len != kSessionTicketAppDataSize) return std::nullopt;
-
-  const uint8_t* buf = reinterpret_cast<const uint8_t*>(data.base);
-
-  // buf[0] is the type byte (already checked by caller), buf[1] is version.
-  if (buf[1] != kSessionTicketAppDataVersion) return std::nullopt;
-
-  const uint8_t* payload = buf + kSessionTicketAppDataHeaderSize;
-  uint32_t stored_crc = ReadBE32(buf + 2);
-  uLong computed_crc = crc32(0L, Z_NULL, 0);
-  computed_crc = crc32(computed_crc, payload, kSessionTicketAppDataPayloadSize);
-  if (stored_crc != static_cast<uint32_t>(computed_crc)) return std::nullopt;
-
-  return Http3TicketData{
-      ReadBE64(payload),
-      ReadBE64(payload + 8),
-      ReadBE64(payload + 16),
-      ReadBE64(payload + 24),
-      payload[32] != 0,
-      payload[33] != 0,
-  };
-}
-
 std::unique_ptr<Session::Application> CreateHttp3Application(
     Session* session, const Session::Application_Options& options) {
   Debug(session, "Selecting HTTP/3 application");
diff --git a/src/quic/http3.h b/src/quic/http3.h
index f1a1b674d969..09033ca78b3d 100644
--- a/src/quic/http3.h
+++ b/src/quic/http3.h
@@ -3,7 +3,6 @@
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
 #include <memory>
-#include <optional>
 #include "application.h"
 #include "session.h"
 
@@ -15,11 +14,6 @@ namespace node::quic {
 std::unique_ptr<Session::Application> CreateHttp3Application(
     Session* session, const Session::Application_Options& options);
 
-// Parse HTTP/3 specific session ticket app data. Called from
-// Application::ParseTicketData() when the type byte is HTTP3.
-// The data includes the type byte prefix.
-std::optional<PendingTicketAppData> ParseHttp3TicketData(const uv_buf_t& data);
-
 }  // namespace node::quic
 
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/quic/session.cc b/src/quic/session.cc
index 2266f74a1277..1c159d763521 100644
--- a/src/quic/session.cc
+++ b/src/quic/session.cc
@@ -17,6 +17,7 @@
 #include <util-inl.h>
 #include <uv.h>
 #include <v8.h>
+#include <span>
 #include "application.h"
 #include "bindingdata.h"
 #include "cid.h"
@@ -785,8 +786,8 @@ struct Session::Impl final : public MemoryRetainer {
   SocketAddress remote_address_;
   std::unique_ptr<Application> application_;
   StreamsMap streams_;
-  // Emits deferred until after session setup is completed
-  std::vector<std::function<void()>> deferred_emits_;
+  // qlog chunks produced before the server session was handed to JS.
+  std::vector<std::pair<uint32_t, std::string>> pending_qlog_;
   TimerWrapHandle timer_;
   size_t send_scope_depth_ = 0;
   QuicError last_error_;
@@ -797,11 +798,6 @@ struct Session::Impl final : public MemoryRetainer {
   PendingStream::PendingStreamQueue pending_bidi_stream_queue_;
   PendingStream::PendingStreamQueue pending_uni_stream_queue_;
 
-  // Session ticket app data parsed before ALPN negotiation.
-  // Validated and applied in SetApplication() after ALPN selects
-  // the application type.
-  std::optional<PendingTicketAppData> pending_ticket_data_;
-
   // When true, the handshake is deferred until the first stream or
   // datagram is sent. This is set for client sessions with a session
   // ticket, enabling 0-RTT: the first send triggers the handshake
@@ -881,6 +877,9 @@ struct Session::Impl final : public MemoryRetainer {
     tracker->TrackField("remote_address", remote_address_);
     tracker->TrackField("application", application_);
     tracker->TrackField("timer", timer_);
+    size_t qlog_size = 0;
+    for (const auto& [flags, data] : pending_qlog_) qlog_size += data.size();
+    tracker->TrackFieldWithSize("pending_qlog", qlog_size);
   }
   SET_SELF_SIZE(Impl)
   SET_MEMORY_INFO_NAME(Session::Impl)
@@ -1654,7 +1653,7 @@ struct Session::Impl final : public MemoryRetainer {
 
   static constexpr ngtcp2_callbacks CLIENT = {
       ngtcp2_crypto_client_initial_cb,
-      nullptr,  // stream_stop_sending
+      nullptr,  // recv_client_initial
       ngtcp2_crypto_recv_crypto_data_cb,
       on_handshake_completed,
       on_receive_version_negotiation,
@@ -1688,7 +1687,7 @@ struct Session::Impl final : public MemoryRetainer {
       on_acknowledge_datagram,
       on_lost_datagram,
       nullptr,  // get_path_challenge_data (deprecated, use v2 below)
-      nullptr,  // stream_stop_sending
+      nullptr,  // stream_stop_sending (deprecated, use v2 below)
       ngtcp2_crypto_version_negotiation_cb,
       on_receive_rx_key,
       on_receive_tx_key,
@@ -1698,20 +1697,18 @@ struct Session::Impl final : public MemoryRetainer {
       on_get_new_cid,
       on_cid_status,
       ngtcp2_crypto_get_path_challenge_data2_cb,
-#ifdef NGTCP2_CALLBACKS_V4
       on_receive_stream_stop_sending,
 #ifdef NGTCP2_CALLBACKS_V5
-      nullptr,
-#endif  // NGTCP2_CALLBACKS_V5
-#endif  // NGTCP2_CALLBACKS_V4
+      nullptr,  // stream_close2
+#endif
   };
 
   static constexpr ngtcp2_callbacks SERVER = {
-      nullptr,  // stream_stop_sending
+      nullptr,  // client_initial
       ngtcp2_crypto_recv_client_initial_cb,
       ngtcp2_crypto_recv_crypto_data_cb,
       on_handshake_completed,
-      nullptr,
+      nullptr,  // recv_version_negotiation
       ngtcp2_crypto_encrypt_cb,
       ngtcp2_crypto_decrypt_cb,
       ngtcp2_crypto_hp_mask_cb,
@@ -1720,7 +1717,7 @@ struct Session::Impl final : public MemoryRetainer {
       on_stream_open,
       on_stream_close,
       nullptr,  // recv_stateless_reset (deprecated, use v2 below)
-      nullptr,
+      nullptr,  // recv_retry
       on_extend_max_streams_bidi,
       on_extend_max_streams_uni,
       on_rand,
@@ -1728,23 +1725,23 @@ struct Session::Impl final : public MemoryRetainer {
       on_remove_connection_id,
       ngtcp2_crypto_update_key_cb,
       on_path_validation,
-      nullptr,
+      nullptr,  // select_preferred_addr
       on_stream_reset,
       on_extend_max_remote_streams_bidi,
       on_extend_max_remote_streams_uni,
       on_extend_max_stream_data,
       nullptr,  // dcid_status (deprecated, use v2 below)
-      nullptr,
-      nullptr,
+      nullptr,  // handshake_confirmed
+      nullptr,  // recv_new_token
       ngtcp2_crypto_delete_crypto_aead_ctx_cb,
       ngtcp2_crypto_delete_crypto_cipher_ctx_cb,
       on_receive_datagram,
       on_acknowledge_datagram,
       on_lost_datagram,
       nullptr,  // get_path_challenge_data (deprecated, use v2 below)
-      nullptr,  // stream_stop_sending
+      nullptr,  // stream_stop_sending (deprecated, use v2 below)
       ngtcp2_crypto_version_negotiation_cb,
-      nullptr,
+      nullptr,  // recv_rx_key
       on_receive_tx_key,
       on_early_data_rejected,
       on_begin_path_validation,
@@ -1752,12 +1749,10 @@ struct Session::Impl final : public MemoryRetainer {
       on_get_new_cid,
       on_cid_status,
       ngtcp2_crypto_get_path_challenge_data2_cb,
-#ifdef NGTCP2_CALLBACKS_V4
       on_receive_stream_stop_sending,
 #ifdef NGTCP2_CALLBACKS_V5
-      nullptr,
-#endif  // NGTCP2_CALLBACKS_V5
-#endif  // NGTCP2_CALLBACKS_V4
+      nullptr,  // stream_close2
+#endif
   };
 };
 
@@ -2265,13 +2260,11 @@ Session::Session(Endpoint* endpoint,
   DCHECK(impl_);
   STAT_RECORD_TIMESTAMP(Stats, created_at);
 
-  // For clients, select the Application immediately — the ALPN is
+  // For clients, select the Application immediately - the ALPN is
   // known upfront from the options. For servers, application_ stays
-  // null until OnSelectAlpn fires during the TLS handshake.
+  // null until the ClientHello names a protocol.
   if (config.side == Side::CLIENT) {
-    auto app =
-        SelectApplicationFromAlpn(DecodeAlpn(config.options.tls_options.alpn));
-    if (app) SetApplication(std::move(app));
+    InstallApplicationForAlpn(DecodeAlpn(config.options.tls_options.alpn));
   }
 
   // For client sessions with a session ticket and early data enabled,
@@ -2632,21 +2625,22 @@ std::unique_ptr<Session::Application> Session::SelectApplicationFromAlpn(
   return CreateDefaultApplication(this, config().options.application_options);
 }
 
+void Session::InstallApplicationForAlpn(std::string_view alpn) {
+  // Acting on the ClientHello twice would install a second Application over
+  // a live one; TLSSession::EarlySelection is what prevents that.
+  CHECK(!has_application());
+  SetApplication(SelectApplicationFromAlpn(alpn));
+}
+
+void Session::SetEarlyRemoteTransportParams(std::span<const uint8_t> params) {
+  DCHECK(!is_destroyed());
+  if (params.empty()) return;
+  USE(ngtcp2_conn_decode_and_set_remote_transport_params(
+      *this, params.data(), params.size()));
+}
+
 void Session::SetApplication(std::unique_ptr<Application> app) {
   DCHECK(!impl_->application_);
-  // If we have pending ticket data from a session ticket that was
-  // parsed before ALPN negotiation, validate it against the selected
-  // application now. If the type doesn't match or the application
-  // rejects the data, the handshake will fail (application_ stays null
-  // and the caller returns an error).
-  if (impl_->pending_ticket_data_.has_value()) {
-    auto data = std::move(*impl_->pending_ticket_data_);
-    impl_->pending_ticket_data_.reset();
-    if (!app->ApplySessionTicketData(data)) {
-      Debug(this, "Session ticket app data rejected by application");
-      return;
-    }
-  }
   impl_->state()->application_type = static_cast<uint8_t>(app->type());
   impl_->state()->headers_supported = static_cast<uint8_t>(
       app->SupportsHeaders() ? HeadersSupportState::SUPPORTED
@@ -2701,9 +2695,8 @@ const Session::Options& Session::options() const {
 void Session::EmitQlog(uint32_t flags, std::string_view data) {
   if (!env()->can_call_into_js()) return;
 
-  if (!is_destroyed() && must_defer_emits()) {
-    QueueDeferredEmit(
-        [this, flags, held = std::string(data)]() { EmitQlog(flags, held); });
+  if (!is_destroyed() && is_server() && !impl_->state()->wrapped) {
+    impl_->pending_qlog_.emplace_back(flags, std::string(data));
     return;
   }
 
@@ -2821,23 +2814,48 @@ bool Session::ReadPacket(const uint8_t* data,
 
   Debug(this, "Session receiving %zu-byte packet with result %d", len, err);
 
+  if (err == 0 && !is_destroyed()) [[likely]] {
+    STAT_INCREMENT_N(Stats, bytes_received, len);
+  }
+  return AfterNgtcp2Read(err);
+}
+
+void Session::ResumeHandshake() {
+  DCHECK(!is_destroyed());
+  DCHECK(is_server());
+  // From here on the ClientHello callback is a no-op, so the handshake
+  // runs on into ticket decryption, early data and the rest.
+  tls_session().set_early_selection(TLSSession::EarlySelection::kComplete);
+  Debug(this, "Resuming the TLS handshake");
+  int err;
+  {
+    NgTcp2CallbackScope callback_scope(this);
+    err = ngtcp2_conn_continue_handshake(*this, uv_hrtime());
+  }
+  if (is_destroyed()) return;
+  AfterNgtcp2Read(err);
+}
+
+bool Session::AfterNgtcp2Read(int err) {
   switch (err) {
     case 0: {
-      Debug(this, "Session successfully received %zu-byte packet", len);
       if (!is_destroyed()) [[likely]] {
-        STAT_INCREMENT_N(Stats, bytes_received, len);
         // Process deferred application operations after ALPN selection - not
         // necessarily resolved yet as ClientHello can span multiple packets.
         if (has_application()) application().PostReceive();
-        // Surface a server session to JS once its ClientHello has been
-        // processed (OnSelectAlpn fired: SNI + ALPN are known and reliable).
-        // Held first-flight events - including 0-RTT request streams - replay
-        // at emit. The !wrapped guard makes this fire exactly once, on
-        // whichever packet completes the ClientHello (so a multi-datagram
-        // ClientHello is handled correctly).
-        if (is_server() && hello_processed_ && !impl_->state()->wrapped &&
-            !is_destroyed()) {
+
+        if (is_destroyed()) return true;
+
+        // The ClientHello has been processed: SNI and ALPN are selected and
+        // the Application is installed, but the handshake is stopped short
+        // of ticket decryption, so no early data exists yet. Surface the
+        // session, then let the handshake run on. The guard makes this fire
+        // exactly once, on whichever packet completed the ClientHello, so a
+        // ClientHello split across datagrams is handled correctly.
+        if (is_server() && tls_session().early_selection() ==
+                               TLSSession::EarlySelection::kSelected) {
           endpoint().EmitNewSession(BaseObjectPtr<Session>(this));
+          if (!is_destroyed()) ResumeHandshake();
         }
       }
       return true;
@@ -3389,42 +3407,11 @@ void Session::CollectSessionTicketAppData(
 SessionTicket::AppData::Status Session::ExtractSessionTicketAppData(
     const SessionTicket::AppData& app_data, Flag flag) {
   DCHECK(!is_destroyed());
-  // If the application is already selected (client side, or server after
-  // ALPN), delegate directly.
-  if (impl_->application_) {
-    return application().ExtractSessionTicketAppData(app_data, flag);
-  }
-  // The application is not yet selected (server during ClientHello
-  // processing, before ALPN). Parse the ticket data now while the
-  // SSL_SESSION is still valid, and stash the result for validation
-  // after ALPN negotiation in SetApplication().
-  auto data = app_data.Get();
-  if (!data.has_value() || data->len == 0) {
-    // No app data in the ticket. Accept optimistically.
-    return flag == Flag::STATUS_RENEW
-               ? SessionTicket::AppData::Status::TICKET_USE_RENEW
-               : SessionTicket::AppData::Status::TICKET_USE;
-  }
-  auto parsed = Application::ParseTicketData(*data);
-  if (!parsed.has_value()) {
-    return SessionTicket::AppData::Status::TICKET_IGNORE_RENEW;
-  }
-  // Pre-validate the ticket data against the current application options.
-  // If the stored settings are more permissive than the current config
-  // (e.g., a feature was enabled when the ticket was issued but is now
-  // disabled), reject the ticket so 0-RTT is not used. This must happen
-  // here (during TLS ticket processing) rather than in SetApplication,
-  // because by SetApplication time the TLS layer has already accepted
-  // the ticket and told the client 0-RTT is ok.
-  if (!Application::ValidateTicketData(*parsed,
-                                       config().options.application_options)) {
-    Debug(this, "Session ticket app data incompatible with current settings");
+  // Renew, so the client stops offering a ticket that is never accepted.
+  if (!has_application()) [[unlikely]] {
     return SessionTicket::AppData::Status::TICKET_IGNORE_RENEW;
   }
-  impl_->pending_ticket_data_ = std::move(parsed);
-  return flag == Flag::STATUS_RENEW
-             ? SessionTicket::AppData::Status::TICKET_USE_RENEW
-             : SessionTicket::AppData::Status::TICKET_USE;
+  return application().ExtractSessionTicketAppData(app_data, flag);
 }
 
 void Session::MemoryInfo(MemoryTracker* tracker) const {
@@ -3528,33 +3515,20 @@ void Session::set_wrapped() {
   impl_->state()->wrapped = 1;
 }
 
-bool Session::must_defer_emits() const {
-  // Server sessions are surfaced to JS (via the deferred new-session emit)
-  // only after the ClientHello has been processed and wrapped; anything
-  // emitted before then has no JS wrapper to receive it and must be held
-  // for replay.
-  return is_server() && !impl_->state()->wrapped;
-}
-
 bool Session::tls_info_ready() const {
   // hello_processed_ is set server-side, handshake_completed covers
   // the client. Together they mark the point when SNI/ALPN are final.
   return hello_processed_ || impl_->state()->handshake_completed;
 }
 
-void Session::QueueDeferredEmit(std::function<void()> fn) {
-  impl_->deferred_emits_.emplace_back(std::move(fn));
-}
-
-void Session::ReplayDeferredEmits() {
+void Session::FlushPendingQlog() {
   if (is_destroyed()) return;
   DCHECK(impl_->state()->wrapped);
-  // Runs synchronously immediately after the new-session callback
-  // returns (still within first-flight processing).
-  auto emits = std::move(impl_->deferred_emits_);
-  for (auto& emit : emits) {
+  // Runs synchronously immediately after the new-session callback returns.
+  auto pending = std::move(impl_->pending_qlog_);
+  for (auto& [flags, data] : pending) {
     if (is_destroyed()) return;
-    emit();
+    EmitQlog(flags, data);
   }
 }
 
@@ -4069,7 +4043,6 @@ void Session::set_max_datagram_size(uint16_t size) {
 
 void Session::EmitGoaway(stream_id last_stream_id) {
   if (is_destroyed()) return;
-  if (DeferEmit([this, last_stream_id] { EmitGoaway(last_stream_id); })) return;
   if (!env()->can_call_into_js()) return;
 
   CallbackScope<Session> cb_scope(this);
@@ -4085,13 +4058,6 @@ void Session::EmitGoaway(stream_id last_stream_id) {
 void Session::EmitDatagram(Store&& datagram, DatagramReceivedFlags flag) {
   DCHECK(!is_destroyed());
 
-  if (must_defer_emits()) {
-    QueueDeferredEmit([this, datagram = std::move(datagram), flag]() mutable {
-      EmitDatagram(std::move(datagram), flag);
-    });
-    return;
-  }
-
   if (!env()->can_call_into_js()) return;
 
   CallbackScope<Session> cbv_scope(this);
@@ -4107,8 +4073,6 @@ void Session::EmitDatagram(Store&& datagram, DatagramReceivedFlags flag) {
 void Session::EmitDatagramStatus(datagram_id id, quic::DatagramStatus status) {
   DCHECK(!is_destroyed());
 
-  if (DeferEmit([this, id, status] { EmitDatagramStatus(id, status); })) return;
-
   if (!env()->can_call_into_js()) return;
 
   CallbackScope<Session> cb_scope(this);
@@ -4270,7 +4234,6 @@ void Session::EmitSessionTicket(Store&& ticket) {
 
 void Session::EmitApplication() {
   if (is_destroyed()) return;
-  if (DeferEmit([this] { EmitApplication(); })) return;
   if (!env()->can_call_into_js()) return;
 
   if (!has_application()) {
@@ -4341,8 +4304,6 @@ void Session::EmitNewToken(const uint8_t* token, size_t len) {
 void Session::EmitStream(const BaseObjectWeakPtr<Stream>& stream) {
   DCHECK(!is_destroyed());
 
-  if (DeferEmit([this, stream] { EmitStream(stream); })) return;
-
   if (!stream) return;
 
   if (!env()->can_call_into_js()) return;
@@ -4401,13 +4362,6 @@ void Session::EmitVersionNegotiation(const ngtcp2_pkt_hd& hd,
 void Session::EmitOrigins(std::vector<std::string>&& origins) {
   DCHECK(!is_destroyed());
 
-  if (must_defer_emits()) {
-    QueueDeferredEmit([this, origins = std::move(origins)]() mutable {
-      EmitOrigins(std::move(origins));
-    });
-    return;
-  }
-
   if (!HasListenerFlag(impl_->state()->listener_flags,
                        SessionListenerFlags::ORIGIN))
     return;
@@ -4434,12 +4388,6 @@ void Session::EmitOrigins(std::vector<std::string>&& origins) {
 void Session::EmitKeylog(const char* line) {
   DCHECK(!is_destroyed());
 
-  if (must_defer_emits()) {
-    QueueDeferredEmit(
-        [this, str = std::string(line)]() { EmitKeylog(str.c_str()); });
-    return;
-  }
-
   if (!env()->can_call_into_js()) return;
 
   Local<Value> argv[] = {Undefined(env()->isolate())};
diff --git a/src/quic/session.h b/src/quic/session.h
index 3b2a9773a380..6cc3db4c86f4 100644
--- a/src/quic/session.h
+++ b/src/quic/session.h
@@ -12,6 +12,7 @@
 #include <timer_wrap.h>
 #include <util.h>
 #include <optional>
+#include <span>
 #include "bindingdata.h"
 #include "cid.h"
 #include "data.h"
@@ -123,19 +124,6 @@ class Session final : public AsyncWrap, private SessionTicket::AppData::Source {
     std::string ToString() const;
   };
 
-  // Decode the first ALPN protocol name from wire format (length-prefixed).
-  static std::string_view DecodeAlpn(std::string_view wire);
-
-  // Select the Application implementation based on the negotiated ALPN.
-  // h3 (and h3-XX variants) map to Http3ApplicationImpl; all others map
-  // to DefaultApplication. Sets the application_type state field.
-  std::unique_ptr<Application> SelectApplicationFromAlpn(std::string_view alpn);
-
-  // Install the Application on the session. Called at construction for
-  // clients (ALPN known upfront) or from OnSelectAlpn for servers
-  // (ALPN negotiated during handshake). Must be called before any
-  // application data is received.
-  void SetApplication(std::unique_ptr<Application> app);
   // Controls which datagram to drop when the pending datagram queue is full.
   enum class DatagramDropPolicy : uint8_t {
     DROP_OLDEST = 0,  // Drop the oldest queued datagram (default).
@@ -431,6 +419,29 @@ class Session final : public AsyncWrap, private SessionTicket::AppData::Source {
                   const PacketInfo& pkt_info = PacketInfo(),
                   uint64_t ts = 0);
 
+  // Handles the result of an ngtcp2 call that drives inbound processing
+  // (ngtcp2_conn_read_pkt or ngtcp2_conn_continue_handshake).
+  bool AfterNgtcp2Read(int err);
+
+  // Decode the first ALPN protocol name from wire format (length-prefixed).
+  static std::string_view DecodeAlpn(std::string_view wire);
+
+  // Select the Application implementation based on the negotiated ALPN.
+  // h3 (and h3-XX variants) map to Http3ApplicationImpl; all others map
+  // to DefaultApplication. Sets the application_type state field.
+  std::unique_ptr<Application> SelectApplicationFromAlpn(std::string_view alpn);
+
+  // Install the Application on the session. Called at construction for
+  // clients (ALPN known upfront) or from the ClientHello callback for
+  // servers (ALPN negotiated during handshake). Must be called before any
+  // application data is received.
+  void SetApplication(std::unique_ptr<Application> app);
+
+  void InstallApplicationForAlpn(std::string_view alpn);
+
+  // ngtcp2 ignores the duplicate when the TLS stack reports these again.
+  void SetEarlyRemoteTransportParams(std::span<const uint8_t> params);
+
   // Called by BindingData's flush callback to trigger SendPendingData
   // on this session. Encapsulates the application() access so that
   // bindingdata.cc doesn't need the full Application type definition.
@@ -610,24 +621,9 @@ class Session final : public AsyncWrap, private SessionTicket::AppData::Source {
   // defined there to manage it.
   void set_wrapped();
 
-  // True while JS emits must be held for later replay, before the handshake
-  // is complete and the server session event has been emitted.
-  bool must_defer_emits() const;
-
-  // Replays, in order, any emits held while must_defer_emits() was true.
-  // Called synchronously right after the new-session emit.
-  void ReplayDeferredEmits();
-
-  // Queues fn to be replayed by ReplayDeferredEmits(). Out-of-line so the
-  // header does not need the full Impl definition.
-  void QueueDeferredEmit(std::function<void()> fn);
+  void ResumeHandshake();
 
-  template <typename F>
-  bool DeferEmit(F&& fn) {
-    if (!must_defer_emits()) return false;
-    QueueDeferredEmit(std::forward<F>(fn));
-    return true;
-  }
+  void FlushPendingQlog();
 
   enum class CloseMethod : uint8_t {
     // Immediate close with a roundtrip through JavaScript, causing all
diff --git a/src/quic/streams.cc b/src/quic/streams.cc
index c2691362447a..1f8761c75049 100644
--- a/src/quic/streams.cc
+++ b/src/quic/streams.cc
@@ -1211,11 +1211,9 @@ Stream::Stream(BaseObjectWeakPtr<Session> session,
   STAT_SET(Stats, max_offset, params->initial_max_data);
 }
 
-Stream::~Stream() {
-  // Make sure that Destroy() was called before Stream is actually destructed.
-  DCHECK_NE(stats()->destroyed_at, 0);
+Stream::~Stream() = default;
 
-  // Release arena slots back to the freelist.
+void Stream::ReleaseArenaSlots() {
   auto& binding = BindingData::Get(env());
   if (stats_slot_) {
     GetStreamStatsArena(binding).ReleaseSlot(stats_slot_);
@@ -1306,6 +1304,7 @@ bool Stream::is_pending() const {
 }
 
 bool Stream::is_destroyed() const {
+  if (!stats_slot_) return true;
   return stats()->destroyed_at != 0;
 }
 
@@ -1499,12 +1498,37 @@ void Stream::EndWriting() {
   if (!is_pending()) session_->ResumeStream(id());
 }
 
+void Stream::ReturnFlowControlCredit(uint64_t amount, CreditScope scope) {
+  if (amount == 0) return;
+  // The stream can outlive a destroyed session (the JS side may still hold a
+  // reader over the inbound queue), leaving no window to extend.
+  if (!session_ || session_->is_destroyed()) return;
+  // Extending a window queues MAX_STREAM_DATA / MAX_DATA. The scope flushes
+  // them; inside an ngtcp2 callback the flush is a no-op and they go out with
+  // the next scheduled send instead.
+  Session::SendPendingDataScope send_scope(&session());
+  if (scope == CreditScope::STREAM_AND_CONNECTION) {
+    // Receiving data requires an id, so this should always hold.
+    DCHECK(!is_pending());
+    session().Consume(id(), amount);
+  } else {
+    session().ExtendOffset(amount);
+  }
+}
+
+void Stream::CreditConsumedBytes(uint64_t amount) {
+  // Clamped because Destroy() returns the outstanding credit in bulk and the
+  // flush that triggers can re-enter JS, which may then report some of those
+  // same bytes as read. Never give the peer more credit than we took.
+  amount = std::min(uncredited_bytes_, amount);
+  uncredited_bytes_ -= amount;
+  ReturnFlowControlCredit(amount, CreditScope::STREAM_AND_CONNECTION);
+}
+
 void Stream::EntryRead(size_t amount) {
   // Called when the JS consumer reads data from the inbound DataQueue.
   // Extend the flow control window so the sender can transmit more.
-  if (session().is_destroyed()) return;
-  Session::SendPendingDataScope send_scope(&session());
-  session().Consume(id(), amount);
+  CreditConsumedBytes(amount);
 }
 
 void Stream::BeforePull() {
@@ -1517,16 +1541,26 @@ void Stream::BeforePull() {
 
 void Stream::FlushAccumulation() {
   if (!recv_accumulator_ || recv_accumulator_->available() == 0) return;
+  size_t flushed = recv_accumulator_->available();
   auto entry = recv_accumulator_->Flush(env());
-  if (entry) {
-    inbound_->append(std::move(entry));
+  // Flush() always drains the accumulator, so the stat is reset either way.
+  STAT_SET(Stats, bytes_accumulated, 0);
+  if (entry && inbound_->append(std::move(entry)).value_or(false)) {
     // Notify the reader that data is now available in the DataQueue.
     // This is the only place we notify — not on every ReceiveData call —
     // so the reader only wakes up when there is a well-sized entry to
     // consume.
     if (reader_) reader_->NotifyPull();
+    return;
   }
-  STAT_SET(Stats, bytes_accumulated, 0);
+  // Should be unreachable: append() only fails once the queue has been capped,
+  // EndReadable() flushes before capping, and ReceiveData() accumulates
+  // nothing once read_ended is set. Reaching here means received stream data
+  // is being dropped on the floor, so say so and at least do not also leak
+  // the flow control credit for it.
+  DCHECK(false);
+  Debug(this, "Inbound queue rejected %zu accumulated bytes", flushed);
+  CreditConsumedBytes(flushed);
 }
 
 int Stream::DoPull(bob::Next<ngtcp2_vec> next,
@@ -1614,14 +1648,13 @@ void Stream::EndReadable(std::optional<uint64_t> maybe_final_size) {
   FlushAccumulation();
   set_final_size(maybe_final_size.value_or(STAT_GET(Stats, bytes_received)));
   inbound_->cap(STAT_GET(Stats, final_size));
-  // Notify the JS reader so it can see EOS. Pass fin=true so the
-  // wakeup promise resolves with a value the iterator can check to
-  // avoid waiting for another wakeup that will never come.
-  if (reader_) reader_->NotifyPull(true);
+  // Notify the JS reader so it can see EOS. The subsequent pull observes
+  // the now-capped DataQueue and returns EOS.
+  if (reader_) reader_->NotifyPull();
 }
 
 void Stream::Destroy(QuicError error) {
-  if (stats()->destroyed_at != 0) return;
+  if (is_destroyed()) return;
 
   // Record the destroyed at timestamp before notifying the JavaScript side
   // that the stream is being destroyed.
@@ -1652,6 +1685,16 @@ void Stream::Destroy(QuicError error) {
   // the ring buffer memory.
   recv_accumulator_.reset();
 
+  // Data that was received but never consumed still holds connection-level
+  // flow control credit, and EntryRead() will never fire for it once the
+  // listener is detached below. Leaking it would permanently shrink the
+  // session's shared receive window and, over enough streams, deadlock the
+  // connection. Zero the counter first: returning credit flushes packets,
+  // which can re-enter JS and report some of these bytes as read.
+  const uint64_t outstanding = uncredited_bytes_;
+  uncredited_bytes_ = 0;
+  ReturnFlowControlCredit(outstanding, CreditScope::CONNECTION_ONLY);
+
   // We reset the inbound here also. However, it's important to note that
   // the JavaScript side could still have a reader on the inbound DataQueue,
   // which may keep that data alive a bit longer.
@@ -1666,6 +1709,9 @@ void Stream::Destroy(QuicError error) {
   // handle.
   EmitClose(error);
 
+  stream_id id_to_remove = id();
+  ReleaseArenaSlots();
+
   auto session = session_;
   session_.reset();
   // EmitClose above triggers MakeCallback which can destroy the session
@@ -1673,7 +1719,7 @@ void Stream::Destroy(QuicError error) {
   // Session BaseObject can be kept alive by a BaseObjectPtr elsewhere,
   // e.g. OnTimeout's ref) even though impl_ has been reset. We must
   // check is_destroyed() to avoid dereferencing the null impl_.
-  if (session && !session->is_destroyed()) session->RemoveStream(id());
+  if (session && !session->is_destroyed()) session->RemoveStream(id_to_remove);
 
   // Critically, make sure that the RemoveStream call is the last thing
   // trying to use this stream object. Once that call is made, the stream
@@ -1691,6 +1737,13 @@ void Stream::ReceiveData(const uint8_t* data,
   Debug(this, "Receiving %zu bytes of data", len);
   if (state()->read_ended == 1 || len == 0) {
     if (flags.fin) EndReadable();
+    // Nothing will ever consume these bytes, so return the connection-level
+    // credit ngtcp2 charged for them. The stream window is deliberately left
+    // alone: there is no point inviting more data onto a stream we have
+    // stopped reading. Reachable when, for example, HTTP/3 replays DATA
+    // payload it had buffered for QPACK head-of-line blocking after the
+    // readable side was shut down.
+    ReturnFlowControlCredit(len, CreditScope::CONNECTION_ONLY);
     return;
   }
 
@@ -1699,6 +1752,9 @@ void Stream::ReceiveData(const uint8_t* data,
   STAT_SET(Stats, max_offset_received, STAT_GET(Stats, bytes_received));
   STAT_RECORD_TIMESTAMP(Stats, received_at);
 
+  // These bytes now hold inbound flow control credit. See uncredited_bytes_.
+  uncredited_bytes_ += len;
+
   // Lazy-allocate the receive accumulation buffer on first data-carrying
   // call. Streams that never receive data (write-only, immediately reset)
   // pay zero cost.
diff --git a/src/quic/streams.h b/src/quic/streams.h
index f18702ae75ab..cd4849aae277 100644
--- a/src/quic/streams.h
+++ b/src/quic/streams.h
@@ -395,6 +395,22 @@ class Stream final : public AsyncWrap,
   // inbound DataQueue as a single right-sized entry.
   void FlushAccumulation();
 
+  // Every byte ngtcp2 delivers is charged against both the stream-level and
+  // the connection-level receive window until we hand the credit back.
+  enum class CreditScope : uint8_t {
+    // The stream is still readable, so the peer may usefully send more on it.
+    STREAM_AND_CONNECTION,
+    // The stream is finished, so only the session-wide window is extended.
+    CONNECTION_ONLY,
+  };
+
+  // Returns `amount` bytes of inbound flow control credit to the peer.
+  void ReturnFlowControlCredit(uint64_t amount, CreditScope scope);
+
+  // Returns credit for bytes that have left our custody, either read by the
+  // consumer or dropped before reaching one.
+  void CreditConsumedBytes(uint64_t amount);
+
   // Gets a reader for the data received for this stream from the peer,
   BaseObjectPtr<Blob::Reader> get_reader();
 
@@ -408,6 +424,7 @@ class Stream final : public AsyncWrap,
 
   bool is_local_unidirectional() const;
   bool is_remote_unidirectional() const;
+  void ReleaseArenaSlots();
 
   // JavaScript callouts
 
@@ -458,6 +475,14 @@ class Stream final : public AsyncWrap,
   BaseObjectWeakPtr<Blob::Reader> reader_;
   std::unique_ptr<RecvAccumulator> recv_accumulator_;
 
+  // Bytes delivered to ReceiveData() that still hold inbound flow control
+  // credit. Returned incrementally as the consumer reads them, and in bulk
+  // when the stream is destroyed -- otherwise abandoning a stream with unread
+  // data would permanently shrink the session's receive window. Data still
+  // buffered inside nghttp3 is deliberately not counted: nghttp3 returns that
+  // credit itself through its deferred_consume callback.
+  uint64_t uncredited_bytes_ = 0;
+
   // If the stream cannot be opened yet, it will be created in a pending state.
   // Once the owning session is able to, it will complete opening of the stream
   // and the stream id will be assigned.
diff --git a/src/quic/tlscontext.cc b/src/quic/tlscontext.cc
index cbbee77c85c1..e68380fd0424 100644
--- a/src/quic/tlscontext.cc
+++ b/src/quic/tlscontext.cc
@@ -3,6 +3,7 @@
 #ifndef OPENSSL_NO_QUIC
 #include <async_wrap-inl.h>
 #include <base_object-inl.h>
+#include <crypto/crypto_tls_certificates.h>
 #include <crypto/crypto_util.h>
 #include <debug_utils-inl.h>
 #include <env-inl.h>
@@ -32,7 +33,6 @@ using ncrypto::MarkPopErrorOnReturn;
 using ncrypto::SSLCtxPointer;
 using ncrypto::SSLPointer;
 using ncrypto::SSLSessionPointer;
-using ncrypto::X509Pointer;
 using v8::Array;
 using v8::ArrayBuffer;
 using v8::ArrayBufferView;
@@ -334,52 +334,100 @@ TLSContext::operator SSL_CTX*() const {
   return ctx_.get();
 }
 
+crypto::ClientHelloResult TLSContext::OnClientHello(
+    const crypto::ClientHelloContext& hello) {
+  auto& tls_session = TLSSession::From(hello.ssl());
+  auto& session = tls_session.session();
+
+  using EarlySelection = TLSSession::EarlySelection;
+  switch (tls_session.early_selection()) {
+    case EarlySelection::kPending:
+      break;
+    case EarlySelection::kSelected:
+      // Selected already, but the Session has not been surfaced yet, so
+      // the handshake must stay where it is.
+      return crypto::ClientHelloResult::kRetry;
+    case EarlySelection::kComplete: {
+      // Don't let HelloRetryRequests change SNI:
+      auto name = hello.servername();
+      if (!name.has_value() || *name != tls_session.servername()) {
+        Debug(&session, "ClientHello changed the requested servername");
+        hello.set_alert(SSL_AD_ILLEGAL_PARAMETER);
+        return crypto::ClientHelloResult::kFail;
+      }
+      // Everything else the TLS library needs from here on is cached on the
+      // TLSSession, so just let the handshake run.
+      return crypto::ClientHelloResult::kContinue;
+    }
+  }
+
+  auto requested = hello.servername();
+  if (!requested.has_value()) {
+    Debug(&session, "Unusable servername in ClientHello");
+    hello.set_alert(SSL_AD_DECODE_ERROR);
+    return crypto::ClientHelloResult::kFail;
+  }
+  const std::string_view servername = *requested;
+
+  auto* selected = tls_session.context().SelectSNIContext(servername);
+  if (selected == nullptr) {
+    Debug(&session, "No TLS context for servername %s", servername);
+    hello.set_alert(SSL_AD_UNRECOGNIZED_NAME);
+    return crypto::ClientHelloResult::kFail;
+  }
+  if (selected != &tls_session.context()) {
+    SSL_set_SSL_CTX(hello.ssl(), *selected);
+  }
+  tls_session.set_servername(servername);
+
+  // The client's QUIC transport parameters travel in the ClientHello, but
+  // the TLS stack does not hand them to ngtcp2 until it parses extensions,
+  // which is after this callback.
+  auto params = hello.extension(TLSEXT_TYPE_quic_transport_parameters);
+  if (params.has_value()) session.SetEarlyRemoteTransportParams(*params);
+
+  const auto& supported = selected->options().alpn;
+  auto negotiated = crypto::SelectNextProtocol(
+      {reinterpret_cast<const uint8_t*>(supported.data()), supported.size()},
+      hello.alpn_protocols());
+  if (!negotiated.has_value()) {
+    Debug(&session, "ALPN negotiation failed");
+    hello.set_alert(SSL_AD_NO_APPLICATION_PROTOCOL);
+    return crypto::ClientHelloResult::kFail;
+  }
+  Debug(&session, "ALPN negotiation succeeded: %s", *negotiated);
+  tls_session.set_alpn(*negotiated);
+
+  // Install the Application while the handshake is still stopped, so that
+  // it is in place before a session ticket can be accepted and early data
+  // can start arriving.
+  session.InstallApplicationForAlpn(*negotiated);
+  session.set_hello_processed();
+
+  // Stop here. Session::AfterNgtcp2Read surfaces the server session to
+  // JavaScript and then resumes the handshake, at which point this callback
+  // runs again and takes the kComplete path.
+  tls_session.set_early_selection(EarlySelection::kSelected);
+  return crypto::ClientHelloResult::kRetry;
+}
+
 int TLSContext::OnSelectAlpn(SSL* ssl,
                              const unsigned char** out,
                              unsigned char* outlen,
                              const unsigned char* in,
                              unsigned int inlen,
                              void* arg) {
-  auto& tls_session = TLSSession::From(ssl);
-
-  const auto& requested = tls_session.context().options().alpn;
-  if (requested.empty()) return SSL_TLSEXT_ERR_NOACK;
-
-  // The requested ALPN string is in wire format (one or more
-  // length-prefixed protocol names). SSL_select_next_proto finds the
-  // first match between the server's list and the client's list.
-  if (SSL_select_next_proto(
-          const_cast<unsigned char**>(out),
-          outlen,
-          reinterpret_cast<const unsigned char*>(requested.data()),
-          requested.length(),
-          in,
-          inlen) == OPENSSL_NPN_NO_OVERLAP) {
-    Debug(&tls_session.session(), "ALPN negotiation failed");
+  // The protocol was already chosen from the ClientHello. OpenSSL still
+  // requires it to be handed back here for the ALPN extension to be sent.
+  const auto& negotiated = TLSSession::From(ssl).alpn();
+  if (negotiated.empty()) return SSL_TLSEXT_ERR_NOACK;
+  // The list offered here should be the one the choice was made from, but
+  // a peer can send a second ClientHello after HelloRetryRequest; never
+  // answer with a protocol this one does not offer.
+  if (!crypto::AlpnListContains({in, inlen}, negotiated)) {
     return SSL_TLSEXT_ERR_ALERT_FATAL;
   }
-
-  // ALPN negotiated successfully. *out/*outlen point to the selected
-  // protocol name (without the length prefix). Select the Application
-  // implementation based on the negotiated ALPN. This must happen now
-  // because early data (0-RTT) may arrive in the same ngtcp2_conn_read_pkt
-  // call and needs the Application to be ready.
-  std::string_view negotiated(reinterpret_cast<const char*>(*out), *outlen);
-  Debug(&tls_session.session(),
-        "ALPN negotiation succeeded: %s",
-        std::string(negotiated).c_str());
-
-  auto& session = tls_session.session();
-  auto app = session.SelectApplicationFromAlpn(negotiated);
-  if (!app) {
-    Debug(&session,
-          "Failed to create Application for ALPN %s",
-          std::string(negotiated).c_str());
-    return SSL_TLSEXT_ERR_NOACK;
-  }
-  session.SetApplication(std::move(app));
-  session.set_hello_processed();
-
+  crypto::SetSelectedProtocol(out, outlen, negotiated);
   return SSL_TLSEXT_ERR_OK;
 }
 
@@ -486,6 +534,7 @@ SSLCtxPointer TLSContext::Initialize(Environment* env) {
 
       SSL_CTX_set_mode(ctx.get(), SSL_MODE_RELEASE_BUFFERS);
       SSL_CTX_set_alpn_select_cb(ctx.get(), OnSelectAlpn, this);
+      crypto::SetClientHelloCallback<OnClientHello>(ctx.get());
 
       if (SSL_CTX_set_session_id_context(
               ctx.get(), kSidCtx, sizeof(kSidCtx) - 1) != 1) {
@@ -506,8 +555,9 @@ SSLCtxPointer TLSContext::Initialize(Environment* env) {
                                              nullptr),
                1);
 
+      // The SNI context is selected from the ClientHello; this callback
+      // exists only so that OpenSSL acknowledges the extension.
       SSL_CTX_set_tlsext_servername_callback(ctx.get(), OnSNI);
-      SSL_CTX_set_tlsext_servername_arg(ctx.get(), this);
       break;
     }
     case Side::CLIENT: {
@@ -528,12 +578,6 @@ SSLCtxPointer TLSContext::Initialize(Environment* env) {
     }
   }
 
-  // Only load system CA certificates if no custom CAs are provided.
-  // SSL_CTX_set_default_verify_paths involves filesystem I/O to read
-  // the system CA bundle.
-  if (options_.ca.empty()) {
-    SSL_CTX_set_default_verify_paths(ctx.get());
-  }
   if (options_.keylog) {
     SSL_CTX_set_keylog_callback(ctx.get(), OnKeylog);
   }
@@ -551,30 +595,16 @@ SSLCtxPointer TLSContext::Initialize(Environment* env) {
   {
     ClearErrorOnReturn clear_error_on_return;
     if (options_.ca.empty()) {
-      auto store = crypto::GetOrCreateRootCertStore(env);
-      X509_STORE_up_ref(store);
-      SSL_CTX_set_cert_store(ctx.get(), store);
+      crypto::UseDefaultRootCertStore(env, ctx.get());
     } else {
       for (const auto& ca : options_.ca) {
         uv_buf_t buf = ca;
         if (buf.len == 0) {
-          auto store = crypto::GetOrCreateRootCertStore(env);
-          X509_STORE_up_ref(store);
-          SSL_CTX_set_cert_store(ctx.get(), store);
+          crypto::UseDefaultRootCertStore(env, ctx.get());
         } else {
           BIOPointer bio = crypto::NodeBIO::NewFixed(buf.base, buf.len);
           CHECK(bio);
-          X509_STORE* cert_store = SSL_CTX_get_cert_store(ctx.get());
-          while (
-              auto x509 = X509Pointer(PEM_read_bio_X509_AUX(
-                  bio.get(), nullptr, crypto::NoPasswordCallback, nullptr))) {
-            if (cert_store == crypto::GetOrCreateRootCertStore(env)) {
-              cert_store = crypto::NewRootCertStore(env);
-              SSL_CTX_set_cert_store(ctx.get(), cert_store);
-            }
-            CHECK_EQ(1, X509_STORE_add_cert(cert_store, x509.get()));
-            CHECK_EQ(1, SSL_CTX_add_client_CA(ctx.get(), x509.get()));
-          }
+          crypto::AddCACertificates(env, ctx.get(), bio);
         }
       }
     }
@@ -643,11 +673,7 @@ SSLCtxPointer TLSContext::Initialize(Environment* env) {
   {
     ClearErrorOnReturn clear_error_on_return;
     for (const auto& key : options_.keys) {
-      if (key.GetKeyType() != crypto::KeyType::kKeyTypePrivate) {
-        validation_error_ = "Invalid key";
-        return SSLCtxPointer();
-      }
-      if (!SSL_CTX_use_PrivateKey(ctx.get(), key.GetAsymmetricKey().get())) {
+      if (!crypto::UsePrivateKey(ctx.get(), key)) {
         validation_error_ = "Invalid key";
         return SSLCtxPointer();
       }
@@ -659,25 +685,10 @@ SSLCtxPointer TLSContext::Initialize(Environment* env) {
     for (const auto& crl : options_.crl) {
       uv_buf_t buf = crl;
       BIOPointer bio = crypto::NodeBIO::NewFixed(buf.base, buf.len);
-      DeleteFnPtr<X509_CRL, X509_CRL_free> crlptr(PEM_read_bio_X509_CRL(
-          bio.get(), nullptr, crypto::NoPasswordCallback, nullptr));
-
-      if (!crlptr) {
+      if (!crypto::AddCRL(env, ctx.get(), bio)) {
         validation_error_ = "Invalid CRL";
         return SSLCtxPointer();
       }
-
-      X509_STORE* cert_store = SSL_CTX_get_cert_store(ctx.get());
-      if (cert_store == crypto::GetOrCreateRootCertStore(env)) {
-        cert_store = crypto::NewRootCertStore(env);
-        SSL_CTX_set_cert_store(ctx.get(), cert_store);
-      }
-
-      CHECK_EQ(1, X509_STORE_add_crl(cert_store, crlptr.get()));
-      CHECK_EQ(
-          1,
-          X509_STORE_set_flags(
-              cert_store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL));
     }
   }
 
@@ -693,23 +704,22 @@ SSLCtxPointer TLSContext::Initialize(Environment* env) {
   return ctx;
 }
 
-int TLSContext::OnSNI(SSL* ssl, int* ad, void* arg) {
-  auto* default_ctx = static_cast<TLSContext*>(arg);
-  const char* servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name);
-  if (servername != nullptr) {
-    auto it = default_ctx->sni_contexts_.find(servername);
-    if (it != default_ctx->sni_contexts_.end()) {
-      SSL_set_SSL_CTX(ssl, it->second->ctx_.get());
-      return SSL_TLSEXT_ERR_OK;
-    }
-  }
-  // No matching hostname found. If the default context has a certificate
-  // (from the sni['*'] wildcard identity), fall through to use it.
-  // Otherwise, reject the connection with an unrecognized_name alert.
-  if (SSL_CTX_get0_certificate(default_ctx->ctx_.get()) == nullptr) {
-    *ad = SSL_AD_UNRECOGNIZED_NAME;
-    return SSL_TLSEXT_ERR_ALERT_FATAL;
+TLSContext* TLSContext::SelectSNIContext(std::string_view servername) {
+  DCHECK_EQ(side_, Side::SERVER);
+  if (!servername.empty()) {
+    auto it = sni_contexts_.find(servername);
+    if (it != sni_contexts_.end()) return it->second.get();
   }
+  // No matching hostname. If this context has a certificate (from the
+  // sni['*'] wildcard identity), fall back to it. Otherwise there is no
+  // identity that can serve this connection.
+  if (SSL_CTX_get0_certificate(ctx_.get()) == nullptr) return nullptr;
+  return this;
+}
+
+int TLSContext::OnSNI(SSL* ssl, int* ad, void* arg) {
+  // The context for this host name was already selected and applied from
+  // the ClientHello. OpenSSL only needs the extension acknowledged here.
   return SSL_TLSEXT_ERR_OK;
 }
 
@@ -726,7 +736,7 @@ bool TLSContext::AddSNIContext(Environment* env,
 bool TLSContext::SetSNIContexts(
     Environment* env, const std::unordered_map<std::string, Options>& entries) {
   DCHECK_EQ(side_, Side::SERVER);
-  std::unordered_map<std::string, std::shared_ptr<TLSContext>> new_contexts;
+  decltype(sni_contexts_) new_contexts;
   for (const auto& [hostname, options] : entries) {
     auto ctx = std::make_shared<TLSContext>(env, Side::SERVER, options);
     if (!*ctx) return false;
@@ -828,7 +838,7 @@ const TLSContext::Options TLSContext::Options::kDefault = {};
 
 // ============================================================================
 
-const TLSSession& TLSSession::From(const SSL* ssl) {
+TLSSession& TLSSession::From(const SSL* ssl) {
   auto ref = static_cast<ngtcp2_crypto_conn_ref*>(SSL_get_app_data(ssl));
   CHECK_NOT_NULL(ref);
   return *static_cast<TLSSession*>(ref->user_data);
@@ -1029,12 +1039,19 @@ MaybeLocal<Value> TLSSession::cipher_version(Environment* env) const {
 }
 
 const std::string_view TLSSession::servername() const {
+  // A server caches the name from the ClientHello, which is available
+  // earlier than SSL_get_servername() and stays available while the
+  // handshake is paused. A client just reports what it asked for.
+  if (context_->side() == Side::SERVER) return servername_;
   SSLPointerRef ssl(ossl_context_);
   return ssl->getServerName().value_or(std::string_view());
 }
 
 const std::string TLSSession::protocol() const {
   CHECK(ossl_context_);
+  // As with servername(), a server has the answer cached from the
+  // ClientHello; a client learns it from the ServerHello.
+  if (context_->side() == Side::SERVER) return alpn_;
   return ossl_context_.get_selected_alpn();
 }
 
diff --git a/src/quic/tlscontext.h b/src/quic/tlscontext.h
index f1d6451bcfa7..8209eda12dbc 100644
--- a/src/quic/tlscontext.h
+++ b/src/quic/tlscontext.h
@@ -3,6 +3,7 @@
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
 #include <base_object.h>
+#include <crypto/crypto_client_hello.h>
 #include <crypto/crypto_context.h>
 #include <crypto/crypto_keys.h>
 #include <memory_tracker.h>
@@ -91,7 +92,7 @@ class TLSSession final : public MemoryRetainer {
   // for each.
 
   // Gets the TLSSession from the SSL pointer app data.
-  static const TLSSession& From(const SSL* ssl);
+  static TLSSession& From(const SSL* ssl);
 
   // The constructor is public in order to satisfy the call to std::make_unique
   // in TLSContext::NewSession. It should not be called directly.
@@ -124,6 +125,38 @@ class TLSSession final : public MemoryRetainer {
   // The ALPN (protocol name) negotiated for the session
   const std::string protocol() const;
 
+  // Server-side early selection. A server picks the SNI context and the
+  // ALPN protocol from the ClientHello itself, before the TLS library
+  // reaches ticket decryption and early data, and holds the handshake
+  // there while the Session is handed to JavaScript. The results are
+  // cached here because the SSL object does not carry them until the
+  // later servername/ALPN callbacks run, which is after the pause.
+  //
+  // The state is explicit because the ClientHello callback can run more
+  // than once per handshake: the TLS stack restarts ClientHello
+  // processing when the handshake is resumed, and ngtcp2 can hand it
+  // further CRYPTO data - a reordered chunk replayed by
+  // conn_emit_pending_crypto_data, another CRYPTO frame in the same
+  // packet - while the handshake is still suspended. Only kPending does
+  // the work; kSelected keeps the handshake suspended until the Session
+  // has been surfaced.
+  enum class EarlySelection : uint8_t {
+    // Nothing selected yet.
+    kPending,
+    // Selected, and the handshake is suspended waiting for the Session
+    // to be handed to JavaScript.
+    kSelected,
+    // The Session has been surfaced; the handshake may run on.
+    kComplete,
+  };
+  inline EarlySelection early_selection() const { return early_selection_; }
+  inline void set_early_selection(EarlySelection state) {
+    early_selection_ = state;
+  }
+  inline void set_servername(std::string_view name) { servername_ = name; }
+  inline void set_alpn(std::string_view alpn) { alpn_ = alpn; }
+  inline const std::string& alpn() const { return alpn_; }
+
   // Triggers key update to begin. This will fail and return false if either a
   // previous key update is in progress or if the initial handshake has not yet
   // been confirmed.
@@ -161,6 +194,9 @@ class TLSSession final : public MemoryRetainer {
   Session* session_;
   ncrypto::BIOPointer bio_trace_;
   std::string validation_error_ = "";
+  std::string servername_;
+  std::string alpn_;
+  EarlySelection early_selection_ = EarlySelection::kPending;
 };
 
 // The TLSContext is used to create a TLSSession. For the client, there is
@@ -326,6 +362,17 @@ class TLSContext final : public MemoryRetainer,
   ncrypto::SSLCtxPointer Initialize(Environment* env);
   operator SSL_CTX*() const;
 
+  // Returns the context to use for the requested host name, which is this
+  // context when nothing more specific matches. Returns nullptr when the
+  // connection cannot be served at all.
+  TLSContext* SelectSNIContext(std::string_view servername);
+
+  // Performs the server's early selection: SNI, then ALPN, then the
+  // Application, and then suspends the handshake. See the comment on
+  // TLSSession::EarlySelection.
+  static crypto::ClientHelloResult OnClientHello(
+      const crypto::ClientHelloContext& hello);
+
   static void OnKeylog(const SSL* ssl, const char* line);
   static int OnNewSession(SSL* ssl, SSL_SESSION* session);
   static int OnSelectAlpn(SSL* ssl,
@@ -337,13 +384,26 @@ class TLSContext final : public MemoryRetainer,
   static int OnVerifyClientCertificate(int preverify_ok, X509_STORE_CTX* ctx);
   static int OnSNI(SSL* ssl, int* ad, void* arg);
 
+  // Lets sni_contexts_ be looked up by string_view, so a connection that
+  // sends SNI does not have to build a std::string key to find its identity.
+  struct StringHash {
+    using is_transparent = void;
+    size_t operator()(std::string_view value) const {
+      return std::hash<std::string_view>{}(value);
+    }
+  };
+
   Side side_;
   Options options_;
   ncrypto::X509Pointer cert_;
   ncrypto::X509Pointer issuer_;
   std::string validation_error_ = "";
   ncrypto::SSLCtxPointer ctx_;
-  std::unordered_map<std::string, std::shared_ptr<TLSContext>> sni_contexts_;
+  std::unordered_map<std::string,
+                     std::shared_ptr<TLSContext>,
+                     StringHash,
+                     std::equal_to<>>
+      sni_contexts_;
 
   friend class TLSSession;
 };
diff --git a/src/string_bytes.cc b/src/string_bytes.cc
index 88b499fb4289..6e628b907e66 100644
--- a/src/string_bytes.cc
+++ b/src/string_bytes.cc
@@ -60,7 +60,6 @@ class ExternString: public ResourceType {
   ~ExternString() override {
     free(const_cast<TypeName*>(data_));
     external_memory_accounter_->Decrease(isolate(), byte_length());
-    delete external_memory_accounter_;
   }
 
   const TypeName* data() const override {
@@ -126,7 +125,7 @@ class ExternString: public ResourceType {
  private:
   ExternString(Isolate* isolate, const TypeName* data, size_t length)
       : isolate_(isolate),
-        external_memory_accounter_(new ExternalMemoryAccounter()),
+        external_memory_accounter_(std::make_unique<ExternalMemoryAccounter>()),
         data_(data),
         length_(length) {
     external_memory_accounter_->Increase(isolate, byte_length());
@@ -140,7 +139,7 @@ class ExternString: public ResourceType {
                                              size_t length);
 
   Isolate* isolate_;
-  ExternalMemoryAccounter* external_memory_accounter_;
+  std::unique_ptr<ExternalMemoryAccounter> external_memory_accounter_;
   const TypeName* data_;
   size_t length_;
 };
@@ -534,8 +533,10 @@ Maybe<size_t> StringBytes::Size(Isolate* isolate,
         return Just<size_t>(simdutf::utf8_length_from_latin1(
             reinterpret_cast<const char*>(view.data8()), view.length()));
       }
-      return Just<size_t>(simdutf::utf8_length_from_utf16(
-          reinterpret_cast<const char16_t*>(view.data16()), view.length()));
+      return Just<size_t>(
+          simdutf::utf8_length_from_utf16_with_replacement(
+              reinterpret_cast<const char16_t*>(view.data16()), view.length())
+              .count);
 
     case UCS2:
       return Just(view.length() * sizeof(uint16_t));
diff --git a/src/zlib_version.h b/src/zlib_version.h
index a9d28e3a7cd4..42c81bc0ae5d 100644
--- a/src/zlib_version.h
+++ b/src/zlib_version.h
@@ -2,5 +2,5 @@
 // Refer to tools/dep_updaters/update-zlib.sh
 #ifndef SRC_ZLIB_VERSION_H_
 #define SRC_ZLIB_VERSION_H_
-#define ZLIB_VERSION "1.3.2.1-motley-5eb4d7e"
+#define ZLIB_VERSION "1.3.2.1-motley-285e94b"
 #endif  // SRC_ZLIB_VERSION_H_
diff --git a/test/addons/addons.status b/test/addons/addons.status
index 18b1c2b2157d..60a33ec9acc6 100644
--- a/test/addons/addons.status
+++ b/test/addons/addons.status
@@ -14,6 +14,7 @@ openssl-binding/test: PASS,FLAKY
 openssl-binding/test: SKIP
 openssl-get-ssl-ctx/test: SKIP
 openssl-providers/test-default-only-config: SKIP
+openssl-providers/test-default-properties-config: SKIP
 openssl-providers/test-legacy-provider-config: SKIP
 openssl-providers/test-legacy-provider-inactive-config: SKIP
 openssl-providers/test-legacy-provider-option: SKIP
diff --git a/test/addons/openssl-providers/providers.cjs b/test/addons/openssl-providers/providers.cjs
index efa1019c62d9..fc0f93ef45c8 100644
--- a/test/addons/openssl-providers/providers.cjs
+++ b/test/addons/openssl-providers/providers.cjs
@@ -10,7 +10,13 @@ if (!hasOpenSSL3) {
   common.skip('this test requires OpenSSL 3.x');
 }
 const assert = require('node:assert');
-const { createHash, getCiphers, getHashes } = require('node:crypto');
+const {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  getCiphers,
+  getHashes,
+} = require('node:crypto');
 const { debuglog } = require('node:util');
 const { getProviders } = require(`./build/${common.buildType}/binding`);
 
@@ -20,11 +26,45 @@ const { getProviders } = require(`./build/${common.buildType}/binding`);
 // supported by the provider.
 const providers = {
   'default': {
-    ciphers: ['des3-wrap'],
-    hashes: ['sha512-256'],
+    ciphers: [
+      {
+        name: 'aes-128-cbc-cts',
+        keyLength: 16,
+        ivLength: 16,
+        plaintextLength: 32,
+        unavailableCode: 'ERR_CRYPTO_UNKNOWN_CIPHER',
+      },
+      {
+        name: 'des3-wrap',
+        keyLength: 24,
+        ivLength: null,
+        plaintextLength: 16,
+        unavailableCode: 'ERR_OSSL_EVP_UNSUPPORTED',
+      },
+    ],
+    hashes: [
+      'sha512-256',
+      ...['keccak-kmac-128', 'keccak-kmac128']
+        .filter((name) => getHashes().includes(name)),
+    ],
   },
   'legacy': {
-    ciphers: ['blowfish', 'idea'],
+    ciphers: [
+      {
+        name: 'blowfish',
+        keyLength: 16,
+        ivLength: 8,
+        plaintextLength: 16,
+        unavailableCode: 'ERR_OSSL_EVP_UNSUPPORTED',
+      },
+      {
+        name: 'idea',
+        keyLength: 16,
+        ivLength: 8,
+        plaintextLength: 16,
+        unavailableCode: 'ERR_OSSL_EVP_UNSUPPORTED',
+      },
+    ],
     hashes: ['md4', 'whirlpool'],
   },
 };
@@ -47,17 +87,50 @@ function assertArrayIncludes(array, item, desc) {
          `${desc} [${array}] does not include "${item}"`);
 }
 
+function createSupportedHash(hash) {
+  try {
+    return createHash(hash);
+  } catch (err) {
+    if (err?.code !== 'ERR_OSSL_EVP_NOT_XOF_OR_INVALID_LENGTH') throw err;
+    return createHash(hash, { outputLength: 32 });
+  }
+}
+
+function assertCipherRoundTrip({
+  name,
+  keyLength,
+  ivLength,
+  plaintextLength,
+}) {
+  const key = Buffer.alloc(keyLength, 0x42);
+  const iv = ivLength === null ? null : Buffer.alloc(ivLength, 0x24);
+  const plaintext = Buffer.alloc(plaintextLength, 0x61);
+
+  const cipher = createCipheriv(name, key, iv);
+  const ciphertext = Buffer.concat([
+    cipher.update(plaintext),
+    cipher.final(),
+  ]);
+  const decipher = createDecipheriv(name, key, iv);
+  const received = Buffer.concat([
+    decipher.update(ciphertext),
+    decipher.final(),
+  ]);
+  assert.deepStrictEqual(received, plaintext);
+}
+
 function testProviderPresent(provider) {
   debug(`Checking '${provider}' is present`);
   assertArrayIncludes(getProviders(), provider, 'Loaded providers');
   for (const cipher of providers[provider].ciphers || []) {
-    debug(`Checking '${cipher}' cipher is available`);
-    assertArrayIncludes(getCiphers(), cipher, 'Available ciphers');
+    debug(`Checking '${cipher.name}' cipher is available`);
+    assertArrayIncludes(getCiphers(), cipher.name, 'Available ciphers');
+    assertCipherRoundTrip(cipher);
   }
   for (const hash of providers[provider].hashes || []) {
     debug(`Checking '${hash}' hash is available`);
     assertArrayIncludes(getHashes(), hash, 'Available hashes');
-    createHash(hash);
+    createSupportedHash(hash);
   }
 }
 
@@ -65,8 +138,14 @@ function testProviderAbsent(provider) {
   debug(`Checking '${provider}' is absent`);
   assertArrayDoesNotInclude(getProviders(), provider, 'Loaded providers');
   for (const cipher of providers[provider].ciphers || []) {
-    debug(`Checking '${cipher}' cipher is unavailable`);
-    assertArrayDoesNotInclude(getCiphers(), cipher, 'Available ciphers');
+    const { name, keyLength, ivLength, unavailableCode } = cipher;
+    debug(`Checking '${name}' cipher is unavailable`);
+    assertArrayDoesNotInclude(getCiphers(), name, 'Available ciphers');
+    const key = Buffer.alloc(keyLength, 0x42);
+    const iv = ivLength === null ? null : Buffer.alloc(ivLength, 0x24);
+    assert.throws(() => createCipheriv(name, key, iv), {
+      code: unavailableCode,
+    });
   }
   for (const hash of providers[provider].hashes || []) {
     debug(`Checking '${hash}' hash is unavailable`);
diff --git a/test/addons/openssl-providers/test-default-properties-config.js b/test/addons/openssl-providers/test-default-properties-config.js
new file mode 100644
index 000000000000..43f42864def4
--- /dev/null
+++ b/test/addons/openssl-providers/test-default-properties-config.js
@@ -0,0 +1,158 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../../common');
+const fixtures = require('../../common/fixtures');
+const providers = require('./providers.cjs');
+
+const assert = require('node:assert');
+const { fork } = require('node:child_process');
+const {
+  createHash,
+  getHashes,
+  hash: oneShotHash,
+  setFips,
+} = require('node:crypto');
+const { Worker } = require('node:worker_threads');
+const { getHashCache } = require('internal/crypto/util');
+const option = `--openssl-config=${fixtures.path(
+  'openssl3-conf',
+  'default_properties.cnf',
+)}`;
+
+if (!process.execArgv.includes(option)) {
+  const cp = fork(__filename, { execArgv: [...process.execArgv, option] });
+  cp.on('exit', common.mustCall((code, signal) => {
+    assert.strictEqual(code, 0);
+    assert.strictEqual(signal, null);
+  }));
+  return;
+}
+
+assert(providers.getCurrentProviders().includes('default'));
+assert(providers.getCurrentProviders().includes('legacy'));
+providers.testProviderPresent('default');
+
+const hashes = getHashes();
+const input = Buffer.alloc(0);
+const md5 = 'd41d8cd98f00b204e9800998ecf8427e';
+assert.strictEqual(createHash('md5').update(input).digest('hex'), md5);
+assert.strictEqual(oneShotHash('md5', input), md5);
+
+const hashName = 'SHA256';
+const hashCache = getHashCache();
+const descriptor = Object.getOwnPropertyDescriptor(hashCache, hashName);
+assert(descriptor);
+const cacheId = descriptor.value;
+const sentinel = new Error('hash cache setter');
+const throwsSentinel = (err) => err === sentinel;
+
+function installThrowingHashCacheEntry(id) {
+  Object.defineProperty(hashCache, hashName, {
+    __proto__: null,
+    configurable: true,
+    enumerable: descriptor.enumerable,
+    get() { return id; },
+    set() { throw sentinel; },
+  });
+}
+
+installThrowingHashCacheEntry(-1);
+assert.throws(() => createHash(hashName), throwsSentinel);
+assert.throws(() => oneShotHash(hashName, input), throwsSentinel);
+Object.defineProperty(hashCache, hashName, descriptor);
+
+installThrowingHashCacheEntry(cacheId);
+setFips(true);
+assert.throws(() => createHash(hashName), throwsSentinel);
+assert.throws(() => oneShotHash(hashName, input), throwsSentinel);
+Object.defineProperty(hashCache, hashName, descriptor);
+assert.deepStrictEqual(getHashes(), []);
+assert.throws(
+  () => createHash('md5'),
+  { code: 'ERR_OSSL_EVP_UNSUPPORTED' },
+);
+assert.throws(
+  () => oneShotHash('md5', input),
+  { code: 'ERR_OSSL_EVP_UNSUPPORTED' },
+);
+
+setFips(false);
+assert.deepStrictEqual(getHashes(), hashes);
+assert.strictEqual(createHash('md5').update(input).digest('hex'), md5);
+assert.strictEqual(oneShotHash('md5', input), md5);
+
+for (const hash of ['md4', 'whirlpool']) {
+  assert(!hashes.includes(hash));
+  assert.throws(() => createHash(hash), { code: 'ERR_OSSL_EVP_UNSUPPORTED' });
+}
+
+const worker = new Worker(`
+  'use strict';
+  const {
+    createHash,
+    getHashes,
+    hash,
+  } = require('node:crypto');
+  const { parentPort } = require('node:worker_threads');
+
+  const input = Buffer.alloc(0);
+  const hashes = getHashes();
+  const liveHash = createHash('md5').update(input);
+  hash('md5', input);
+  parentPort.postMessage({ phase: 'warm' });
+
+  function getErrorCode(fn) {
+    try {
+      fn();
+    } catch (err) {
+      return err.code;
+    }
+  }
+
+  parentPort.on('message', (phase) => {
+    if (phase === 'fips-on') {
+      parentPort.postMessage({
+        phase,
+        createHashError: getErrorCode(() => createHash('md5')),
+        oneShotHashError: getErrorCode(() => hash('md5', input)),
+        hashes: getHashes(),
+        liveDigest: liveHash.digest('hex'),
+      });
+    } else {
+      parentPort.postMessage({
+        phase,
+        createHashDigest: createHash('md5').update(input).digest('hex'),
+        oneShotHashDigest: hash('md5', input),
+        hashes: getHashes(),
+      });
+      parentPort.close();
+    }
+  });
+`, { eval: true });
+
+worker.once('message', common.mustCall((message) => {
+  assert.strictEqual(message.phase, 'warm');
+  setFips(true);
+
+  worker.once('message', common.mustCall((message) => {
+    assert.strictEqual(message.phase, 'fips-on');
+    assert.strictEqual(message.createHashError, 'ERR_OSSL_EVP_UNSUPPORTED');
+    assert.strictEqual(message.oneShotHashError, 'ERR_OSSL_EVP_UNSUPPORTED');
+    assert.deepStrictEqual(message.hashes, []);
+    assert.strictEqual(message.liveDigest, md5);
+
+    setFips(false);
+
+    worker.once('message', common.mustCall((message) => {
+      assert.strictEqual(message.phase, 'fips-off');
+      assert.strictEqual(message.createHashDigest, md5);
+      assert.strictEqual(message.oneShotHashDigest, md5);
+      assert.deepStrictEqual(message.hashes, hashes);
+    }));
+    worker.postMessage('fips-off');
+  }));
+  worker.postMessage('fips-on');
+}));
+worker.on('error', common.mustNotCall());
+worker.on('exit', common.mustCall((code) => assert.strictEqual(code, 0)));
diff --git a/test/benchmark/test-benchmark-vfs.js b/test/benchmark/test-benchmark-vfs.js
new file mode 100644
index 000000000000..47988ddd5fdb
--- /dev/null
+++ b/test/benchmark/test-benchmark-vfs.js
@@ -0,0 +1,7 @@
+'use strict';
+
+require('../common');
+
+const runBenchmark = require('../common/benchmark');
+
+runBenchmark('vfs');
diff --git a/test/cctest/test_environment.cc b/test/cctest/test_environment.cc
index 109e224f788d..449d7d38750b 100644
--- a/test/cctest/test_environment.cc
+++ b/test/cctest/test_environment.cc
@@ -1,6 +1,7 @@
 #include "libplatform/libplatform.h"
 #include "node_buffer.h"
 #include "node_internals.h"
+#include "node_realm-inl.h"
 #include "node_url.h"
 #include "util.h"
 
@@ -28,6 +29,12 @@ static void at_exit_callback_ordered2(void* arg);
 static void at_exit_js(void* arg);
 static std::string cb_1_arg;  // NOLINT(runtime/string)
 
+struct SelfRemovingCleanupHookState {
+  v8::Isolate* isolate;
+  bool ran = false;
+};
+static void self_removing_cleanup_hook(void* arg);
+
 class EnvironmentTest : public EnvironmentTestFixture {
  private:
   void TearDown() override {
@@ -310,6 +317,27 @@ TEST_F(EnvironmentTest, AtExitRunsJS) {
   EXPECT_TRUE(called_at_exit_js);
 }
 
+// A cleanup hook that removes itself while the environment cleanup queue is
+// being drained must not cause a use-after-free. This registers such a hook
+// directly rather than through node::ObjectWrap, whose destructor removes
+// its own hook and is what makes this reachable for addons since #63642.
+// The use-after-free is silent in ordinary builds; it is caught by the
+// ASan/Valgrind CI, which is also how the original assertion (#63923)
+// surfaced. Regression test for https://github.com/nodejs/node/issues/65195.
+TEST_F(EnvironmentTest, RemoveEnvironmentCleanupHookDuringCleanup) {
+  const v8::HandleScope handle_scope(isolate_);
+  const Argv argv;
+  SelfRemovingCleanupHookState state{isolate_};
+  {
+    Env env{handle_scope, argv};
+    node::AddEnvironmentCleanupHook(
+        isolate_, self_removing_cleanup_hook, &state);
+    // Destroying `env` runs FreeEnvironment() -> RunCleanup(), which drains
+    // the cleanup queue and invokes CleanupHookThunkRun() for the hook above.
+  }
+  EXPECT_TRUE(state.ran);
+}
+
 TEST_F(EnvironmentTest, MultipleEnvironmentsPerIsolate) {
   const v8::HandleScope handle_scope(isolate_);
   const Argv argv;
@@ -393,6 +421,19 @@ static void at_exit_js(void* arg) {
   called_at_exit_js = true;
 }
 
+// Reproduces the sequence node::ObjectWrap performs since
+// https://github.com/nodejs/node/pull/63642, without using ObjectWrap
+// itself: the hook removes its own environment cleanup hook. When that runs
+// while the cleanup queue is being drained, CleanupHookThunkRun() must not
+// read the CleanupHookThunk after invoking the hook -- the hook has already
+// erased and freed it. See https://github.com/nodejs/node/issues/65195.
+static void self_removing_cleanup_hook(void* arg) {
+  auto* state = static_cast<SelfRemovingCleanupHookState*>(arg);
+  state->ran = true;
+  node::RemoveEnvironmentCleanupHook(
+      state->isolate, self_removing_cleanup_hook, state);
+}
+
 TEST_F(EnvironmentTest, SetImmediateCleanup) {
   int called = 0;
   int called_unref = 0;
@@ -869,6 +910,41 @@ TEST_F(EnvironmentTest, RequestInterruptAtExit) {
   context->Exit();
 }
 
+TEST_F(EnvironmentTest, EmbedderBuiltinCodeCache) {
+  v8::HandleScope handle_scope(isolate_);
+  v8::Local<v8::Context> context = node::NewContext(isolate_);
+  v8::Context::Scope context_scope(context);
+
+  std::vector<node::EmbedderBuiltinCodeCache::Entry> entries =
+      node::EmbedderBuiltinCodeCache::Generate(context);
+  ASSERT_GT(entries.size(), 100u);
+  {
+    node::EmbedderBuiltinCodeCache cache(std::move(entries));
+    EXPECT_EQ(node::SetBuiltinCodeCache(isolate_data_, &cache),
+              v8::ScriptCompiler::CachedData::kSuccess);
+  }
+  std::unique_ptr<node::Environment, decltype(&node::FreeEnvironment)> env(
+      node::CreateEnvironment(isolate_data_, context, {}, {}),
+      node::FreeEnvironment);
+  node::Realm* realm = env->principal_realm();
+  EXPECT_EQ(realm->builtins_with_cache.count("internal/bootstrap/node"), 1u);
+  for (const std::string& id : realm->builtins_without_cache) {
+    EXPECT_EQ(id.rfind("internal/per_context/", 0), 0u) << id;
+  }
+
+  uint8_t* bytes = new uint8_t[64]();
+  std::vector<node::EmbedderBuiltinCodeCache::Entry> bad;
+  bad.push_back({"internal/bootstrap/node",
+                 std::make_unique<v8::ScriptCompiler::CachedData>(
+                     bytes, 64, v8::ScriptCompiler::CachedData::BufferOwned)});
+  node::EmbedderBuiltinCodeCache bad_cache(std::move(bad));
+  EXPECT_NE(node::SetBuiltinCodeCache(isolate_data_, &bad_cache),
+            v8::ScriptCompiler::CachedData::kSuccess);
+  EXPECT_FALSE(isolate_data_->builtin_code_cache().empty());
+  node::SetBuiltinCodeCache(isolate_data_, nullptr);
+  EXPECT_TRUE(isolate_data_->builtin_code_cache().empty());
+}
+
 TEST_F(EnvironmentTest, EmbedderPreload) {
   v8::HandleScope handle_scope(isolate_);
   v8::Local<v8::Context> context = node::NewContext(isolate_);
diff --git a/test/cctest/test_node_api.cc b/test/cctest/test_node_api.cc
index 902776c157e9..29f1f3098fe4 100644
--- a/test/cctest/test_node_api.cc
+++ b/test/cctest/test_node_api.cc
@@ -40,3 +40,109 @@ TEST_F(NodeApiTest, CreateNodeApiEnv) {
   node_napi_env internal_env = reinterpret_cast<node_napi_env>(addon_env);
   EXPECT_EQ(internal_env->node_env(), env);
 }
+
+namespace {
+
+struct ContextCheckState {
+  napi_async_work work = nullptr;
+  bool complete_called = false;
+  bool complete_in_own_context = false;
+  bool call_js_called = false;
+  bool call_js_in_own_context = false;
+  bool tsfn_finalize_called = false;
+  bool tsfn_finalize_in_own_context = false;
+};
+
+bool InOwnContext(napi_env env) {
+  node_napi_env internal_env = reinterpret_cast<node_napi_env>(env);
+  return internal_env->isolate->GetCurrentContext() == internal_env->context();
+}
+
+}  // namespace
+
+TEST_F(NodeApiTest, AsyncCallbacksEnterOwnContext) {
+  const v8::HandleScope handle_scope(isolate_);
+  Argv argv;
+
+  Env env1{handle_scope, argv};
+  node::LoadEnvironment(*env1, "");
+  Env env2{handle_scope, argv, node::EnvironmentFlags::kNoFlags};
+  node::LoadEnvironment(*env2, "");
+  ASSERT_EQ(isolate_->GetCurrentContext(), env2.context());
+
+  ContextCheckState state;
+  {
+    v8::Context::Scope context_scope(env1.context());
+    napi_addon_register_func init = [](napi_env env, napi_value exports) {
+      addon_env = env;
+      return exports;
+    };
+    addon_env = nullptr;
+    napi_module_register_by_symbol(Object::New(isolate_),
+                                   Object::New(isolate_),
+                                   env1.context(),
+                                   init,
+                                   NAPI_VERSION);
+    ASSERT_NE(addon_env, nullptr);
+
+    napi_value resource_name;
+    ASSERT_EQ(napi_create_string_utf8(
+                  addon_env, "cctest", NAPI_AUTO_LENGTH, &resource_name),
+              napi_ok);
+
+    ASSERT_EQ(napi_create_async_work(
+                  addon_env,
+                  nullptr,
+                  resource_name,
+                  [](napi_env env, void* data) {},
+                  [](napi_env env, napi_status status, void* data) {
+                    auto* state = static_cast<ContextCheckState*>(data);
+                    state->complete_called = true;
+                    state->complete_in_own_context = InOwnContext(env);
+                    napi_delete_async_work(env, state->work);
+                  },
+                  &state,
+                  &state.work),
+              napi_ok);
+    ASSERT_EQ(napi_queue_async_work(addon_env, state.work), napi_ok);
+
+    napi_threadsafe_function tsfn;
+    ASSERT_EQ(napi_create_threadsafe_function(
+                  addon_env,
+                  nullptr,
+                  nullptr,
+                  resource_name,
+                  0,
+                  1,
+                  &state,
+                  [](napi_env env, void* finalize_data, void* hint) {
+                    auto* state =
+                        static_cast<ContextCheckState*>(finalize_data);
+                    state->tsfn_finalize_called = true;
+                    state->tsfn_finalize_in_own_context = InOwnContext(env);
+                  },
+                  &state,
+                  [](napi_env env, napi_value cb, void* context, void* data) {
+                    auto* state = static_cast<ContextCheckState*>(context);
+                    state->call_js_called = true;
+                    state->call_js_in_own_context = InOwnContext(env);
+                  },
+                  &tsfn),
+              napi_ok);
+    ASSERT_EQ(napi_call_threadsafe_function(tsfn, nullptr, napi_tsfn_blocking),
+              napi_ok);
+    ASSERT_EQ(napi_release_threadsafe_function(tsfn, napi_tsfn_release),
+              napi_ok);
+  }
+
+  ASSERT_EQ(isolate_->GetCurrentContext(), env2.context());
+  uv_run(&current_loop, UV_RUN_DEFAULT);
+
+  EXPECT_TRUE(state.complete_called);
+  EXPECT_TRUE(state.complete_in_own_context);
+  EXPECT_TRUE(state.call_js_called);
+  EXPECT_TRUE(state.call_js_in_own_context);
+  EXPECT_TRUE(state.tsfn_finalize_called);
+  EXPECT_TRUE(state.tsfn_finalize_in_own_context);
+  EXPECT_EQ(isolate_->GetCurrentContext(), env2.context());
+}
diff --git a/test/cctest/test_per_process.cc b/test/cctest/test_per_process.cc
index 7a6f53d56222..937e9cab54dd 100644
--- a/test/cctest/test_per_process.cc
+++ b/test/cctest/test_per_process.cc
@@ -4,18 +4,45 @@
 #include "gtest/gtest.h"
 #include "node_test_fixture.h"
 
+#include <algorithm>
+#include <memory>
 #include <string>
+#include <vector>
 
+using node::builtins::BuiltinCodeCacheData;
 using node::builtins::BuiltinLoader;
 using node::builtins::BuiltinSourceMap;
+using node::builtins::CodeCacheInfo;
 
 class PerProcessTest : public ::testing::Test {
  protected:
   static const BuiltinSourceMap get_sources_for_test() {
     return *BuiltinLoader().source_.read();
   }
+
+  // id -> first byte of the cached data, after feeding `batches` in order.
+  static std::vector<std::pair<std::string, uint8_t>> RefreshCodeCacheWith(
+      const std::vector<std::vector<CodeCacheInfo>>& batches) {
+    BuiltinLoader loader;
+    for (const auto& batch : batches) loader.RefreshCodeCache(batch);
+    std::vector<std::pair<std::string, uint8_t>> out;
+    node::RwLock::ScopedReadLock lock(loader.code_cache_->mutex);
+    EXPECT_TRUE(loader.code_cache_->has_code_cache);
+    for (const auto& [id, data] : loader.code_cache_->map) {
+      out.emplace_back(id, data.data[0]);
+    }
+    std::sort(out.begin(), out.end());
+    return out;
+  }
 };
 
+CodeCacheInfo MakeCodeCacheInfo(const std::string& id, uint8_t marker) {
+  auto* bytes = new uint8_t[4]{marker, marker, marker, marker};
+  auto cached_data = std::make_shared<v8::ScriptCompiler::CachedData>(
+      bytes, 4, v8::ScriptCompiler::CachedData::BufferOwned);
+  return CodeCacheInfo{id, BuiltinCodeCacheData(std::move(cached_data))};
+}
+
 namespace {
 
 TEST_F(PerProcessTest, EmbeddedSources) {
@@ -29,4 +56,22 @@ TEST_F(PerProcessTest, EmbeddedSources) {
   })) << "BuiltinLoader::source_ should have some 16bit items";
 }
 
+// RefreshCodeCache() merges: it can be fed the snapshot's code cache and then
+// an embedder's, and the entry supplied last wins for a shared id.
+TEST_F(PerProcessTest, RefreshCodeCacheMerges) {
+  const auto merged = PerProcessTest::RefreshCodeCacheWith({
+      {MakeCodeCacheInfo("internal/a", 1), MakeCodeCacheInfo("internal/b", 1)},
+      {MakeCodeCacheInfo("internal/b", 2), MakeCodeCacheInfo("embedder/c", 2)},
+  });
+  const std::vector<std::pair<std::string, uint8_t>> expected = {
+      {"embedder/c", 2}, {"internal/a", 1}, {"internal/b", 2}};
+  EXPECT_EQ(merged, expected);
+
+  // A single call still behaves as before.
+  const auto single = PerProcessTest::RefreshCodeCacheWith(
+      {{MakeCodeCacheInfo("internal/a", 7)}});
+  ASSERT_EQ(single.size(), 1u);
+  EXPECT_EQ(single[0].second, 7);
+}
+
 }  // end namespace
diff --git a/test/client-proxy/test-https-proxy-request-header-overflow.mjs b/test/client-proxy/test-https-proxy-request-header-overflow.mjs
new file mode 100644
index 000000000000..2ffc215bafa9
--- /dev/null
+++ b/test/client-proxy/test-https-proxy-request-header-overflow.mjs
@@ -0,0 +1,45 @@
+// This tests that the proxy server cannot send unbounded incomplete headers
+// while establishing a CONNECT tunnel.
+
+import * as common from '../common/index.mjs';
+import assert from 'node:assert';
+import { once } from 'events';
+import http from 'node:http';
+import { runProxiedRequest } from '../common/proxy-server.js';
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const proxy = http.createServer();
+proxy.on('connect', common.mustCall((req, socket) => {
+  socket.write('HTTP/1.1 200 Connection Established\r\n');
+
+  const interval = setInterval(() => {
+    if (socket.destroyed) {
+      clearInterval(interval);
+      return;
+    }
+    socket.write('x'.repeat(100));
+  }, 10);
+  socket.on('close', () => clearInterval(interval));
+  socket.on('error', () => clearInterval(interval));
+}, 1));
+proxy.listen(0);
+await once(proxy, 'listening');
+
+const { code, signal, stderr, stdout } = await runProxiedRequest({
+  NODE_USE_ENV_PROXY: 1,
+  REQUEST_URL: 'https://localhost:1/test',
+  HTTPS_PROXY: `http://localhost:${proxy.address().port}`,
+}, ['--max-http-header-size=1024']);
+
+assert.match(
+  stderr,
+  /ERR_PROXY_TUNNEL.*Proxy response headers exceeded 1024 bytes/,
+);
+assert.doesNotMatch(stderr, /MaxListenersExceededWarning/);
+assert.strictEqual(stdout.trim(), '');
+assert.strictEqual(code, 0);
+assert.strictEqual(signal, null);
+
+proxy.close();
diff --git a/test/common/README.md b/test/common/README.md
index 6c8fcf42847a..193250562972 100644
--- a/test/common/README.md
+++ b/test/common/README.md
@@ -28,6 +28,7 @@ several other tasks:
 ## Table of contents
 
 * [ArrayStream module](#arraystream-module)
+* [Bench module](#bench-module)
 * [Benchmark module](#benchmark-module)
 * [Child process module](#child-process-module)
 * [Common module API](#common-module-api)
@@ -49,6 +50,21 @@ several other tasks:
 * [UDP pair helper](#udp-pair-helper)
 * [WPT module](#wpt-module)
 
+## Bench module
+
+The `bench` module has helpers for tests of `node:bench`.
+
+### `completeSample(b[, operations[, options]])`
+
+* `b` The `BenchContext` passed to a `node:bench` benchmark function.
+* `operations` [\<number>][<number>] Passed to `b.end()`. **Default:** `1`.
+* `options` [\<Object>][<Object>] Passed to `b.end()`.
+* return the sample returned by `b.end()`.
+
+Calls `b.start()` and `b.end()` with at least one `process.hrtime.bigint()`
+tick in between, so the sample has a non-zero duration on hosts whose
+monotonic clock is coarse.
+
 ## Benchmark module
 
 The `benchmark` module is used by tests to run benchmarks.
diff --git a/test/common/bench.js b/test/common/bench.js
new file mode 100644
index 000000000000..25d67e3a17b2
--- /dev/null
+++ b/test/common/bench.js
@@ -0,0 +1,13 @@
+'use strict';
+
+// Records a sample with start()/end() and at least one hrtime tick in
+// between, so its duration is non-zero even on hosts with a coarse clock.
+function completeSample(b, operations = 1, options = undefined) {
+  b.start();
+  const started = process.hrtime.bigint();
+  let now = started;
+  while (now === started) now = process.hrtime.bigint();
+  return b.end(operations, options);
+}
+
+module.exports = { completeSample };
diff --git a/test/common/index.js b/test/common/index.js
index 0eb8b781442d..3ec677e566d8 100755
--- a/test/common/index.js
+++ b/test/common/index.js
@@ -73,6 +73,7 @@ const hasSQLite = Boolean(process.versions.sqlite);
 const hasFFI = Boolean(process.config.variables.node_use_ffi);
 const hasPerfetto = Boolean(process.config.variables.v8_use_perfetto);
 
+const hasDtls = hasCrypto && !!process.features.dtls;
 const hasQuic = hasCrypto && !!process.features.quic;
 
 const hasLocalStorage = (() => {
@@ -854,8 +855,9 @@ function invalidArgTypeHelper(input) {
     return ` Received function ${input.name}`;
   }
   if (typeof input === 'object') {
-    if (input.constructor?.name) {
-      return ` Received an instance of ${input.constructor.name}`;
+    const name = input.constructor?.name;
+    if (typeof name === 'string' && name !== '') {
+      return ` Received an instance of ${name}`;
     }
     return ` Received ${inspect(input, { depth: -1 })}`;
   }
@@ -1019,6 +1021,7 @@ const common = {
   hasTemporal,
   hasFullICU,
   hasCrypto,
+  hasDtls,
   hasQuic,
   hasInspector,
   hasSQLite,
diff --git a/test/common/index.mjs b/test/common/index.mjs
index 3327ae8df9db..108cae290999 100644
--- a/test/common/index.mjs
+++ b/test/common/index.mjs
@@ -16,6 +16,7 @@ const {
   getBufferSources,
   getTTYfd,
   hasCrypto,
+  hasDtls,
   hasQuic,
   hasInspector,
   hasSQLite,
@@ -74,6 +75,7 @@ export {
   getPort,
   getTTYfd,
   hasCrypto,
+  hasDtls,
   hasQuic,
   hasInspector,
   hasSQLite,
diff --git a/test/common/quic.mjs b/test/common/quic.mjs
index d05ee634f5e5..dc4b094cf900 100644
--- a/test/common/quic.mjs
+++ b/test/common/quic.mjs
@@ -53,9 +53,56 @@ async function connect(address, options = {}) {
   return quic.connect(address, { alpn, verifyPeer, ...rest });
 }
 
+/**
+ * Build a deterministic payload whose content depends on absolute position.
+ *
+ * Flow control bugs frequently show up as duplicated, dropped, or reordered
+ * regions rather than as a wrong total length, so the pattern deliberately
+ * varies over a long period (not a repeating 256-byte ramp) to make such
+ * damage detectable by `hashBytes` below.
+ * @param {number} size Number of bytes to generate.
+ * @param {number} [seed] Offsets the pattern so callers can build distinct
+ *   payloads of the same length.
+ * @returns {Uint8Array}
+ */
+function makePayload(size, seed = 0) {
+  const out = new Uint8Array(size);
+  let state = (seed * 2654435761 + 1) >>> 0;
+  for (let i = 0; i < size; i++) {
+    // xorshift32 -- cheap, deterministic, and position sensitive.
+    state ^= state << 13; state >>>= 0;
+    state ^= state >>> 17;
+    state ^= state << 5; state >>>= 0;
+    out[i] = state & 0xff;
+  }
+  return out;
+}
+
+/**
+ * Order-sensitive FNV-1a 32-bit hash.
+ *
+ * Note this is deliberately not a simple additive checksum: addition is
+ * commutative, so it cannot distinguish correctly ordered data from
+ * reordered data. Flow control errors can reorder or duplicate regions
+ * while preserving the byte total, so verification needs to be sensitive to
+ * position.
+ * @param {Uint8Array} buf
+ * @returns {number} Hash as an unsigned 32-bit integer.
+ */
+function hashBytes(buf) {
+  let h = 0x811c9dc5;
+  for (let i = 0; i < buf.byteLength; i++) {
+    h ^= buf[i];
+    h = Math.imul(h, 0x01000193) >>> 0;
+  }
+  return h >>> 0;
+}
+
 export {
   key,
   cert,
   listen,
   connect,
+  makePayload,
+  hashBytes,
 };
diff --git a/test/common/wpt.js b/test/common/wpt.js
index 41c56e964f76..4ad788ae029d 100644
--- a/test/common/wpt.js
+++ b/test/common/wpt.js
@@ -8,9 +8,12 @@ const path = require('path');
 const events = require('events');
 const os = require('os');
 const { inspect } = require('util');
+const { pathToFileURL } = require('url');
 const { Worker } = require('worker_threads');
+const { fork } = require('child_process');
 
 const workerPath = path.join(__dirname, 'wpt/worker.js');
+const wptNonTestDirs = new Set(['resources', 'support', 'tools']);
 
 function getBrowserProperties() {
   const { node: version } = process.versions; // e.g. 18.13.0, 20.0.0-nightly202302078e6e215481
@@ -107,7 +110,7 @@ class WPTReport {
    * @returns {ReportResult}
    */
   getResult(spec) {
-    const name = `/${spec.getRelativePath()}${spec.variant}`;
+    const name = `/${spec.getTestPath()}`;
     if (this.results.has(name)) {
       return this.results.get(name);
     }
@@ -121,13 +124,7 @@ class WPTReport {
    */
   write() {
     this.time_end = Date.now();
-    const results = Array.from(this.results.values())
-      .map((result) => {
-        const url = new URL(result.test, 'http://wpt');
-        url.pathname = url.pathname.replace(/\.js$/, '.html');
-        result.test = url.href.slice(url.origin.length);
-        return result;
-      });
+    const results = Array.from(this.results.values());
 
     /**
      * Return required and some optional properties
@@ -194,6 +191,24 @@ class ResourceLoader {
       fixtures.path('wpt', base, url);
   }
 
+  /**
+   * Map a URL that a test would have fetched from the WPT server (an
+   * absolute path, or a path relative to the test file) to a file: URL
+   * into the fixtures directory. URLs that already have a scheme (data:,
+   * blob:, http:, ...) are returned unchanged.
+   * @param {string} from the path of the file loading this resource,
+   *   relative to the WPT folder.
+   * @param {string|URL} url the url of the resource being loaded.
+   * @returns {string}
+   */
+  mapServerURL(from, url) {
+    url = `${url}`;
+    if (/^[a-zA-Z][a-zA-Z0-9+.-]*:|^\/\//.test(url)) {
+      return url;
+    }
+    return pathToFileURL(this.toRealFilePath(from, url)).href;
+  }
+
   /**
    * Load a resource in test/fixtures/wpt specified with a URL
    * @param {string} from the path of the file loading this resource,
@@ -304,18 +319,21 @@ class WPTTestSpec {
    *   'test.any.js'
    * @param {StatusRule[]} rules
    * @param {string} variant test file variant
+   * @param {'window'|'dedicatedworker'} [globalScope] generated test global
    */
-  constructor(mod, filename, rules, variant = '') {
+  constructor(mod, filename, rules, variant = '', globalScope) {
     this.module = mod;
     this.filename = filename;
     this.variant = variant;
+    this.globalScope = globalScope;
+    this.rules = [...new Set(rules)];
 
     this.requires = new Set();
     this.failedTests = [];
     this.flakyTests = [];
     this.skipReasons = [];
     this.skippedTests = [];
-    for (const item of rules) {
+    for (const item of this.rules) {
       if (item.requires.length) {
         for (const req of item.requires) {
           this.requires.add(req);
@@ -345,12 +363,63 @@ class WPTTestSpec {
    * @param {string} mod
    * @param {string} filename
    * @param {StatusRule[]} rules
-   * @returns {ReturnType<WPTTestSpec['getMeta']>[]}
+   * @param {(spec: WPTTestSpec) => StatusRule[]} [getAdditionalRules]
+   * @returns {WPTTestSpec[]}
    */
-  static from(mod, filename, rules) {
+  static from(mod, filename, rules, getAdditionalRules) {
     const spec = new WPTTestSpec(mod, filename, rules);
     const meta = spec.getMeta();
-    return meta.variant?.map((variant) => new WPTTestSpec(mod, filename, rules, variant)) || [spec];
+    const variants = meta.variant || [''];
+    const createSpec = (variant, globalScope) => {
+      let result = new WPTTestSpec(mod, filename, rules, variant, globalScope);
+      const additionalRules = getAdditionalRules?.(result) || [];
+      if (additionalRules.length > 0) {
+        result = new WPTTestSpec(
+          mod,
+          filename,
+          [...new Set([...rules, ...additionalRules])],
+          variant,
+          globalScope,
+        );
+      }
+      return result;
+    };
+
+    if (!spec.isAnyTest()) {
+      return variants.map((variant) => createSpec(variant));
+    }
+
+    const requestedGlobals = meta.global ?
+      meta.global.split(',').map((item) => item.trim()) :
+      ['window', 'dedicatedworker'];
+    const supportedGlobals = new Set();
+    for (const globalScope of requestedGlobals) {
+      if (globalScope === 'window' || globalScope === 'dedicatedworker') {
+        supportedGlobals.add(globalScope);
+      } else if (globalScope === 'worker') {
+        supportedGlobals.add('dedicatedworker');
+      }
+    }
+
+    return ['window', 'dedicatedworker']
+      .filter((globalScope) => supportedGlobals.has(globalScope))
+      .flatMap((globalScope) => variants.map(
+        (variant) => createSpec(variant, globalScope)));
+  }
+
+  /**
+   * @returns {boolean}
+   */
+  isAnyTest() {
+    return /\.any\.js$/.test(this.filename);
+  }
+
+  /**
+   * @returns {boolean}
+   */
+  isWebWorkerTest() {
+    return /\.worker\.js$/.test(this.filename) ||
+      this.globalScope === 'dedicatedworker';
   }
 
   /**
@@ -373,6 +442,41 @@ class WPTTestSpec {
     return path.join(this.module, this.filename);
   }
 
+  getStatusKey() {
+    if (this.globalScope === 'dedicatedworker') {
+      return this.filename.replace(/\.any\.js$/, '.any.worker.html');
+    }
+    if (this.globalScope === 'window') {
+      return this.filename.replace(/\.any\.js$/, '.any.html');
+    }
+    return this.filename;
+  }
+
+  getTestPath() {
+    let testPath = path.join(this.module, this.getStatusKey());
+    testPath = testPath.replace(/\.js$/, '.html');
+    return `${testPath.split(path.sep).join('/')}${this.variant}`;
+  }
+
+  /**
+   * Whether a command line argument selects this spec. Accepts the source file
+   * name, which selects every global and variant generated from it, or a test
+   * path as printed alongside the results, which selects only this one.
+   * @param {string} arg
+   * @returns {boolean}
+   */
+  isSelectedBy(arg) {
+    if (arg === this.getTestPath()) {
+      return true;
+    }
+    const [filename, variant = ''] = arg.split('?');
+    // Spec filenames are relative paths, so they use the platform separator,
+    // while the argument is written with forward slashes.
+    return filename.split(path.sep).join('/') ===
+      this.filename.split(path.sep).join('/') &&
+      (!variant || this.variant.substring(1) === variant);
+  }
+
   getAbsolutePath() {
     return fixtures.path('wpt', this.getRelativePath());
   }
@@ -389,13 +493,15 @@ class WPTTestSpec {
    * @returns {{ script?: string[]; variant?: string[]; [key: string]: string }} parsed META tags of a spec file
    */
   getMeta() {
-    const matches = this.getContent().match(/\/\/ META: .+/g);
+    // Like upstream, tolerate missing whitespace around "META:".
+    // Refs: https://github.com/web-platform-tests/wpt/blob/master/tools/manifest/sourcefile.py
+    const matches = this.getContent().match(/\/\/\s*META:\s*.+/g);
     if (!matches) {
       return {};
     }
     const result = {};
     for (const match of matches) {
-      const parts = match.match(/\/\/ META: ([^=]+?)=(.+)/);
+      const parts = match.match(/\/\/\s*META:\s*([^=]+?)=(.+)/);
       const key = parts[1];
       const value = parts[2];
       if (key === 'script' || key === 'variant') {
@@ -487,6 +593,9 @@ class StatusLoader {
       const filepath = path.join(dir, file);
       const stat = fs.statSync(filepath);
       if (stat.isDirectory()) {
+        if (wptNonTestDirs.has(file)) {
+          continue;
+        }
         const list = this.grep(filepath);
         result = result.concat(list);
       } else {
@@ -520,7 +629,15 @@ class StatusLoader {
     for (const file of list) {
       const relativePath = path.relative(subDir, file);
       const match = this.rules.match(relativePath);
-      this.specs.push(...WPTTestSpec.from(this.path, relativePath, match));
+      this.specs.push(...WPTTestSpec.from(
+        this.path,
+        relativePath,
+        match,
+        (spec) => [
+          ...this.rules.match(spec.getStatusKey()),
+          ...this.rules.match(`${spec.getStatusKey()}${spec.variant}`),
+        ],
+      ));
     }
   }
 }
@@ -537,27 +654,173 @@ const limit = (concurrency) => {
   let running = 0;
   const queue = [];
 
-  const execute = async (fn) => {
-    if (running < concurrency) {
-      running++;
-      try {
-        await fn();
-      } finally {
-        running--;
-        if (queue.length > 0) {
-          execute(queue.shift());
-        }
+  const execute = async ({ fn, resolve, reject }) => {
+    running++;
+    try {
+      resolve(await fn());
+    } catch (err) {
+      reject(err);
+    } finally {
+      running--;
+      if (queue.length > 0) {
+        execute(queue.shift());
       }
+    }
+  };
+
+  return (fn) => new Promise((resolve, reject) => {
+    const task = { fn, resolve, reject };
+    if (running < concurrency) {
+      execute(task);
     } else {
-      queue.push(fn);
+      queue.push(task);
+    }
+  });
+};
+
+function isUnexpectedPass(spec, name) {
+  return spec.failedTests.includes(name) && !spec.flakyTests.includes(name);
+}
+
+function getUnexpectedPasses(queue, results) {
+  const unexpectedPasses = [];
+  for (const spec of queue) {
+    const key = spec.getStatusKey();
+    if (results[key]?.skip) {
+      continue;
+    }
+
+    for (const expectedToFail of spec.failedTests) {
+      if (isUnexpectedPass(spec, expectedToFail) &&
+          !results[key]?.fail?.expected?.includes(expectedToFail)) {
+        unexpectedPasses.push(`${key}:${expectedToFail}`);
+      }
+    }
+  }
+  return unexpectedPasses;
+}
+
+function getHarnessErrorName(harnessStatus) {
+  if (typeof harnessStatus.stack === 'string') {
+    const name = harnessStatus.stack.split('\n', 1)[0];
+    if (name) {
+      return name;
+    }
+  }
+  return harnessStatus.message || 'WPT test harness error';
+}
+
+/**
+ * @typedef {object} SpecHandlers
+ * @property {(message: object) => void} message Handles a message from the spec.
+ * @property {(failure: { name: string, message: string, stack: string })
+ *   => boolean} failure Reports a spec that died without completing. Returns
+ *   false when the spec had already finished and the failure was ignored.
+ */
+
+/**
+ * @typedef {object} SpecHandle
+ * @property {() => void} kill Forces the spec to stop running.
+ * @property {Promise<unknown>} finished Settles once the spec has stopped.
+ */
+
+/**
+ * Run a spec on a worker thread.
+ * @param {string[]} execArgv
+ * @param {object} workerData
+ * @param {SpecHandlers} handlers
+ * @returns {SpecHandle}
+ */
+function runSpecOnThread(execArgv, workerData, handlers) {
+  const worker = new Worker(workerPath, { execArgv, workerData });
+  worker.on('message', handlers.message);
+  worker.on('error', (err) => handlers.failure({
+    name: `${err}`,
+    message: err.message,
+    stack: inspect(err),
+  }));
+  return {
+    kill: () => worker.terminate(),
+    finished: events.once(worker, 'exit').catch(() => {}),
+  };
+}
+
+/**
+ * Run a spec in a child process, so that a spec crashing the process only
+ * takes down its own run and the runner can attribute the crash to it.
+ * @param {string[]} execArgv
+ * @param {object} workerData
+ * @param {SpecHandlers} handlers
+ * @returns {SpecHandle}
+ */
+function runSpecInProcess(execArgv, workerData, handlers) {
+  const forwardStderr = execArgv.some(
+    (flag) => flag === '--inspect-brk' || flag.startsWith('--inspect-brk='));
+  const child = fork(workerPath, {
+    execArgv,
+    // Status files may skip subtests by regular expression, which JSON
+    // serialization would not preserve.
+    serialization: 'advanced',
+    stdio: ['ignore', 'inherit', 'pipe', 'ipc'],
+  });
+  child.send(workerData);
+
+  let stderr = '';
+  child.stderr.setEncoding('utf8');
+  child.stderr.on('data', (chunk) => {
+    stderr += chunk;
+    if (forwardStderr) {
+      process.stderr.write(chunk);
+    }
+  });
+
+  child.on('message', (message) => {
+    // The spec reports uncaught errors itself so that they are named the same
+    // way as they would be on the worker thread backend.
+    if (message.type === 'uncaught') {
+      handlers.failure(message.error);
+      return;
     }
+    handlers.message(message);
+  });
+  child.on('error', (err) => handlers.failure({
+    name: `${err}`,
+    message: err.message,
+    stack: inspect(err),
+  }));
+  // `close` rather than `exit` so that everything the process wrote to stderr
+  // on its way out is part of the reported failure.
+  child.on('close', (code, signal) => {
+    const name = signal ?
+      `Test process was killed by signal ${signal}` :
+      `Test process exited with code ${code}`;
+    if (!handlers.failure({ name, message: name, stack: stderr }) &&
+        stderr && !forwardStderr) {
+      process.stderr.write(stderr);
+    }
+  });
+
+  return {
+    kill: () => child.kill('SIGKILL'),
+    finished: events.once(child, 'close').catch(() => {}),
   };
+}
 
-  return execute;
+const backends = {
+  __proto__: null,
+  thread: runSpecOnThread,
+  process: runSpecInProcess,
 };
 
 class WPTRunner {
-  constructor(path, { concurrency = os.availableParallelism() - 1 || 1 } = {}) {
+  constructor(path, {
+    concurrency = os.availableParallelism() - 1 || 1,
+    backend = 'thread',
+  } = {}) {
+    if (!Number.isInteger(concurrency) || concurrency < 1) {
+      throw new TypeError('WPT concurrency must be a positive integer');
+    }
+
     // RISC-V has very limited virtual address space in the currently common
     // sv39 mode, in which we can only create a very limited number of wasm
     // memories(27 from a fresh node repl). Limit the concurrency to avoid
@@ -566,11 +829,33 @@ class WPTRunner {
       concurrency = Math.min(10, concurrency);
     }
 
+    this.inspectBrk = process.env.WPT_INSPECT !== undefined;
+
+    // The override exists so that every suite can be run either way without
+    // editing the drivers, which is how the two backends are kept compatible.
+    if (this.inspectBrk) {
+      backend = 'process';
+    } else {
+      backend = process.env.WPT_BACKEND || backend;
+    }
+    this.runSpec = backends[backend];
+    if (this.runSpec === undefined) {
+      throw new Error(`Invalid WPT backend ${backend}, expected one of ` +
+                      `${Object.keys(backends).join(', ')}`);
+    }
+
     this.path = path;
     this.resource = new ResourceLoader(path);
     this.concurrency = concurrency;
 
-    this.flags = [];
+    // Since we need to prepare the Web Worker APIs
+    // in the harness that runs on all WPT workers,
+    // we enable the API globally. This has no practical
+    // effect on the non-web-worker tests, however.
+    this.flags = ['--experimental-web-worker'];
+    if (this.inspectBrk) {
+      this.flags.push('--inspect-brk=0');
+    }
     this.globalThisInitScripts = [];
     this.initScript = null;
 
@@ -581,8 +866,9 @@ class WPTRunner {
 
     this.results = {};
     this.inProgress = new Set();
-    this.workers = new Map();
+    this.handles = new Map();
     this.unexpectedFailures = [];
+    this.skippedSpecCount = 0;
 
     this.subtestCounts = { passed: 0, failed: 0, expectedFailures: 0, skipped: 0, unexpectedPasses: 0 };
 
@@ -596,7 +882,7 @@ class WPTRunner {
    * @param {string[]} flags
    */
   setFlags(flags) {
-    this.flags = flags;
+    this.flags = this.flags.concat(flags);
   }
 
   /**
@@ -620,7 +906,7 @@ class WPTRunner {
    * @returns {string}
    */
   fullInitScript(spec) {
-    const url = new URL(`/${spec.getRelativePath().replace(/\.js$/, '.html')}${spec.variant}`, 'http://wpt');
+    const url = new URL(`/${spec.getTestPath()}`, 'http://wpt');
     const title = spec.getMeta().title;
     let { initScript } = this;
 
@@ -634,6 +920,10 @@ class WPTRunner {
       return initScript;
     }
 
+    if (spec.isWebWorkerTest()) {
+      return initScript;
+    }
+
     const globalThisInitScript = this.globalThisInitScripts.join('\n\n//===\n');
 
     if (initScript === null) {
@@ -671,6 +961,7 @@ class WPTRunner {
     const queue = this.buildQueue();
 
     const run = limit(this.concurrency);
+    const jobs = [];
 
     for (const spec of queue) {
       const content = spec.getContent();
@@ -679,9 +970,17 @@ class WPTRunner {
       const absolutePath = spec.getAbsolutePath();
       const relativePath = spec.getRelativePath();
       const harnessPath = fixtures.path('wpt', 'resources', 'testharness.js');
-
-      // Scripts specified with the `// META: script=` header
-      const scriptsToRun = meta.script?.map((script) => {
+      // *.worker.js tests are dedicated worker tests by definition. Each
+      // dedicated worker variant generated from a multi-global (*.any.js)
+      // test also runs inside an actual Web Worker. Refs:
+      // https://web-platform-tests.org/writing-tests/testharness.html#multi-global-tests
+      const isAnyTest = spec.isAnyTest();
+      const isWebWorkerTest = spec.isWebWorkerTest();
+
+      // Scripts specified with the `// META: script=` header. For tests
+      // that run inside a Web Worker they are imported by the worker
+      // instead.
+      const scriptsToRun = isWebWorkerTest ? [] : meta.script?.map((script) => {
         const obj = {
           filename: this.resource.toRealFilePath(relativePath, script),
           code: this.resource.read(relativePath, script),
@@ -689,74 +988,77 @@ class WPTRunner {
         this.scriptsModifier?.(obj);
         return obj;
       }) ?? [];
-      // The actual test
-      const obj = {
-        code: content,
-        filename: absolutePath,
-      };
-      this.scriptsModifier?.(obj);
-      scriptsToRun.push(obj);
-
-      run(async () => {
-        const worker = new Worker(workerPath, {
-          execArgv: this.flags,
-          workerData: {
-            testRelativePath: relativePath,
-            wptRunner: __filename,
-            wptPath: this.path,
-            initScript: this.fullInitScript(spec),
-            harness: {
-              code: fs.readFileSync(harnessPath, 'utf8'),
-              filename: harnessPath,
-            },
-            scriptsToRun,
-            needsGc: !!meta.script?.find((script) => script === '/common/gc.js'),
-            skippedTests: spec.skippedTests,
-          },
-        });
-        this.inProgress.add(spec);
-        this.workers.set(spec, worker);
+      if (!isWebWorkerTest) {
+        // The actual test
+        const obj = {
+          code: content,
+          filename: absolutePath,
+        };
+        this.scriptsModifier?.(obj);
+        scriptsToRun.push(obj);
+      }
 
+      jobs.push(run(async () => {
+        this.inProgress.add(spec);
         const reportResult = this.report?.getResult(spec);
-        worker.on('message', (message) => {
-          switch (message.type) {
-            case 'result':
-              return this.resultCallback(spec, message.result, reportResult);
-            case 'skip':
-              return this.skipTest(spec, { name: message.name }, reportResult);
-            case 'completion':
-              return this.completionCallback(spec, message.status, reportResult);
-            default:
-              throw new Error(`Unexpected message from worker: ${message.type}`);
-          }
-        });
 
-        worker.on('error', (err) => {
-          if (!this.inProgress.has(spec)) {
-            // The test is already finished. Ignore errors that occur after it.
-            // This can happen normally, for example in timers tests.
-            return;
-          }
-          // Generate a subtest failure for visibility.
-          // No need to record this synthetic failure with wpt.fyi.
-          this.fail(
-            spec,
-            {
-              status: NODE_UNCAUGHT,
-              name: `${err}`,
-              message: err.message,
-              stack: inspect(err),
-            },
-            kUncaught,
-          );
-          // Mark the whole test as failed in wpt.fyi report.
-          reportResult?.finish('ERROR');
-          this.inProgress.delete(spec);
-          this.report?.write();
+        const handle = this.runSpec(this.flags, {
+          testRelativePath: relativePath,
+          wptRunner: __filename,
+          wptPath: this.path,
+          initScript: this.fullInitScript(spec),
+          harness: {
+            code: fs.readFileSync(harnessPath, 'utf8'),
+            filename: harnessPath,
+          },
+          scriptsToRun,
+          // Set when the test runs inside an actual Web Worker.
+          webWorker: isWebWorkerTest ? {
+            path: absolutePath,
+            isAnyTest,
+            initScript: this.initScript,
+            title: meta.title,
+            variant: spec.variant,
+            scripts: meta.script?.map(
+              (script) => this.resource.toRealFilePath(relativePath, script),
+            ) ?? [],
+            skippedTests: spec.skippedTests,
+          } : undefined,
+          needsGc: !!meta.script?.find((script) => script === '/common/gc.js'),
+          skippedTests: spec.skippedTests,
+        }, {
+          message: (message) => {
+            switch (message.type) {
+              case 'result':
+                return this.resultCallback(spec, message.result, reportResult);
+              case 'skip':
+                return this.skipTest(spec, { name: message.name }, reportResult);
+              case 'completion':
+                return this.completionCallback(spec, message.status, reportResult);
+              default:
+                throw new Error(`Unexpected message from spec runner: ${message.type}`);
+            }
+          },
+          failure: (failure) => {
+            if (!this.inProgress.has(spec)) {
+              // The test is already finished. Ignore anything that happens
+              // after it, including the runner terminating it itself.
+              return false;
+            }
+            // Generate a subtest failure for visibility.
+            // No need to record this synthetic failure with wpt.fyi.
+            this.fail(spec, { status: NODE_UNCAUGHT, ...failure }, kUncaught);
+            // Mark the whole test as failed in wpt.fyi report.
+            reportResult?.finish('ERROR');
+            this.inProgress.delete(spec);
+            this.report?.write();
+            return true;
+          },
         });
+        this.handles.set(spec, handle);
 
-        await events.once(worker, 'exit').catch(() => {});
-      });
+        await handle.finished;
+      }));
     }
 
     process.on('exit', () => {
@@ -780,7 +1082,6 @@ class WPTRunner {
 
       const failures = [];
       let expectedFailures = 0;
-      let skipped = 0;
       for (const [key, item] of Object.entries(this.results)) {
         if (item.fail?.unexpected) {
           failures.push(key);
@@ -788,37 +1089,9 @@ class WPTRunner {
         if (item.fail?.expected) {
           expectedFailures++;
         }
-        if (item.skip) {
-          skipped++;
-        }
       }
 
-      const unexpectedPasses = [];
-      for (const specs of queue) {
-        const key = specs.filename;
-
-        // File has no expected failures
-        if (!specs.failedTests.length) {
-          continue;
-        }
-
-        // File was (maybe even conditionally) skipped
-        if (this.results[key]?.skip) {
-          continue;
-        }
-
-        // Full check: every expected to fail test is present
-        const _unexpectedPasses = specs.failedTests.filter((expectedToFail) => {
-          if (specs.flakyTests.includes(expectedToFail)) {
-            return false;
-          }
-          return this.results[key]?.fail?.expected?.includes(expectedToFail) !== true;
-        });
-        if (_unexpectedPasses.length) {
-          unexpectedPasses.push(..._unexpectedPasses.map((name) => `${key}:${name}`));
-          continue;
-        }
-      }
+      const unexpectedPasses = getUnexpectedPasses(queue, this.results);
 
       // Write the report on clean exit. The report is also written
       // incrementally after each spec completes (see completionCallback)
@@ -827,6 +1100,7 @@ class WPTRunner {
 
       const p = (n, word, suffix = 's') => `${n} ${word}${n === 1 ? '' : suffix}`;
       const ran = queue.length;
+      const skipped = this.skippedSpecCount;
       const total = ran + skipped;
       const passed = ran - expectedFailures - failures.length;
       const { subtestCounts } = this;
@@ -852,6 +1126,25 @@ class WPTRunner {
           `Consider updating ${file} for these files:\n${unexpectedPasses.join('\n')}`);
       }
     });
+
+    // Promises do not keep the event loop alive. Keep a referenced handle
+    // until every queued spec has run, including the gap between terminating
+    // one spec runner and receiving its exit event.
+    const keepAlive = setInterval(() => {}, 2 ** 31 - 1);
+    try {
+      const outcomes = await Promise.allSettled(jobs);
+      const errors = outcomes
+        .filter((outcome) => outcome.status === 'rejected')
+        .map((outcome) => outcome.reason);
+      if (errors.length === 1) {
+        throw errors[0];
+      }
+      if (errors.length > 1) {
+        throw new AggregateError(errors, 'Multiple WPT spec runners failed');
+      }
+    } finally {
+      clearInterval(keepAlive);
+    }
   }
 
   // Map WPT test status to strings
@@ -905,7 +1198,7 @@ class WPTRunner {
       // No need to record this synthetic failure with wpt.fyi.
       this.fail(spec, {
         status: status,
-        name: 'WPT test harness error',
+        name: getHarnessErrorName(harnessStatus),
         message: harnessStatus.message,
         stack: harnessStatus.stack,
       }, status);
@@ -918,14 +1211,15 @@ class WPTRunner {
     // Write report incrementally so results survive even if the process
     // is killed before the exit handler runs.
     this.report?.write();
-    // Always force termination of the worker. Some tests allocate resources
-    // that would otherwise keep it alive.
-    this.workers.get(spec).terminate();
+    // Always force termination of the spec runner. Some tests allocate
+    // resources that would otherwise keep it alive.
+    this.handles.get(spec).kill();
   }
 
   addTestResult(spec, item) {
-    let result = this.results[spec.filename];
-    result ||= this.results[spec.filename] = {};
+    const key = spec.getStatusKey();
+    let result = this.results[key];
+    result ||= this.results[key] = {};
     if (item.status === kSkip) {
       if (item.name) {
         // Subtest-level skip: { filename: { skipTests: [ ... ] } }
@@ -951,19 +1245,19 @@ class WPTRunner {
   }
 
   succeed(spec, test, status, reportResult) {
-    const unexpectedPass = spec.failedTests.includes(test.name);
+    const unexpectedPass = isUnexpectedPass(spec, test.name);
     if (unexpectedPass) {
-      console.log(`[UNEXPECTED_PASS][${status.toUpperCase()}] ${test.name}`);
+      console.log(`[UNEXPECTED_PASS][${status.toUpperCase()}] ${spec.getTestPath()}: ${test.name}`);
       this.subtestCounts.unexpectedPasses++;
     } else {
-      console.log(`[${status.toUpperCase()}] ${test.name}`);
+      console.log(`[${status.toUpperCase()}] ${spec.getTestPath()}: ${test.name}`);
       this.subtestCounts.passed++;
     }
     reportResult?.addSubtest(test.name, 'PASS');
   }
 
   skipTest(spec, test, reportResult) {
-    console.log(`[SKIP] ${test.name}`);
+    console.log(`[SKIP] ${spec.getTestPath()}: ${test.name}`);
     reportResult?.addSubtest(test.name, 'NOTRUN');
     this.subtestCounts.skipped++;
     this.addTestResult(spec, {
@@ -975,16 +1269,20 @@ class WPTRunner {
   fail(spec, test, status, reportResult) {
     const expected = spec.failedTests.includes(test.name);
     if (expected) {
-      console.log(`[EXPECTED_FAILURE][${status.toUpperCase()}] ${test.name}`);
+      console.log(`[EXPECTED_FAILURE][${status.toUpperCase()}] ${spec.getTestPath()}: ${test.name}`);
     } else {
-      console.log(`[UNEXPECTED_FAILURE][${status.toUpperCase()}] ${test.name}`);
+      console.log(`[UNEXPECTED_FAILURE][${status.toUpperCase()}] ${spec.getTestPath()}: ${test.name}`);
     }
     if (status === kFail || status === kUncaught) {
       console.log(test.message);
       console.log(test.stack);
     }
-    const command = `${process.execPath} ${process.execArgv}` +
-                    ` ${require.main?.filename} '${spec.filename}${spec.variant}'`;
+    const command = [
+      process.execPath,
+      ...process.execArgv,
+      require.main?.filename,
+      `'${spec.getTestPath()}'`,
+    ].join(' ');
     console.log(`Command: ${command}\n`);
 
     reportResult?.addSubtest(test.name, 'FAIL', test.message);
@@ -1004,7 +1302,8 @@ class WPTRunner {
 
   skip(spec, reasons) {
     const joinedReasons = reasons.join('; ');
-    console.log(`[SKIPPED] ${spec.filename}${spec.variant}: ${joinedReasons}`);
+    console.log(`[SKIPPED] ${spec.getTestPath()}: ${joinedReasons}`);
+    this.skippedSpecCount++;
     this.addTestResult(spec, {
       status: kSkip,
       reason: joinedReasons,
@@ -1013,14 +1312,14 @@ class WPTRunner {
 
   buildQueue() {
     const queue = [];
-    let argFilename;
-    let argVariant;
-    if (process.argv[2]) {
-      ([argFilename, argVariant = ''] = process.argv[2].split('?'));
+    this.skippedSpecCount = 0;
+    const arg = process.argv[2];
+    if (this.inspectBrk && !arg) {
+      throw new Error('WPT_INSPECT requires a WPT test path');
     }
     for (const spec of this.specs) {
-      if (argFilename) {
-        if (spec.filename === argFilename && (!argVariant || spec.variant.substring(1) === argVariant)) {
+      if (arg) {
+        if (spec.isSelectedBy(arg)) {
           queue.push(spec);
         }
         continue;
@@ -1041,11 +1340,25 @@ class WPTRunner {
     }
 
     // If the tests are run as `node test/wpt/test-something.js subset.any.js`,
-    // only `subset.any.js` (all variants) will be run by the runner.
+    // only `subset.any.js` (all variants and globals) will be run by the runner.
     // If the tests are run as `node test/wpt/test-something.js 'subset.any.js?1-10'`,
     // only the `?1-10` variant of `subset.any.js` will be run by the runner.
-    if (argFilename && queue.length === 0) {
-      throw new Error(`${process.argv[2]} not found!`);
+    // A test path as printed with the results, e.g.
+    // `'dir/subset.any.worker.html?1-10'`, runs exactly that one.
+    if (arg && queue.length === 0) {
+      throw new Error(`${arg} not found!`);
+    }
+    if (this.inspectBrk && queue.length !== 1) {
+      const matches = queue.map((spec) => spec.getTestPath()).join('\n');
+      throw new Error(
+        `WPT_INSPECT requires exactly one generated WPT test path; ` +
+        `${arg} matched ${queue.length}:\n${matches}`,
+      );
+    }
+    if (this.inspectBrk && queue[0].isWebWorkerTest()) {
+      throw new Error(
+        `WPT_INSPECT does not support worker tests: ${queue[0].getTestPath()}`,
+      );
     }
 
     return queue;
@@ -1053,7 +1366,12 @@ class WPTRunner {
 }
 
 module.exports = {
+  backends,
+  getHarnessErrorName,
+  getUnexpectedPasses,
   harness: harnessMock,
+  isUnexpectedPass,
   ResourceLoader,
+  WPTTestSpec,
   WPTRunner,
 };
diff --git a/test/common/wpt/webworker.js b/test/common/wpt/webworker.js
new file mode 100644
index 000000000000..1f94c82c02a3
--- /dev/null
+++ b/test/common/wpt/webworker.js
@@ -0,0 +1,133 @@
+'use strict';
+
+// Runs a WPT test file inside a Web Worker
+// Refs: https://web-platform-tests.org/writing-tests/testharness.html
+
+const { pathToFileURL } = require('url');
+const {
+  runInThisContext,
+  constants: { USE_MAIN_CONTEXT_DEFAULT_LOADER },
+} = require('vm');
+
+globalThis.onmessage = ({ data }) => {
+  // Let the test install its own handler.
+  globalThis.onmessage = null;
+
+  const { ResourceLoader } = require(data.wptRunner);
+  const resource = new ResourceLoader(data.wptPath);
+
+  globalThis.fetch = function fetch(file) {
+    return resource.readAsFetch(data.testRelativePath, file);
+  };
+
+  // Pretend the worker was served from the URL the WPT server would have
+  // used
+  const fakePath = (data.isAnyTest ?
+    data.testRelativePath.replace(/\.any\.js$/, '.any.worker.js') :
+    data.testRelativePath).replace(/\\/g, '/');
+  const fakeURL = new URL(`/${fakePath}${data.variant}`, 'http://wpt');
+  // eslint-disable-next-line no-undef
+  const fakeLocation = { __proto__: WorkerLocation.prototype };
+  for (const key of ['href', 'origin', 'protocol', 'host', 'hostname',
+                     'port', 'pathname', 'search', 'hash']) {
+    Object.defineProperty(fakeLocation, key, {
+      value: fakeURL[key],
+      enumerable: true,
+    });
+  }
+  Object.defineProperty(fakeLocation, 'toString', {
+    value: function toString() { return fakeURL.href; },
+    enumerable: true,
+  });
+  Object.defineProperty(globalThis, 'location', {
+    value: fakeLocation,
+    enumerable: true,
+    configurable: true,
+  });
+
+  const testharnessPath =
+    pathToFileURL(resource.toRealFilePath(data.testRelativePath,
+                                          '/resources/testharness.js')).href;
+
+  // If there are skip patterns, wrap the test functions to prevent
+  // execution of matching tests. This must happen after testharness.js is
+  // loaded but before the test scripts run.
+  function applySkips() {
+    if (!data.skippedTests?.length) {
+      return;
+    }
+    function isSkipped(name) {
+      for (const matcher of data.skippedTests) {
+        if (typeof matcher === 'string') {
+          if (name === matcher) return true;
+        } else if (matcher.test(name)) {
+          return true;
+        }
+      }
+      return false;
+    }
+    for (const fn of ['test', 'async_test', 'promise_test']) {
+      const original = globalThis[fn];
+      globalThis[fn] = function(func, name, ...rest) {
+        if (typeof name === 'string' && isSkipped(name)) {
+          // eslint-disable-next-line no-undef
+          postMessage({ type: 'skip', name });
+          return;
+        }
+        return original.call(this, func, name, ...rest);
+      };
+    }
+  }
+
+  // Tests fetch scripts and nested worker scripts from the WPT server; map
+  // those URLs into the fixtures directory.
+  const realImportScripts = globalThis.importScripts;
+  globalThis.importScripts = function importScripts(...urls) {
+    const mapped = urls.map(
+      (url) => resource.mapServerURL(data.testRelativePath, url));
+    const result = realImportScripts.apply(this, mapped);
+    if (mapped.includes(testharnessPath)) {
+      applySkips();
+    }
+    return result;
+  };
+  const RealWorker = globalThis.Worker;
+  globalThis.Worker = class Worker extends RealWorker {
+    constructor(url, options) {
+      super(resource.mapServerURL(data.testRelativePath, url), options);
+    }
+  };
+
+  if (data.isAnyTest) {
+    // Emulate the generated .any.worker.js wrapper script.
+    // Refs: https://github.com/web-platform-tests/wpt/blob/master/tools/serve/serve.py
+    globalThis.GLOBAL = {
+      isWindow() { return false; },
+      isWorker() { return true; },
+      isShadowRealm() { return false; },
+    };
+  }
+
+  if (data.initScript) {
+    runInThisContext(data.initScript, {
+      importModuleDynamically: USE_MAIN_CONTEXT_DEFAULT_LOADER,
+    });
+  }
+
+  if (data.title) {
+    globalThis.META_TITLE = data.title;
+  }
+
+  if (data.isAnyTest) {
+    globalThis.importScripts('/resources/testharness.js');
+    for (const script of data.scripts) {
+      globalThis.importScripts(pathToFileURL(script).href);
+    }
+    globalThis.importScripts(pathToFileURL(data.path).href);
+    // eslint-disable-next-line no-undef
+    done();
+  } else {
+    // *.worker.js tests import testharness.js and call done() themselves.
+    globalThis.importScripts(pathToFileURL(data.path).href);
+  }
+};
diff --git a/test/common/wpt/worker.js b/test/common/wpt/worker.js
index 74a35419cd1d..ca4f4706f89b 100644
--- a/test/common/wpt/worker.js
+++ b/test/common/wpt/worker.js
@@ -1,106 +1,185 @@
 'use strict';
 
+const path = require('path');
+const { pathToFileURL } = require('url');
 const {
   runInNewContext,
   runInThisContext,
   constants: { USE_MAIN_CONTEXT_DEFAULT_LOADER },
 } = require('vm');
 const { setFlagsFromString } = require('v8');
-const { parentPort, workerData } = require('worker_threads');
-
-const { ResourceLoader } = require(workerData.wptRunner);
-const resource = new ResourceLoader(workerData.wptPath);
+const { inspect } = require('util');
+const {
+  isMainThread,
+  parentPort,
+  workerData: threadData,
+} = require('worker_threads');
 
-if (workerData.needsGc) {
-  // See https://github.com/nodejs/node/issues/16595#issuecomment-340288680
-  setFlagsFromString('--expose-gc');
-  globalThis.gc = runInNewContext('gc');
-}
+// The runner starts this either on a worker thread, where the spec to run
+// arrives as workerData, or in a child process, where it arrives over IPC.
+const send = isMainThread ?
+  (message) => process.send(message) :
+  (message) => parentPort.postMessage(message);
 
-globalThis.self = global;
-globalThis.GLOBAL = {
-  isWindow() { return false; },
-  isShadowRealm() { return false; },
-};
-globalThis.require = require;
-
-// This is a mock for non-fetch tests that use fetch to resolve
-// a relative fixture file.
-// Actual Fetch API WPTs are executed in nodejs/undici.
-globalThis.fetch = function fetch(file) {
-  return resource.readAsFetch(workerData.testRelativePath, file);
-};
-
-if (workerData.initScript) {
-  runInThisContext(workerData.initScript, {
-    importModuleDynamically: USE_MAIN_CONTEXT_DEFAULT_LOADER,
+if (isMainThread) {
+  // A worker thread surfaces uncaught errors through its 'error' event; a
+  // process has to report them itself so that the runner names the failure
+  // exactly the same way.
+  process.on('uncaughtException', (err) => {
+    process.send({
+      type: 'uncaught',
+      error: { name: `${err}`, message: err.message, stack: inspect(err) },
+    }, () => process.exit(1));
   });
+  process.once('message', run);
+} else {
+  run(threadData);
 }
 
-runInThisContext(workerData.harness.code, {
-  filename: workerData.harness.filename,
-  importModuleDynamically: USE_MAIN_CONTEXT_DEFAULT_LOADER,
-});
-
-// If there are skip patterns, wrap test functions to prevent execution of
-// matching tests. This must happen after testharness.js is loaded but before
-// the test scripts run.
-if (workerData.skippedTests?.length) {
-  function isSkipped(name) {
-    for (const matcher of workerData.skippedTests) {
-      if (typeof matcher === 'string') {
-        if (name === matcher) return true;
-      } else if (matcher.test(name)) {
-        return true;
-      }
+function run(workerData) {
+  const { ResourceLoader } = require(workerData.wptRunner);
+  const resource = new ResourceLoader(workerData.wptPath);
+
+  // Tests create workers with URLs the WPT server would have served them
+  // from; map them into the fixtures directory.
+  const RealWorker = globalThis.Worker;
+  globalThis.Worker = class Worker extends RealWorker {
+    constructor(url, options) {
+      super(resource.mapServerURL(workerData.testRelativePath, url), options);
     }
-    return false;
+  };
+
+  if (workerData.needsGc) {
+    // See https://github.com/nodejs/node/issues/16595#issuecomment-340288680
+    setFlagsFromString('--expose-gc');
+    globalThis.gc = runInNewContext('gc');
   }
-  for (const fn of ['test', 'async_test', 'promise_test']) {
-    const original = globalThis[fn];
-    globalThis[fn] = function(func, name, ...rest) {
-      if (typeof name === 'string' && isSkipped(name)) {
-        parentPort.postMessage({ type: 'skip', name });
-        return;
+
+  globalThis.self = global;
+  globalThis.GLOBAL = {
+    isWindow() { return false; },
+    isShadowRealm() { return false; },
+  };
+  globalThis.require = require;
+
+  // This is a mock for non-fetch tests that use fetch to resolve
+  // a relative fixture file.
+  // Actual Fetch API WPTs are executed in nodejs/undici.
+  globalThis.fetch = function fetch(file) {
+    return resource.readAsFetch(workerData.testRelativePath, file);
+  };
+
+  if (workerData.initScript) {
+    runInThisContext(workerData.initScript, {
+      importModuleDynamically: USE_MAIN_CONTEXT_DEFAULT_LOADER,
+    });
+  }
+
+  runInThisContext(workerData.harness.code, {
+    filename: workerData.harness.filename,
+    importModuleDynamically: USE_MAIN_CONTEXT_DEFAULT_LOADER,
+  });
+
+  // If there are skip patterns, wrap test functions to prevent execution of
+  // matching tests. This must happen after testharness.js is loaded but before
+  // the test scripts run.
+  if (workerData.skippedTests?.length) {
+    const isSkipped = (name) => {
+      for (const matcher of workerData.skippedTests) {
+        if (typeof matcher === 'string') {
+          if (name === matcher) return true;
+        } else if (matcher.test(name)) {
+          return true;
+        }
       }
-      return original.call(this, func, name, ...rest);
+      return false;
     };
+    for (const fn of ['test', 'async_test', 'promise_test']) {
+      const original = globalThis[fn];
+      globalThis[fn] = function(func, name, ...rest) {
+        if (typeof name === 'string' && isSkipped(name)) {
+          send({ type: 'skip', name });
+          return;
+        }
+        return original.call(this, func, name, ...rest);
+      };
+    }
   }
-}
 
-// eslint-disable-next-line no-undef
-add_result_callback((result) => {
-  parentPort.postMessage({
-    type: 'result',
-    result: {
-      status: result.status,
-      name: result.name,
-      message: result.message,
-      stack: result.stack,
-    },
+  // eslint-disable-next-line no-undef
+  add_result_callback((result) => {
+    send({
+      type: 'result',
+      result: {
+        status: result.status,
+        name: result.name,
+        message: result.message,
+        stack: result.stack,
+      },
+    });
   });
-});
 
-// Keep the event loop alive
-const timeout = setTimeout(() => {
-  parentPort.postMessage({
-    type: 'completion',
-    status: { status: 2 },
-  });
-}, 2 ** 31 - 1); // Max timeout is 2^31-1, when overflown the timeout is set to 1.
-
-// eslint-disable-next-line no-undef
-add_completion_callback((_, status) => {
-  clearTimeout(timeout);
-  parentPort.postMessage({
-    type: 'completion',
-    status,
-  });
-});
+  // Keep the event loop alive
+  const timeout = setTimeout(() => {
+    send({
+      type: 'completion',
+      status: { status: 2 },
+    });
+  }, 2 ** 31 - 1); // Max timeout is 2^31-1, when overflown the timeout is set to 1.
 
-for (const scriptToRun of workerData.scriptsToRun) {
-  runInThisContext(scriptToRun.code, {
-    filename: scriptToRun.filename,
-    importModuleDynamically: USE_MAIN_CONTEXT_DEFAULT_LOADER,
+  // eslint-disable-next-line no-undef
+  add_completion_callback((_, status) => {
+    clearTimeout(timeout);
+    send({
+      type: 'completion',
+      status,
+    });
   });
+
+  for (const scriptToRun of workerData.scriptsToRun) {
+    runInThisContext(scriptToRun.code, {
+      filename: scriptToRun.filename,
+      importModuleDynamically: USE_MAIN_CONTEXT_DEFAULT_LOADER,
+    });
+  }
+
+  if (workerData.webWorker) {
+    const worker = new RealWorker(
+      pathToFileURL(path.join(__dirname, 'webworker.js')));
+    worker.postMessage({
+      wptRunner: workerData.wptRunner,
+      wptPath: workerData.wptPath,
+      testRelativePath: workerData.testRelativePath,
+      ...workerData.webWorker,
+    });
+
+    let completed = false;
+    worker.addEventListener('message', (event) => {
+      if (event.data?.type === 'complete') {
+        completed = true;
+      }
+      // Skipped subtests never register with the testharness inside the
+      // worker; the runner is notified about them directly.
+      if (event.data?.type === 'skip') {
+        send({ type: 'skip', name: event.data.name });
+      }
+    });
+    worker.addEventListener('error', (event) => {
+      if (completed) {
+        return;
+      }
+      clearTimeout(timeout);
+      send({
+        type: 'completion',
+        status: {
+          status: 1,
+          message: event.message,
+          stack: event.error?.stack,
+        },
+      });
+    });
+
+    // eslint-disable-next-line no-undef
+    fetch_tests_from_worker(worker);
+  }
 }
diff --git a/test/doctool/test-make-doc.mjs b/test/doctool/test-make-doc.mjs
index e7a6f1b85e75..59e681707dd4 100644
--- a/test/doctool/test-make-doc.mjs
+++ b/test/doctool/test-make-doc.mjs
@@ -46,7 +46,7 @@ const expectedJsons = linkedHtmls
                        .map((name) => name.replace('.html', '.json'));
 const expectedDocs = linkedHtmls.concat(expectedJsons);
 const renamedDocs = ['policy.json', 'policy.html'];
-const skipedDocs = ['quic.json', 'quic.html'];
+const skipedDocs = ['dtls.json', 'dtls.html', 'quic.json', 'quic.html'];
 
 // Test that all the relative links in the TOC match to the actual documents.
 for (const expectedDoc of expectedDocs) {
@@ -61,7 +61,8 @@ for (const actualDoc of actualDocs) {
   // Unless the old file is still available pointing to the correct location
   // 301 redirects are not yet automated. So keeping the old URL is a
   // reasonable workaround.
-  if (renamedDocs.includes(actualDoc) || actualDoc === 'apilinks.json') continue;
+  if (renamedDocs.includes(actualDoc) || skipedDocs.includes(actualDoc) ||
+      actualDoc === 'apilinks.json') continue;
   assert.ok(
     expectedDocs.includes(actualDoc), `${actualDoc} does not match TOC`);
 
diff --git a/test/embedding/embedtest.cc b/test/embedding/embedtest.cc
index 982eed74f954..b9b22c0efee7 100644
--- a/test/embedding/embedtest.cc
+++ b/test/embedding/embedtest.cc
@@ -19,6 +19,7 @@ using node::MultiIsolatePlatform;
 using v8::Context;
 using v8::HandleScope;
 using v8::Isolate;
+using v8::Local;
 using v8::Locker;
 using v8::MaybeLocal;
 using v8::V8;
@@ -27,25 +28,35 @@ using v8::Value;
 static int RunNodeInstance(MultiIsolatePlatform* platform,
                            const std::vector<std::string>& args,
                            const std::vector<std::string>& exec_args);
+static int RunSnapshotWithIsolateSettings(
+    MultiIsolatePlatform* platform,
+    const node::EmbedderSnapshotData* snapshot,
+    const std::vector<std::string>& args,
+    const std::vector<std::string>& exec_args);
 
 NODE_MAIN(int argc, node::argv_type raw_argv[]) {
   char** argv = nullptr;
   node::FixupMain(argc, raw_argv, &argv);
 
   std::vector<std::string> args(argv, argv + argc);
+  uint32_t flags =
+      node::ProcessInitializationFlags::kNoInitializeV8 |
+      node::ProcessInitializationFlags::kNoInitializeNodeV8Platform |
+      // This is used to test NODE_REPL_EXTERNAL_MODULE is disabled with
+      // kDisableNodeOptionsEnv. If other tests need NODE_OPTIONS
+      // support in the future, split this configuration out as a
+      // command line option.
+      node::ProcessInitializationFlags::kDisableNodeOptionsEnv |
+      node::ProcessInitializationFlags::kNoInitializeCppgc;
+  auto it =
+      std::find(args.begin(), args.end(), "--no-harvest-builtin-code-cache");
+  if (it != args.end()) {
+    args.erase(it);
+    flags |= node::ProcessInitializationFlags::kNoHarvestBuiltinCodeCache;
+  }
   std::shared_ptr<node::InitializationResult> result =
       node::InitializeOncePerProcess(
-          args,
-          {
-              node::ProcessInitializationFlags::kNoInitializeV8,
-              node::ProcessInitializationFlags::kNoInitializeNodeV8Platform,
-              // This is used to test NODE_REPL_EXTERNAL_MODULE is disabled with
-              // kDisableNodeOptionsEnv. If other tests need NODE_OPTIONS
-              // support in the future, split this configuration out as a
-              // command line option.
-              node::ProcessInitializationFlags::kDisableNodeOptionsEnv,
-              node::ProcessInitializationFlags::kNoInitializeCppgc,
-          });
+          args, static_cast<node::ProcessInitializationFlags::Flags>(flags));
 
   for (const std::string& error : result->errors())
     fprintf(stderr, "%s: %s\n", args[0].c_str(), error.c_str());
@@ -84,6 +95,7 @@ int RunNodeInstance(MultiIsolatePlatform* platform,
   // Running snapshot:
   // embedtest --embedder-snapshot-blob blob-path
   //           [--embedder-snapshot-as-file]
+  //           [--embedder-isolate-settings]
   //           arg1 arg2...
   // No snapshot:
   // embedtest arg1 arg2...
@@ -93,6 +105,7 @@ int RunNodeInstance(MultiIsolatePlatform* platform,
   std::vector<std::string> filtered_args;
   bool is_building_snapshot = false;
   bool snapshot_as_file = false;
+  bool with_isolate_settings = false;
   std::optional<node::SnapshotConfig> snapshot_config;
   std::string snapshot_blob_path;
   for (size_t i = 0; i < args.size(); ++i) {
@@ -101,6 +114,8 @@ int RunNodeInstance(MultiIsolatePlatform* platform,
       is_building_snapshot = true;
     } else if (arg == "--embedder-snapshot-as-file") {
       snapshot_as_file = true;
+    } else if (arg == "--embedder-isolate-settings") {
+      with_isolate_settings = true;
     } else if (arg == "--without-code-cache") {
       if (!snapshot_config.has_value()) {
         snapshot_config = node::SnapshotConfig{};
@@ -150,6 +165,11 @@ int RunNodeInstance(MultiIsolatePlatform* platform,
                          node::GetAnonymousMainPath());
   }
 
+  if (snapshot && with_isolate_settings) {
+    return RunSnapshotWithIsolateSettings(
+        platform, snapshot.get(), filtered_args, exec_args);
+  }
+
   std::vector<std::string> errors;
   std::unique_ptr<CommonEnvironmentSetup> setup;
 
@@ -233,3 +253,67 @@ int RunNodeInstance(MultiIsolatePlatform* platform,
 
   return exit_code;
 }
+
+// CommonEnvironmentSetup does not take IsolateSettings, so this goes through
+// NewIsolate()/CreateIsolateData()/CreateEnvironment() directly.
+static int RunSnapshotWithIsolateSettings(
+    MultiIsolatePlatform* platform,
+    const node::EmbedderSnapshotData* snapshot,
+    const std::vector<std::string>& args,
+    const std::vector<std::string>& exec_args) {
+  uv_loop_t loop;
+  int ret = uv_loop_init(&loop);
+  assert(ret == 0);
+
+  std::shared_ptr<node::ArrayBufferAllocator> allocator =
+      node::ArrayBufferAllocator::Create();
+  node::IsolateSettings settings;
+  settings.prepare_stack_trace_callback = [](Local<Context> context,
+                                             Local<Value> exception,
+                                             Local<v8::Array> trace) {
+    return MaybeLocal<Value>(v8::String::NewFromUtf8Literal(
+        v8::Isolate::GetCurrent(), "stack trace prepared by the embedder"));
+  };
+  Isolate* isolate =
+      node::NewIsolate(allocator, &loop, platform, snapshot, settings);
+  assert(isolate != nullptr);
+
+  int exit_code = 1;
+  {
+    Locker locker(isolate);
+    Isolate::Scope isolate_scope(isolate);
+    HandleScope handle_scope(isolate);
+
+    std::unique_ptr<node::IsolateData, decltype(&node::FreeIsolateData)>
+        isolate_data(node::CreateIsolateData(
+                         isolate, &loop, platform, allocator.get(), snapshot),
+                     node::FreeIsolateData);
+    std::unique_ptr<Environment, decltype(&node::FreeEnvironment)> env(
+        node::CreateEnvironment(
+            isolate_data.get(), Local<Context>(), args, exec_args),
+        node::FreeEnvironment);
+    assert(env);
+
+    Context::Scope context_scope(node::GetMainContext(env.get()));
+    if (!node::LoadEnvironment(env.get(), node::StartExecutionCallback{})
+             .IsEmpty()) {
+      exit_code = node::SpinEventLoop(env.get()).FromMaybe(1);
+    }
+    node::Stop(env.get());
+  }
+
+  bool platform_finished = false;
+  platform->AddIsolateFinishedCallback(
+      isolate,
+      [](void* data) {
+        bool* finished = static_cast<bool*>(data);
+        *finished = true;
+      },
+      &platform_finished);
+  platform->DisposeIsolate(isolate);
+  while (!platform_finished) uv_run(&loop, UV_RUN_ONCE);
+  ret = uv_loop_close(&loop);
+  assert(ret == 0);
+
+  return exit_code;
+}
diff --git a/test/embedding/test-embedding-builtin-code-cache-harvest.js b/test/embedding/test-embedding-builtin-code-cache-harvest.js
new file mode 100644
index 000000000000..19cdd499c6ea
--- /dev/null
+++ b/test/embedding/test-embedding-builtin-code-cache-harvest.js
@@ -0,0 +1,25 @@
+'use strict';
+// By default a builtin compiled without a code cache serializes one that worker
+// threads then start from; with kNoHarvestBuiltinCodeCache it does not.
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+tmpdir.refresh();
+const embedtest = common.resolveBuiltBinary('embedtest');
+const workerScript = 'new (require("worker_threads").Worker)("", { eval: true })';
+
+function workerCompileLog(args) {
+  let log;
+  spawnSyncAndAssert(
+    embedtest, ['--', ...args, workerScript],
+    { cwd: tmpdir.path, env: { ...process.env, NODE_DEBUG_NATIVE: 'CODE_CACHE' } },
+    { stderr(output) { log = output; return true; } });
+  const worker = log.slice(log.lastIndexOf('Compiling internal/bootstrap/realm'));
+  assert.notStrictEqual(worker, log);
+  return worker;
+}
+assert.match(workerCompileLog([]), /Code cache of internal\/bootstrap\/node \(\w+\) is accepted/);
+assert.match(workerCompileLog(['--no-harvest-builtin-code-cache']),
+             /Compiling internal\/bootstrap\/node without code cache/);
diff --git a/test/embedding/test-embedding-snapshot-isolate-settings.js b/test/embedding/test-embedding-snapshot-isolate-settings.js
new file mode 100644
index 000000000000..67444da1e4cf
--- /dev/null
+++ b/test/embedding/test-embedding-snapshot-isolate-settings.js
@@ -0,0 +1,38 @@
+'use strict';
+
+// IsolateSettings passed to NewIsolate() with a snapshot must survive
+// CreateEnvironment(); see RunSnapshotWithIsolateSettings() in embedtest.cc.
+
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+
+const {
+  spawnSyncAndAssert,
+  spawnSyncAndExitWithoutError,
+} = require('../common/child_process');
+
+const embedtest = common.resolveBuiltBinary('embedtest');
+const snapshotBlobArgs = [
+  '--embedder-snapshot-blob', tmpdir.resolve('embedder-snapshot.blob'),
+];
+const buildSnapshotScript = `
+  require('v8').startupSnapshot.setDeserializeMainFunction(() => {
+    console.log(new Error('from the snapshot main function').stack);
+  });
+`;
+
+tmpdir.refresh();
+
+spawnSyncAndExitWithoutError(
+  embedtest,
+  ['--', buildSnapshotScript, ...snapshotBlobArgs, '--embedder-snapshot-create'],
+  { cwd: tmpdir.path });
+
+spawnSyncAndAssert(
+  embedtest,
+  ['--', ...snapshotBlobArgs, '--embedder-isolate-settings'],
+  { cwd: tmpdir.path },
+  {
+    trim: true,
+    stdout: 'stack trace prepared by the embedder',
+  });
diff --git a/test/ffi/test-ffi-calls.js b/test/ffi/test-ffi-calls.js
index e966809de666..3314c566b1cf 100644
--- a/test/ffi/test-ffi-calls.js
+++ b/test/ffi/test-ffi-calls.js
@@ -1,4 +1,4 @@
-// Flags: --experimental-ffi --expose-gc --allow-natives-syntax
+// Flags: --expose-gc --allow-natives-syntax
 'use strict';
 const common = require('../common');
 common.skipIfFFIMissing();
@@ -313,7 +313,6 @@ test('ffi division helpers behave as expected', () => {
 
 function assertInvalidCallbackReturnAborts(returnExpression) {
   const { stderr, status, signal } = spawnSync(process.execPath, [
-    '--experimental-ffi',
     '-e',
     `'use strict';
 const ffi = require('node:ffi');
@@ -336,7 +335,6 @@ stderr: ${stderr}`);
 
 function assertInvalidCallbackBehaviorAborts(callbackBody, message) {
   const { stderr, status, signal } = spawnSync(process.execPath, [
-    '--experimental-ffi',
     '-e',
     `'use strict';
 const ffi = require('node:ffi');
@@ -366,7 +364,6 @@ const { functions } = ffi.dlopen(libraryPath, fixtureSymbols);
 functions.call_int_callback(workerData, 21);
 `;
   const { stderr, status, signal } = spawnSync(process.execPath, [
-    '--experimental-ffi',
     '-e',
     `'use strict';
 const { Worker } = require('node:worker_threads');
diff --git a/test/ffi/test-ffi-dynamic-library.js b/test/ffi/test-ffi-dynamic-library.js
index c7dab03f64e9..c7741a9eed55 100644
--- a/test/ffi/test-ffi-dynamic-library.js
+++ b/test/ffi/test-ffi-dynamic-library.js
@@ -1,4 +1,4 @@
-// Flags: --experimental-ffi --expose-gc --allow-natives-syntax
+// Flags: --expose-gc --allow-natives-syntax
 'use strict';
 const common = require('../common');
 common.skipIfFFIMissing();
@@ -124,6 +124,24 @@ test('DynamicLibrary exposes functions and symbols', () => {
   }
 });
 
+test('DynamicLibrary getters reject incompatible receivers', () => {
+  const lib = new ffi.DynamicLibrary(libraryPath);
+
+  try {
+    const invalidGets = [
+      () => Reflect.get(lib, 'path', {}),
+      () => Reflect.get(lib, 'symbols', {}),
+      () => Reflect.get(ffi.DynamicLibrary.prototype, 'functions', {}),
+    ];
+
+    for (const invalidGet of invalidGets) {
+      assert.throws(invalidGet, TypeError);
+    }
+  } finally {
+    lib.close();
+  }
+});
+
 test('DynamicLibrary evaluates function signatures once', () => {
   function makeChangingSignature() {
     const reads = { arguments: 0, return: 0 };
diff --git a/test/ffi/test-ffi-fast-buffer.js b/test/ffi/test-ffi-fast-buffer.js
index add25a27f4e4..0358b4f33c29 100644
--- a/test/ffi/test-ffi-fast-buffer.js
+++ b/test/ffi/test-ffi-fast-buffer.js
@@ -1,4 +1,4 @@
-// Flags: --experimental-ffi --expose-internals --allow-natives-syntax
+// Flags: --expose-internals --allow-natives-syntax
 'use strict';
 
 const common = require('../common');
diff --git a/test/ffi/test-ffi-fast-integer-validation.js b/test/ffi/test-ffi-fast-integer-validation.js
index 66b6866b4e47..e6bedfab967c 100644
--- a/test/ffi/test-ffi-fast-integer-validation.js
+++ b/test/ffi/test-ffi-fast-integer-validation.js
@@ -1,4 +1,4 @@
-// Flags: --experimental-ffi --allow-natives-syntax
+// Flags: --allow-natives-syntax
 'use strict';
 
 const common = require('../common');
diff --git a/test/ffi/test-ffi-memory.js b/test/ffi/test-ffi-memory.js
index 72d37efacd5a..6d47200db187 100644
--- a/test/ffi/test-ffi-memory.js
+++ b/test/ffi/test-ffi-memory.js
@@ -1,4 +1,3 @@
-// Flags: --experimental-ffi
 'use strict';
 
 const common = require('../common');
@@ -319,3 +318,23 @@ test('ffi validates memory access arguments', () => {
     }
   }));
 });
+
+test('ffi memory helpers reject missing required arguments', () => {
+  const widths = ['Int8', 'Uint8', 'Int16', 'Uint16', 'Int32', 'Uint32',
+                  'Int64', 'Uint64', 'Float32', 'Float64'];
+
+  // Calling a helper with no arguments must report the missing pointer the
+  // same way an explicitly passed `undefined` does, instead of returning
+  // `undefined` as if the read or the write had succeeded.
+  for (const width of widths) {
+    for (const name of [`get${width}`, `set${width}`]) {
+      assert.throws(() => ffi[name](), { code: 'ERR_INVALID_ARG_VALUE' });
+      assert.throws(() => ffi[name](undefined), { code: 'ERR_INVALID_ARG_VALUE' });
+    }
+  }
+
+  assert.throws(() => ffi.toBuffer(1n), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => ffi.toBuffer(1n, undefined), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => ffi.toArrayBuffer(1n), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => ffi.toArrayBuffer(1n, undefined), { code: 'ERR_INVALID_ARG_VALUE' });
+});
diff --git a/test/ffi/test-ffi-module.js b/test/ffi/test-ffi-module.js
index 7fe265972a74..97b7072c7622 100644
--- a/test/ffi/test-ffi-module.js
+++ b/test/ffi/test-ffi-module.js
@@ -1,4 +1,3 @@
-// Flags: --experimental-ffi
 'use strict';
 const common = require('../common');
 const { spawnSyncAndAssert } = require('../common/child_process');
@@ -33,22 +32,24 @@ test('ffi builtin is unavailable when disabled', () => {
   assert.strictEqual(signal, null);
 });
 
-test('ffi builtin is listed', () => {
-  for (const [flag, stdout] of Object.entries({
-    '--experimental-ffi': 'true\n',
-    '--no-experimental-ffi': 'false\n',
-  })) {
+test('ffi builtin is listed by default', () => {
+  for (const flags of [[], ['--experimental-ffi']]) {
     spawnSyncAndAssert(process.execPath, [
-      flag,
+      ...flags,
       '-p',
       'require("node:module").builtinModules.includes("node:ffi")',
-    ], { stdout });
+    ], { stdout: 'true\n' });
   }
+
+  spawnSyncAndAssert(process.execPath, [
+    '--no-experimental-ffi',
+    '-p',
+    'require("node:module").builtinModules.includes("node:ffi")',
+  ], { stdout: 'false\n' });
 });
 
 test('ffi can be imported from ESM', () => {
   const { stdout, stderr, status, signal } = spawnSync(process.execPath, [
-    '--experimental-ffi',
     '--input-type=module',
     '-e',
     'import * as ffi from "node:ffi"; console.log(typeof ffi.dlopen);',
@@ -64,7 +65,6 @@ test('ffi can be imported from ESM', () => {
 
 test('DynamicLibrary requires new', () => {
   const { stdout, stderr, status, signal } = spawnSync(process.execPath, [
-    '--experimental-ffi',
     '-e',
     'const ffi = require("node:ffi"); ffi.DynamicLibrary("missing");',
   ], {
diff --git a/test/ffi/test-ffi-permission-allow-cli.js b/test/ffi/test-ffi-permission-allow-cli.js
index f84ff69223a9..5a65f61091d7 100644
--- a/test/ffi/test-ffi-permission-allow-cli.js
+++ b/test/ffi/test-ffi-permission-allow-cli.js
@@ -1,4 +1,4 @@
-// Flags: --permission --allow-ffi --allow-child-process --experimental-ffi --allow-fs-read=* --allow-fs-write=*
+// Flags: --permission --allow-ffi --allow-child-process --allow-fs-read=* --allow-fs-write=*
 'use strict';
 
 const { skipIfFFIMissing } = require('../common');
@@ -19,7 +19,6 @@ test('allow-ffi enables ffi APIs and permission flag discovery', () => {
   const { stdout, status, signal } = spawnSync(process.execPath, [
     '--permission',
     '--expose-internals',
-    '--experimental-ffi',
     '-p',
     'JSON.stringify(require("internal/process/permission").availableFlags())',
   ], {
diff --git a/test/ffi/test-ffi-permission-audit.js b/test/ffi/test-ffi-permission-audit.js
index 5e0d227c5eae..e4c79c8381b7 100644
--- a/test/ffi/test-ffi-permission-audit.js
+++ b/test/ffi/test-ffi-permission-audit.js
@@ -10,7 +10,6 @@ skipIfFFIMissing();
 test('permission audit does not deny ffi access', () => {
   const { stdout, stderr, status, signal } = spawnSync(process.execPath, [
     '--permission-audit',
-    '--experimental-ffi',
     '-e',
     'const ffi = require("node:ffi"); ' +
       'console.log(JSON.stringify({ ' +
diff --git a/test/ffi/test-ffi-permissions.js b/test/ffi/test-ffi-permissions.js
index 970f5f019ee7..e441d88efac2 100644
--- a/test/ffi/test-ffi-permissions.js
+++ b/test/ffi/test-ffi-permissions.js
@@ -1,4 +1,4 @@
-// Flags: --permission --experimental-ffi --allow-fs-read=*
+// Flags: --permission --allow-fs-read=*
 'use strict';
 const common = require('../common');
 const assert = require('node:assert');
diff --git a/test/ffi/test-ffi-readonly-write.js b/test/ffi/test-ffi-readonly-write.js
index 33aa2245752c..426af583361a 100644
--- a/test/ffi/test-ffi-readonly-write.js
+++ b/test/ffi/test-ffi-readonly-write.js
@@ -1,4 +1,3 @@
-// Flags: --experimental-ffi
 'use strict';
 const { skipIfFFIMissing, isWindows, skip } = require('../common');
 const assert = require('node:assert');
@@ -15,7 +14,6 @@ test('writing to readonly memory via buffer fails', () => {
   const symbols = JSON.stringify(fixtureSymbols);
   const libPath = JSON.stringify(libraryPath);
   const { stdout, status } = spawnSync(process.execPath, [
-    '--experimental-ffi',
     '-p',
     `
     const ffi = require('node:ffi');
diff --git a/test/ffi/test-ffi-shared-buffer.js b/test/ffi/test-ffi-shared-buffer.js
index 2e982e37ab2d..a56df8daeabd 100644
--- a/test/ffi/test-ffi-shared-buffer.js
+++ b/test/ffi/test-ffi-shared-buffer.js
@@ -1,4 +1,4 @@
-// Flags: --experimental-ffi --expose-internals
+// Flags: --expose-internals
 'use strict';
 const common = require('../common');
 common.skipIfFFIMissing();
diff --git a/test/ffi/test-ffi-void-parameter.js b/test/ffi/test-ffi-void-parameter.js
index d79631ed542f..c25105f33716 100644
--- a/test/ffi/test-ffi-void-parameter.js
+++ b/test/ffi/test-ffi-void-parameter.js
@@ -1,4 +1,3 @@
-// Flags: --experimental-ffi
 'use strict';
 
 const common = require('../common');
diff --git a/test/ffi/test-ffi-weakref-calls.js b/test/ffi/test-ffi-weakref-calls.js
index b158ee810776..432b39797f44 100644
--- a/test/ffi/test-ffi-weakref-calls.js
+++ b/test/ffi/test-ffi-weakref-calls.js
@@ -1,4 +1,4 @@
-// Flags: --experimental-ffi --expose-gc
+// Flags: --expose-gc
 'use strict';
 const { skipIfFFIMissing } = require('../common');
 skipIfFFIMissing();
diff --git a/test/fixtures/aead-vectors.js b/test/fixtures/aead-vectors.js
index e511c6babf38..4784b8165ffa 100644
--- a/test/fixtures/aead-vectors.js
+++ b/test/fixtures/aead-vectors.js
@@ -52,6 +52,38 @@ module.exports = [
     ct: '0eaccb',
     tag: '93da9bb81333aee0c785b240d319719d', tampered: false },
 
+  // RFC 8998, Appendix A.1
+  { algo: 'sm4-gcm',
+    key: '0123456789abcdeffedcba9876543210',
+    iv: '00001234567800000000abcd',
+    plain: 'aaaaaaaaaaaaaaaabbbbbbbbbbbbbbbb' +
+           'ccccccccccccccccdddddddddddddddd' +
+           'eeeeeeeeeeeeeeeeffffffffffffffff' +
+           'eeeeeeeeeeeeeeeeaaaaaaaaaaaaaaaa',
+    plainIsHex: true,
+    aad: 'feedfacedeadbeeffeedfacedeadbeefabaddad2',
+    ct: '17f399f08c67d5ee19d0dc9969c4bb7d' +
+        '5fd46fd3756489069157b282bb200735' +
+        'd82710ca5c22f0ccfa7cbf93d496ac15' +
+        'a56834cbcf98c397b4024a2691233b8d',
+    tag: '83de3541e4c2b58177e065a9bf7b62ec', tampered: false },
+
+  // RFC 8998, Appendix A.2
+  { algo: 'sm4-ccm',
+    key: '0123456789abcdeffedcba9876543210',
+    iv: '00001234567800000000abcd',
+    plain: 'aaaaaaaaaaaaaaaabbbbbbbbbbbbbbbb' +
+           'ccccccccccccccccdddddddddddddddd' +
+           'eeeeeeeeeeeeeeeeffffffffffffffff' +
+           'eeeeeeeeeeeeeeeeaaaaaaaaaaaaaaaa',
+    plainIsHex: true,
+    aad: 'feedfacedeadbeeffeedfacedeadbeefabaddad2',
+    ct: '48af93501fa62adbcd414cce6034d895' +
+        'dda1bf8f132f042098661572e7483094' +
+        'fd12e518ce062c98acee28d95df4416b' +
+        'ed31a2f04476c18bb40c84a74b97dc5b',
+    tag: '16842d4fa186f56ab33256971fa110f4', tampered: false },
+
   { algo: 'aes-128-gcm',
     key: '6970787039613669314d623455536234',
     iv: '583673497131313748307652', plain: 'Hello World!',
diff --git a/test/fixtures/bench-runner/a.cjs b/test/fixtures/bench-runner/a.cjs
new file mode 100644
index 000000000000..3edaf85ad856
--- /dev/null
+++ b/test/fixtures/bench-runner/a.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('alpha', {
+  params: { file: 'a', pid: process.pid },
+  samples: 1,
+}, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/abrupt-exit.cjs b/test/fixtures/bench-runner/abrupt-exit.cjs
new file mode 100644
index 000000000000..3489f424b8da
--- /dev/null
+++ b/test/fixtures/bench-runner/abrupt-exit.cjs
@@ -0,0 +1,16 @@
+'use strict';
+
+const mode = process.env.NODE_BENCH_EXIT_MODE;
+
+if (mode === 'code') process.exit(2);
+if (mode === 'signal') process.kill(process.pid, 'SIGTERM');
+
+const { bench } = require('node:bench');
+
+if (mode === 'late') {
+  process.on('beforeExit', () => { process.exitCode = 2; });
+}
+
+bench('abrupt exit', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/acknowledged-records.mjs b/test/fixtures/bench-runner/acknowledged-records.mjs
new file mode 100644
index 000000000000..633f3412eaaf
--- /dev/null
+++ b/test/fixtures/bench-runner/acknowledged-records.mjs
@@ -0,0 +1,41 @@
+import common from '../../common/index.js';
+
+const pending = new Map();
+const onMessage = (message) => {
+  if (message?.type !== 'node:bench:ack') return;
+  pending.get(message.id)?.();
+  pending.delete(message.id);
+};
+process.on('message', onMessage);
+
+const timeout = setTimeout(() => {
+  throw new Error('benchmark record was not acknowledged');
+}, common.platformTimeout(10_000));
+
+function sendDiagnostic(id) {
+  return new Promise((resolve, reject) => {
+    pending.set(id, resolve);
+    process.send({
+      id,
+      type: 'node:bench:record',
+      record: {
+        type: 'bench:diagnostic',
+        data: {
+          runId: process.env.NODE_BENCH_RUN_ID,
+          fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+          entryFile: process.argv[1],
+          message: `acknowledged ${id}`,
+          level: 'info',
+          file: process.argv[1],
+        },
+      },
+    }, (error) => {
+      if (error) reject(error);
+    });
+  });
+}
+
+for (let i = 0; i < 32; i++) await sendDiagnostic(10_000 + i);
+
+clearTimeout(timeout);
+process.off('message', onMessage);
diff --git a/test/fixtures/bench-runner/b.mjs b/test/fixtures/bench-runner/b.mjs
new file mode 100644
index 000000000000..ca35178ecf79
--- /dev/null
+++ b/test/fixtures/bench-runner/b.mjs
@@ -0,0 +1,8 @@
+import { bench } from 'node:bench';
+
+bench('beta', {
+  params: { file: 'b', pid: process.pid },
+  samples: 1,
+}, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/destroying-reporter.cjs b/test/fixtures/bench-runner/destroying-reporter.cjs
new file mode 100644
index 000000000000..8a2a2406f932
--- /dev/null
+++ b/test/fixtures/bench-runner/destroying-reporter.cjs
@@ -0,0 +1,8 @@
+'use strict';
+
+module.exports = async function* destroyingReporter(source) {
+  source.once('bench:plan', () => {
+    source.destroy(new Error('benchmark reporter closed the stream'));
+  });
+  yield* source;
+};
diff --git a/test/fixtures/bench-runner/diagnostic.cjs b/test/fixtures/bench-runner/diagnostic.cjs
new file mode 100644
index 000000000000..9e413e943dd7
--- /dev/null
+++ b/test/fixtures/bench-runner/diagnostic.cjs
@@ -0,0 +1,17 @@
+'use strict';
+
+const { bench } = require('node:bench');
+const { channel } = require('diagnostics_channel');
+
+const channelName = 'node:bench:test:diagnostic';
+const diagnosticChannel = channel(channelName);
+
+bench('diagnostic relay', {
+  diagnosticChannels: [channelName],
+  samples: 1,
+}, (b) => {
+  const message = { value: 42n };
+  diagnosticChannel.publish(message);
+  message.value = 0n;
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/error.cjs b/test/fixtures/bench-runner/error.cjs
new file mode 100644
index 000000000000..cf1db903e2b7
--- /dev/null
+++ b/test/fixtures/bench-runner/error.cjs
@@ -0,0 +1,14 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('failure', {
+  params: { kind: 'structured-error' },
+  samples: 1,
+}, () => {
+  const error = new Error('benchmark fixture failed', {
+    cause: { value: 42n },
+  });
+  error.code = 'ERR_BENCHMARK_FIXTURE';
+  throw error;
+});
diff --git a/test/fixtures/bench-runner/exit-code.cjs b/test/fixtures/bench-runner/exit-code.cjs
new file mode 100644
index 000000000000..67f065fea7eb
--- /dev/null
+++ b/test/fixtures/bench-runner/exit-code.cjs
@@ -0,0 +1,8 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('sets exit code', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+  process.exitCode = 2;
+});
diff --git a/test/fixtures/bench-runner/failing-reporter.cjs b/test/fixtures/bench-runner/failing-reporter.cjs
new file mode 100644
index 000000000000..da1299fd17d5
--- /dev/null
+++ b/test/fixtures/bench-runner/failing-reporter.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { Transform } = require('stream');
+
+module.exports = new Transform({
+  writableObjectMode: true,
+  transform(_record, _encoding, callback) {
+    callback(new Error('benchmark reporter failed'));
+  },
+});
diff --git a/test/fixtures/bench-runner/fake-ipc.cjs b/test/fixtures/bench-runner/fake-ipc.cjs
new file mode 100644
index 000000000000..7b2afa8dda93
--- /dev/null
+++ b/test/fixtures/bench-runner/fake-ipc.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+process.send = () => {};
diff --git a/test/fixtures/bench-runner/identity-child-a.cjs b/test/fixtures/bench-runner/identity-child-a.cjs
new file mode 100644
index 000000000000..ae7824d0ab7d
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-child-a.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+module.exports = function declareChildA() {
+  bench('child a', { samples: 1 }, (b) => {
+    completeSample(b);
+  });
+};
diff --git a/test/fixtures/bench-runner/identity-child-b.cjs b/test/fixtures/bench-runner/identity-child-b.cjs
new file mode 100644
index 000000000000..2841a98055e0
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-child-b.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+module.exports = function declareChildB() {
+  bench('child b', { samples: 1 }, (b) => {
+    completeSample(b);
+  });
+};
diff --git a/test/fixtures/bench-runner/identity-entry-a.cjs b/test/fixtures/bench-runner/identity-entry-a.cjs
new file mode 100644
index 000000000000..2892ea3f3eca
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-entry-a.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { suite } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+const registerSharedIdentity = require('./identity-shared.cjs');
+
+suite('shared suite', async () => {
+  await setImmediate();
+  registerSharedIdentity();
+});
diff --git a/test/fixtures/bench-runner/identity-entry-b.cjs b/test/fixtures/bench-runner/identity-entry-b.cjs
new file mode 100644
index 000000000000..2892ea3f3eca
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-entry-b.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { suite } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+const registerSharedIdentity = require('./identity-shared.cjs');
+
+suite('shared suite', async () => {
+  await setImmediate();
+  registerSharedIdentity();
+});
diff --git a/test/fixtures/bench-runner/identity-hook.cjs b/test/fixtures/bench-runner/identity-hook.cjs
new file mode 100644
index 000000000000..14c4cacd9cdc
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-hook.cjs
@@ -0,0 +1,9 @@
+'use strict';
+
+const { before, bench } = require('node:bench');
+
+before(() => {
+  throw new Error('scoped hook failed');
+});
+
+bench('scoped hook benchmark', { samples: 1 }, () => {});
diff --git a/test/fixtures/bench-runner/identity-preload.cjs b/test/fixtures/bench-runner/identity-preload.cjs
new file mode 100644
index 000000000000..bcc9df72c410
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-preload.cjs
@@ -0,0 +1,8 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+bench('preload identity', { samples: 1 }, (b) => {
+  completeSample(b);
+});
diff --git a/test/fixtures/bench-runner/identity-shared.cjs b/test/fixtures/bench-runner/identity-shared.cjs
new file mode 100644
index 000000000000..c47bcc954745
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-shared.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+module.exports = function registerSharedIdentity() {
+  bench('shared identity', { samples: 1 }, (b) => {
+    completeSample(b);
+  });
+};
diff --git a/test/fixtures/bench-runner/identity-suite.cjs b/test/fixtures/bench-runner/identity-suite.cjs
new file mode 100644
index 000000000000..53c5982ce1a9
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-suite.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { suite } = require('node:bench');
+const declareChildA = require('./identity-child-a.cjs');
+const declareChildB = require('./identity-child-b.cjs');
+
+suite('cross-module suite', () => {
+  declareChildA();
+  declareChildB();
+});
diff --git a/test/fixtures/bench-runner/import.mjs b/test/fixtures/bench-runner/import.mjs
new file mode 100644
index 000000000000..e027d905eec0
--- /dev/null
+++ b/test/fixtures/bench-runner/import.mjs
@@ -0,0 +1 @@
+globalThis.benchImport = 'loaded';
diff --git a/test/fixtures/bench-runner/imported.cjs b/test/fixtures/bench-runner/imported.cjs
new file mode 100644
index 000000000000..9a5fb24bb33d
--- /dev/null
+++ b/test/fixtures/bench-runner/imported.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('imported', {
+  samples: 1,
+  params: { imported: globalThis.benchImport },
+}, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/inspector.cjs b/test/fixtures/bench-runner/inspector.cjs
new file mode 100644
index 000000000000..d357b54f864e
--- /dev/null
+++ b/test/fixtures/bench-runner/inspector.cjs
@@ -0,0 +1,13 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+const inspectPort = process.execArgv.filter(
+  (arg) => arg.startsWith('--inspect-port=')).at(-1);
+
+bench('inspector option', {
+  params: { inspectPort },
+  samples: 1,
+}, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/ipc.cjs b/test/fixtures/bench-runner/ipc.cjs
new file mode 100644
index 000000000000..e6b9ceb49823
--- /dev/null
+++ b/test/fixtures/bench-runner/ipc.cjs
@@ -0,0 +1,9 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+process.send?.({ type: 'user-message' });
+
+bench('user IPC', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/load-error-after-declaration.cjs b/test/fixtures/bench-runner/load-error-after-declaration.cjs
new file mode 100644
index 000000000000..6f2cf085742c
--- /dev/null
+++ b/test/fixtures/bench-runner/load-error-after-declaration.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+bench('declared before load error', { samples: 1 }, (b) => {
+  completeSample(b);
+});
+
+throw new Error('load failed after declaration');
diff --git a/test/fixtures/bench-runner/malformed-plan-order.mjs b/test/fixtures/bench-runner/malformed-plan-order.mjs
new file mode 100644
index 000000000000..80c8cdf4cd8f
--- /dev/null
+++ b/test/fixtures/bench-runner/malformed-plan-order.mjs
@@ -0,0 +1,34 @@
+import { bench } from 'node:bench';
+import common from '../../common/index.js';
+
+await new Promise((resolve, reject) => {
+  const timeout = setTimeout(() => {
+    reject(new Error('benchmark summary was not acknowledged'));
+  }, common.platformTimeout(10_000));
+  process.on('message', (message) => {
+    if (message?.type === 'node:bench:ack' && message.id === 0) {
+      clearTimeout(timeout);
+      resolve();
+    }
+  });
+  process.send?.({
+    id: 0,
+    type: 'node:bench:record',
+    record: {
+      type: 'bench:summary',
+      data: {
+        counts: { completed: 0, failed: 0, skipped: 0, total: 0 },
+        duration_ns: 1n,
+        entryFile: import.meta.filename,
+        fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+        file: import.meta.filename,
+        runId: process.env.NODE_BENCH_RUN_ID,
+        success: true,
+      },
+    },
+  });
+});
+
+bench('late plan', { samples: 1 }, () => {
+  throw new Error('late plan benchmark ran');
+});
diff --git a/test/fixtures/bench-runner/malformed-record.cjs b/test/fixtures/bench-runner/malformed-record.cjs
new file mode 100644
index 000000000000..3550694532f5
--- /dev/null
+++ b/test/fixtures/bench-runner/malformed-record.cjs
@@ -0,0 +1,81 @@
+'use strict';
+
+const common = require('../../common');
+
+const kind = process.env.NODE_BENCH_MALFORMED_RECORD;
+const id = kind === 'sequence' ? null : 0;
+const benchmarkData = {
+  __proto__: null,
+  benchId: 'invalid plan',
+  column: 1,
+  entryFile: __filename,
+  file: __filename,
+  fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+  line: 1,
+  name: 'invalid plan',
+  namePath: ['invalid plan'],
+  params: {},
+  parentId: null,
+  runId: process.env.NODE_BENCH_RUN_ID,
+  tags: [],
+};
+const plan = {
+  type: 'bench:plan',
+  data: {
+    __proto__: null,
+    ...benchmarkData,
+    samples: 1,
+    selected: true,
+    timeout: null,
+    warmup: 0,
+    yieldBetweenSamples: true,
+  },
+};
+const record = kind === 'summary' ? {
+  type: 'bench:summary',
+  data: {
+    counts: { completed: 0, failed: 0, skipped: 0, total: -1 },
+    duration_ns: 1n,
+    entryFile: __filename,
+    fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+    runId: process.env.NODE_BENCH_RUN_ID,
+    success: true,
+  },
+} : kind === 'name-path' ? {
+  ...plan,
+  data: {
+    ...plan.data,
+    namePath: [1],
+  },
+} : kind === 'plan' ? {
+  ...plan,
+  data: {
+    ...plan.data,
+    samples: 0,
+  },
+} : kind === 'timeout' ? {
+  ...plan,
+  data: {
+    ...plan.data,
+    timeout: -1,
+  },
+} : kind === 'identity' ? {
+  type: 'bench:complete',
+  data: {
+    entryFile: __filename,
+    fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+    runId: process.env.NODE_BENCH_RUN_ID,
+  },
+} : kind === 'diagnostic' || kind === 'diagnostic-order' ? {
+  type: 'bench:diagnostic',
+  data: {
+    ...benchmarkData,
+    index: 0,
+    level: kind === 'diagnostic' ? 'error' : 'warning',
+    message: 'invalid diagnostic',
+    phase: 'measurement',
+  },
+} : null;
+
+process.send?.({ id, type: 'node:bench:record', record });
+setTimeout(() => process.exit(2), common.platformTimeout(10_000));
diff --git a/test/fixtures/bench-runner/many-records.cjs b/test/fixtures/bench-runner/many-records.cjs
new file mode 100644
index 000000000000..aacb17821035
--- /dev/null
+++ b/test/fixtures/bench-runner/many-records.cjs
@@ -0,0 +1,8 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('many records', { samples: 30 }, (b) => {
+  process.stdout.write(`${b.index}\n`);
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/node.config.json b/test/fixtures/bench-runner/node.config.json
new file mode 100644
index 000000000000..0344e2a4b7f4
--- /dev/null
+++ b/test/fixtures/bench-runner/node.config.json
@@ -0,0 +1,7 @@
+{
+  "bench": {
+    "bench-isolation": "none",
+    "bench-reporter": ["json"],
+    "bench-samples": 1
+  }
+}
diff --git a/test/fixtures/bench-runner/options.cjs b/test/fixtures/bench-runner/options.cjs
new file mode 100644
index 000000000000..e9a1bcde9af3
--- /dev/null
+++ b/test/fixtures/bench-runner/options.cjs
@@ -0,0 +1,17 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+let invocations = 0;
+bench('selected', {
+  params: { boolean: true, number: 42, string: 'value' },
+  samples: 8,
+  warmup: 8,
+}, (b) => {
+  invocations++;
+  b.record({ duration_ns: 1n, operations: invocations });
+});
+
+bench('filtered out', { samples: 1 }, () => {
+  throw new Error('filtered benchmark ran');
+});
diff --git a/test/fixtures/bench-runner/output.cjs b/test/fixtures/bench-runner/output.cjs
new file mode 100644
index 000000000000..3500f2a23383
--- /dev/null
+++ b/test/fixtures/bench-runner/output.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+process.stdout.write('benchmark stdout\n');
+process.stderr.write('benchmark stderr\n');
+
+bench('output', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/preload.cjs b/test/fixtures/bench-runner/preload.cjs
new file mode 100644
index 000000000000..1b03dcbf65cf
--- /dev/null
+++ b/test/fixtures/bench-runner/preload.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+globalThis.benchRunnerPreloaded = true;
diff --git a/test/fixtures/bench-runner/preloaded.cjs b/test/fixtures/bench-runner/preloaded.cjs
new file mode 100644
index 000000000000..b141b49e9695
--- /dev/null
+++ b/test/fixtures/bench-runner/preloaded.cjs
@@ -0,0 +1,14 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+if (globalThis.benchRunnerPreloaded !== true) {
+  throw new Error('benchmark preload did not run');
+}
+
+bench('preloaded', {
+  params: { preloaded: true },
+  samples: 1,
+}, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/recorded-detail.cjs b/test/fixtures/bench-runner/recorded-detail.cjs
new file mode 100644
index 000000000000..1643783225d0
--- /dev/null
+++ b/test/fixtures/bench-runner/recorded-detail.cjs
@@ -0,0 +1,17 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('recorded detail', { samples: 3 }, (b) => {
+  b.record({
+    __proto__: null,
+    detail: {
+      index: b.index,
+      phase: b.phase,
+      value: 42n,
+    },
+    duration_ns: 4n,
+    operations: 2,
+  });
+  b.done();
+});
diff --git a/test/fixtures/bench-runner/run-file-blocked.cjs b/test/fixtures/bench-runner/run-file-blocked.cjs
new file mode 100644
index 000000000000..9298d0dccc4b
--- /dev/null
+++ b/test/fixtures/bench-runner/run-file-blocked.cjs
@@ -0,0 +1,7 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('blocked run file', { samples: 1 }, async () => {
+  await new Promise(() => {});
+});
diff --git a/test/fixtures/bench-runner/run-file-lingering.cjs b/test/fixtures/bench-runner/run-file-lingering.cjs
new file mode 100644
index 000000000000..954bc108d01d
--- /dev/null
+++ b/test/fixtures/bench-runner/run-file-lingering.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+setInterval(() => {}, 1_000);
+if (process.platform !== 'win32') process.on('SIGTERM', () => {});
+process.on('disconnect', () => process.stdout.write('child disconnected\n'));
+
+bench('lingering run file', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/run-file-partial.cjs b/test/fixtures/bench-runner/run-file-partial.cjs
new file mode 100644
index 000000000000..9e3019e94e62
--- /dev/null
+++ b/test/fixtures/bench-runner/run-file-partial.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('completed before abort', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
+
+bench('aborted run file', { samples: 1 }, async () => {
+  await new Promise(() => {});
+});
diff --git a/test/fixtures/bench-runner/run-file.cjs b/test/fixtures/bench-runner/run-file.cjs
new file mode 100644
index 000000000000..436665074b6b
--- /dev/null
+++ b/test/fixtures/bench-runner/run-file.cjs
@@ -0,0 +1,22 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('run file', {
+  samples: 1,
+  params: {
+    context: process.env.NODE_BENCH_CONTEXT,
+    exposed: typeof globalThis.gc === 'function',
+    omitted: process.env.NODE_BENCH_OMITTED === undefined,
+    value: process.env.NODE_BENCH_RUN_FILE ?? 'unset',
+  },
+}, (b) => {
+  b.record({
+    duration_ns: 1n,
+    operations: 1,
+    detail: {
+      execArgv: process.execArgv,
+      pid: process.pid,
+    },
+  });
+});
diff --git a/test/fixtures/bench-runner/run.cjs b/test/fixtures/bench-runner/run.cjs
new file mode 100644
index 000000000000..4064dc1c9797
--- /dev/null
+++ b/test/fixtures/bench-runner/run.cjs
@@ -0,0 +1,9 @@
+'use strict';
+
+const { bench, run } = require('node:bench');
+
+bench('declared before run', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
+
+run();
diff --git a/test/fixtures/bench-runner/send-error.cjs b/test/fixtures/bench-runner/send-error.cjs
new file mode 100644
index 000000000000..9e1df941dfeb
--- /dev/null
+++ b/test/fixtures/bench-runner/send-error.cjs
@@ -0,0 +1,15 @@
+'use strict';
+
+if (process.env.NODE_BENCH_SEND_ERROR === 'callback') {
+  process.send = (_message, _handle, _options, callback) => {
+    callback(new Error('benchmark send callback failed'));
+  };
+} else {
+  process.send = () => { throw new Error('benchmark send threw'); };
+}
+
+const { bench } = require('node:bench');
+
+bench('send error', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/serial-a.cjs b/test/fixtures/bench-runner/serial-a.cjs
new file mode 100644
index 000000000000..02ea8d8d972a
--- /dev/null
+++ b/test/fixtures/bench-runner/serial-a.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+require('./serial')('serial a');
diff --git a/test/fixtures/bench-runner/serial-b.cjs b/test/fixtures/bench-runner/serial-b.cjs
new file mode 100644
index 000000000000..58f87d933473
--- /dev/null
+++ b/test/fixtures/bench-runner/serial-b.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+require('./serial')('serial b');
diff --git a/test/fixtures/bench-runner/serial.js b/test/fixtures/bench-runner/serial.js
new file mode 100644
index 000000000000..4e6f44c3b679
--- /dev/null
+++ b/test/fixtures/bench-runner/serial.js
@@ -0,0 +1,17 @@
+'use strict';
+
+const fs = require('fs');
+const { setTimeout } = require('timers/promises');
+const { bench } = require('node:bench');
+
+module.exports = function register(name) {
+  const lock = process.env.NODE_BENCH_LOCK;
+  fs.writeFileSync(lock, `${process.pid}`, { flag: 'wx' });
+  process.on('exit', () => fs.unlinkSync(lock));
+
+  bench(name, { samples: 1 }, async (b) => {
+    b.start();
+    await setTimeout(25);
+    b.end(1);
+  });
+};
diff --git a/test/fixtures/bench-runner/slow-reporter.cjs b/test/fixtures/bench-runner/slow-reporter.cjs
new file mode 100644
index 000000000000..7832bd94cd49
--- /dev/null
+++ b/test/fixtures/bench-runner/slow-reporter.cjs
@@ -0,0 +1,36 @@
+'use strict';
+
+const { setTimeout } = require('timers/promises');
+
+module.exports = async function* slowReporter(source) {
+  const { promise, resolve } = Promise.withResolvers();
+  let emitted = 0;
+  const onRecord = () => {
+    if (++emitted === source.readableHighWaterMark) resolve();
+  };
+  for (const type of [
+    'bench:plan',
+    'bench:start',
+    'bench:sample',
+    'bench:complete',
+    'bench:diagnostic',
+    'bench:summary',
+  ]) {
+    source.on(type, onRecord);
+  }
+  await promise;
+
+  let samples = 0;
+  let stdout = '';
+  for await (const record of source) {
+    await setTimeout(2);
+    if (record.type === 'bench:sample') samples++;
+    if (record.type === 'bench:diagnostic' &&
+        record.data.stream === 'stdout') {
+      stdout += record.data.message;
+    }
+    if (record.type === 'bench:summary') {
+      yield `${JSON.stringify({ samples, stdout })}\n`;
+    }
+  }
+};
diff --git a/test/fixtures/bench-runner/throws-null.cjs b/test/fixtures/bench-runner/throws-null.cjs
new file mode 100644
index 000000000000..562e969ac350
--- /dev/null
+++ b/test/fixtures/bench-runner/throws-null.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+throw null;
diff --git a/test/fixtures/bench-runner/tools-collision.cjs b/test/fixtures/bench-runner/tools-collision.cjs
new file mode 100644
index 000000000000..40ab0a4d4a50
--- /dev/null
+++ b/test/fixtures/bench-runner/tools-collision.cjs
@@ -0,0 +1,12 @@
+'use strict';
+
+const { bench, suite } = require('node:bench');
+
+function register(name) {
+  bench(name, { params: { size: 1 } }, (b) => {
+    b.record({ duration_ns: 1n, operations: 1 });
+  });
+}
+
+suite('first', () => register('same'));
+suite('second', () => register('same'));
diff --git a/test/fixtures/bench-runner/tools-no-params.cjs b/test/fixtures/bench-runner/tools-no-params.cjs
new file mode 100644
index 000000000000..182a7886286e
--- /dev/null
+++ b/test/fixtures/bench-runner/tools-no-params.cjs
@@ -0,0 +1,7 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('tools/no-params.js', (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/tools-reserved-param.cjs b/test/fixtures/bench-runner/tools-reserved-param.cjs
new file mode 100644
index 000000000000..8084d6c33f81
--- /dev/null
+++ b/test/fixtures/bench-runner/tools-reserved-param.cjs
@@ -0,0 +1,7 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('tools/reserved.js', { params: { rate: 'parameter' } }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/tools.cjs b/test/fixtures/bench-runner/tools.cjs
new file mode 100644
index 000000000000..073a090d8829
--- /dev/null
+++ b/test/fixtures/bench-runner/tools.cjs
@@ -0,0 +1,15 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+if (process.env.NODE_BENCH_PID_LOG !== undefined) {
+  require('fs').appendFileSync(
+    process.env.NODE_BENCH_PID_LOG, `${process.pid}\n`);
+}
+
+for (const size of [1, 2]) {
+  bench('tools/simple.js', {
+    params: { method: 'loop', size },
+  }, (b) => completeSample(b, 1_000));
+}
diff --git a/test/fixtures/bench-runner/utf8-output.cjs b/test/fixtures/bench-runner/utf8-output.cjs
new file mode 100644
index 000000000000..7dab41cd7c22
--- /dev/null
+++ b/test/fixtures/bench-runner/utf8-output.cjs
@@ -0,0 +1,14 @@
+'use strict';
+
+const { setTimeout } = require('timers/promises');
+const { bench } = require('node:bench');
+
+const output = Buffer.from('split:\u20ac\n');
+process.stdout.write(output.subarray(0, 7));
+
+bench('UTF-8 output', { samples: 1 }, async (b) => {
+  b.start();
+  await setTimeout(20);
+  process.stdout.write(output.subarray(7));
+  b.end(1);
+});
diff --git a/test/fixtures/bench-runner/v8-option.cjs b/test/fixtures/bench-runner/v8-option.cjs
new file mode 100644
index 000000000000..833024161c50
--- /dev/null
+++ b/test/fixtures/bench-runner/v8-option.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const assert = require('assert');
+const { bench } = require('node:bench');
+
+assert.strictEqual(Error.stackTraceLimit, 17);
+assert(process.execArgv.includes('--random-seed=17'));
+
+bench('V8 option', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/verifying-reporter.cjs b/test/fixtures/bench-runner/verifying-reporter.cjs
new file mode 100644
index 000000000000..2dd467e12597
--- /dev/null
+++ b/test/fixtures/bench-runner/verifying-reporter.cjs
@@ -0,0 +1,21 @@
+'use strict';
+
+const assert = require('assert');
+
+module.exports = async function* verify(source) {
+  for await (const { type, data } of source) {
+    if (type === 'bench:sample') {
+      assert.strictEqual(typeof data.duration_ns, 'bigint');
+      assert.strictEqual(typeof data.rate, 'number');
+    }
+    if (type === 'bench:complete' && data.error !== undefined) {
+      assert(data.error instanceof Error);
+      assert.strictEqual(data.error.code, 'ERR_BENCHMARK_FIXTURE');
+      assert.deepStrictEqual(data.error.cause, { value: 42n });
+    }
+    if (type === 'bench:complete' && data.summary !== undefined) {
+      assert(Number.isFinite(data.summary.medianConfidenceInterval.lower));
+    }
+    if (type === 'bench:summary') yield 'verified\n';
+  }
+};
diff --git a/test/fixtures/keys/Makefile b/test/fixtures/keys/Makefile
index 3ef61d00afff..0960e69f36fd 100644
--- a/test/fixtures/keys/Makefile
+++ b/test/fixtures/keys/Makefile
@@ -70,6 +70,7 @@ all: \
   rsa_spkac.spkac \
   rsa_spkac_invalid.spkac \
   rsa_private_2048.pem \
+  rsa_private_2048_3_primes.pem \
   rsa_private_4096.pem \
   rsa_public_2048.pem \
   rsa_public_4096.pem \
@@ -927,6 +928,13 @@ rsa_spkac_invalid.spkac: rsa_spkac.spkac
 rsa_private_2048.pem:
 	openssl genrsa -out rsa_private_2048.pem 2048
 
+rsa_private_2048_3_primes.pem:
+	openssl genpkey \
+		-algorithm RSA \
+		-pkeyopt rsa_keygen_bits:2048 \
+		-pkeyopt rsa_keygen_primes:3 \
+		-out rsa_private_2048_3_primes.pem
+
 rsa_private_4096.pem:
 	openssl genrsa -out rsa_private_4096.pem 4096
 
diff --git a/test/fixtures/keys/rsa_private_2048_3_primes.pem b/test/fixtures/keys/rsa_private_2048_3_primes.pem
new file mode 100644
index 000000000000..49535f2cd7f7
--- /dev/null
+++ b/test/fixtures/keys/rsa_private_2048_3_primes.pem
@@ -0,0 +1,29 @@
+-----BEGIN PRIVATE KEY-----
+MIIE8wIBADANBgkqhkiG9w0BAQEFAASCBN0wggTZAgEBAoIBAQC1Lu9a9Hlj8/OA
+J3I2h/1aFYV59SxWb1KzbuRb2nAoOVWCqG8ettkT7kGN6qva3C/oCw2pYPIlRxpX
+0Vve0fNRqpSCCXcnN9vlKpU0BrHfpIHuXSleT7vwSq70UV5YwjFhL+g5wcCUVCuz
+Fkd8dYb0keqVApSKkcydepk5/BwBwQdkfibs3RuIjROkgIbDKSXrm1lFinqyCBTG
+umLcaL9XMhaJRxsVIVqkCM6hs+kEXhIBvlFIqcycECKEV3l71nV0VM3RwlbORIjx
+iHpSvNEUixGR0Rwx4WdJNU4GiUJGZACKj+RrLX+mh0odOl5r8Up9TkTgWp4UEdUx
+GHbQ6lIrAgMBAAECggEAA8mZY1Nc/kPpQTKR5qXtG+b7RVNku+HT3sBgsbLdSVn5
+eaO/vuqfmxUN9cOEGC0mKzmf7XyDU1grKs7LltrYtUpVlGpSPVWjmSTMvauuKDiu
+Jqd35+irM+pQerj/AYOs9Lv2lLzzA1ivcSmB0uR2gNyiVvVxBAxydNXiBwCn+v8M
++qosREPVN9eEQ+1j+ZWvZ2j/AkT6EDdOl0qbhkLDkaLgDkO4uhAZfNKjwmuVkBoW
+BI9bUiQv9vzsSp7AIVXwd8D+NaX0VuDpbcIq/tIfrl2OxwUDuTkYYsvwlIwvAkZ4
+yMl57x2YjRJu2u4f4t+fuagqCisbbbE+LywM5r+YEQJWB/Z/lOoAXXCRSBSGhI29
+zI+pXWiK4UneitEKTJpdR7i38Var03aciK+q64z4gWDNSBRzYq5eyVWosv0f9WkO
+lQFRfOy0HM68dg2KYDCIVnquCwwgaDcCVgZ7lxyKqwirCDYL9VFxRNiBIOXuMLdl
+6c4YNpdPTrp/AILBeINJYKBYjpro6fPe0YHcxJpMNf5Izaow17VVAqJKDmXbca7y
+SclsgBR6mAnFf6WfFM5rAlYBe2nHp74lphwEVH2tEkyvVFXrotemkv8uyzWliF2w
+SbtC2iTlGQCNmFSxvu1J92B9+AB574aI5r6dget+2+zw4uvt2oizi+8b8e09dgsK
+PY9DUyB9BQJWBTsT4uPAvW3DYlijyOMsOcV3Vg+rH1AMJ09CPTSwwapYLykMpGJA
+pSDPcA8fNrdDNRV9TULRDiyQRhLC+n1tcqVumKFISXEWOIBjmCKTKs9A/9IsZ6EC
+VgQG607Arq/ztxJFVKHY4RW0v8Ofx9Q0h+GDcKqqxDlymZfrDsdKJjC1QTofRUR+
+JJiwshahF2jBtlsPwEjX8/InboaF2f2VlIxzxe2+GpzWeRgzIN9yMIIBDDCCAQgC
+VgOChKyWwWrVMfjdfwtFnMA/OjwK4KBtR8VWwAapaiJPFhZRM0jh8EMsC03X7xm9
+AbL3hfE3eLU2mRLxw1pPh0RfK2xtKTCZWjgnQDhPznMUUvF+FYxHAlYCZbRvGa1U
+Zffy7n7m2Q4+tTD2b8uLZ/jcjess4awvcOs6JQ4tWr07dCroaXPTlahCcBRZdLUK
+uRcGvIDc/3L5vTMwpMK8ghIARrbzf3cYXSpl7eOT4wJWAuPXcrk1PE1YuMidPa2v
+3OshgH2no6BeVW2vChBDnK9IBstWII/AhjQzDHjbj9S8xjLZA6bqHH89uXc+0Z/2
+hF8lLDsruEceLVckmk7wb1eFAvns/XA=
+-----END PRIVATE KEY-----
diff --git a/test/fixtures/openssl3-conf/default_properties.cnf b/test/fixtures/openssl3-conf/default_properties.cnf
new file mode 100644
index 000000000000..bb26de636b2c
--- /dev/null
+++ b/test/fixtures/openssl3-conf/default_properties.cnf
@@ -0,0 +1,19 @@
+nodejs_conf = nodejs_init
+
+[nodejs_init]
+providers = provider_sect
+alg_section = algorithm_sect
+
+# Load both providers but select only implementations from the default provider.
+[provider_sect]
+default = default_sect
+legacy = legacy_sect
+
+[default_sect]
+activate = 1
+
+[legacy_sect]
+activate = 1
+
+[algorithm_sect]
+default_properties = provider=default
diff --git a/test/fixtures/permission/has-reference-types.js b/test/fixtures/permission/has-reference-types.js
new file mode 100644
index 000000000000..c16a99e69adb
--- /dev/null
+++ b/test/fixtures/permission/has-reference-types.js
@@ -0,0 +1,41 @@
+'use strict';
+
+const assert = require('assert');
+const { pathToFileURL } = require('url');
+
+const allowedDir = process.env.ALLOWED_DIR;
+const allowedFile = process.env.ALLOWED_FILE;
+const deniedFile = process.env.DENIED_FILE;
+
+// file: URL
+{
+  assert.strictEqual(process.permission.has('fs.read', pathToFileURL(allowedFile)), true);
+  assert.strictEqual(process.permission.has('fs.read', pathToFileURL(deniedFile)), false);
+  assert.throws(() => {
+    process.permission.has('fs.read', new URL('https://example.com'));
+  }, { code: 'ERR_INVALID_URL_SCHEME' });
+}
+
+// Non-fs scopes like net ignore the reference, so a non-file: URL must not be rejected here.
+{
+  assert.strictEqual(process.permission.has('net', new URL('https://example.com')), false);
+}
+
+// Uint8Array
+{
+  const allowedBytes = new Uint8Array(Buffer.from(allowedFile));
+  const deniedBytes = new Uint8Array(Buffer.from(deniedFile));
+  assert.strictEqual(process.permission.has('fs.read', allowedBytes), true);
+  assert.strictEqual(process.permission.has('fs.read', deniedBytes), false);
+
+  // Must respect byteOffset/byteLength, not read from the start of the buffer.
+  const padded = Buffer.concat([Buffer.from('padding-'), Buffer.from(allowedFile)]);
+  const view = new Uint8Array(padded.buffer, padded.byteOffset + 8, Buffer.byteLength(allowedFile));
+  assert.strictEqual(process.permission.has('fs.read', view), true);
+}
+
+// drop() only matches the exact granted path (the directory), not a file inside it.
+{
+  process.permission.drop('fs.read', pathToFileURL(allowedDir));
+  assert.strictEqual(process.permission.has('fs.read', pathToFileURL(allowedFile)), false);
+}
diff --git a/test/fixtures/sea/vfs-esm/calculator.cjs b/test/fixtures/sea/vfs-esm/calculator.cjs
new file mode 100644
index 000000000000..3499fb2cad12
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/calculator.cjs
@@ -0,0 +1,5 @@
+'use strict';
+// CommonJS module imported from the ESM main to test interop inside the VFS.
+module.exports = {
+  sum: (a, b) => a + b,
+};
diff --git a/test/fixtures/sea/vfs-esm/config.json b/test/fixtures/sea/vfs-esm/config.json
new file mode 100644
index 000000000000..8dd57a1d1fdf
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/config.json
@@ -0,0 +1 @@
+{"name":"test-app","version":"1.0.0"}
diff --git a/test/fixtures/sea/vfs-esm/greeting.txt b/test/fixtures/sea/vfs-esm/greeting.txt
new file mode 100644
index 000000000000..cbfbb578572c
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/greeting.txt
@@ -0,0 +1 @@
+Hello from SEA VFS!
\ No newline at end of file
diff --git a/test/fixtures/sea/vfs-esm/main.mjs b/test/fixtures/sea/vfs-esm/main.mjs
new file mode 100644
index 000000000000..24ae629a5bce
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/main.mjs
@@ -0,0 +1,63 @@
+// The ESM SEA main script runs from inside the VFS mount: import.meta
+// reflects the mount, and static imports, dynamic imports, and bare
+// specifier lookups all resolve against the bundled assets.
+import fs from 'node:fs';
+import path from 'node:path';
+import assert from 'node:assert';
+import { createRequire } from 'node:module';
+
+// Static import of a relative ESM module from the VFS.
+import { add, multiply } from './modules/math.mjs';
+
+// Static import of a CommonJS module from the VFS (interop).
+import calculator from './modules/calculator.cjs';
+
+// Static import of a bare specifier resolved via the in-VFS node_modules.
+import { name as pkgName, greet } from 'test-esm-pkg';
+
+// The main script runs from inside the VFS, not from the executable.
+assert.ok(import.meta.url.startsWith('file:'));
+assert.strictEqual(path.basename(import.meta.filename), 'main.mjs');
+assert.notStrictEqual(import.meta.filename, process.execPath);
+console.log('main module runs from', import.meta.url);
+
+// import.meta.dirname is the root of the mounted assets.
+const config = JSON.parse(
+  fs.readFileSync(path.join(import.meta.dirname, 'config.json'), 'utf8'));
+assert.strictEqual(config.name, 'test-app');
+const greeting = fs.readFileSync(
+  path.join(import.meta.dirname, 'data', 'greeting.txt'), 'utf8');
+assert.strictEqual(greeting, 'Hello from SEA VFS!');
+console.log('fs access through import.meta.dirname passed');
+
+// Static ESM import from the VFS.
+assert.strictEqual(add(2, 3), 5);
+assert.strictEqual(multiply(4, 5), 20);
+console.log('static relative import passed');
+
+// CommonJS interop from the VFS.
+assert.strictEqual(calculator.sum(10, 20), 30);
+console.log('static import of CommonJS module passed');
+
+// Bare specifier resolution confined to the in-VFS node_modules.
+assert.strictEqual(pkgName, 'test-esm-pkg');
+assert.strictEqual(greet('World'), 'Hello, World!');
+console.log('bare specifier import passed');
+
+// Dynamic import from the VFS.
+const dynamicMath = await import('./modules/math.mjs');
+assert.strictEqual(dynamicMath.add(1, 1), 2);
+console.log('dynamic import passed');
+
+// createRequire against the VFS main URL.
+const require = createRequire(import.meta.url);
+const requiredCalculator = require('./modules/calculator.cjs');
+assert.strictEqual(requiredCalculator.sum(3, 4), 7);
+console.log('createRequire from import.meta.url passed');
+
+// node:sea and the VFS serve the same content.
+const { getAsset } = await import('node:sea');
+assert.strictEqual(getAsset('data/greeting.txt', 'utf8'), greeting);
+console.log('node:sea API and VFS coexistence passed');
+
+console.log('All SEA VFS ESM tests passed!');
diff --git a/test/fixtures/sea/vfs-esm/math.mjs b/test/fixtures/sea/vfs-esm/math.mjs
new file mode 100644
index 000000000000..acc4868a6f6e
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/math.mjs
@@ -0,0 +1,6 @@
+export function add(a, b) {
+  return a + b;
+}
+export function multiply(a, b) {
+  return a * b;
+}
diff --git a/test/fixtures/sea/vfs-esm/sea-config.json b/test/fixtures/sea/vfs-esm/sea-config.json
new file mode 100644
index 000000000000..c17694a412fa
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/sea-config.json
@@ -0,0 +1,14 @@
+{
+  "main": "main.mjs",
+  "mainFormat": "module",
+  "output": "sea-prep.blob",
+  "useVfs": true,
+  "assets": {
+    "config.json": "config.json",
+    "data/greeting.txt": "greeting.txt",
+    "modules/math.mjs": "math.mjs",
+    "modules/calculator.cjs": "calculator.cjs",
+    "node_modules/test-esm-pkg/package.json": "test-esm-pkg-package.json",
+    "node_modules/test-esm-pkg/index.mjs": "test-esm-pkg-index.mjs"
+  }
+}
diff --git a/test/fixtures/sea/vfs-esm/test-esm-pkg-index.mjs b/test/fixtures/sea/vfs-esm/test-esm-pkg-index.mjs
new file mode 100644
index 000000000000..1cc3c9c7fa55
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/test-esm-pkg-index.mjs
@@ -0,0 +1,4 @@
+export const name = 'test-esm-pkg';
+export function greet(who) {
+  return `Hello, ${who}!`;
+}
diff --git a/test/fixtures/sea/vfs-esm/test-esm-pkg-package.json b/test/fixtures/sea/vfs-esm/test-esm-pkg-package.json
new file mode 100644
index 000000000000..ee0ab8500ba1
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/test-esm-pkg-package.json
@@ -0,0 +1,6 @@
+{
+  "name": "test-esm-pkg",
+  "version": "1.0.0",
+  "type": "module",
+  "exports": { ".": "./index.mjs" }
+}
diff --git a/test/fixtures/sea/vfs/calculator.js b/test/fixtures/sea/vfs/calculator.js
new file mode 100644
index 000000000000..dc8e496a85ee
--- /dev/null
+++ b/test/fixtures/sea/vfs/calculator.js
@@ -0,0 +1,9 @@
+'use strict';
+// This module tests transitive requires - it requires math.js using a
+// relative path, which tests that module hooks resolve correctly.
+const math = require('./math.js');
+
+module.exports = {
+  sum: (a, b) => math.add(a, b),
+  product: (a, b) => math.multiply(a, b),
+};
diff --git a/test/fixtures/sea/vfs/config.json b/test/fixtures/sea/vfs/config.json
new file mode 100644
index 000000000000..8dd57a1d1fdf
--- /dev/null
+++ b/test/fixtures/sea/vfs/config.json
@@ -0,0 +1 @@
+{"name":"test-app","version":"1.0.0"}
diff --git a/test/fixtures/sea/vfs/greeting.txt b/test/fixtures/sea/vfs/greeting.txt
new file mode 100644
index 000000000000..cbfbb578572c
--- /dev/null
+++ b/test/fixtures/sea/vfs/greeting.txt
@@ -0,0 +1 @@
+Hello from SEA VFS!
\ No newline at end of file
diff --git a/test/fixtures/sea/vfs/math.js b/test/fixtures/sea/vfs/math.js
new file mode 100644
index 000000000000..26be73d850ac
--- /dev/null
+++ b/test/fixtures/sea/vfs/math.js
@@ -0,0 +1,4 @@
+module.exports = {
+  add: (a, b) => a + b,
+  multiply: (a, b) => a * b,
+};
diff --git a/test/fixtures/sea/vfs/sea-config.json b/test/fixtures/sea/vfs/sea-config.json
new file mode 100644
index 000000000000..767e778ea26e
--- /dev/null
+++ b/test/fixtures/sea/vfs/sea-config.json
@@ -0,0 +1,15 @@
+{
+  "main": "sea.js",
+  "output": "sea-prep.blob",
+  "useVfs": true,
+  "assets": {
+    "config.json": "config.json",
+    "data/greeting.txt": "greeting.txt",
+    "modules/math.js": "math.js",
+    "modules/calculator.js": "calculator.js",
+    "node_modules/test-pkg/package.json": "test-pkg-package.json",
+    "node_modules/test-pkg/index.js": "test-pkg-index.js",
+    "node_modules/test-exports-pkg/package.json": "test-exports-pkg-package.json",
+    "node_modules/test-exports-pkg/lib/entry.js": "test-exports-pkg-entry.js"
+  }
+}
diff --git a/test/fixtures/sea/vfs/sea.js b/test/fixtures/sea/vfs/sea.js
new file mode 100644
index 000000000000..59989390c7d1
--- /dev/null
+++ b/test/fixtures/sea/vfs/sea.js
@@ -0,0 +1,106 @@
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const assert = require('assert');
+
+// The SEA VFS never shadows the real file system: the assets are mounted at
+// a reserved mount point and the main script runs from inside the mount, so
+// everything is reachable through __dirname-relative paths and relative
+// requires.
+
+// The main script runs from inside the VFS, not from the executable.
+assert.notStrictEqual(__filename, process.execPath);
+assert.strictEqual(path.basename(__filename), 'sea.js');
+assert.strictEqual(require.main, module);
+console.log('main script runs from', __filename);
+
+// The main script itself is readable through fs.
+assert.strictEqual(fs.existsSync(__filename), true);
+
+// Read the config file through standard fs (via VFS hooks)
+const configContent = fs.readFileSync(path.join(__dirname, 'config.json'), 'utf8');
+const config = JSON.parse(configContent);
+assert.strictEqual(config.name, 'test-app', 'config.name should match');
+assert.strictEqual(config.version, '1.0.0', 'config.version should match');
+console.log('Read config.json:', config);
+
+// Read a text file
+const greetingPath = path.join(__dirname, 'data', 'greeting.txt');
+const greeting = fs.readFileSync(greetingPath, 'utf8');
+assert.strictEqual(greeting, 'Hello from SEA VFS!', 'greeting should match');
+console.log('Read greeting.txt:', greeting);
+
+// Test existsSync
+assert.strictEqual(fs.existsSync(path.join(__dirname, 'config.json')), true);
+assert.strictEqual(fs.existsSync(greetingPath), true);
+assert.strictEqual(fs.existsSync(path.join(__dirname, 'nonexistent.txt')), false);
+console.log('existsSync tests passed');
+
+// Test statSync
+const configStat = fs.statSync(path.join(__dirname, 'config.json'));
+assert.strictEqual(configStat.isFile(), true);
+assert.strictEqual(configStat.isDirectory(), false);
+const dirStat = fs.statSync(path.join(__dirname, 'data'));
+assert.strictEqual(dirStat.isDirectory(), true);
+console.log('statSync tests passed');
+
+// Test readdirSync - the mount root lists the assets and the main script
+const entries = fs.readdirSync(__dirname);
+assert.ok(entries.includes('config.json'), 'Should include config.json');
+assert.ok(entries.includes('data'), 'Should include data directory');
+assert.ok(entries.includes('sea.js'), 'Should include the main script');
+console.log('readdirSync tests passed, entries:', entries);
+
+// The VFS is read-only
+assert.throws(() => {
+  fs.writeFileSync(path.join(__dirname, 'new-file.txt'), 'nope');
+}, { code: 'EROFS' });
+console.log('read-only test passed');
+
+// Test relative require from main script - __filename is inside the mount so
+// relative paths resolve against the bundled assets via module hooks
+const mathModule = require('./modules/math.js');
+assert.strictEqual(mathModule.add(2, 3), 5, 'math.add should work');
+assert.strictEqual(mathModule.multiply(4, 5), 20, 'math.multiply should work');
+console.log('relative require from main script passed');
+
+// Test transitive requires: calculator.js requires ./math.js internally
+const calculator = require('./modules/calculator.js');
+assert.strictEqual(calculator.sum(10, 20), 30, 'calculator.sum should work');
+assert.strictEqual(calculator.product(3, 7), 21, 'calculator.product should work');
+console.log('transitive require from VFS tests passed');
+
+// Module lookup paths are confined to the mount
+assert.deepStrictEqual(module.paths, [path.join(__dirname, 'node_modules')]);
+console.log('module.paths confinement test passed');
+
+// Test that node:sea API and VFS can load the same asset
+const sea = require('node:sea');
+const seaAsset = sea.getAsset('data/greeting.txt', 'utf8');
+const vfsAsset = fs.readFileSync(greetingPath, 'utf8');
+assert.strictEqual(seaAsset, vfsAsset, 'node:sea and VFS should return the same content');
+console.log('node:sea API and VFS coexistence test passed');
+
+// Test buffer independence: multiple reads return independent copies
+const buf1 = fs.readFileSync(greetingPath);
+const buf2 = fs.readFileSync(greetingPath);
+const original = buf1[0];
+buf1[0] = 0xFF;
+assert.strictEqual(buf2[0], original, 'buf2 should be unaffected by buf1 mutation');
+assert.strictEqual(buf1[0], 0xFF, 'buf1 mutation should persist');
+console.log('buffer independence test passed');
+
+// Test node_modules package lookup via VFS (resolved through "exports" field)
+const testPkg = require('test-pkg');
+assert.strictEqual(testPkg.name, 'test-pkg', 'package name should match');
+assert.strictEqual(testPkg.greet('World'), 'Hello, World!', 'package function should work');
+console.log('node_modules package lookup test passed');
+
+// Test exports-only package (no "main" field, entry in subdirectory)
+// This proves the package.json reader is VFS-aware - without it,
+// "exports" would not be consulted and resolution would fail.
+const exportsPkg = require('test-exports-pkg');
+assert.strictEqual(exportsPkg.fromExports, true, 'exports-only package should resolve');
+console.log('exports-only package lookup test passed');
+
+console.log('All SEA VFS tests passed!');
diff --git a/test/fixtures/sea/vfs/test-exports-pkg-entry.js b/test/fixtures/sea/vfs/test-exports-pkg-entry.js
new file mode 100644
index 000000000000..3ef6bdcadc7a
--- /dev/null
+++ b/test/fixtures/sea/vfs/test-exports-pkg-entry.js
@@ -0,0 +1,2 @@
+'use strict';
+module.exports = { fromExports: true };
diff --git a/test/fixtures/sea/vfs/test-exports-pkg-package.json b/test/fixtures/sea/vfs/test-exports-pkg-package.json
new file mode 100644
index 000000000000..86f62f622da5
--- /dev/null
+++ b/test/fixtures/sea/vfs/test-exports-pkg-package.json
@@ -0,0 +1,5 @@
+{
+  "name": "test-exports-pkg",
+  "version": "1.0.0",
+  "exports": { ".": "./lib/entry.js" }
+}
diff --git a/test/fixtures/sea/vfs/test-pkg-index.js b/test/fixtures/sea/vfs/test-pkg-index.js
new file mode 100644
index 000000000000..e6c2ee94611c
--- /dev/null
+++ b/test/fixtures/sea/vfs/test-pkg-index.js
@@ -0,0 +1,5 @@
+'use strict';
+module.exports = {
+  name: 'test-pkg',
+  greet: (name) => `Hello, ${name}!`,
+};
diff --git a/test/fixtures/sea/vfs/test-pkg-package.json b/test/fixtures/sea/vfs/test-pkg-package.json
new file mode 100644
index 000000000000..bc4109d609ae
--- /dev/null
+++ b/test/fixtures/sea/vfs/test-pkg-package.json
@@ -0,0 +1,5 @@
+{
+  "name": "test-pkg",
+  "version": "1.0.0",
+  "exports": { ".": "./index.js" }
+}
diff --git a/test/fixtures/snapshot/crypto-provider-cipher-cache.js b/test/fixtures/snapshot/crypto-provider-cipher-cache.js
new file mode 100644
index 000000000000..6d765f6b89bb
--- /dev/null
+++ b/test/fixtures/snapshot/crypto-provider-cipher-cache.js
@@ -0,0 +1,55 @@
+'use strict';
+
+const assert = require('assert');
+const {
+  createHash,
+  createCipheriv,
+  getCipherInfo,
+  getCiphers,
+  getHashes,
+  setFips,
+} = require('crypto');
+const { setDeserializeMainFunction } = require('v8').startupSnapshot;
+
+const algorithm = 'aes-128-cbc-cts';
+const key = Buffer.alloc(16);
+const iv = Buffer.alloc(16);
+const legacyCipher = 'blowfish';
+const legacyHash = 'md4';
+
+setFips(0);
+assert(getCiphers().includes(algorithm));
+assert(getCiphers().includes(legacyCipher));
+assert(getHashes().includes(legacyHash));
+assert(getCipherInfo(algorithm));
+createCipheriv(algorithm, key, iv);
+createHash(legacyHash).digest();
+
+setDeserializeMainFunction(() => {
+  assert(getCiphers().includes(algorithm));
+  assert(!getCiphers().includes(legacyCipher));
+  assert(!getHashes().includes(legacyHash));
+  assert(getCipherInfo(algorithm));
+  createCipheriv(algorithm, key, iv);
+  assert.throws(
+    () => createCipheriv(legacyCipher, key, Buffer.alloc(8)),
+    { code: 'ERR_OSSL_EVP_UNSUPPORTED' },
+  );
+  assert.throws(
+    () => createHash(legacyHash),
+    { code: 'ERR_OSSL_EVP_UNSUPPORTED' },
+  );
+
+  setFips(1);
+  assert(!getCiphers().includes(algorithm));
+  assert.strictEqual(getCipherInfo(algorithm), undefined);
+  assert.throws(() => createCipheriv(algorithm, key, iv), {
+    code: 'ERR_CRYPTO_UNKNOWN_CIPHER',
+  });
+
+  setFips(0);
+  assert(getCiphers().includes(algorithm));
+  assert(getCipherInfo(algorithm));
+  createCipheriv(algorithm, key, iv);
+  console.log('provider crypto caches snapshot: ok');
+});
diff --git a/test/fixtures/snapshot/crypto-provider-mac-cache.js b/test/fixtures/snapshot/crypto-provider-mac-cache.js
new file mode 100644
index 000000000000..ac401d8a979a
--- /dev/null
+++ b/test/fixtures/snapshot/crypto-provider-mac-cache.js
@@ -0,0 +1,65 @@
+'use strict';
+
+const assert = require('node:assert');
+const {
+  createMac,
+  getFips,
+  getMacs,
+  setFips,
+} = require('node:crypto');
+const { setDeserializeMainFunction } = require('node:v8').startupSnapshot;
+
+const algorithm = 'poly1305';
+const key = Buffer.from(
+  '85d6be7857556d337f4452fe42d506a8' +
+  '0103808afb0db2fd4abff6af4149f51b',
+  'hex',
+);
+const data = Buffer.from('Cryptographic Forum Research Group');
+const expected = 'a8061dc1305136c6c22b8baf0c0127a9';
+
+setFips(0);
+assert(getMacs().includes(algorithm));
+assert.strictEqual(
+  createMac(algorithm, key).update(data).final('hex'),
+  expected,
+);
+
+setDeserializeMainFunction(() => {
+  // Resolve through the JavaScript alias cache before refreshing getMacs().
+  // Startup snapshot serialization must not retain the build-time cache IDs.
+  assert.strictEqual(
+    createMac(algorithm, key).update(data).final('hex'),
+    expected,
+  );
+  const expectedMacs = getMacs();
+  assert(expectedMacs.includes(algorithm));
+  const disposableMacs = getMacs();
+  disposableMacs.length = 0;
+  assert.deepStrictEqual(getMacs(), expectedMacs);
+  assert.strictEqual(
+    createMac(algorithm, key).update(data).final('hex'),
+    expected,
+  );
+
+  let toggled = false;
+  try {
+    setFips(1);
+    toggled = getFips() === 1;
+  } catch {
+    // FIPS mode is optional; snapshot cache rebuilding is still covered.
+  }
+  if (toggled && !getMacs().includes(algorithm)) {
+    assert.throws(() => createMac(algorithm, key), {
+      code: 'ERR_CRYPTO_INVALID_MAC',
+    });
+  }
+  setFips(0);
+
+  assert(getMacs().includes(algorithm));
+  assert.strictEqual(
+    createMac(algorithm, key).update(data).final('hex'),
+    expected,
+  );
+  console.log('provider MAC cache snapshot: ok');
+});
diff --git a/test/fixtures/sqlite/backup-last-request.mjs b/test/fixtures/sqlite/backup-last-request.mjs
new file mode 100644
index 000000000000..91ad84e77ed5
--- /dev/null
+++ b/test/fixtures/sqlite/backup-last-request.mjs
@@ -0,0 +1,34 @@
+import { backup, DatabaseSync } from 'node:sqlite';
+
+const source = new DatabaseSync(':memory:');
+source.exec(`
+  CREATE TABLE data(value);
+  INSERT INTO data VALUES (zeroblob(1048576));
+`);
+
+let keepAlive = setInterval(() => {}, 1_000);
+let settled = false;
+
+process.once('beforeExit', () => {
+  if (!settled) {
+    process.stderr.write('backup promise did not settle before the event loop became idle\n');
+    process.exit(1);
+  }
+});
+
+backup(source, process.argv[2], {
+  rate: 1,
+  progress() {
+    if (keepAlive !== undefined) {
+      clearInterval(keepAlive);
+      keepAlive = undefined;
+    }
+  },
+}).then(() => {
+  settled = true;
+  source.close();
+}, (error) => {
+  settled = true;
+  process.stderr.write(`${error.stack ?? error}\n`);
+  process.exitCode = 1;
+});
diff --git a/test/fixtures/web-worker/classic.mjs b/test/fixtures/web-worker/classic.mjs
new file mode 100644
index 000000000000..b2ecbaa7030d
--- /dev/null
+++ b/test/fixtures/web-worker/classic.mjs
@@ -0,0 +1,7 @@
+var classicBinding = 'classic';
+
+postMessage({
+  binding: globalThis.classicBinding,
+  requireType: typeof require,
+  thisIsGlobal: this === globalThis,
+});
diff --git a/test/fixtures/web-worker/close.js b/test/fixtures/web-worker/close.js
new file mode 100644
index 000000000000..2f7c3b351d44
--- /dev/null
+++ b/test/fixtures/web-worker/close.js
@@ -0,0 +1,7 @@
+'use strict';
+
+postMessage('before-close');
+// close() terminates the worker immediately
+close();
+// This shouldn't be called
+postMessage('after-close');
diff --git a/test/fixtures/web-worker/echo.js b/test/fixtures/web-worker/echo.js
new file mode 100644
index 000000000000..753c32599775
--- /dev/null
+++ b/test/fixtures/web-worker/echo.js
@@ -0,0 +1,5 @@
+'use strict';
+
+addEventListener('message', (event) => {
+  postMessage(event.data);
+});
diff --git a/test/fixtures/web-worker/import-scheme.js b/test/fixtures/web-worker/import-scheme.js
new file mode 100644
index 000000000000..af52513a65ea
--- /dev/null
+++ b/test/fixtures/web-worker/import-scheme.js
@@ -0,0 +1,11 @@
+'use strict';
+
+let name = null;
+try {
+  // The only accepted schemes are 'blob', 'file', and 'data'
+  importScripts('https://nodejs.org/worker.js');
+} catch (err) {
+  name = err.name;
+}
+
+postMessage(name);
diff --git a/test/fixtures/web-worker/module-dependency.mjs b/test/fixtures/web-worker/module-dependency.mjs
new file mode 100644
index 000000000000..bd1596224653
--- /dev/null
+++ b/test/fixtures/web-worker/module-dependency.mjs
@@ -0,0 +1 @@
+export default 'module';
diff --git a/test/fixtures/web-worker/module.cjs b/test/fixtures/web-worker/module.cjs
new file mode 100644
index 000000000000..0f5507a85c5d
--- /dev/null
+++ b/test/fixtures/web-worker/module.cjs
@@ -0,0 +1,7 @@
+import value from './module-dependency.mjs';
+
+postMessage({
+  requireType: typeof require,
+  thisIsUndefined: this === undefined,
+  value,
+});
diff --git a/test/fixtures/web-worker/no-events.js b/test/fixtures/web-worker/no-events.js
new file mode 100644
index 000000000000..599b9e1e8674
--- /dev/null
+++ b/test/fixtures/web-worker/no-events.js
@@ -0,0 +1,19 @@
+'use strict';
+
+const dispatched = [];
+for (const name of ['languagechange', 'online', 'offline',
+                    'rejectionhandled', 'unhandledrejection']) {
+  addEventListener(name, () => dispatched.push(name));
+}
+
+let processEvents = 0;
+process.on('unhandledRejection', () => {
+  processEvents++;
+  // Give the event target a chance to fire before reporting back.
+  setImmediate(() => postMessage({
+    dispatched,
+    processEvents,
+  }));
+});
+
+Promise.reject(new Error('reported through process, not the event target'));
diff --git a/test/fixtures/web-worker/relative.js b/test/fixtures/web-worker/relative.js
new file mode 100644
index 000000000000..87f67b64cb26
--- /dev/null
+++ b/test/fixtures/web-worker/relative.js
@@ -0,0 +1,3 @@
+'use strict';
+
+postMessage('relative');
diff --git a/test/fixtures/web-worker/wpt-error-after-result.js b/test/fixtures/web-worker/wpt-error-after-result.js
new file mode 100644
index 000000000000..4dfb835a92f3
--- /dev/null
+++ b/test/fixtures/web-worker/wpt-error-after-result.js
@@ -0,0 +1,12 @@
+'use strict';
+
+// Throw only once a result has been reported, so the harness has to surface
+// the error rather than treat the test file as already done.
+add_result_callback(() => {
+  setTimeout(() => {
+    throw new Error('probe error after first result');
+  }, 0);
+});
+
+test(() => {}, 'reported before error');
+async_test(() => {}, 'waiting for error');
diff --git a/test/fixtures/workload/heap-profile-and-snapshot-near-heap-limit.js b/test/fixtures/workload/heap-profile-and-snapshot-near-heap-limit.js
new file mode 100644
index 000000000000..2f9ad332aa20
--- /dev/null
+++ b/test/fixtures/workload/heap-profile-and-snapshot-near-heap-limit.js
@@ -0,0 +1,9 @@
+'use strict';
+const path = require('path');
+const v8 = require('v8');
+
+v8.setHeapSnapshotNearHeapLimit(1);
+v8.startHeapProfile();
+v8.setHeapProfileNearHeapLimit(1);
+
+require(path.resolve(__dirname, 'grow.js'));
diff --git a/test/fixtures/workload/heap-profile-near-heap-limit-with-heap-prof.js b/test/fixtures/workload/heap-profile-near-heap-limit-with-heap-prof.js
new file mode 100644
index 000000000000..1e39cf5df896
--- /dev/null
+++ b/test/fixtures/workload/heap-profile-near-heap-limit-with-heap-prof.js
@@ -0,0 +1,7 @@
+'use strict';
+const path = require('path');
+const v8 = require('v8');
+
+v8.setHeapProfileNearHeapLimit(1);
+
+require(path.resolve(__dirname, 'grow.js'));
diff --git a/test/fixtures/workload/heap-profile-near-heap-limit.js b/test/fixtures/workload/heap-profile-near-heap-limit.js
new file mode 100644
index 000000000000..303cd71ad12c
--- /dev/null
+++ b/test/fixtures/workload/heap-profile-near-heap-limit.js
@@ -0,0 +1,8 @@
+'use strict';
+const path = require('path');
+const v8 = require('v8');
+
+v8.startHeapProfile();
+v8.setHeapProfileNearHeapLimit(1);
+
+require(path.resolve(__dirname, 'grow.js'));
diff --git a/test/fixtures/wpt-backends-spec.js b/test/fixtures/wpt-backends-spec.js
new file mode 100644
index 000000000000..19424eddad27
--- /dev/null
+++ b/test/fixtures/wpt-backends-spec.js
@@ -0,0 +1,24 @@
+'use strict';
+
+// Driven through both WPT runner backends by
+// test/parallel/test-common-wpt-backends.js. Between them these produce every
+// kind of message the two backends have to agree on.
+
+test(() => {}, 'passes');
+
+test(() => {
+  assert_true(false, 'deliberate failure');
+}, 'fails');
+
+test(() => {}, 'skipped by name');
+
+test(() => {}, 'skipped by pattern');
+
+promise_test(async () => {}, 'passes asynchronously');
+
+if (globalThis.WPT_BACKENDS_THROW) {
+  // Thrown once results have already been reported, which is when the backends
+  // stop sharing a mechanism: a worker thread surfaces this through its
+  // 'error' event, a process has to report it before exiting.
+  throw new Error('deliberate uncaught error');
+}
diff --git a/test/fixtures/wpt/interfaces/FileAPI.idl b/test/fixtures/wpt/interfaces/FileAPI.idl
index 49219fce277f..4a711a684459 100644
--- a/test/fixtures/wpt/interfaces/FileAPI.idl
+++ b/test/fixtures/wpt/interfaces/FileAPI.idl
@@ -20,6 +20,7 @@ interface Blob {
   [NewObject] ReadableStream stream();
   [NewObject] Promise<USVString> text();
   [NewObject] Promise<ArrayBuffer> arrayBuffer();
+  [NewObject] ReadableStream textStream();
   [NewObject] Promise<Uint8Array> bytes();
 };
 
diff --git a/test/fixtures/wpt/interfaces/compression.idl b/test/fixtures/wpt/interfaces/compression.idl
index defe4ba55cdf..6e44b4ad6dd9 100644
--- a/test/fixtures/wpt/interfaces/compression.idl
+++ b/test/fixtures/wpt/interfaces/compression.idl
@@ -4,6 +4,7 @@
 // Source: Compression Standard (https://compression.spec.whatwg.org/)
 
 enum CompressionFormat {
+  "brotli",
   "deflate",
   "deflate-raw",
   "gzip",
diff --git a/test/fixtures/wpt/interfaces/dom.idl b/test/fixtures/wpt/interfaces/dom.idl
index 1ddc084b949d..f61580f43a90 100644
--- a/test/fixtures/wpt/interfaces/dom.idl
+++ b/test/fixtures/wpt/interfaces/dom.idl
@@ -328,7 +328,7 @@ interface DOMImplementation {
   [NewObject] XMLDocument createDocument(DOMString? namespace, [LegacyNullToEmptyString] DOMString qualifiedName, optional DocumentType? doctype = null);
   [NewObject] Document createHTMLDocument(optional DOMString title);
 
-  boolean hasFeature(); // useless; always returns true
+  boolean hasFeature(); // historical; always returns true
 };
 
 [Exposed=Window]
@@ -347,9 +347,9 @@ interface DocumentFragment : Node {
 interface ShadowRoot : DocumentFragment {
   readonly attribute ShadowRootMode mode;
   readonly attribute boolean delegatesFocus;
+  readonly attribute boolean serializable;
   readonly attribute SlotAssignmentMode slotAssignment;
   readonly attribute boolean clonable;
-  readonly attribute boolean serializable;
   readonly attribute Element host;
 
   attribute EventHandler onslotchange;
@@ -409,9 +409,9 @@ interface Element : Node {
 dictionary ShadowRootInit {
   required ShadowRootMode mode;
   boolean delegatesFocus = false;
+  boolean serializable = false;
   SlotAssignmentMode slotAssignment = "named";
   boolean clonable = false;
-  boolean serializable = false;
   CustomElementRegistry? customElementRegistry;
 };
 
@@ -438,7 +438,7 @@ interface Attr : Node {
 
   readonly attribute Element? ownerElement;
 
-  readonly attribute boolean specified; // useless; always returns true
+  readonly attribute boolean specified; // historical; always returns true
 };
 [Exposed=Window]
 interface CharacterData : Node {
@@ -464,7 +464,17 @@ interface CDATASection : Text {
 };
 [Exposed=Window]
 interface ProcessingInstruction : CharacterData {
+  constructor(DOMString target, optional DOMString data = "");
+
   readonly attribute DOMString target;
+
+  boolean hasAttributes();
+  sequence<DOMString> getAttributeNames();
+  DOMString? getAttribute(DOMString name);
+  undefined setAttribute(DOMString name, DOMString value);
+  undefined removeAttribute(DOMString name);
+  boolean toggleAttribute(DOMString name, optional boolean force);
+  boolean hasAttribute(DOMString name);
 };
 [Exposed=Window]
 interface Comment : CharacterData {
diff --git a/test/fixtures/wpt/interfaces/html.idl b/test/fixtures/wpt/interfaces/html.idl
index 567e5a79a36a..e5ce24af481a 100644
--- a/test/fixtures/wpt/interfaces/html.idl
+++ b/test/fixtures/wpt/interfaces/html.idl
@@ -48,7 +48,8 @@ typedef (HTMLScriptElement or SVGScriptElement) HTMLOrSVGScriptElement;
 
 [LegacyOverrideBuiltIns]
 partial interface Document {
-  static Document parseHTMLUnsafe((TrustedHTML or DOMString) html);
+  static Document parseHTMLUnsafe((TrustedHTML or DOMString) html, optional ParseHTMLUnsafeOptions options = {});
+  static Document parseHTML(DOMString html, optional SetHTMLOptions options = {});
 
   // resource metadata management
   [PutForwards=href, LegacyUnforgeable] readonly attribute Location? location;
@@ -152,14 +153,14 @@ dictionary TogglePopoverOptions : ShowPopoverOptions {
 
 HTMLElement includes GlobalEventHandlers;
 HTMLElement includes ElementContentEditable;
-HTMLElement includes HTMLOrSVGElement;
+HTMLElement includes HTMLOrSVGOrMathMLElement;
 
 [Exposed=Window]
 interface HTMLUnknownElement : HTMLElement {
   // Note: intentionally no [HTMLConstructor]
 };
 
-interface mixin HTMLOrSVGElement {
+interface mixin HTMLOrSVGOrMathMLElement {
   [SameObject] readonly attribute DOMStringMap dataset;
   attribute DOMString nonce; // intentionally no [CEReactions]
 
@@ -349,13 +350,10 @@ interface HTMLDivElement : HTMLElement {
 interface HTMLAnchorElement : HTMLElement {
   [HTMLConstructor] constructor();
 
-  [CEReactions, Reflect] attribute DOMString target;
   [CEReactions, Reflect] attribute DOMString download;
   [CEReactions, Reflect] attribute USVString ping;
   [CEReactions, Reflect] attribute DOMString rel;
   [SameObject, PutForwards=value, Reflect="rel"] readonly attribute DOMTokenList relList;
-  [CEReactions, Reflect] attribute DOMString hreflang;
-  [CEReactions, Reflect] attribute DOMString type;
 
   [CEReactions] attribute DOMString text;
 
@@ -403,10 +401,14 @@ interface mixin HyperlinkElementUtils {
   [CEReactions] attribute USVString pathname;
   [CEReactions] attribute USVString search;
   [CEReactions] attribute USVString hash;
+
+  [CEReactions, Reflect] attribute DOMString hreflang;
+  [CEReactions, Reflect] attribute DOMString type;
 };
 
 interface mixin HTMLHyperlinkElementUtils {
   [CEReactions, ReflectSetter] stringifier attribute USVString href;
+  [CEReactions, Reflect] attribute DOMString target;
 };
 
 [Exposed=Window]
@@ -447,6 +449,7 @@ interface HTMLImageElement : HTMLElement {
   [CEReactions] attribute DOMString? crossOrigin;
   [CEReactions, Reflect] attribute DOMString useMap;
   [CEReactions, Reflect] attribute boolean isMap;
+  [CEReactions, Reflect] attribute boolean controls;
   [CEReactions, ReflectSetter] attribute unsigned long width;
   [CEReactions, ReflectSetter] attribute unsigned long height;
   readonly attribute unsigned long naturalWidth;
@@ -531,6 +534,7 @@ interface HTMLVideoElement : HTMLMediaElement {
   readonly attribute unsigned long videoHeight;
   [CEReactions, ReflectURL] attribute USVString poster;
   [CEReactions, Reflect] attribute boolean playsInline;
+
 };
 
 [Exposed=Window,
@@ -613,6 +617,7 @@ interface HTMLMediaElement : HTMLElement {
   attribute double volume;
   attribute boolean muted;
   [CEReactions, Reflect="muted"] attribute boolean defaultMuted;
+  [CEReactions] attribute DOMString loading;
 
   // tracks
   [SameObject] readonly attribute AudioTrackList audioTracks;
@@ -760,7 +765,6 @@ interface HTMLAreaElement : HTMLElement {
   [CEReactions, Reflect] attribute DOMString alt;
   [CEReactions, Reflect] attribute DOMString coords;
   [CEReactions, Reflect] attribute DOMString shape;
-  [CEReactions, Reflect] attribute DOMString target;
   [CEReactions, Reflect] attribute DOMString download;
   [CEReactions, Reflect] attribute USVString ping;
   [CEReactions, Reflect] attribute DOMString rel;
@@ -966,7 +970,7 @@ interface HTMLButtonElement : HTMLElement {
   [HTMLConstructor] constructor();
 
   [CEReactions, ReflectSetter] attribute DOMString command;
-  [CEReactions, Reflect] attribute Element? commandForElement;
+  [CEReactions, Reflect="commandfor"] attribute Element? commandForElement;
   [CEReactions, Reflect] attribute boolean disabled;
   readonly attribute HTMLFormElement? form;
   [CEReactions, ReflectSetter] attribute USVString formAction;
@@ -1271,10 +1275,12 @@ interface HTMLTemplateElement : HTMLElement {
   [HTMLConstructor] constructor();
 
   readonly attribute DocumentFragment content;
+  [CEReactions, Reflect="for"] attribute DOMString htmlFor;
   [CEReactions] attribute DOMString shadowRootMode;
   [CEReactions, Reflect] attribute boolean shadowRootDelegatesFocus;
-  [CEReactions, Reflect] attribute boolean shadowRootClonable;
   [CEReactions, Reflect] attribute boolean shadowRootSerializable;
+  [CEReactions] attribute DOMString shadowRootSlotAssignment;
+  [CEReactions, Reflect] attribute boolean shadowRootClonable;
   [CEReactions, Reflect] attribute DOMString shadowRootCustomElementRegistry;
 };
 
@@ -1808,7 +1814,7 @@ dictionary DragEventInit : MouseEventInit {
 };
 
 interface mixin PopoverTargetAttributes {
-  [CEReactions, Reflect] attribute Element? popoverTargetElement;
+  [CEReactions, Reflect="popovertarget"] attribute Element? popoverTargetElement;
   [CEReactions] attribute DOMString popoverTargetAction;
 };
 
@@ -2357,7 +2363,8 @@ Window includes WindowOrWorkerGlobalScope;
 WorkerGlobalScope includes WindowOrWorkerGlobalScope;
 
 partial interface Element {
-  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html);
+  [CEReactions] undefined setHTML(DOMString html, optional SetHTMLOptions options = {});
+  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html, optional SetHTMLUnsafeOptions options = {});
   DOMString getHTML(optional GetHTMLOptions options = {});
 
   [CEReactions] attribute (TrustedHTML or [LegacyNullToEmptyString] DOMString) innerHTML;
@@ -2366,12 +2373,25 @@ partial interface Element {
 };
 
 partial interface ShadowRoot {
-  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html);
+  [CEReactions] undefined setHTML(DOMString html, optional SetHTMLOptions options = {});
+  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html, optional SetHTMLUnsafeOptions options = {});
   DOMString getHTML(optional GetHTMLOptions options = {});
 
   [CEReactions] attribute (TrustedHTML or [LegacyNullToEmptyString] DOMString) innerHTML;
 };
 
+enum SanitizerPresets { "default" };
+dictionary SetHTMLOptions {
+  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = "default";
+};
+dictionary SetHTMLUnsafeOptions {
+  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = {};
+  boolean runScripts = false;
+};
+dictionary ParseHTMLUnsafeOptions {
+  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = {};
+};
+
 dictionary GetHTMLOptions {
   boolean serializableShadowRoots = false;
   sequence<ShadowRoot> shadowRoots = [];
@@ -2403,6 +2423,68 @@ interface XMLSerializer {
   DOMString serializeToString(Node root);
 };
 
+[Exposed=Window]
+interface Sanitizer {
+  constructor(optional (SanitizerConfig or SanitizerPresets) configuration = "default");
+
+  // Query configuration:
+  SanitizerConfig get();
+
+  // Modify a Sanitizer's lists and fields:
+  boolean allowElement(SanitizerElementWithAttributes element);
+  boolean removeElement(SanitizerElement element);
+  boolean replaceElementWithChildren(SanitizerElement element);
+  boolean allowProcessingInstruction(SanitizerPI pi);
+  boolean removeProcessingInstruction(SanitizerPI pi);
+  boolean allowAttribute(SanitizerAttribute attribute);
+  boolean removeAttribute(SanitizerAttribute attribute);
+  boolean setComments(boolean allow);
+  boolean setDataAttributes(boolean allow);
+
+  // Remove markup that executes script.
+  boolean removeUnsafe();
+};
+
+dictionary SanitizerElementNamespace {
+  required DOMString name;
+  DOMString? _namespace = "http://www.w3.org/1999/xhtml";
+};
+
+// Used by "elements"
+dictionary SanitizerElementNamespaceWithAttributes : SanitizerElementNamespace {
+  sequence<SanitizerAttribute> attributes;
+  sequence<SanitizerAttribute> removeAttributes;
+};
+
+dictionary SanitizerAttributeNamespace {
+  required DOMString name;
+  DOMString? _namespace = null;
+};
+
+dictionary SanitizerProcessingInstruction {
+  required DOMString target;
+};
+
+typedef (DOMString or SanitizerElementNamespace) SanitizerElement;
+typedef (DOMString or SanitizerElementNamespaceWithAttributes) SanitizerElementWithAttributes;
+typedef (DOMString or SanitizerProcessingInstruction) SanitizerPI;
+typedef (DOMString or SanitizerAttributeNamespace) SanitizerAttribute;
+
+dictionary SanitizerConfig {
+  sequence<SanitizerElementWithAttributes> elements;
+  sequence<SanitizerElement> removeElements;
+  sequence<SanitizerElement> replaceWithChildrenElements;
+
+  sequence<SanitizerPI> processingInstructions;
+  sequence<SanitizerPI> removeProcessingInstructions;
+
+  sequence<SanitizerAttribute> attributes;
+  sequence<SanitizerAttribute> removeAttributes;
+
+  boolean comments;
+  boolean dataAttributes;
+};
+
 [Exposed=Window]
 interface Navigator {
   // objects implementing this interface also implement the interfaces given below
diff --git a/test/fixtures/wpt/interfaces/resource-timing.idl b/test/fixtures/wpt/interfaces/resource-timing.idl
index ba8e3953b497..1391b09022e1 100644
--- a/test/fixtures/wpt/interfaces/resource-timing.idl
+++ b/test/fixtures/wpt/interfaces/resource-timing.idl
@@ -41,7 +41,8 @@ enum RenderBlockingStatusType {
     "non-blocking"
 };
 
-partial interface Performance {  undefined clearResourceTimings ();
-  undefined setResourceTimingBufferSize (unsigned long maxSize);
-  attribute EventHandler onresourcetimingbufferfull;
-};
+partial interface Performance {
+      undefined clearResourceTimings ();
+      undefined setResourceTimingBufferSize (unsigned long maxSize);
+      attribute EventHandler onresourcetimingbufferfull;
+    };
diff --git a/test/fixtures/wpt/interfaces/streams.idl b/test/fixtures/wpt/interfaces/streams.idl
index 8abc8f5cfda9..a0de8b89aa46 100644
--- a/test/fixtures/wpt/interfaces/streams.idl
+++ b/test/fixtures/wpt/interfaces/streams.idl
@@ -7,7 +7,7 @@
 interface ReadableStream {
   constructor(optional object underlyingSource, optional QueuingStrategy strategy = {});
 
-  static ReadableStream from(any asyncIterable);
+  static ReadableStream from(async_sequence<any> asyncIterable);
 
   readonly attribute boolean locked;
 
@@ -114,7 +114,7 @@ interface ReadableByteStreamController {
 
 [Exposed=*]
 interface ReadableStreamBYOBRequest {
-  readonly attribute ArrayBufferView? view;
+  readonly attribute Uint8Array? view;
 
   undefined respond([EnforceRange] unsigned long long bytesWritten);
   undefined respondWithNewView(ArrayBufferView view);
diff --git a/test/fixtures/wpt/interfaces/web-locks.idl b/test/fixtures/wpt/interfaces/web-locks.idl
index 00648cc3b1e5..d79e404b983f 100644
--- a/test/fixtures/wpt/interfaces/web-locks.idl
+++ b/test/fixtures/wpt/interfaces/web-locks.idl
@@ -10,7 +10,7 @@ interface mixin NavigatorLocks {
 Navigator includes NavigatorLocks;
 WorkerNavigator includes NavigatorLocks;
 
-[SecureContext, Exposed=(Window,Worker,SharedStorageWorklet)]
+[SecureContext, Exposed=(Window,Worker)]
 interface LockManager {
   Promise<any> request(DOMString name,
                        LockGrantedCallback callback);
@@ -43,7 +43,7 @@ dictionary LockInfo {
   DOMString clientId;
 };
 
-[SecureContext, Exposed=(Window,Worker,SharedStorageWorklet)]
+[SecureContext, Exposed=(Window,Worker)]
 interface Lock {
   readonly attribute DOMString name;
   readonly attribute LockMode mode;
diff --git a/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl b/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl
index aeb1d650b7d7..00df80f74ccf 100644
--- a/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl
+++ b/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl
@@ -38,7 +38,7 @@ partial interface SubtleCrypto {
 
   static boolean supports(DOMString operation,
                    AlgorithmIdentifier algorithm,
-                   optional unsigned long? length = null);
+                   optional [EnforceRange] unsigned long? length = null);
   static boolean supports(DOMString operation,
                    AlgorithmIdentifier algorithm,
                    AlgorithmIdentifier additionalAlgorithm);
@@ -59,7 +59,7 @@ dictionary EncapsulatedBits {
 };
 
 partial dictionary JsonWebKey {
-  // The following fields are defined in draft-ietf-cose-dilithium-08
+  // The following fields are defined in RFC 9964
   DOMString pub;
   DOMString priv;
 };
@@ -99,7 +99,7 @@ dictionary KmacImportParams : Algorithm {
 };
 
 dictionary KmacKeyAlgorithm : KeyAlgorithm {
-  required unsigned long length;
+  required [EnforceRange] unsigned long length;
 };
 
 dictionary KmacParams : Algorithm {
diff --git a/test/fixtures/wpt/interfaces/webcrypto.idl b/test/fixtures/wpt/interfaces/webcrypto.idl
index ebb9cf5718b9..7599a1a994aa 100644
--- a/test/fixtures/wpt/interfaces/webcrypto.idl
+++ b/test/fixtures/wpt/interfaces/webcrypto.idl
@@ -79,7 +79,7 @@ interface SubtleCrypto {
   Promise<ArrayBuffer> deriveBits(
     AlgorithmIdentifier algorithm,
     CryptoKey baseKey,
-    optional unsigned long? length = null
+    optional [EnforceRange] unsigned long? length = null
   );
 
   Promise<CryptoKey> importKey(
@@ -161,7 +161,7 @@ dictionary RsaHashedKeyGenParams : RsaKeyGenParams {
 };
 
 dictionary RsaKeyAlgorithm : KeyAlgorithm {
-  required unsigned long modulusLength;
+  required [EnforceRange] unsigned long modulusLength;
   required BigInteger publicExponent;
 };
 
@@ -209,7 +209,7 @@ dictionary AesCtrParams : Algorithm {
 };
 
 dictionary AesKeyAlgorithm : KeyAlgorithm {
-  required unsigned short length;
+  required [EnforceRange] unsigned short length;
 };
 
 dictionary AesKeyGenParams : Algorithm {
@@ -237,7 +237,7 @@ dictionary HmacImportParams : Algorithm {
 
 dictionary HmacKeyAlgorithm : KeyAlgorithm {
   required KeyAlgorithm hash;
-  required unsigned long length;
+  required [EnforceRange] unsigned long length;
 };
 
 dictionary HmacKeyGenParams : Algorithm {
diff --git a/test/fixtures/wpt/service-workers/META.yml b/test/fixtures/wpt/service-workers/META.yml
new file mode 100644
index 000000000000..03a0dd0fe16e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/META.yml
@@ -0,0 +1,6 @@
+spec: https://w3c.github.io/ServiceWorker/
+suggested_reviewers:
+  - asutherland
+  - mkruisselbrink
+  - mattto
+  - wanderview
diff --git a/test/fixtures/wpt/service-workers/WEB_FEATURES.yml b/test/fixtures/wpt/service-workers/WEB_FEATURES.yml
new file mode 100644
index 000000000000..4c579802fad5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "*": [service-workers]
diff --git a/test/fixtures/wpt/service-workers/cache-storage/META.yml b/test/fixtures/wpt/service-workers/cache-storage/META.yml
new file mode 100644
index 000000000000..bf34474f74aa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/META.yml
@@ -0,0 +1,3 @@
+suggested_reviewers:
+  - inexorabletash
+  - wanderview
diff --git a/test/fixtures/wpt/service-workers/cache-storage/WEB_FEATURES.yml b/test/fixtures/wpt/service-workers/cache-storage/WEB_FEATURES.yml
new file mode 100644
index 000000000000..5bee18ab21d0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [service-workers]
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-abort.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-abort.https.any.js
new file mode 100644
index 000000000000..99f29b0a08ba
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-abort.https.any.js
@@ -0,0 +1,81 @@
+// META: title=Cache Storage: Abort
+// META: global=window,worker
+// META: script=./resources/test-helpers.js
+// META: script=/common/utils.js
+// META: timeout=long
+
+// We perform the same tests on put, add, addAll. Parameterise the tests to
+// reduce repetition.
+const methodsToTest = {
+  put: async (cache, request) => {
+    const response = await fetch(request);
+    return cache.put(request, response);
+  },
+  add: async (cache, request) => cache.add(request),
+  addAll: async (cache, request) => cache.addAll([request]),
+};
+
+for (const method in methodsToTest) {
+  const perform = methodsToTest[method];
+
+  cache_test(async (cache, test) => {
+    const controller = new AbortController();
+    const signal = controller.signal;
+    controller.abort();
+    const request = new Request('../resources/simple.txt', { signal });
+    return promise_rejects_dom(test, 'AbortError', perform(cache, request),
+                          `${method} should reject`);
+  }, `${method}() on an already-aborted request should reject with AbortError`);
+
+  cache_test(async (cache, test) => {
+    const controller = new AbortController();
+    const signal = controller.signal;
+    const request = new Request('../resources/simple.txt', { signal });
+    const promise = perform(cache, request);
+    controller.abort();
+    return promise_rejects_dom(test, 'AbortError', promise,
+                          `${method} should reject`);
+  }, `${method}() synchronously followed by abort should reject with ` +
+     `AbortError`);
+
+  cache_test(async (cache, test) => {
+    const controller = new AbortController();
+    const signal = controller.signal;
+    const stateKey = token();
+    const abortKey = token();
+    const request = new Request(
+        `../../../fetch/api/resources/infinite-slow-response.py?stateKey=${stateKey}&abortKey=${abortKey}`,
+        { signal });
+
+    const promise = perform(cache, request);
+
+    // Wait for the server to start sending the response body.
+    let opened = false;
+    do {
+      // Normally only one fetch to 'stash-take' is needed, but the fetches
+      // will be served in reverse order sometimes
+      // (i.e., 'stash-take' gets served before 'infinite-slow-response').
+
+      const response =
+            await fetch(`../../../fetch/api/resources/stash-take.py?key=${stateKey}`);
+      const body = await response.json();
+      if (body === 'open') opened = true;
+    } while (!opened);
+
+    // Sadly the above loop cannot guarantee that the browser has started
+    // processing the response body. This delay is needed to make the test
+    // failures non-flaky in Chrome version 66. My deepest apologies.
+    await new Promise(resolve => setTimeout(resolve, 250));
+
+    controller.abort();
+
+    await promise_rejects_dom(test, 'AbortError', promise,
+                          `${method} should reject`);
+
+    // infinite-slow-response.py doesn't know when to stop.
+    return fetch(`../../../fetch/api/resources/stash-put.py?key=${abortKey}&value=close`);
+  }, `${method}() followed by abort after headers received should reject ` +
+     `with AbortError`);
+}
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-add.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-add.https.any.js
new file mode 100644
index 000000000000..c4846eaae40a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-add.https.any.js
@@ -0,0 +1,368 @@
+// META: title=Cache.add and Cache.addAll
+// META: global=window,worker
+// META: script=/common/get-host-info.sub.js
+// META: script=./resources/test-helpers.js
+// META: timeout=long
+
+const { REMOTE_HOST } = get_host_info();
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.add(),
+      'Cache.add should throw a TypeError when no arguments are given.');
+  }, 'Cache.add called with no arguments');
+
+cache_test(function(cache) {
+    return cache.add('./resources/simple.txt')
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.add should resolve with undefined on success.');
+          return cache.match('./resources/simple.txt');
+        })
+        .then(function(response) {
+          assert_class_string(response, 'Response',
+                              'Cache.add should put a resource in the cache.');
+          return response.text();
+        })
+        .then(function(body) {
+          assert_equals(body, 'a simple text file\n',
+                        'Cache.add should retrieve the correct body.');
+        });
+  }, 'Cache.add called with relative URL specified as a string');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.add('javascript://this-is-not-http-mmkay'),
+      'Cache.add should throw a TypeError for non-HTTP/HTTPS URLs.');
+  }, 'Cache.add called with non-HTTP/HTTPS URL');
+
+cache_test(function(cache) {
+    var request = new Request('./resources/simple.txt');
+    return cache.add(request)
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.add should resolve with undefined on success.');
+        });
+  }, 'Cache.add called with Request object');
+
+cache_test(function(cache, test) {
+    var request = new Request('./resources/simple.txt',
+                              {method: 'POST', body: 'This is a body.'});
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.add(request),
+      'Cache.add should throw a TypeError for non-GET requests.');
+  }, 'Cache.add called with POST request');
+
+cache_test(function(cache) {
+    var request = new Request('./resources/simple.txt');
+    return cache.add(request)
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.add should resolve with undefined on success.');
+        })
+      .then(function() {
+          return cache.add(request);
+        })
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.add should resolve with undefined on success.');
+        });
+  }, 'Cache.add called twice with the same Request object');
+
+cache_test(function(cache) {
+    var request = new Request('./resources/simple.txt');
+    return request.text()
+      .then(function() {
+          assert_false(request.bodyUsed);
+        })
+      .then(function() {
+          return cache.add(request);
+        });
+  }, 'Cache.add with request with null body (not consumed)');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.add('./resources/fetch-status.py?status=206'),
+      'Cache.add should reject on partial response');
+  }, 'Cache.add with 206 response');
+
+cache_test(function(cache, test) {
+    var urls = ['./resources/fetch-status.py?status=206',
+                './resources/fetch-status.py?status=200'];
+    var requests = urls.map(function(url) {
+        return new Request(url);
+      });
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.addAll(requests),
+      'Cache.addAll should reject with TypeError if any request fails');
+  }, 'Cache.addAll with 206 response');
+
+cache_test(function(cache, test) {
+    var urls = ['./resources/fetch-status.py?status=206',
+                './resources/fetch-status.py?status=200'];
+    var requests = urls.map(function(url) {
+        var cross_origin_url = new URL(url, location.href);
+        cross_origin_url.hostname = REMOTE_HOST;
+        return new Request(cross_origin_url.href, { mode: 'no-cors' });
+      });
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.addAll(requests),
+      'Cache.addAll should reject with TypeError if any request fails');
+  }, 'Cache.addAll with opaque-filtered 206 response');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.add('this-does-not-exist-please-dont-create-it'),
+      'Cache.add should reject if response is !ok');
+  }, 'Cache.add with request that results in a status of 404');
+
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.add('./resources/fetch-status.py?status=500'),
+      'Cache.add should reject if response is !ok');
+  }, 'Cache.add with request that results in a status of 500');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.addAll(),
+      'Cache.addAll with no arguments should throw TypeError.');
+  }, 'Cache.addAll with no arguments');
+
+cache_test(function(cache, test) {
+    // Assumes the existence of ../resources/simple.txt and ../resources/blank.html
+    var urls = ['./resources/simple.txt', undefined, './resources/blank.html'];
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.addAll(urls),
+      'Cache.addAll should throw TypeError for an undefined argument.');
+  }, 'Cache.addAll with a mix of valid and undefined arguments');
+
+cache_test(function(cache) {
+    return cache.addAll([])
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.addAll should resolve with undefined on ' +
+                        'success.');
+          return cache.keys();
+        })
+      .then(function(result) {
+          assert_equals(result.length, 0,
+                        'There should be no entry in the cache.');
+        });
+  }, 'Cache.addAll with an empty array');
+
+cache_test(function(cache) {
+    // Assumes the existence of ../resources/simple.txt and
+    // ../resources/blank.html
+    var urls = ['./resources/simple.txt',
+                self.location.href,
+                './resources/blank.html'];
+    return cache.addAll(urls)
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.addAll should resolve with undefined on ' +
+                        'success.');
+          return Promise.all(
+            urls.map(function(url) { return cache.match(url); }));
+        })
+      .then(function(responses) {
+          assert_class_string(
+            responses[0], 'Response',
+            'Cache.addAll should put a resource in the cache.');
+          assert_class_string(
+            responses[1], 'Response',
+            'Cache.addAll should put a resource in the cache.');
+          assert_class_string(
+            responses[2], 'Response',
+            'Cache.addAll should put a resource in the cache.');
+          return Promise.all(
+            responses.map(function(response) { return response.text(); }));
+        })
+      .then(function(bodies) {
+          assert_equals(
+            bodies[0], 'a simple text file\n',
+            'Cache.add should retrieve the correct body.');
+          assert_equals(
+            bodies[2], '<!DOCTYPE html>\n<title>Empty doc</title>\n',
+            'Cache.add should retrieve the correct body.');
+        });
+  }, 'Cache.addAll with string URL arguments');
+
+cache_test(function(cache) {
+    // Assumes the existence of ../resources/simple.txt and
+    // ../resources/blank.html
+    var urls = ['./resources/simple.txt',
+                self.location.href,
+                './resources/blank.html'];
+    var requests = urls.map(function(url) {
+        return new Request(url);
+      });
+    return cache.addAll(requests)
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.addAll should resolve with undefined on ' +
+                        'success.');
+          return Promise.all(
+            urls.map(function(url) { return cache.match(url); }));
+        })
+      .then(function(responses) {
+          assert_class_string(
+            responses[0], 'Response',
+            'Cache.addAll should put a resource in the cache.');
+          assert_class_string(
+            responses[1], 'Response',
+            'Cache.addAll should put a resource in the cache.');
+          assert_class_string(
+            responses[2], 'Response',
+            'Cache.addAll should put a resource in the cache.');
+          return Promise.all(
+            responses.map(function(response) { return response.text(); }));
+        })
+      .then(function(bodies) {
+          assert_equals(
+            bodies[0], 'a simple text file\n',
+            'Cache.add should retrieve the correct body.');
+          assert_equals(
+            bodies[2], '<!DOCTYPE html>\n<title>Empty doc</title>\n',
+            'Cache.add should retrieve the correct body.');
+        });
+  }, 'Cache.addAll with Request arguments');
+
+cache_test(function(cache, test) {
+    // Assumes that ../resources/simple.txt and ../resources/blank.html exist.
+    // The second resource does not.
+    var urls = ['./resources/simple.txt',
+                'this-resource-should-not-exist',
+                './resources/blank.html'];
+    var requests = urls.map(function(url) {
+        return new Request(url);
+      });
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.addAll(requests),
+      'Cache.addAll should reject with TypeError if any request fails')
+      .then(function() {
+          return Promise.all(urls.map(function(url) {
+              return cache.match(url);
+            }));
+      })
+      .then(function(matches) {
+          assert_array_equals(
+            matches,
+            [undefined, undefined, undefined],
+            'If any response fails, no response should be added to cache');
+      });
+  }, 'Cache.addAll with a mix of succeeding and failing requests');
+
+cache_test(function(cache, test) {
+    var request = new Request('./resources/simple.txt');
+    return promise_rejects_dom(
+      test,
+      'InvalidStateError',
+      cache.addAll([request, request]),
+      'Cache.addAll should throw InvalidStateError if the same request is added ' +
+      'twice.');
+  }, 'Cache.addAll called with the same Request object specified twice');
+
+cache_test(async function(cache, test) {
+    const url = './resources/vary.py?vary=x-shape';
+    let requests = [
+      new Request(url, { headers: { 'x-shape': 'circle' }}),
+      new Request(url, { headers: { 'x-shape': 'square' }}),
+    ];
+    let result = await cache.addAll(requests);
+    assert_equals(result, undefined, 'Cache.addAll() should succeed');
+  }, 'Cache.addAll should succeed when entries differ by vary header');
+
+cache_test(async function(cache, test) {
+    const url = './resources/vary.py?vary=x-shape';
+    let requests = [
+      new Request(url, { headers: { 'x-shape': 'circle' }}),
+      new Request(url, { headers: { 'x-shape': 'circle' }}),
+    ];
+    await promise_rejects_dom(
+      test,
+      'InvalidStateError',
+      cache.addAll(requests),
+      'Cache.addAll() should reject when entries are duplicate by vary header');
+  }, 'Cache.addAll should reject when entries are duplicate by vary header');
+
+// VARY header matching is asymmetric.  Determining if two entries are duplicate
+// depends on which entry's response is used in the comparison.  The target
+// response's VARY header determines what request headers are examined.  This
+// test verifies that Cache.addAll() duplicate checking handles this asymmetric
+// behavior correctly.
+cache_test(async function(cache, test) {
+    const base_url = './resources/vary.py';
+
+    // Define a request URL that sets a VARY header in the
+    // query string to be echoed back by the server.
+    const url = base_url + '?vary=x-size';
+
+    // Set a cookie to override the VARY header of the response
+    // when the request is made with credentials.  This will
+    // take precedence over the query string vary param.  This
+    // is a bit confusing, but it's necessary to construct a test
+    // where the URL is the same, but the VARY headers differ.
+    //
+    // Note, the test could also pass this information in additional
+    // request headers.  If the cookie approach becomes too unwieldy
+    // this test could be rewritten to use that technique.
+    await fetch(base_url + '?set-vary-value-override-cookie=x-shape');
+    test.add_cleanup(_ => fetch(base_url + '?clear-vary-value-override-cookie'));
+
+    let requests = [
+      // This request will result in a Response with a "Vary: x-shape"
+      // header.  This *will not* result in a duplicate match with the
+      // other entry.
+      new Request(url, { headers: { 'x-shape': 'circle',
+                                    'x-size': 'big' },
+                         credentials: 'same-origin' }),
+
+      // This request will result in a Response with a "Vary: x-size"
+      // header.  This *will* result in a duplicate match with the other
+      // entry.
+      new Request(url, { headers: { 'x-shape': 'square',
+                                    'x-size': 'big' },
+                         credentials: 'omit' }),
+    ];
+    await promise_rejects_dom(
+      test,
+      'InvalidStateError',
+      cache.addAll(requests),
+      'Cache.addAll() should reject when one entry has a vary header ' +
+      'matching an earlier entry.');
+
+    // Test the reverse order now.
+    await promise_rejects_dom(
+      test,
+      'InvalidStateError',
+      cache.addAll(requests.reverse()),
+      'Cache.addAll() should reject when one entry has a vary header ' +
+      'matching a later entry.');
+
+  }, 'Cache.addAll should reject when one entry has a vary header ' +
+     'matching another entry');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker.https.html b/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker.https.html
new file mode 100644
index 000000000000..769200f66aa3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker.https.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<title>Cache Storage: Verify nested worker functionality</title>
+<link rel="help" href="https://w3c.github.io/ServiceWorker/#cache-storage">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+promise_test(async function(t) {
+   const worker = new Worker("cache-api-nested-worker1.js");
+   const result = await new Promise((resolve, reject) => {
+       worker.onmessage = e => resolve(e.data);
+       t.step_timeout(() => reject("test timed out"), 2000);
+   });
+   assert_equals(result, "PASS");
+}, "Cache API in nested worker");
+</script>
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker1.js b/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker1.js
new file mode 100644
index 000000000000..1a3c7b7c646e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker1.js
@@ -0,0 +1,3 @@
+const worker2 = new Worker("cache-api-nested-worker2.js");
+worker2.onmessage = e => self.postMessage(e.data);
+
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker2.js b/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker2.js
new file mode 100644
index 000000000000..0af8c3eebfef
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker2.js
@@ -0,0 +1 @@
+self.caches.keys().then(() => postMessage('PASS'), () => postMessage('FAIL'));
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-delete.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-delete.https.any.js
new file mode 100644
index 000000000000..3eae2b6a08b7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-delete.https.any.js
@@ -0,0 +1,164 @@
+// META: title=Cache.delete
+// META: global=window,worker
+// META: script=./resources/test-helpers.js
+// META: timeout=long
+
+var test_url = 'https://example.com/foo';
+
+// Construct a generic Request object. The URL is |test_url|. All other fields
+// are defaults.
+function new_test_request() {
+  return new Request(test_url);
+}
+
+// Construct a generic Response object.
+function new_test_response() {
+  return new Response('Hello world!', { status: 200 });
+}
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.delete(),
+      'Cache.delete should reject with a TypeError when called with no ' +
+      'arguments.');
+  }, 'Cache.delete with no arguments');
+
+cache_test(function(cache) {
+    return cache.put(new_test_request(), new_test_response())
+      .then(function() {
+          return cache.delete(test_url);
+        })
+      .then(function(result) {
+          assert_true(result,
+                      'Cache.delete should resolve with "true" if an entry ' +
+                      'was successfully deleted.');
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_equals(result, undefined,
+            'Cache.delete should remove matching entries from cache.');
+        });
+  }, 'Cache.delete called with a string URL');
+
+cache_test(function(cache) {
+    var request = new Request(test_url);
+    return cache.put(request, new_test_response())
+      .then(function() {
+          return cache.delete(request);
+        })
+      .then(function(result) {
+          assert_true(result,
+                      'Cache.delete should resolve with "true" if an entry ' +
+                      'was successfully deleted.');
+        });
+  }, 'Cache.delete called with a Request object');
+
+cache_test(function(cache) {
+    var request = new Request(test_url);
+    var response = new_test_response();
+    return cache.put(request, response)
+      .then(function() {
+          return cache.delete(new Request(test_url, {method: 'HEAD'}));
+        })
+      .then(function(result) {
+          assert_false(result,
+                       'Cache.delete should not match a non-GET request ' +
+                       'unless ignoreMethod option is set.');
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_response_equals(result, response,
+            'Cache.delete should leave non-matching response in the cache.');
+          return cache.delete(new Request(test_url, {method: 'HEAD'}),
+                              {ignoreMethod: true});
+        })
+      .then(function(result) {
+          assert_true(result,
+                      'Cache.delete should match a non-GET request ' +
+                      ' if ignoreMethod is true.');
+        });
+  }, 'Cache.delete called with a HEAD request');
+
+cache_test(function(cache) {
+    var vary_request = new Request('http://example.com/c',
+                                   {headers: {'Cookies': 'is-for-cookie'}});
+    var vary_response = new Response('', {headers: {'Vary': 'Cookies'}});
+    var mismatched_vary_request = new Request('http://example.com/c');
+
+    return cache.put(vary_request.clone(), vary_response.clone())
+      .then(function() {
+          return cache.delete(mismatched_vary_request.clone());
+        })
+      .then(function(result) {
+          assert_false(result,
+                       'Cache.delete should not delete if vary does not ' +
+                       'match unless ignoreVary is true');
+          return cache.delete(mismatched_vary_request.clone(),
+                              {ignoreVary: true});
+        })
+      .then(function(result) {
+          assert_true(result,
+                      'Cache.delete should ignore vary if ignoreVary is true');
+        });
+  }, 'Cache.delete supports ignoreVary');
+
+cache_test(function(cache) {
+    return cache.delete(test_url)
+      .then(function(result) {
+          assert_false(result,
+                       'Cache.delete should resolve with "false" if there ' +
+                       'are no matching entries.');
+        });
+  }, 'Cache.delete with a non-existent entry');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(entries.a_with_query.request,
+                          { ignoreSearch: true })
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [
+              entries.a.response,
+              entries.a_with_query.response
+            ]);
+          return cache.delete(entries.a_with_query.request,
+                              { ignoreSearch: true });
+        })
+      .then(function(result) {
+          return cache.matchAll(entries.a_with_query.request,
+                                { ignoreSearch: true });
+        })
+      .then(function(result) {
+          assert_response_array_equals(result, []);
+        });
+  },
+  'Cache.delete with ignoreSearch option (request with search parameters)');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(entries.a_with_query.request,
+                          { ignoreSearch: true })
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [
+              entries.a.response,
+              entries.a_with_query.response
+            ]);
+          // cache.delete()'s behavior should be the same if ignoreSearch is
+          // not provided or if ignoreSearch is false.
+          return cache.delete(entries.a_with_query.request,
+                              { ignoreSearch: false });
+        })
+      .then(function(result) {
+          return cache.matchAll(entries.a_with_query.request,
+                                { ignoreSearch: true });
+        })
+      .then(function(result) {
+          assert_response_array_equals(result, [ entries.a.response ]);
+        });
+  },
+  'Cache.delete with ignoreSearch option (when it is specified as false)');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-keys-attributes-for-service-worker.https.html b/test/fixtures/wpt/service-workers/cache-storage/cache-keys-attributes-for-service-worker.https.html
new file mode 100644
index 000000000000..3c96348e0e03
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-keys-attributes-for-service-worker.https.html
@@ -0,0 +1,75 @@
+<!DOCTYPE html>
+<title>Cache.keys (checking request attributes that can be set only on service workers)</title>
+<link rel="help" href="https://w3c.github.io/ServiceWorker/#cache-keys">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./../service-worker/resources/test-helpers.sub.js"></script>
+<script>
+const worker = './resources/cache-keys-attributes-for-service-worker.js';
+
+function wait(ms) {
+  return new Promise(resolve => step_timeout(resolve, ms));
+}
+
+promise_test(async (t) => {
+    const scope = './resources/blank.html?name=isReloadNavigation';
+    let frame;
+    let reg;
+
+    try {
+      reg = await service_worker_unregister_and_register(t, worker, scope);
+      await wait_for_state(t, reg.installing, 'activated');
+      frame = await with_iframe(scope);
+      assert_equals(frame.contentDocument.body.textContent,
+                    'original: false, stored: false');
+      await new Promise((resolve) => {
+        frame.onload = resolve;
+        frame.contentWindow.location.reload();
+      });
+      assert_equals(frame.contentDocument.body.textContent,
+                    'original: true, stored: true');
+    } finally {
+      if (frame) {
+        frame.remove();
+      }
+      if (reg) {
+        await reg.unregister();
+      }
+    }
+}, 'Request.IsReloadNavigation should persist.');
+
+promise_test(async (t) => {
+    const scope = './resources/blank.html?name=isHistoryNavigation';
+    let frame;
+    let reg;
+
+    try {
+      reg = await service_worker_unregister_and_register(t, worker, scope);
+      await wait_for_state(t, reg.installing, 'activated');
+      frame = await with_iframe(scope);
+      assert_equals(frame.contentDocument.body.textContent,
+                    'original: false, stored: false');
+      // Use step_timeout(0) to ensure the history entry is created for Blink
+      // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+      await wait(0);
+      await new Promise((resolve) => {
+        frame.onload = resolve;
+        frame.src = '../resources/blank.html?ignore';
+      });
+      await wait(0);
+      await new Promise((resolve) => {
+        frame.onload = resolve;
+        frame.contentWindow.history.go(-1);
+      });
+      assert_equals(frame.contentDocument.body.textContent,
+                    'original: true, stored: true');
+    } finally {
+      if (frame) {
+        frame.remove();
+      }
+      if (reg) {
+        await reg.unregister();
+      }
+    }
+}, 'Request.IsHistoryNavigation should persist.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-keys.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-keys.https.any.js
new file mode 100644
index 000000000000..232fb760d408
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-keys.https.any.js
@@ -0,0 +1,212 @@
+// META: title=Cache.keys
+// META: global=window,worker
+// META: script=./resources/test-helpers.js
+// META: timeout=long
+
+cache_test(cache => {
+    return cache.keys()
+      .then(requests => {
+          assert_equals(
+            requests.length, 0,
+            'Cache.keys should resolve to an empty array for an empty cache');
+        });
+  }, 'Cache.keys() called on an empty cache');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys('not-present-in-the-cache')
+      .then(function(result) {
+          assert_request_array_equals(
+            result, [],
+            'Cache.keys should resolve with an empty array on failure.');
+        });
+  }, 'Cache.keys with no matching entries');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys(entries.a.request.url)
+      .then(function(result) {
+          assert_request_array_equals(result, [entries.a.request],
+                                      'Cache.keys should match by URL.');
+        });
+  }, 'Cache.keys with URL');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys(entries.a.request)
+      .then(function(result) {
+          assert_request_array_equals(
+            result, [entries.a.request],
+            'Cache.keys should match by Request.');
+        });
+  }, 'Cache.keys with Request');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys(new Request(entries.a.request.url))
+      .then(function(result) {
+          assert_request_array_equals(
+            result, [entries.a.request],
+            'Cache.keys should match by Request.');
+        });
+  }, 'Cache.keys with new Request');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys(entries.a.request, {ignoreSearch: true})
+      .then(function(result) {
+          assert_request_array_equals(
+            result,
+            [
+              entries.a.request,
+              entries.a_with_query.request
+            ],
+            'Cache.keys with ignoreSearch should ignore the ' +
+            'search parameters of cached request.');
+        });
+  },
+  'Cache.keys with ignoreSearch option (request with no search ' +
+  'parameters)');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys(entries.a_with_query.request, {ignoreSearch: true})
+      .then(function(result) {
+          assert_request_array_equals(
+            result,
+            [
+              entries.a.request,
+              entries.a_with_query.request
+            ],
+            'Cache.keys with ignoreSearch should ignore the ' +
+            'search parameters of request.');
+        });
+  },
+  'Cache.keys with ignoreSearch option (request with search parameters)');
+
+cache_test(function(cache) {
+    var request = new Request('http://example.com/');
+    var head_request = new Request('http://example.com/', {method: 'HEAD'});
+    var response = new Response('foo');
+    return cache.put(request.clone(), response.clone())
+      .then(function() {
+          return cache.keys(head_request.clone());
+        })
+      .then(function(result) {
+          assert_request_array_equals(
+            result, [],
+            'Cache.keys should resolve with an empty array with a ' +
+            'mismatched method.');
+          return cache.keys(head_request.clone(),
+                            {ignoreMethod: true});
+        })
+      .then(function(result) {
+          assert_request_array_equals(
+            result,
+            [
+              request,
+            ],
+            'Cache.keys with ignoreMethod should ignore the ' +
+            'method of request.');
+        });
+  }, 'Cache.keys supports ignoreMethod');
+
+cache_test(function(cache) {
+    var vary_request = new Request('http://example.com/c',
+                                   {headers: {'Cookies': 'is-for-cookie'}});
+    var vary_response = new Response('', {headers: {'Vary': 'Cookies'}});
+    var mismatched_vary_request = new Request('http://example.com/c');
+
+    return cache.put(vary_request.clone(), vary_response.clone())
+      .then(function() {
+          return cache.keys(mismatched_vary_request.clone());
+        })
+      .then(function(result) {
+          assert_request_array_equals(
+            result, [],
+            'Cache.keys should resolve with an empty array with a ' +
+            'mismatched vary.');
+          return cache.keys(mismatched_vary_request.clone(),
+                              {ignoreVary: true});
+        })
+      .then(function(result) {
+          assert_request_array_equals(
+            result,
+            [
+              vary_request,
+            ],
+            'Cache.keys with ignoreVary should ignore the ' +
+            'vary of request.');
+        });
+  }, 'Cache.keys supports ignoreVary');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys(entries.cat.request.url + '#mouse')
+      .then(function(result) {
+          assert_request_array_equals(
+            result,
+            [
+              entries.cat.request,
+            ],
+            'Cache.keys should ignore URL fragment.');
+        });
+  }, 'Cache.keys with URL containing fragment');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys('http')
+      .then(function(result) {
+          assert_request_array_equals(
+            result, [],
+            'Cache.keys should treat query as a URL and not ' +
+            'just a string fragment.');
+        });
+  }, 'Cache.keys with string fragment "http" as query');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys()
+      .then(function(result) {
+          assert_request_array_equals(
+            result,
+            simple_entries.map(entry => entry.request),
+            'Cache.keys without parameters should match all entries.');
+        });
+  }, 'Cache.keys without parameters');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys(undefined)
+      .then(function(result) {
+          assert_request_array_equals(
+            result,
+            simple_entries.map(entry => entry.request),
+            'Cache.keys with undefined request should match all entries.');
+        });
+  }, 'Cache.keys with explicitly undefined request');
+
+cache_test(cache => {
+    return cache.keys(undefined, {})
+      .then(requests => {
+          assert_equals(
+            requests.length, 0,
+            'Cache.keys should resolve to an empty array for an empty cache');
+        });
+  }, 'Cache.keys with explicitly undefined request and empty options');
+
+prepopulated_cache_test(vary_entries, function(cache, entries) {
+    return cache.keys()
+      .then(function(result) {
+          assert_request_array_equals(
+            result,
+            [
+              entries.vary_cookie_is_cookie.request,
+              entries.vary_cookie_is_good.request,
+              entries.vary_cookie_absent.request,
+            ],
+            'Cache.keys without parameters should match all entries.');
+        });
+  }, 'Cache.keys without parameters and VARY entries');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys(new Request(entries.cat.request.url, {method: 'HEAD'}))
+      .then(function(result) {
+          assert_request_array_equals(
+            result, [],
+            'Cache.keys should not match HEAD request unless ignoreMethod ' +
+            'option is set.');
+        });
+  }, 'Cache.keys with a HEAD Request');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-match.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-match.https.any.js
new file mode 100644
index 000000000000..9ca45903cbb1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-match.https.any.js
@@ -0,0 +1,437 @@
+// META: title=Cache.match
+// META: global=window,worker
+// META: script=./resources/test-helpers.js
+// META: script=/common/get-host-info.sub.js
+// META: timeout=long
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match('not-present-in-the-cache')
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.match failures should resolve with undefined.');
+        });
+  }, 'Cache.match with no matching entries');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match(entries.a.request.url)
+      .then(function(result) {
+          assert_response_equals(result, entries.a.response,
+                                 'Cache.match should match by URL.');
+        });
+  }, 'Cache.match with URL');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match(entries.a.request)
+      .then(function(result) {
+          assert_response_equals(result, entries.a.response,
+                                 'Cache.match should match by Request.');
+        });
+  }, 'Cache.match with Request');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    var alt_response = new Response('', {status: 201});
+
+    return self.caches.open('second_matching_cache')
+      .then(function(cache) {
+          return cache.put(entries.a.request, alt_response.clone());
+        })
+      .then(function() {
+          return cache.match(entries.a.request);
+        })
+      .then(function(result) {
+          assert_response_equals(
+            result, entries.a.response,
+            'Cache.match should match the first cache.');
+        });
+  }, 'Cache.match with multiple cache hits');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match(new Request(entries.a.request.url))
+      .then(function(result) {
+          assert_response_equals(result, entries.a.response,
+                                 'Cache.match should match by Request.');
+        });
+  }, 'Cache.match with new Request');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match(new Request(entries.a.request.url, {method: 'HEAD'}))
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.match should not match HEAD Request.');
+        });
+  }, 'Cache.match with HEAD');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match(entries.a.request,
+                       {ignoreSearch: true})
+      .then(function(result) {
+          assert_response_in_array(
+            result,
+            [
+              entries.a.response,
+              entries.a_with_query.response
+            ],
+            'Cache.match with ignoreSearch should ignore the ' +
+            'search parameters of cached request.');
+        });
+  },
+  'Cache.match with ignoreSearch option (request with no search ' +
+  'parameters)');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match(entries.a_with_query.request,
+                       {ignoreSearch: true})
+      .then(function(result) {
+          assert_response_in_array(
+            result,
+            [
+              entries.a.response,
+              entries.a_with_query.response
+            ],
+            'Cache.match with ignoreSearch should ignore the ' +
+            'search parameters of request.');
+        });
+  },
+  'Cache.match with ignoreSearch option (request with search parameter)');
+
+cache_test(function(cache) {
+    var request = new Request('http://example.com/');
+    var head_request = new Request('http://example.com/', {method: 'HEAD'});
+    var response = new Response('foo');
+    return cache.put(request.clone(), response.clone())
+      .then(function() {
+          return cache.match(head_request.clone());
+        })
+      .then(function(result) {
+          assert_equals(
+            result, undefined,
+            'Cache.match should resolve as undefined with a ' +
+            'mismatched method.');
+          return cache.match(head_request.clone(),
+                             {ignoreMethod: true});
+        })
+      .then(function(result) {
+          assert_response_equals(
+            result, response,
+            'Cache.match with ignoreMethod should ignore the ' +
+            'method of request.');
+        });
+  }, 'Cache.match supports ignoreMethod');
+
+cache_test(function(cache) {
+    var vary_request = new Request('http://example.com/c',
+                                   {headers: {'Cookies': 'is-for-cookie'}});
+    var vary_response = new Response('', {headers: {'Vary': 'Cookies'}});
+    var mismatched_vary_request = new Request('http://example.com/c');
+
+    return cache.put(vary_request.clone(), vary_response.clone())
+      .then(function() {
+          return cache.match(mismatched_vary_request.clone());
+        })
+      .then(function(result) {
+          assert_equals(
+            result, undefined,
+            'Cache.match should resolve as undefined with a ' +
+            'mismatched vary.');
+          return cache.match(mismatched_vary_request.clone(),
+                              {ignoreVary: true});
+        })
+      .then(function(result) {
+          assert_response_equals(
+            result, vary_response,
+            'Cache.match with ignoreVary should ignore the ' +
+            'vary of request.');
+        });
+  }, 'Cache.match supports ignoreVary');
+
+cache_test(function(cache) {
+    let has_cache_name = false;
+    const opts = {
+      get cacheName() {
+        has_cache_name = true;
+        return undefined;
+      }
+    };
+    return self.caches.open('foo')
+      .then(function() {
+          return cache.match('bar', opts);
+        })
+      .then(function() {
+          assert_false(has_cache_name,
+                       'Cache.match does not support cacheName option ' +
+                       'which was removed in CacheQueryOptions.');
+        });
+  }, 'Cache.match does not support cacheName option');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match(entries.cat.request.url + '#mouse')
+      .then(function(result) {
+          assert_response_equals(result, entries.cat.response,
+                                 'Cache.match should ignore URL fragment.');
+        });
+  }, 'Cache.match with URL containing fragment');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match('http')
+      .then(function(result) {
+          assert_equals(
+            result, undefined,
+            'Cache.match should treat query as a URL and not ' +
+            'just a string fragment.');
+        });
+  }, 'Cache.match with string fragment "http" as query');
+
+prepopulated_cache_test(vary_entries, function(cache, entries) {
+    return cache.match('http://example.com/c')
+      .then(function(result) {
+          assert_response_in_array(
+            result,
+            [
+              entries.vary_cookie_absent.response
+            ],
+            'Cache.match should honor "Vary" header.');
+        });
+  }, 'Cache.match with responses containing "Vary" header');
+
+cache_test(function(cache) {
+    var request = new Request('http://example.com');
+    var response;
+    var request_url = new URL('./resources/simple.txt', location.href).href;
+    return fetch(request_url)
+      .then(function(fetch_result) {
+          response = fetch_result;
+          assert_equals(
+            response.url, request_url,
+            '[https://fetch.spec.whatwg.org/#dom-response-url] ' +
+            'Reponse.url should return the URL of the response.');
+          return cache.put(request, response.clone());
+        })
+      .then(function() {
+          return cache.match(request.url);
+        })
+      .then(function(result) {
+          assert_response_equals(
+            result, response,
+            'Cache.match should return a Response object that has the same ' +
+            'properties as the stored response.');
+          return cache.match(response.url);
+        })
+      .then(function(result) {
+          assert_equals(
+            result, undefined,
+            'Cache.match should not match cache entry based on response URL.');
+        });
+  }, 'Cache.match with Request and Response objects with different URLs');
+
+cache_test(function(cache) {
+    var request_url = new URL('./resources/simple.txt', location.href).href;
+    return fetch(request_url)
+      .then(function(fetch_result) {
+          return cache.put(new Request(request_url), fetch_result);
+        })
+      .then(function() {
+          return cache.match(request_url);
+        })
+      .then(function(result) {
+          return result.text();
+        })
+      .then(function(body_text) {
+          assert_equals(body_text, 'a simple text file\n',
+                        'Cache.match should return a Response object with a ' +
+                        'valid body.');
+        })
+      .then(function() {
+          return cache.match(request_url);
+        })
+      .then(function(result) {
+          return result.text();
+        })
+      .then(function(body_text) {
+          assert_equals(body_text, 'a simple text file\n',
+                        'Cache.match should return a Response object with a ' +
+                        'valid body each time it is called.');
+        });
+  }, 'Cache.match invoked multiple times for the same Request/Response');
+
+cache_test(function(cache) {
+    var request_url = new URL('./resources/simple.txt', location.href).href;
+    return fetch(request_url)
+      .then(function(fetch_result) {
+          return cache.put(new Request(request_url), fetch_result);
+        })
+      .then(function() {
+          return cache.match(request_url);
+        })
+      .then(function(result) {
+          return result.blob();
+        })
+      .then(function(blob) {
+          var sliced = blob.slice(2,8);
+
+          return new Promise(function (resolve, reject) {
+              var reader = new FileReader();
+              reader.onloadend = function(event) {
+                resolve(event.target.result);
+              };
+              reader.readAsText(sliced);
+            });
+        })
+      .then(function(text) {
+          assert_equals(text, 'simple',
+                        'A Response blob returned by Cache.match should be ' +
+                        'sliceable.' );
+        });
+  }, 'Cache.match blob should be sliceable');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    var request = new Request(entries.a.request.clone(), {method: 'POST'});
+    return cache.match(request)
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.match should not find a match');
+        });
+  }, 'Cache.match with POST Request');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    var response = entries.non_2xx_response.response;
+    return cache.match(entries.non_2xx_response.request.url)
+      .then(function(result) {
+          assert_response_equals(
+              result, entries.non_2xx_response.response,
+              'Cache.match should return a Response object that has the ' +
+                  'same properties as a stored non-2xx response.');
+        });
+  }, 'Cache.match with a non-2xx Response');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    var response = entries.error_response.response;
+    return cache.match(entries.error_response.request.url)
+      .then(function(result) {
+          assert_response_equals(
+              result, entries.error_response.response,
+              'Cache.match should return a Response object that has the ' +
+                  'same properties as a stored network error response.');
+        });
+  }, 'Cache.match with a network error Response');
+
+cache_test(function(cache) {
+    // This test validates that we can get a Response from the Cache API,
+    // clone it, and read just one side of the clone.  This was previously
+    // bugged in FF for Responses with large bodies.
+    var data = [];
+    data.length = 80 * 1024;
+    data.fill('F');
+    var response;
+    return cache.put('/', new Response(data.toString()))
+      .then(function(result) {
+          return cache.match('/');
+        })
+      .then(function(r) {
+          // Make sure the original response is not GC'd.
+          response = r;
+          // Return only the clone.  We purposefully test that the other
+          // half of the clone does not need to be read here.
+          return response.clone().text();
+        })
+      .then(function(text) {
+          assert_equals(text, data.toString(), 'cloned body text can be read correctly');
+        });
+  }, 'Cache produces large Responses that can be cloned and read correctly.');
+
+cache_test(async (cache) => {
+    const url = get_host_info().HTTPS_REMOTE_ORIGIN +
+      '/service-workers/cache-storage/resources/simple.txt?pipe=' +
+      'header(access-control-allow-origin,*)|' +
+      'header(access-control-expose-headers,*)|' +
+      'header(foo,bar)|' +
+      'header(set-cookie,X)';
+
+    const response = await fetch(url);
+    await cache.put(new Request(url), response);
+    const cached_response = await cache.match(url);
+
+    const headers = cached_response.headers;
+    assert_equals(headers.get('access-control-expose-headers'), '*');
+    assert_equals(headers.get('foo'), 'bar');
+    assert_equals(headers.get('set-cookie'), null);
+  }, 'cors-exposed header should be stored correctly.');
+
+cache_test(async (cache) => {
+    // A URL that should load a resource with a known mime type.
+    const url = '/service-workers/cache-storage/resources/blank.html';
+    const expected_mime_type = 'text/html';
+
+    // Verify we get the expected mime type from the network.  Note,
+    // we cannot use an exact match here since some browsers append
+    // character encoding information to the blob.type value.
+    const net_response = await fetch(url);
+    const net_mime_type = (await net_response.blob()).type;
+    assert_true(net_mime_type.includes(expected_mime_type),
+                'network response should include the expected mime type');
+
+    // Verify we get the exact same mime type when reading the same
+    // URL resource back out of the cache.
+    await cache.add(url);
+    const cache_response = await cache.match(url);
+    const cache_mime_type = (await cache_response.blob()).type;
+    assert_equals(cache_mime_type, net_mime_type,
+                  'network and cache response mime types should match');
+  }, 'MIME type should be set from content-header correctly.');
+
+cache_test(async (cache) => {
+    const url = '/dummy';
+    const original_type = 'text/html';
+    const override_type = 'text/plain';
+    const init_with_headers = {
+      headers: {
+        'content-type': original_type
+      }
+    }
+
+    // Verify constructing a synthetic response with a content-type header
+    // gets the correct mime type.
+    const response = new Response('hello world', init_with_headers);
+    const original_response_type = (await response.blob()).type;
+    assert_true(original_response_type.includes(original_type),
+                'original response should include the expected mime type');
+
+    // Verify overwriting the content-type header changes the mime type.
+    const overwritten_response = new Response('hello world', init_with_headers);
+    overwritten_response.headers.set('content-type', override_type);
+    const overwritten_response_type = (await overwritten_response.blob()).type;
+    assert_equals(overwritten_response_type, override_type,
+                  'mime type can be overridden');
+
+    // Verify the Response read from Cache uses the original mime type
+    // computed when it was first constructed.
+    const tmp = new Response('hello world', init_with_headers);
+    tmp.headers.set('content-type', override_type);
+    await cache.put(url, tmp);
+    const cache_response = await cache.match(url);
+    const cache_mime_type = (await cache_response.blob()).type;
+    assert_equals(cache_mime_type, override_type,
+                  'overwritten and cached response mime types should match');
+  }, 'MIME type should reflect Content-Type headers of response.');
+
+cache_test(async (cache) => {
+  const url = new URL('./resources/vary.py?vary=foo',
+      get_host_info().HTTPS_REMOTE_ORIGIN + self.location.pathname);
+  const original_request = new Request(url, { mode: 'no-cors',
+                                              headers: { 'foo': 'bar' } });
+  const fetch_response = await fetch(original_request);
+  assert_equals(fetch_response.type, 'opaque');
+
+  await cache.put(original_request, fetch_response);
+
+  const match_response_1 = await cache.match(original_request);
+  assert_not_equals(match_response_1, undefined);
+
+  // Verify that cache.match() finds the entry even if queried with a varied
+  // header that does not match the cache key.  Vary headers should be ignored
+  // for opaque responses.
+  const different_request = new Request(url, { headers: { 'foo': 'CHANGED' } });
+  const match_response_2 = await cache.match(different_request);
+  assert_not_equals(match_response_2, undefined);
+}, 'Cache.match ignores vary headers on opaque response.');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-matchAll.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-matchAll.https.any.js
new file mode 100644
index 000000000000..93c55178918c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-matchAll.https.any.js
@@ -0,0 +1,244 @@
+// META: title=Cache.matchAll
+// META: global=window,worker
+// META: script=./resources/test-helpers.js
+// META: timeout=long
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll('not-present-in-the-cache')
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [],
+            'Cache.matchAll should resolve with an empty array on failure.');
+        });
+  }, 'Cache.matchAll with no matching entries');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(entries.a.request.url)
+      .then(function(result) {
+          assert_response_array_equals(result, [entries.a.response],
+                                       'Cache.matchAll should match by URL.');
+        });
+  }, 'Cache.matchAll with URL');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(entries.a.request)
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [entries.a.response],
+            'Cache.matchAll should match by Request.');
+        });
+  }, 'Cache.matchAll with Request');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(new Request(entries.a.request.url))
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [entries.a.response],
+            'Cache.matchAll should match by Request.');
+        });
+  }, 'Cache.matchAll with new Request');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(new Request(entries.a.request.url, {method: 'HEAD'}),
+                          {ignoreSearch: true})
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [],
+            'Cache.matchAll should not match HEAD Request.');
+        });
+  }, 'Cache.matchAll with HEAD');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(entries.a.request,
+                          {ignoreSearch: true})
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [
+              entries.a.response,
+              entries.a_with_query.response
+            ],
+            'Cache.matchAll with ignoreSearch should ignore the ' +
+            'search parameters of cached request.');
+        });
+  },
+  'Cache.matchAll with ignoreSearch option (request with no search ' +
+  'parameters)');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(entries.a_with_query.request,
+                          {ignoreSearch: true})
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [
+              entries.a.response,
+              entries.a_with_query.response
+            ],
+            'Cache.matchAll with ignoreSearch should ignore the ' +
+            'search parameters of request.');
+        });
+  },
+  'Cache.matchAll with ignoreSearch option (request with search parameters)');
+
+cache_test(function(cache) {
+    var request = new Request('http://example.com/');
+    var head_request = new Request('http://example.com/', {method: 'HEAD'});
+    var response = new Response('foo');
+    return cache.put(request.clone(), response.clone())
+      .then(function() {
+          return cache.matchAll(head_request.clone());
+        })
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [],
+            'Cache.matchAll should resolve with empty array for a ' +
+            'mismatched method.');
+          return cache.matchAll(head_request.clone(),
+                                {ignoreMethod: true});
+        })
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [response],
+            'Cache.matchAll with ignoreMethod should ignore the ' +
+            'method of request.');
+        });
+  }, 'Cache.matchAll supports ignoreMethod');
+
+cache_test(function(cache) {
+    var vary_request = new Request('http://example.com/c',
+                                   {headers: {'Cookies': 'is-for-cookie'}});
+    var vary_response = new Response('', {headers: {'Vary': 'Cookies'}});
+    var mismatched_vary_request = new Request('http://example.com/c');
+
+    return cache.put(vary_request.clone(), vary_response.clone())
+      .then(function() {
+          return cache.matchAll(mismatched_vary_request.clone());
+        })
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [],
+            'Cache.matchAll should resolve as undefined with a ' +
+            'mismatched vary.');
+          return cache.matchAll(mismatched_vary_request.clone(),
+                              {ignoreVary: true});
+        })
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [vary_response],
+            'Cache.matchAll with ignoreVary should ignore the ' +
+            'vary of request.');
+        });
+  }, 'Cache.matchAll supports ignoreVary');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(entries.cat.request.url + '#mouse')
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [
+              entries.cat.response,
+            ],
+            'Cache.matchAll should ignore URL fragment.');
+        });
+  }, 'Cache.matchAll with URL containing fragment');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll('http')
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [],
+            'Cache.matchAll should treat query as a URL and not ' +
+            'just a string fragment.');
+        });
+  }, 'Cache.matchAll with string fragment "http" as query');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll()
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            simple_entries.map(entry => entry.response),
+            'Cache.matchAll without parameters should match all entries.');
+        });
+  }, 'Cache.matchAll without parameters');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(undefined)
+      .then(result => {
+          assert_response_array_equals(
+            result,
+            simple_entries.map(entry => entry.response),
+            'Cache.matchAll with undefined request should match all entries.');
+        });
+  }, 'Cache.matchAll with explicitly undefined request');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+  return cache.matchAll(undefined, {})
+      .then(result => {
+          assert_response_array_equals(
+            result,
+            simple_entries.map(entry => entry.response),
+            'Cache.matchAll with undefined request should match all entries.');
+        });
+  }, 'Cache.matchAll with explicitly undefined request and empty options');
+
+prepopulated_cache_test(vary_entries, function(cache, entries) {
+    return cache.matchAll('http://example.com/c')
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [
+              entries.vary_cookie_absent.response
+            ],
+            'Cache.matchAll should exclude matches if a vary header is ' +
+            'missing in the query request, but is present in the cached ' +
+            'request.');
+        })
+
+      .then(function() {
+          return cache.matchAll(
+            new Request('http://example.com/c',
+                        {headers: {'Cookies': 'none-of-the-above'}}));
+        })
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [
+            ],
+            'Cache.matchAll should exclude matches if a vary header is ' +
+            'missing in the cached request, but is present in the query ' +
+            'request.');
+        })
+
+      .then(function() {
+          return cache.matchAll(
+            new Request('http://example.com/c',
+                        {headers: {'Cookies': 'is-for-cookie'}}));
+        })
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [entries.vary_cookie_is_cookie.response],
+            'Cache.matchAll should match the entire header if a vary header ' +
+            'is present in both the query and cached requests.');
+        });
+  }, 'Cache.matchAll with responses containing "Vary" header');
+
+prepopulated_cache_test(vary_entries, function(cache, entries) {
+    return cache.matchAll('http://example.com/c',
+                          {ignoreVary: true})
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [
+              entries.vary_cookie_is_cookie.response,
+              entries.vary_cookie_is_good.response,
+              entries.vary_cookie_absent.response
+            ],
+            'Cache.matchAll should support multiple vary request/response ' +
+            'pairs.');
+        });
+  }, 'Cache.matchAll with multiple vary pairs');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-put.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-put.https.any.js
new file mode 100644
index 000000000000..dbf2650a75a5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-put.https.any.js
@@ -0,0 +1,411 @@
+// META: title=Cache.put
+// META: global=window,worker
+// META: script=/common/get-host-info.sub.js
+// META: script=./resources/test-helpers.js
+// META: timeout=long
+
+var test_url = 'https://example.com/foo';
+var test_body = 'Hello world!';
+const { REMOTE_HOST } = get_host_info();
+
+cache_test(function(cache) {
+    var request = new Request(test_url);
+    var response = new Response(test_body);
+    return cache.put(request, response)
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.put should resolve with undefined on success.');
+        });
+  }, 'Cache.put called with simple Request and Response');
+
+cache_test(function(cache) {
+    var test_url = new URL('./resources/simple.txt', location.href).href;
+    var request = new Request(test_url);
+    var response;
+    return fetch(test_url)
+      .then(function(fetch_result) {
+          response = fetch_result.clone();
+          return cache.put(request, fetch_result);
+        })
+      .then(function() {
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_response_equals(result, response,
+                                 'Cache.put should update the cache with ' +
+                                 'new request and response.');
+          return result.text();
+        })
+      .then(function(body) {
+          assert_equals(body, 'a simple text file\n',
+                        'Cache.put should store response body.');
+        });
+  }, 'Cache.put called with Request and Response from fetch()');
+
+cache_test(function(cache) {
+    var request = new Request(test_url);
+    var response = new Response(test_body);
+    assert_false(request.bodyUsed,
+                 '[https://fetch.spec.whatwg.org/#dom-body-bodyused] ' +
+                 'Request.bodyUsed should be initially false.');
+    return cache.put(request, response)
+      .then(function() {
+        assert_false(request.bodyUsed,
+                     'Cache.put should not mark empty request\'s body used');
+      });
+  }, 'Cache.put with Request without a body');
+
+cache_test(function(cache) {
+    var request = new Request(test_url);
+    var response = new Response();
+    assert_false(response.bodyUsed,
+                 '[https://fetch.spec.whatwg.org/#dom-body-bodyused] ' +
+                 'Response.bodyUsed should be initially false.');
+    return cache.put(request, response)
+      .then(function() {
+        assert_false(response.bodyUsed,
+                     'Cache.put should not mark empty response\'s body used');
+      });
+  }, 'Cache.put with Response without a body');
+
+cache_test(function(cache) {
+    var request = new Request(test_url);
+    var response = new Response(test_body);
+    return cache.put(request, response.clone())
+      .then(function() {
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_response_equals(result, response,
+                                 'Cache.put should update the cache with ' +
+                                 'new Request and Response.');
+        });
+  }, 'Cache.put with a Response containing an empty URL');
+
+cache_test(function(cache) {
+    var request = new Request(test_url);
+    var response = new Response('', {
+        status: 200,
+        headers: [['Content-Type', 'text/plain']]
+      });
+    return cache.put(request, response)
+      .then(function() {
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_equals(result.status, 200, 'Cache.put should store status.');
+          assert_equals(result.headers.get('Content-Type'), 'text/plain',
+                        'Cache.put should store headers.');
+          return result.text();
+        })
+      .then(function(body) {
+          assert_equals(body, '',
+                        'Cache.put should store response body.');
+        });
+  }, 'Cache.put with an empty response body');
+
+cache_test(function(cache, test) {
+    var request = new Request(test_url);
+    var response = new Response('', {
+        status: 206,
+        headers: [['Content-Type', 'text/plain']]
+      });
+
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.put(request, response),
+      'Cache.put should reject 206 Responses with a TypeError.');
+  }, 'Cache.put with synthetic 206 response');
+
+cache_test(function(cache, test) {
+    var test_url = new URL('./resources/fetch-status.py?status=206', location.href).href;
+    var request = new Request(test_url);
+    var response;
+    return fetch(test_url)
+      .then(function(fetch_result) {
+          assert_equals(fetch_result.status, 206,
+                        'Test framework error: The status code should be 206.');
+          response = fetch_result.clone();
+          return promise_rejects_js(test, TypeError, cache.put(request, fetch_result));
+        });
+  }, 'Cache.put with HTTP 206 response');
+
+cache_test(function(cache, test) {
+    // We need to jump through some hoops to allow the test to perform opaque
+    // response filtering, but bypass the ORB safelist check. This is
+    // done, by forcing the MIME type retrieval to fail and the
+    // validation of partial first response to succeed.
+    var pipe = "status(206)|header(Content-Type,)|header(Content-Range, bytes 0-1/41)|slice(null, 1)";
+    var test_url = new URL(`./resources/blank.html?pipe=${pipe}`, location.href);
+    test_url.hostname = REMOTE_HOST;
+    var request = new Request(test_url.href, { mode: 'no-cors' });
+    var response;
+    return fetch(request)
+      .then(function(fetch_result) {
+          assert_equals(fetch_result.type, 'opaque',
+              'Test framework error: The response type should be opaque.');
+          assert_equals(fetch_result.status, 0,
+              'Test framework error: The status code should be 0 for an ' +
+              ' opaque-filtered response. This is actually HTTP 206.');
+          response = fetch_result.clone();
+          return cache.put(request, fetch_result);
+        })
+      .then(function() {
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_not_equals(result, undefined,
+              'Cache.put should store an entry for the opaque response');
+        });
+  }, 'Cache.put with opaque-filtered HTTP 206 response');
+
+cache_test(function(cache) {
+    var test_url = new URL('./resources/fetch-status.py?status=500', location.href).href;
+    var request = new Request(test_url);
+    var response;
+    return fetch(test_url)
+      .then(function(fetch_result) {
+          assert_equals(fetch_result.status, 500,
+                        'Test framework error: The status code should be 500.');
+          response = fetch_result.clone();
+          return cache.put(request, fetch_result);
+        })
+      .then(function() {
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_response_equals(result, response,
+                                 'Cache.put should update the cache with ' +
+                                 'new request and response.');
+          return result.text();
+        })
+      .then(function(body) {
+          assert_equals(body, '',
+                        'Cache.put should store response body.');
+        });
+  }, 'Cache.put with HTTP 500 response');
+
+cache_test(function(cache) {
+    var alternate_response_body = 'New body';
+    var alternate_response = new Response(alternate_response_body,
+                                          { statusText: 'New status' });
+    return cache.put(new Request(test_url),
+                     new Response('Old body', { statusText: 'Old status' }))
+      .then(function() {
+          return cache.put(new Request(test_url), alternate_response.clone());
+        })
+      .then(function() {
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_response_equals(result, alternate_response,
+                                 'Cache.put should replace existing ' +
+                                 'response with new response.');
+          return result.text();
+        })
+      .then(function(body) {
+          assert_equals(body, alternate_response_body,
+                        'Cache put should store new response body.');
+        });
+  }, 'Cache.put called twice with matching Requests and different Responses');
+
+cache_test(function(cache) {
+    var first_url = test_url;
+    var second_url = first_url + '#(O_o)';
+    var third_url = first_url + '#fragment';
+    var alternate_response_body = 'New body';
+    var alternate_response = new Response(alternate_response_body,
+                                          { statusText: 'New status' });
+    return cache.put(new Request(first_url),
+                     new Response('Old body', { statusText: 'Old status' }))
+      .then(function() {
+          return cache.put(new Request(second_url), alternate_response.clone());
+        })
+      .then(function() {
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_response_equals(result, alternate_response,
+                                 'Cache.put should replace existing ' +
+                                 'response with new response.');
+          return result.text();
+        })
+      .then(function(body) {
+          assert_equals(body, alternate_response_body,
+                        'Cache put should store new response body.');
+        })
+      .then(function() {
+          return cache.put(new Request(third_url), alternate_response.clone());
+        })
+      .then(function() {
+          return cache.keys();
+        })
+      .then(function(results) {
+          // Should match urls (without fragments or with different ones) to the
+          // same cache key. However, result.url should be the latest url used.
+          assert_equals(results[0].url, third_url);
+          return;
+        });
+}, 'Cache.put called multiple times with request URLs that differ only by a fragment');
+
+cache_test(function(cache) {
+    var url = 'http://example.com/foo';
+    return cache.put(url, new Response('some body'))
+      .then(function() { return cache.match(url); })
+      .then(function(response) { return response.text(); })
+      .then(function(body) {
+          assert_equals(body, 'some body',
+                        'Cache.put should accept a string as request.');
+        });
+  }, 'Cache.put with a string request');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.put(new Request(test_url), 'Hello world!'),
+      'Cache.put should only accept a Response object as the response.');
+  }, 'Cache.put with an invalid response');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.put(new Request('file:///etc/passwd'),
+                new Response(test_body)),
+      'Cache.put should reject non-HTTP/HTTPS requests with a TypeError.');
+  }, 'Cache.put with a non-HTTP/HTTPS request');
+
+cache_test(function(cache) {
+    var response = new Response(test_body);
+    return cache.put(new Request('relative-url'), response.clone())
+      .then(function() {
+          return cache.match(new URL('relative-url', location.href).href);
+        })
+      .then(function(result) {
+          assert_response_equals(result, response,
+                                 'Cache.put should accept a relative URL ' +
+                                 'as the request.');
+        });
+  }, 'Cache.put with a relative URL');
+
+cache_test(function(cache, test) {
+    var request = new Request('http://example.com/foo', { method: 'HEAD' });
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.put(request, new Response(test_body)),
+      'Cache.put should throw a TypeError for non-GET requests.');
+  }, 'Cache.put with a non-GET request');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.put(new Request(test_url), null),
+      'Cache.put should throw a TypeError for a null response.');
+  }, 'Cache.put with a null response');
+
+cache_test(function(cache, test) {
+    var request = new Request(test_url, {method: 'POST', body: test_body});
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.put(request, new Response(test_body)),
+      'Cache.put should throw a TypeError for a POST request.');
+  }, 'Cache.put with a POST request');
+
+cache_test(function(cache) {
+    var response = new Response(test_body);
+    assert_false(response.bodyUsed,
+                 '[https://fetch.spec.whatwg.org/#dom-body-bodyused] ' +
+                 'Response.bodyUsed should be initially false.');
+    return response.text().then(function() {
+      assert_true(
+        response.bodyUsed,
+        '[https://fetch.spec.whatwg.org/#concept-body-consume-body] ' +
+          'The text() method should make the body disturbed.');
+      var request = new Request(test_url);
+      return cache.put(request, response).then(() => {
+          assert_unreached('cache.put should be rejected');
+        }, () => {});
+    });
+  }, 'Cache.put with a used response body');
+
+cache_test(function(cache) {
+    var response = new Response(test_body);
+    return cache.put(new Request(test_url), response)
+      .then(function() {
+          assert_throws_js(TypeError, () => response.body.getReader());
+      });
+  }, 'getReader() after Cache.put');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.put(new Request(test_url),
+                new Response(test_body, { headers: { VARY: '*' }})),
+      'Cache.put should reject VARY:* Responses with a TypeError.');
+  }, 'Cache.put with a VARY:* Response');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.put(new Request(test_url),
+                new Response(test_body,
+                             { headers: { VARY: 'Accept-Language,*' }})),
+      'Cache.put should reject Responses with an embedded VARY:* with a ' +
+      'TypeError.');
+  }, 'Cache.put with an embedded VARY:* Response');
+
+cache_test(async function(cache, test) {
+    const url = new URL('./resources/vary.py?vary=*',
+        get_host_info().HTTPS_REMOTE_ORIGIN + self.location.pathname);
+    const request = new Request(url, { mode: 'no-cors' });
+    const response = await fetch(request);
+    assert_equals(response.type, 'opaque');
+    await cache.put(request, response);
+  }, 'Cache.put with a VARY:* opaque response should not reject');
+
+cache_test(function(cache) {
+    var url = 'foo.html';
+    var redirectURL = 'http://example.com/foo-bar.html';
+    var redirectResponse = Response.redirect(redirectURL);
+    assert_equals(redirectResponse.headers.get('Location'), redirectURL,
+                  'Response.redirect() should set Location header.');
+    return cache.put(url, redirectResponse.clone())
+      .then(function() {
+          return cache.match(url);
+        })
+      .then(function(response) {
+          assert_response_equals(response, redirectResponse,
+                                 'Redirect response is reproduced by the Cache API');
+          assert_equals(response.headers.get('Location'), redirectURL,
+                        'Location header is preserved by Cache API.');
+        });
+  }, 'Cache.put should store Response.redirect() correctly');
+
+cache_test(async (cache) => {
+    var request = new Request(test_url);
+    var response = new Response(new Blob([test_body]));
+    await cache.put(request, response);
+    var cachedResponse = await cache.match(request);
+    assert_equals(await cachedResponse.text(), test_body);
+  }, 'Cache.put called with simple Request and blob Response');
+
+cache_test(async (cache) => {
+  var formData = new FormData();
+  formData.append("name", "value");
+
+  var request = new Request(test_url);
+  var response = new Response(formData);
+  await cache.put(request, response);
+  var cachedResponse = await cache.match(request);
+  var cachedResponseText = await cachedResponse.text();
+  assert_true(cachedResponseText.indexOf("name=\"name\"\r\n\r\nvalue") !== -1);
+}, 'Cache.put called with simple Request and form data Response');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-storage-buckets.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-storage-buckets.https.any.js
new file mode 100644
index 000000000000..fd59ba464db0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-storage-buckets.https.any.js
@@ -0,0 +1,64 @@
+// META: title=Cache.put
+// META: global=window,worker
+// META: script=/common/get-host-info.sub.js
+// META: script=resources/test-helpers.js
+// META: script=/storage/buckets/resources/util.js
+// META: timeout=long
+
+var test_url = 'https://example.com/foo';
+var test_body = 'Hello world!';
+const { REMOTE_HOST } = get_host_info();
+
+promise_test(async function(test) {
+  await prepareForBucketTest(test);
+  var inboxBucket = await navigator.storageBuckets.open('inbox');
+  var draftsBucket = await navigator.storageBuckets.open('drafts');
+
+  const cacheName = 'attachments';
+  const cacheKey = 'receipt1.txt';
+
+  var inboxCache = await inboxBucket.caches.open(cacheName);
+  var draftsCache = await draftsBucket.caches.open(cacheName);
+
+  await inboxCache.put(cacheKey, new Response('bread x 2'))
+  await draftsCache.put(cacheKey, new Response('eggs x 1'));
+
+  return inboxCache.match(cacheKey)
+      .then(function(result) {
+        return result.text();
+      })
+      .then(function(body) {
+        assert_equals(body, 'bread x 2', 'Wrong cache contents');
+        return draftsCache.match(cacheKey);
+      })
+      .then(function(result) {
+        return result.text();
+      })
+      .then(function(body) {
+        assert_equals(body, 'eggs x 1', 'Wrong cache contents');
+      });
+}, 'caches from different buckets have different contents');
+
+promise_test(async function(test) {
+  await prepareForBucketTest(test);
+  var inboxBucket = await navigator.storageBuckets.open('inbox');
+  var draftBucket = await navigator.storageBuckets.open('drafts');
+
+  var caches = inboxBucket.caches;
+  var attachments = await caches.open('attachments');
+  await attachments.put('receipt1.txt', new Response('bread x 2'));
+  var result = await attachments.match('receipt1.txt');
+  assert_equals(await result.text(), 'bread x 2');
+
+  await navigator.storageBuckets.delete('inbox');
+
+  await promise_rejects_dom(
+      test, 'UnknownError', caches.open('attachments'));
+
+  // Also test when `caches` is first accessed after the deletion.
+  await navigator.storageBuckets.delete('drafts');
+  return promise_rejects_dom(
+      test, 'UnknownError', draftBucket.caches.open('attachments'));
+}, 'cache.open promise is rejected when bucket is gone');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-storage-keys.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-storage-keys.https.any.js
new file mode 100644
index 000000000000..f19522be1b43
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-storage-keys.https.any.js
@@ -0,0 +1,35 @@
+// META: title=CacheStorage.keys
+// META: global=window,worker
+// META: script=./resources/test-helpers.js
+// META: timeout=long
+
+var test_cache_list =
+  ['', 'example', 'Another cache name', 'A', 'a', 'ex ample'];
+
+promise_test(function(test) {
+    return self.caches.keys()
+      .then(function(keys) {
+          assert_true(Array.isArray(keys),
+                      'CacheStorage.keys should return an Array.');
+          return Promise.all(keys.map(function(key) {
+              return self.caches.delete(key);
+            }));
+        })
+      .then(function() {
+          return Promise.all(test_cache_list.map(function(key) {
+              return self.caches.open(key);
+            }));
+        })
+
+      .then(function() { return self.caches.keys(); })
+      .then(function(keys) {
+          assert_true(Array.isArray(keys),
+                      'CacheStorage.keys should return an Array.');
+          assert_array_equals(keys,
+                              test_cache_list,
+                              'CacheStorage.keys should only return ' +
+                              'existing caches.');
+        });
+  }, 'CacheStorage keys');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-storage-match.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-storage-match.https.any.js
new file mode 100644
index 000000000000..0c31b726294b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-storage-match.https.any.js
@@ -0,0 +1,245 @@
+// META: title=CacheStorage.match
+// META: global=window,worker
+// META: script=./resources/test-helpers.js
+// META: timeout=long
+
+(function() {
+  var next_index = 1;
+
+  // Returns a transaction (request, response, and url) for a unique URL.
+  function create_unique_transaction(test) {
+    var uniquifier = String(next_index++);
+    var url = 'http://example.com/' + uniquifier;
+
+    return {
+      request: new Request(url),
+      response: new Response('hello'),
+      url: url
+    };
+  }
+
+  self.create_unique_transaction = create_unique_transaction;
+})();
+
+cache_test(function(cache) {
+    var transaction = create_unique_transaction();
+
+    return cache.put(transaction.request.clone(), transaction.response.clone())
+      .then(function() {
+          return self.caches.match(transaction.request);
+        })
+      .then(function(response) {
+          assert_response_equals(response, transaction.response,
+                                 'The response should not have changed.');
+        });
+}, 'CacheStorageMatch with no cache name provided');
+
+cache_test(function(cache) {
+    var transaction = create_unique_transaction();
+
+    var test_cache_list = ['a', 'b', 'c'];
+    return cache.put(transaction.request.clone(), transaction.response.clone())
+      .then(function() {
+          return Promise.all(test_cache_list.map(function(key) {
+              return self.caches.open(key);
+            }));
+        })
+      .then(function() {
+          return self.caches.match(transaction.request);
+        })
+      .then(function(response) {
+          assert_response_equals(response, transaction.response,
+                                 'The response should not have changed.');
+        });
+}, 'CacheStorageMatch from one of many caches');
+
+promise_test(function(test) {
+    var transaction = create_unique_transaction();
+
+    var test_cache_list = ['x', 'y', 'z'];
+    return Promise.all(test_cache_list.map(function(key) {
+        return self.caches.open(key);
+      }))
+      .then(function() { return self.caches.open('x'); })
+      .then(function(cache) {
+          return cache.put(transaction.request.clone(),
+                           transaction.response.clone());
+        })
+      .then(function() {
+          return self.caches.match(transaction.request, {cacheName: 'x'});
+        })
+      .then(function(response) {
+          assert_response_equals(response, transaction.response,
+                                 'The response should not have changed.');
+        })
+      .then(function() {
+          return self.caches.match(transaction.request, {cacheName: 'y'});
+        })
+      .then(function(response) {
+          assert_equals(response, undefined,
+                        'Cache y should not have a response for the request.');
+        });
+}, 'CacheStorageMatch from one of many caches by name');
+
+cache_test(function(cache) {
+    var transaction = create_unique_transaction();
+    return cache.put(transaction.url, transaction.response.clone())
+      .then(function() {
+          return self.caches.match(transaction.request);
+        })
+      .then(function(response) {
+          assert_response_equals(response, transaction.response,
+                                 'The response should not have changed.');
+        });
+}, 'CacheStorageMatch a string request');
+
+cache_test(function(cache) {
+    var transaction = create_unique_transaction();
+    return cache.put(transaction.request.clone(), transaction.response.clone())
+      .then(function() {
+          return self.caches.match(new Request(transaction.request.url,
+                                              {method: 'HEAD'}));
+        })
+      .then(function(response) {
+          assert_equals(response, undefined,
+                        'A HEAD request should not be matched');
+        });
+}, 'CacheStorageMatch a HEAD request');
+
+promise_test(function(test) {
+    var transaction = create_unique_transaction();
+    return self.caches.match(transaction.request)
+      .then(function(response) {
+          assert_equals(response, undefined,
+                        'The response should not be found.');
+        });
+}, 'CacheStorageMatch with no cached entry');
+
+promise_test(function(test) {
+    var transaction = create_unique_transaction();
+    return self.caches.delete('foo')
+      .then(function() {
+          return self.caches.has('foo');
+        })
+      .then(function(has_foo) {
+          assert_false(has_foo, "The cache should not exist.");
+          return self.caches.match(transaction.request, {cacheName: 'foo'});
+        })
+      .then(function(response) {
+          assert_equals(response, undefined,
+                        'The match with bad cache name should resolve to ' +
+                        'undefined.');
+          return self.caches.has('foo');
+        })
+      .then(function(has_foo) {
+          assert_false(has_foo, "The cache should still not exist.");
+        });
+}, 'CacheStorageMatch with no caches available but name provided');
+
+cache_test(function(cache) {
+    var transaction = create_unique_transaction();
+
+    return self.caches.delete('')
+      .then(function() {
+          return self.caches.has('');
+        })
+      .then(function(has_cache) {
+          assert_false(has_cache, "The cache should not exist.");
+          return cache.put(transaction.request, transaction.response.clone());
+        })
+      .then(function() {
+          return self.caches.match(transaction.request, {cacheName: ''});
+        })
+      .then(function(response) {
+          assert_equals(response, undefined,
+                        'The response should not be found.');
+          return self.caches.open('');
+        })
+      .then(function(cache) {
+          return cache.put(transaction.request, transaction.response);
+        })
+      .then(function() {
+          return self.caches.match(transaction.request, {cacheName: ''});
+        })
+      .then(function(response) {
+          assert_response_equals(response, transaction.response,
+                                 'The response should be matched.');
+          return self.caches.delete('');
+        });
+}, 'CacheStorageMatch with empty cache name provided');
+
+cache_test(function(cache) {
+    var request = new Request('http://example.com/?foo');
+    var no_query_request = new Request('http://example.com/');
+    var response = new Response('foo');
+    return cache.put(request.clone(), response.clone())
+      .then(function() {
+          return self.caches.match(no_query_request.clone());
+        })
+      .then(function(result) {
+          assert_equals(
+            result, undefined,
+            'CacheStorageMatch should resolve as undefined with a ' +
+            'mismatched query.');
+          return self.caches.match(no_query_request.clone(),
+                                   {ignoreSearch: true});
+        })
+      .then(function(result) {
+          assert_response_equals(
+            result, response,
+            'CacheStorageMatch with ignoreSearch should ignore the ' +
+            'query of the request.');
+        });
+  }, 'CacheStorageMatch supports ignoreSearch');
+
+cache_test(function(cache) {
+    var request = new Request('http://example.com/');
+    var head_request = new Request('http://example.com/', {method: 'HEAD'});
+    var response = new Response('foo');
+    return cache.put(request.clone(), response.clone())
+      .then(function() {
+          return self.caches.match(head_request.clone());
+        })
+      .then(function(result) {
+          assert_equals(
+            result, undefined,
+            'CacheStorageMatch should resolve as undefined with a ' +
+            'mismatched method.');
+          return self.caches.match(head_request.clone(),
+                                   {ignoreMethod: true});
+        })
+      .then(function(result) {
+          assert_response_equals(
+            result, response,
+            'CacheStorageMatch with ignoreMethod should ignore the ' +
+            'method of request.');
+        });
+  }, 'Cache.match supports ignoreMethod');
+
+cache_test(function(cache) {
+    var vary_request = new Request('http://example.com/c',
+                                   {headers: {'Cookies': 'is-for-cookie'}});
+    var vary_response = new Response('', {headers: {'Vary': 'Cookies'}});
+    var mismatched_vary_request = new Request('http://example.com/c');
+
+    return cache.put(vary_request.clone(), vary_response.clone())
+      .then(function() {
+          return self.caches.match(mismatched_vary_request.clone());
+        })
+      .then(function(result) {
+          assert_equals(
+            result, undefined,
+            'CacheStorageMatch should resolve as undefined with a ' +
+            ' mismatched vary.');
+          return self.caches.match(mismatched_vary_request.clone(),
+                                   {ignoreVary: true});
+        })
+      .then(function(result) {
+          assert_response_equals(
+            result, vary_response,
+            'CacheStorageMatch with ignoreVary should ignore the ' +
+            'vary of request.');
+        });
+  }, 'CacheStorageMatch supports ignoreVary');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-storage.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-storage.https.any.js
new file mode 100644
index 000000000000..b7d5af7b5320
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-storage.https.any.js
@@ -0,0 +1,239 @@
+// META: title=CacheStorage
+// META: global=window,worker
+// META: script=./resources/test-helpers.js
+// META: timeout=long
+
+promise_test(function(t) {
+    var cache_name = 'cache-storage/foo';
+    return self.caches.delete(cache_name)
+      .then(function() {
+          return self.caches.open(cache_name);
+        })
+      .then(function(cache) {
+          assert_true(cache instanceof Cache,
+                      'CacheStorage.open should return a Cache.');
+        });
+  }, 'CacheStorage.open');
+
+promise_test(function(t) {
+    var cache_name = 'cache-storage/bar';
+    var first_cache = null;
+    var second_cache = null;
+    return self.caches.open(cache_name)
+      .then(function(cache) {
+          first_cache = cache;
+          return self.caches.delete(cache_name);
+        })
+      .then(function() {
+          return first_cache.add('./resources/simple.txt');
+        })
+      .then(function() {
+          return self.caches.keys();
+        })
+      .then(function(cache_names) {
+          assert_equals(cache_names.indexOf(cache_name), -1);
+          return self.caches.open(cache_name);
+        })
+      .then(function(cache) {
+          second_cache = cache;
+          return second_cache.keys();
+        })
+      .then(function(keys) {
+          assert_equals(keys.length, 0);
+          return first_cache.keys();
+        })
+      .then(function(keys) {
+          assert_equals(keys.length, 1);
+          // Clean up
+          return self.caches.delete(cache_name);
+        });
+  }, 'CacheStorage.delete dooms, but does not delete immediately');
+
+promise_test(function(t) {
+    // Note that this test may collide with other tests running in the same
+    // origin that also uses an empty cache name.
+    var cache_name = '';
+    return self.caches.delete(cache_name)
+      .then(function() {
+          return self.caches.open(cache_name);
+        })
+      .then(function(cache) {
+          assert_true(cache instanceof Cache,
+                      'CacheStorage.open should accept an empty name.');
+        });
+  }, 'CacheStorage.open with an empty name');
+
+promise_test(function(t) {
+    return promise_rejects_js(
+      t,
+      TypeError,
+      self.caches.open(),
+      'CacheStorage.open should throw TypeError if called with no arguments.');
+  }, 'CacheStorage.open with no arguments');
+
+promise_test(function(t) {
+    var test_cases = [
+      {
+        name: 'cache-storage/lowercase',
+        should_not_match:
+          [
+            'cache-storage/Lowercase',
+            ' cache-storage/lowercase',
+            'cache-storage/lowercase '
+          ]
+      },
+      {
+        name: 'cache-storage/has a space',
+        should_not_match:
+          [
+            'cache-storage/has'
+          ]
+      },
+      {
+        name: 'cache-storage/has\000_in_the_name',
+        should_not_match:
+          [
+            'cache-storage/has',
+            'cache-storage/has_in_the_name'
+          ]
+      }
+    ];
+    return Promise.all(test_cases.map(function(testcase) {
+        var cache_name = testcase.name;
+        return self.caches.delete(cache_name)
+          .then(function() {
+              return self.caches.open(cache_name);
+            })
+          .then(function() {
+              return self.caches.has(cache_name);
+            })
+          .then(function(result) {
+              assert_true(result,
+                          'CacheStorage.has should return true for existing ' +
+                          'cache.');
+            })
+          .then(function() {
+              return Promise.all(
+                testcase.should_not_match.map(function(cache_name) {
+                    return self.caches.has(cache_name)
+                      .then(function(result) {
+                          assert_false(result,
+                                       'CacheStorage.has should only perform ' +
+                                       'exact matches on cache names.');
+                        });
+                  }));
+            })
+          .then(function() {
+              return self.caches.delete(cache_name);
+            });
+      }));
+  }, 'CacheStorage.has with existing cache');
+
+promise_test(function(t) {
+    return self.caches.has('cheezburger')
+      .then(function(result) {
+          assert_false(result,
+                       'CacheStorage.has should return false for ' +
+                       'nonexistent cache.');
+        });
+  }, 'CacheStorage.has with nonexistent cache');
+
+promise_test(function(t) {
+    var cache_name = 'cache-storage/open';
+    var cache;
+    return self.caches.delete(cache_name)
+      .then(function() {
+          return self.caches.open(cache_name);
+        })
+      .then(function(result) {
+          cache = result;
+        })
+      .then(function() {
+          return cache.add('./resources/simple.txt');
+        })
+      .then(function() {
+          return self.caches.open(cache_name);
+        })
+      .then(function(result) {
+          assert_true(result instanceof Cache,
+                      'CacheStorage.open should return a Cache object');
+          assert_not_equals(result, cache,
+                            'CacheStorage.open should return a new Cache ' +
+                            'object each time its called.');
+          return Promise.all([cache.keys(), result.keys()]);
+        })
+      .then(function(results) {
+          var expected_urls = results[0].map(function(r) { return r.url });
+          var actual_urls = results[1].map(function(r) { return r.url });
+          assert_array_equals(actual_urls, expected_urls,
+                              'CacheStorage.open should return a new Cache ' +
+                              'object for the same backing store.');
+        });
+  }, 'CacheStorage.open with existing cache');
+
+promise_test(function(t) {
+    var cache_name = 'cache-storage/delete';
+
+    return self.caches.delete(cache_name)
+      .then(function() {
+          return self.caches.open(cache_name);
+        })
+      .then(function() { return self.caches.delete(cache_name); })
+      .then(function(result) {
+          assert_true(result,
+                      'CacheStorage.delete should return true after ' +
+                      'deleting an existing cache.');
+        })
+
+      .then(function() { return self.caches.has(cache_name); })
+      .then(function(cache_exists) {
+          assert_false(cache_exists,
+                       'CacheStorage.has should return false after ' +
+                       'fulfillment of CacheStorage.delete promise.');
+        });
+  }, 'CacheStorage.delete with existing cache');
+
+promise_test(function(t) {
+    return self.caches.delete('cheezburger')
+      .then(function(result) {
+          assert_false(result,
+                       'CacheStorage.delete should return false for a ' +
+                       'nonexistent cache.');
+        });
+  }, 'CacheStorage.delete with nonexistent cache');
+
+promise_test(function(t) {
+    var unpaired_name = 'unpaired\uD800';
+    var converted_name = 'unpaired\uFFFD';
+
+    // The test assumes that a cache with converted_name does not
+    // exist, but if the implementation fails the test then such
+    // a cache will be created. Start off in a fresh state by
+    // deleting all caches.
+    return delete_all_caches()
+      .then(function() {
+          return self.caches.has(converted_name);
+      })
+      .then(function(cache_exists) {
+          assert_false(cache_exists,
+                       'Test setup failure: cache should not exist');
+      })
+      .then(function() { return self.caches.open(unpaired_name); })
+      .then(function() { return self.caches.keys(); })
+      .then(function(keys) {
+          assert_true(keys.indexOf(unpaired_name) !== -1,
+                      'keys should include cache with bad name');
+      })
+      .then(function() { return self.caches.has(unpaired_name); })
+      .then(function(cache_exists) {
+          assert_true(cache_exists,
+                      'CacheStorage names should be not be converted.');
+        })
+      .then(function() { return self.caches.has(converted_name); })
+      .then(function(cache_exists) {
+          assert_false(cache_exists,
+                       'CacheStorage names should be not be converted.');
+        });
+  }, 'CacheStorage names are DOMStrings not USVStrings');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/common.https.window.js b/test/fixtures/wpt/service-workers/cache-storage/common.https.window.js
new file mode 100644
index 000000000000..eba312c273de
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/common.https.window.js
@@ -0,0 +1,44 @@
+// META: title=Cache Storage: Verify that Window and Workers see same storage
+// META: timeout=long
+
+function wait_for_message(worker) {
+    return new Promise(function(resolve) {
+        worker.addEventListener('message', function listener(e) {
+            resolve(e.data);
+            worker.removeEventListener('message', listener);
+        });
+    });
+}
+
+promise_test(function(t) {
+    var cache_name = 'common-test';
+    return self.caches.delete(cache_name)
+        .then(function() {
+            var worker = new Worker('resources/common-worker.js');
+            worker.postMessage({name: cache_name});
+            return wait_for_message(worker);
+        })
+        .then(function(message) {
+            return self.caches.open(cache_name);
+        })
+        .then(function(cache) {
+            return Promise.all([
+                cache.match('https://example.com/a'),
+                cache.match('https://example.com/b'),
+                cache.match('https://example.com/c')
+            ]);
+        })
+        .then(function(responses) {
+            return Promise.all(responses.map(
+                function(response) { return response.text(); }
+            ));
+        })
+        .then(function(bodies) {
+            assert_equals(bodies[0], 'a',
+                          'Body should match response put by worker');
+            assert_equals(bodies[1], 'b',
+                          'Body should match response put by worker');
+            assert_equals(bodies[2], 'c',
+                          'Body should match response put by worker');
+        });
+}, 'Window sees cache puts by Worker');
diff --git a/test/fixtures/wpt/service-workers/cache-storage/crashtests/cache-response-clone.https.html b/test/fixtures/wpt/service-workers/cache-storage/crashtests/cache-response-clone.https.html
new file mode 100644
index 000000000000..ec930a87d934
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/crashtests/cache-response-clone.https.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="test-wait">
+<meta charset="utf-8">
+<script type="module">
+  const cache = await window.caches.open('cache_name_0')
+  await cache.add("")
+  const resp1 = await cache.match("")
+  const readStream = resp1.body
+  // Cloning will open the stream via NS_AsyncCopy in Gecko
+  resp1.clone()
+  // Give a little bit of time
+  await new Promise(setTimeout)
+  // At this point the previous open operation is about to finish but not yet.
+  // It will finish after the second open operation is made, potentially causing incorrect state.
+  await readStream.getReader().read();
+  document.documentElement.classList.remove('test-wait')
+</script>
diff --git a/test/fixtures/wpt/service-workers/cache-storage/credentials.https.html b/test/fixtures/wpt/service-workers/cache-storage/credentials.https.html
new file mode 100644
index 000000000000..0fe4a0a0ac0d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/credentials.https.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<title>Cache Storage: Verify credentials are respected by Cache operations</title>
+<link rel="help" href="https://w3c.github.io/ServiceWorker/#cache-storage">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./../service-worker/resources/test-helpers.sub.js"></script>
+<style>iframe { display: none; }</style>
+<script>
+
+var worker = "./resources/credentials-worker.js";
+var scope = "./resources/credentials-iframe.html";
+promise_test(function(t) {
+  return self.caches.delete('credentials')
+    .then(function() {
+      return service_worker_unregister_and_register(t, worker, scope)
+    })
+    .then(function(reg) {
+      return wait_for_state(t, reg.installing, 'activated');
+    })
+    .then(function() {
+      return with_iframe(scope);
+    })
+    .then(function(frame) {
+      frame.contentWindow.postMessage([
+        {name: 'file.txt', username: 'aa', password: 'bb'},
+        {name: 'file.txt', username: 'cc', password: 'dd'},
+        {name: 'file.txt'}
+      ], '*');
+      return new Promise(function(resolve, reject) {
+        window.onmessage = t.step_func(function(e) {
+          resolve(e.data);
+        });
+      });
+    })
+    .then(function(data) {
+      assert_equals(data.length, 3, 'three entries should be present');
+      assert_equals(data.filter(function(url) { return /@/.test(url); }).length, 2,
+        'two entries should contain credentials');
+      assert_true(data.some(function(url) { return /aa:bb@/.test(url); }),
+        'entry with credentials aa:bb should be present');
+      assert_true(data.some(function(url) { return /cc:dd@/.test(url); }),
+        'entry with credentials cc:dd should be present');
+    });
+}, "Cache API matching includes credentials");
+</script>
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cross-partition.https.tentative.html b/test/fixtures/wpt/service-workers/cache-storage/cross-partition.https.tentative.html
new file mode 100644
index 000000000000..1cfc2569088e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cross-partition.https.tentative.html
@@ -0,0 +1,269 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/common/utils.js"></script>
+<script src="/common/dispatcher/dispatcher.js"></script>
+<!-- Pull in executor_path needed by newPopup / newIframe -->
+<script src="/html/cross-origin-embedder-policy/credentialless/resources/common.js"></script>
+<!-- Pull in importScript / newPopup / newIframe -->
+<script src="/html/anonymous-iframe/resources/common.js"></script>
+<body>
+<script>
+
+const cache_exists_js = (cache_name, response_queue_name) => `
+  try {
+    const exists = await self.caches.has("${cache_name}");
+    if (exists) {
+      await send("${response_queue_name}", "true");
+    } else {
+      await send("${response_queue_name}", "false");
+    }
+  } catch {
+    await send("${response_queue_name}", "exception");
+  }
+`;
+
+const add_iframe_js = (iframe_origin, response_queue_uuid) => `
+  const importScript = ${importScript};
+  await importScript("/html/cross-origin-embedder-policy/credentialless" +
+                   "/resources/common.js");
+  await importScript("/html/anonymous-iframe/resources/common.js");
+  await importScript("/common/utils.js");
+  await send("${response_queue_uuid}", newIframe("${iframe_origin}"));
+`;
+
+const same_site_origin = get_host_info().HTTPS_ORIGIN;
+const cross_site_origin = get_host_info().HTTPS_NOTSAMESITE_ORIGIN;
+
+async function create_test_iframes(t, response_queue_uuid) {
+
+  // Create a same-origin iframe in a cross-site popup.
+  const not_same_site_popup_uuid = newPopup(t, cross_site_origin);
+  await send(not_same_site_popup_uuid,
+       add_iframe_js(same_site_origin, response_queue_uuid));
+  const iframe_1_uuid = await receive(response_queue_uuid);
+
+  // Create a same-origin iframe in a same-site popup.
+  const same_origin_popup_uuid = newPopup(t, same_site_origin);
+  await send(same_origin_popup_uuid,
+       add_iframe_js(same_site_origin, response_queue_uuid));
+  const iframe_2_uuid = await receive(response_queue_uuid);
+
+  return [iframe_1_uuid, iframe_2_uuid];
+}
+
+promise_test(t => {
+  return new Promise(async (resolve, reject) => {
+    try {
+      const response_queue_uuid = token();
+
+      const [iframe_1_uuid, iframe_2_uuid] =
+        await create_test_iframes(t, response_queue_uuid);
+
+      const cache_name = token();
+      await self.caches.open(cache_name);
+      t.add_cleanup(() => self.caches.delete(cache_name));
+
+      await send(iframe_2_uuid,
+           cache_exists_js(cache_name, response_queue_uuid));
+      if (await receive(response_queue_uuid) !== "true") {
+        reject("Cache not visible in same-top-level-site iframe");
+      }
+
+      await send(iframe_1_uuid,
+           cache_exists_js(cache_name, response_queue_uuid));
+      if (await receive(response_queue_uuid) !== "false") {
+        reject("Cache visible in not-same-top-level-site iframe");
+      }
+
+      resolve();
+    } catch (e) {
+      reject(e);
+    }
+  });
+}, "CacheStorage caches shouldn't be shared with a cross-partition iframe");
+
+const newWorker = (origin) => {
+  const worker_token = token();
+  const worker_url = origin + executor_worker_path + `&uuid=${worker_token}`;
+  const worker = new Worker(worker_url);
+  return worker_token;
+}
+
+promise_test(t => {
+  return new Promise(async (resolve, reject) => {
+    try {
+      const response_queue_uuid = token();
+
+      const create_worker_js = (origin) => `
+        const importScript = ${importScript};
+        await importScript("/html/cross-origin-embedder-policy/credentialless" +
+                         "/resources/common.js");
+        await importScript("/html/anonymous-iframe/resources/common.js");
+        await importScript("/common/utils.js");
+        const newWorker = ${newWorker};
+        await send("${response_queue_uuid}", newWorker("${origin}"));
+      `;
+
+      const [iframe_1_uuid, iframe_2_uuid] =
+        await create_test_iframes(t, response_queue_uuid);
+
+      // Create a dedicated worker in the cross-top-level-site iframe.
+      await send(iframe_1_uuid, create_worker_js(same_site_origin));
+      const worker_1_uuid = await receive(response_queue_uuid);
+
+      // Create a dedicated worker in the same-top-level-site iframe.
+      await send(iframe_2_uuid, create_worker_js(same_site_origin));
+      const worker_2_uuid = await receive(response_queue_uuid);
+
+      const cache_name = token();
+      await self.caches.open(cache_name);
+      t.add_cleanup(() => self.caches.delete(cache_name));
+
+      await send(worker_2_uuid,
+           cache_exists_js(cache_name, response_queue_uuid));
+      if (await receive(response_queue_uuid) !== "true") {
+        reject("Cache not visible in same-top-level-site worker");
+      }
+
+      await send(worker_1_uuid,
+           cache_exists_js(cache_name, response_queue_uuid));
+      if (await receive(response_queue_uuid) !== "false") {
+        reject("Cache visible in not-same-top-level-site worker");
+      }
+      resolve();
+    } catch (e) {
+      reject(e);
+    }
+  });
+}, "CacheStorage caches shouldn't be shared with a cross-partition dedicated worker");
+
+const newSharedWorker = (origin) => {
+  const worker_token = token();
+  const worker_url = origin + executor_worker_path + `&uuid=${worker_token}`;
+  const worker = new SharedWorker(worker_url, worker_token);
+  return worker_token;
+}
+
+promise_test(t => {
+  return new Promise(async (resolve, reject) => {
+    try {
+      const response_queue_uuid = token();
+
+      const create_worker_js = (origin) => `
+        const importScript = ${importScript};
+        await importScript("/html/cross-origin-embedder-policy/credentialless" +
+                         "/resources/common.js");
+        await importScript("/html/anonymous-iframe/resources/common.js");
+        await importScript("/common/utils.js");
+        const newSharedWorker = ${newSharedWorker};
+        await send("${response_queue_uuid}", newSharedWorker("${origin}"));
+      `;
+
+      const [iframe_1_uuid, iframe_2_uuid] =
+        await create_test_iframes(t, response_queue_uuid);
+
+      // Create a shared worker in the cross-top-level-site iframe.
+      await send(iframe_1_uuid, create_worker_js(same_site_origin));
+      const worker_1_uuid = await receive(response_queue_uuid);
+
+      // Create a shared worker in the same-top-level-site iframe.
+      await send(iframe_2_uuid, create_worker_js(same_site_origin));
+      const worker_2_uuid = await receive(response_queue_uuid);
+
+      const cache_name = token();
+      await self.caches.open(cache_name);
+      t.add_cleanup(() => self.caches.delete(cache_name));
+
+      await send(worker_2_uuid,
+           cache_exists_js(cache_name, response_queue_uuid));
+      if (await receive(response_queue_uuid) !== "true") {
+        reject("Cache not visible in same-top-level-site worker");
+      }
+
+      await send(worker_1_uuid,
+           cache_exists_js(cache_name, response_queue_uuid));
+      if (await receive(response_queue_uuid) !== "false") {
+        reject("Cache visible in not-same-top-level-site worker");
+      }
+      resolve();
+    } catch (e) {
+      reject(e);
+    }
+  });
+}, "CacheStorage caches shouldn't be shared with a cross-partition shared worker");
+
+const newServiceWorker = async (origin) => {
+  const worker_token = token();
+  const worker_url = origin + executor_service_worker_path +
+                     `&uuid=${worker_token}`;
+  const worker_url_path = executor_service_worker_path.substring(0,
+                              executor_service_worker_path.lastIndexOf('/'));
+  const scope = worker_url_path + "/not-used/";
+  const reg = await navigator.serviceWorker.register(worker_url,
+                                                     {'scope': scope});
+  return worker_token;
+}
+
+promise_test(t => {
+  return new Promise(async (resolve, reject) => {
+    try {
+      const response_queue_uuid = token();
+
+      const create_worker_js = (origin) => `
+        const importScript = ${importScript};
+        await importScript("/html/cross-origin-embedder-policy/credentialless" +
+                         "/resources/common.js");
+        await importScript("/html/anonymous-iframe/resources/common.js");
+        await importScript("/common/utils.js");
+        const newServiceWorker = ${newServiceWorker};
+        await send("${response_queue_uuid}", await newServiceWorker("${origin}"));
+      `;
+
+      const [iframe_1_uuid, iframe_2_uuid] =
+        await create_test_iframes(t, response_queue_uuid);
+
+      // Create a service worker in the same-top-level-site iframe.
+      await send(iframe_2_uuid, create_worker_js(same_site_origin));
+      const worker_2_uuid = await receive(response_queue_uuid);
+
+      t.add_cleanup(() =>
+        send(worker_2_uuid, "self.registration.unregister();"));
+
+      const cache_name = token();
+      await self.caches.open(cache_name);
+      t.add_cleanup(() => self.caches.delete(cache_name));
+
+      await send(worker_2_uuid,
+           cache_exists_js(cache_name, response_queue_uuid));
+      if (await receive(response_queue_uuid) !== "true") {
+        reject("Cache not visible in same-top-level-site worker");
+      }
+
+      // Create a service worker in the cross-top-level-site iframe. Note that
+      // if service workers are unpartitioned then this new service worker would
+      // replace the one created above. This is why we wait to create the second
+      // service worker until after we are done with the first one.
+      await send(iframe_1_uuid, create_worker_js(same_site_origin));
+      const worker_1_uuid = await receive(response_queue_uuid);
+
+      t.add_cleanup(() =>
+        send(worker_1_uuid, "self.registration.unregister();"));
+
+      await send(worker_1_uuid,
+           cache_exists_js(cache_name, response_queue_uuid));
+      if (await receive(response_queue_uuid) !== "false") {
+        reject("Cache visible in not-same-top-level-site worker");
+      }
+
+      resolve();
+    } catch (e) {
+      reject(e);
+    }
+  });
+}, "CacheStorage caches shouldn't be shared with a cross-partition service worker");
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/cache-storage/resources/blank.html b/test/fixtures/wpt/service-workers/cache-storage/resources/blank.html
new file mode 100644
index 000000000000..a3c3a4689a62
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/resources/blank.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<title>Empty doc</title>
diff --git a/test/fixtures/wpt/service-workers/cache-storage/resources/cache-keys-attributes-for-service-worker.js b/test/fixtures/wpt/service-workers/cache-storage/resources/cache-keys-attributes-for-service-worker.js
new file mode 100644
index 000000000000..ee574d2cb77a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/resources/cache-keys-attributes-for-service-worker.js
@@ -0,0 +1,22 @@
+self.addEventListener('fetch', (event) => {
+    const params = new URL(event.request.url).searchParams;
+    if (params.has('ignore')) {
+      return;
+    }
+    if (!params.has('name')) {
+      event.respondWith(Promise.reject(TypeError('No name is provided.')));
+      return;
+    }
+
+    event.respondWith(Promise.resolve().then(async () => {
+        const name = params.get('name');
+        await caches.delete('foo');
+        const cache = await caches.open('foo');
+        await cache.put(event.request, new Response('hello'));
+        const keys = await cache.keys();
+
+        const original = event.request[name];
+        const stored = keys[0][name];
+        return new Response(`original: ${original}, stored: ${stored}`);
+      }));
+  });
diff --git a/test/fixtures/wpt/service-workers/cache-storage/resources/common-worker.js b/test/fixtures/wpt/service-workers/cache-storage/resources/common-worker.js
new file mode 100644
index 000000000000..d0e8544b56c2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/resources/common-worker.js
@@ -0,0 +1,15 @@
+self.onmessage = function(e) {
+    var cache_name = e.data.name;
+
+    self.caches.open(cache_name)
+        .then(function(cache) {
+            return Promise.all([
+                cache.put('https://example.com/a', new Response('a')),
+                cache.put('https://example.com/b', new Response('b')),
+                cache.put('https://example.com/c', new Response('c'))
+            ]);
+        })
+        .then(function() {
+            self.postMessage('ok');
+        });
+};
diff --git a/test/fixtures/wpt/service-workers/cache-storage/resources/credentials-iframe.html b/test/fixtures/wpt/service-workers/cache-storage/resources/credentials-iframe.html
new file mode 100644
index 000000000000..00702df9e5b1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/resources/credentials-iframe.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<title>Controlled frame for Cache API test with credentials</title>
+<script>
+
+function xhr(url, username, password) {
+  return new Promise(function(resolve, reject) {
+    var xhr = new XMLHttpRequest(), async = true;
+    xhr.open('GET', url, async, username, password);
+    xhr.send();
+    xhr.onreadystatechange = function() {
+      if (xhr.readyState !== XMLHttpRequest.DONE)
+        return;
+      if (xhr.status === 200) {
+        resolve(xhr.responseText);
+      } else {
+        reject(new Error(xhr.statusText));
+      }
+    };
+  });
+}
+
+window.onmessage = function(e) {
+  Promise.all(e.data.map(function(item) {
+    return xhr(item.name, item.username, item.password);
+  }))
+    .then(function() {
+      navigator.serviceWorker.controller.postMessage('keys');
+      navigator.serviceWorker.onmessage = function(e) {
+        window.parent.postMessage(e.data, '*');
+      };
+    });
+};
+
+</script>
+<body>
+Hello? Yes, this is iframe.
+</body>
diff --git a/test/fixtures/wpt/service-workers/cache-storage/resources/credentials-worker.js b/test/fixtures/wpt/service-workers/cache-storage/resources/credentials-worker.js
new file mode 100644
index 000000000000..43965b5fe4c9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/resources/credentials-worker.js
@@ -0,0 +1,59 @@
+var cache_name = 'credentials';
+
+function assert_equals(actual, expected, message) {
+  if (!Object.is(actual, expected))
+    throw Error(message + ': expected: ' + expected + ', actual: ' + actual);
+}
+
+self.onfetch = function(e) {
+  if (!/\.txt$/.test(e.request.url)) return;
+  var content = e.request.url;
+  var cache;
+  e.respondWith(
+    self.caches.open(cache_name)
+      .then(function(result) {
+        cache = result;
+        return cache.put(e.request, new Response(content));
+      })
+
+      .then(function() { return cache.match(e.request); })
+      .then(function(result) { return result.text(); })
+      .then(function(text) {
+        assert_equals(text, content, 'Cache.match() body should match');
+      })
+
+      .then(function() { return cache.matchAll(e.request); })
+      .then(function(results) {
+        assert_equals(results.length, 1, 'Should have one response');
+        return results[0].text();
+      })
+      .then(function(text) {
+        assert_equals(text, content, 'Cache.matchAll() body should match');
+      })
+
+      .then(function() { return self.caches.match(e.request); })
+      .then(function(result) { return result.text(); })
+      .then(function(text) {
+        assert_equals(text, content, 'CacheStorage.match() body should match');
+      })
+
+     .then(function() {
+        return new Response('dummy');
+      })
+  );
+};
+
+self.onmessage = function(e) {
+  if (e.data === 'keys') {
+    self.caches.open(cache_name)
+      .then(function(cache) { return cache.keys(); })
+      .then(function(requests) {
+        var urls = requests.map(function(request) { return request.url; });
+        self.clients.matchAll().then(function(clients) {
+          clients.forEach(function(client) {
+            client.postMessage(urls);
+          });
+        });
+      });
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/cache-storage/resources/iframe.html b/test/fixtures/wpt/service-workers/cache-storage/resources/iframe.html
new file mode 100644
index 000000000000..a2f1e502bb39
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/resources/iframe.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<title>ok</title>
+<script>
+window.onmessage = function(e) {
+    var id = e.data.id;
+    try {
+        var name = 'checkallowed';
+        self.caches.open(name).then(function (cache) {
+            self.caches.delete(name);
+            window.parent.postMessage({id: id, result: 'allowed'}, '*');
+        }).catch(function(e) {
+            window.parent.postMessage({id: id, result: 'denied', name: e.name, message: e.message}, '*');
+        });
+    } catch (e) {
+        window.parent.postMessage({id: id, result: 'unexpecteddenied', name: e.name, message: e.message}, '*');
+    }
+};
+</script>
diff --git a/test/fixtures/wpt/service-workers/cache-storage/resources/simple.txt b/test/fixtures/wpt/service-workers/cache-storage/resources/simple.txt
new file mode 100644
index 000000000000..9e3cb91fb9b9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/resources/simple.txt
@@ -0,0 +1 @@
+a simple text file
diff --git a/test/fixtures/wpt/service-workers/cache-storage/resources/test-helpers.js b/test/fixtures/wpt/service-workers/cache-storage/resources/test-helpers.js
new file mode 100644
index 000000000000..050ac0b54245
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/resources/test-helpers.js
@@ -0,0 +1,272 @@
+(function() {
+  var next_cache_index = 1;
+
+  // Returns a promise that resolves to a newly created Cache object. The
+  // returned Cache will be destroyed when |test| completes.
+  function create_temporary_cache(test) {
+    var uniquifier = String(++next_cache_index);
+    var cache_name = self.location.pathname + '/' + uniquifier;
+
+    test.add_cleanup(function() {
+        self.caches.delete(cache_name);
+      });
+
+    return self.caches.delete(cache_name)
+      .then(function() {
+          return self.caches.open(cache_name);
+        });
+  }
+
+  self.create_temporary_cache = create_temporary_cache;
+})();
+
+// Runs |test_function| with a temporary unique Cache passed in as the only
+// argument. The function is run as a part of Promise chain owned by
+// promise_test(). As such, it is expected to behave in a manner identical (with
+// the exception of the argument) to a function passed into promise_test().
+//
+// E.g.:
+//    cache_test(function(cache) {
+//      // Do something with |cache|, which is a Cache object.
+//    }, "Some Cache test");
+function cache_test(test_function, description) {
+  promise_test(function(test) {
+      return create_temporary_cache(test)
+        .then(function(cache) { return test_function(cache, test); });
+    }, description);
+}
+
+// A set of Request/Response pairs to be used with prepopulated_cache_test().
+var simple_entries = [
+  {
+    name: 'a',
+    request: new Request('http://example.com/a'),
+    response: new Response('')
+  },
+
+  {
+    name: 'b',
+    request: new Request('http://example.com/b'),
+    response: new Response('')
+  },
+
+  {
+    name: 'a_with_query',
+    request: new Request('http://example.com/a?q=r'),
+    response: new Response('')
+  },
+
+  {
+    name: 'A',
+    request: new Request('http://example.com/A'),
+    response: new Response('')
+  },
+
+  {
+    name: 'a_https',
+    request: new Request('https://example.com/a'),
+    response: new Response('')
+  },
+
+  {
+    name: 'a_org',
+    request: new Request('http://example.org/a'),
+    response: new Response('')
+  },
+
+  {
+    name: 'cat',
+    request: new Request('http://example.com/cat'),
+    response: new Response('')
+  },
+
+  {
+    name: 'catmandu',
+    request: new Request('http://example.com/catmandu'),
+    response: new Response('')
+  },
+
+  {
+    name: 'cat_num_lives',
+    request: new Request('http://example.com/cat?lives=9'),
+    response: new Response('')
+  },
+
+  {
+    name: 'cat_in_the_hat',
+    request: new Request('http://example.com/cat/in/the/hat'),
+    response: new Response('')
+  },
+
+  {
+    name: 'non_2xx_response',
+    request: new Request('http://example.com/non2xx'),
+    response: new Response('', {status: 404, statusText: 'nope'})
+  },
+
+  {
+    name: 'error_response',
+    request: new Request('http://example.com/error'),
+    response: Response.error()
+  },
+];
+
+// A set of Request/Response pairs to be used with prepopulated_cache_test().
+// These contain a mix of test cases that use Vary headers.
+var vary_entries = [
+  {
+    name: 'vary_cookie_is_cookie',
+    request: new Request('http://example.com/c',
+                         {headers: {'Cookies': 'is-for-cookie'}}),
+    response: new Response('',
+                           {headers: {'Vary': 'Cookies'}})
+  },
+
+  {
+    name: 'vary_cookie_is_good',
+    request: new Request('http://example.com/c',
+                         {headers: {'Cookies': 'is-good-enough-for-me'}}),
+    response: new Response('',
+                           {headers: {'Vary': 'Cookies'}})
+  },
+
+  {
+    name: 'vary_cookie_absent',
+    request: new Request('http://example.com/c'),
+    response: new Response('',
+                           {headers: {'Vary': 'Cookies'}})
+  }
+];
+
+// Run |test_function| with a Cache object and a map of entries. Prior to the
+// call, the Cache is populated by cache entries from |entries|. The latter is
+// expected to be an Object mapping arbitrary keys to objects of the form
+// {request: <Request object>, response: <Response object>}. Entries are
+// serially added to the cache in the order specified.
+//
+// |test_function| should return a Promise that can be used with promise_test.
+function prepopulated_cache_test(entries, test_function, description) {
+  cache_test(function(cache) {
+      var p = Promise.resolve();
+      var hash = {};
+      entries.forEach(function(entry) {
+          hash[entry.name] = entry;
+          p = p.then(function() {
+              return cache.put(entry.request.clone(), entry.response.clone())
+                  .catch(function(e) {
+                      assert_unreached(
+                          'Test setup failed for entry ' + entry.name + ': ' + e
+                      );
+                  });
+          });
+      });
+      return p
+        .then(function() {
+            assert_equals(Object.keys(hash).length, entries.length);
+        })
+        .then(function() {
+            return test_function(cache, hash);
+        });
+    }, description);
+}
+
+// Helper for testing with Headers objects. Compares Headers instances
+// by serializing |expected| and |actual| to arrays and comparing.
+function assert_header_equals(actual, expected, description) {
+    assert_class_string(actual, "Headers", description);
+    var header;
+    var actual_headers = [];
+    var expected_headers = [];
+    for (header of actual)
+        actual_headers.push(header[0] + ": " + header[1]);
+    for (header of expected)
+        expected_headers.push(header[0] + ": " + header[1]);
+    assert_array_equals(actual_headers, expected_headers,
+                        description + " Headers differ.");
+}
+
+// Helper for testing with Response objects. Compares simple
+// attributes defined on the interfaces, as well as the headers. It
+// does not compare the response bodies.
+function assert_response_equals(actual, expected, description) {
+    assert_class_string(actual, "Response", description);
+    ["type", "url", "status", "ok", "statusText"].forEach(function(attribute) {
+        assert_equals(actual[attribute], expected[attribute],
+                      description + " Attributes differ: " + attribute + ".");
+    });
+    assert_header_equals(actual.headers, expected.headers, description);
+}
+
+// Assert that the two arrays |actual| and |expected| contain the same
+// set of Responses as determined by assert_response_equals. The order
+// is not significant.
+//
+// |expected| is assumed to not contain any duplicates.
+function assert_response_array_equivalent(actual, expected, description) {
+    assert_true(Array.isArray(actual), description);
+    assert_equals(actual.length, expected.length, description);
+    expected.forEach(function(expected_element) {
+        // assert_response_in_array treats the first argument as being
+        // 'actual', and the second as being 'expected array'. We are
+        // switching them around because we want to be resilient
+        // against the |actual| array containing duplicates.
+        assert_response_in_array(expected_element, actual, description);
+    });
+}
+
+// Asserts that two arrays |actual| and |expected| contain the same
+// set of Responses as determined by assert_response_equals(). The
+// corresponding elements must occupy corresponding indices in their
+// respective arrays.
+function assert_response_array_equals(actual, expected, description) {
+    assert_true(Array.isArray(actual), description);
+    assert_equals(actual.length, expected.length, description);
+    actual.forEach(function(value, index) {
+        assert_response_equals(value, expected[index],
+                               description + " : object[" + index + "]");
+    });
+}
+
+// Equivalent to assert_in_array, but uses assert_response_equals.
+function assert_response_in_array(actual, expected_array, description) {
+    assert_true(expected_array.some(function(element) {
+        try {
+            assert_response_equals(actual, element);
+            return true;
+        } catch (e) {
+            return false;
+        }
+    }), description);
+}
+
+// Helper for testing with Request objects. Compares simple
+// attributes defined on the interfaces, as well as the headers.
+function assert_request_equals(actual, expected, description) {
+    assert_class_string(actual, "Request", description);
+    ["url"].forEach(function(attribute) {
+        assert_equals(actual[attribute], expected[attribute],
+                      description + " Attributes differ: " + attribute + ".");
+    });
+    assert_header_equals(actual.headers, expected.headers, description);
+}
+
+// Asserts that two arrays |actual| and |expected| contain the same
+// set of Requests as determined by assert_request_equals(). The
+// corresponding elements must occupy corresponding indices in their
+// respective arrays.
+function assert_request_array_equals(actual, expected, description) {
+    assert_true(Array.isArray(actual), description);
+    assert_equals(actual.length, expected.length, description);
+    actual.forEach(function(value, index) {
+        assert_request_equals(value, expected[index],
+                              description + " : object[" + index + "]");
+    });
+}
+
+// Deletes all caches, returning a promise indicating success.
+function delete_all_caches() {
+  return self.caches.keys()
+    .then(function(keys) {
+      return Promise.all(keys.map(self.caches.delete.bind(self.caches)));
+    });
+}
diff --git a/test/fixtures/wpt/service-workers/cache-storage/sandboxed-iframes.https.html b/test/fixtures/wpt/service-workers/cache-storage/sandboxed-iframes.https.html
new file mode 100644
index 000000000000..098fa89daf44
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/sandboxed-iframes.https.html
@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<title>Cache Storage: Verify access in sandboxed iframes</title>
+<link rel="help" href="https://w3c.github.io/ServiceWorker/#cache-storage">
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+function load_iframe(src, sandbox) {
+    return new Promise(function(resolve, reject) {
+        var iframe = document.createElement('iframe');
+        iframe.onload = function() { resolve(iframe); };
+
+        iframe.sandbox = sandbox;
+        iframe.src = src;
+
+        document.documentElement.appendChild(iframe);
+    });
+}
+
+function wait_for_message(id) {
+    return new Promise(function(resolve) {
+        self.addEventListener('message', function listener(e) {
+            if (e.data.id === id) {
+                resolve(e.data);
+                self.removeEventListener('message', listener);
+            }
+        });
+    });
+}
+
+var counter = 0;
+
+promise_test(function(t) {
+    return load_iframe('./resources/iframe.html',
+                       'allow-scripts allow-same-origin')
+        .then(function(iframe) {
+            var id = ++counter;
+            iframe.contentWindow.postMessage({id: id}, '*');
+            return wait_for_message(id);
+        })
+        .then(function(message) {
+            assert_equals(
+                message.result, 'allowed',
+                'Access should be allowed if sandbox has allow-same-origin');
+        });
+}, 'Sandboxed iframe with allow-same-origin is allowed access');
+
+promise_test(function(t) {
+    return load_iframe('./resources/iframe.html',
+                       'allow-scripts')
+        .then(function(iframe) {
+            var id = ++counter;
+            iframe.contentWindow.postMessage({id: id}, '*');
+            return wait_for_message(id);
+        })
+        .then(function(message) {
+            assert_equals(
+                message.result, 'denied',
+                'Access should be denied if sandbox lacks allow-same-origin');
+            assert_equals(message.name, 'SecurityError',
+                          'Failure should be a SecurityError');
+        });
+}, 'Sandboxed iframe without allow-same-origin is denied access');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/idlharness.https.any.js b/test/fixtures/wpt/service-workers/idlharness.https.any.js
new file mode 100644
index 000000000000..8db5d4d10ff7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/idlharness.https.any.js
@@ -0,0 +1,53 @@
+// META: global=window,worker
+// META: script=/resources/WebIDLParser.js
+// META: script=/resources/idlharness.js
+// META: script=cache-storage/resources/test-helpers.js
+// META: script=service-worker/resources/test-helpers.sub.js
+// META: timeout=long
+
+// https://w3c.github.io/ServiceWorker
+
+idl_test(
+  ['service-workers'],
+  ['dom', 'html'],
+  async (idl_array, t) => {
+    self.cacheInstance = await create_temporary_cache(t);
+
+    idl_array.add_objects({
+      CacheStorage: ['caches'],
+      Cache: ['self.cacheInstance'],
+      ServiceWorkerContainer: ['navigator.serviceWorker']
+    });
+
+    // TODO: Add ServiceWorker and ServiceWorkerRegistration instances for the
+    // other worker scopes.
+    if (self.GLOBAL.isWindow()) {
+      idl_array.add_objects({
+        ServiceWorkerRegistration: ['registrationInstance'],
+        ServiceWorker: ['registrationInstance.installing']
+      });
+
+      const scope = 'service-worker/resources/scope/idlharness';
+      const registration = await service_worker_unregister_and_register(
+          t, 'service-worker/resources/empty-worker.js', scope);
+      t.add_cleanup(() => registration.unregister());
+
+      self.registrationInstance = registration;
+    } else if (self.ServiceWorkerGlobalScope) {
+      // self.ServiceWorkerGlobalScope should only be defined for the
+      // ServiceWorker scope, which allows us to detect and test the interfaces
+      // exposed only for ServiceWorker.
+      idl_array.add_objects({
+        Clients: ['clients'],
+        ExtendableEvent: ['new ExtendableEvent("type")'],
+        FetchEvent: ['new FetchEvent("type", { request: new Request("") })'],
+        ServiceWorkerGlobalScope: ['self'],
+        ServiceWorkerRegistration: ['registration'],
+        ServiceWorker: ['serviceWorker'],
+        // TODO: Test instances of Client and WindowClient, e.g.
+        // Client: ['self.clientInstance'],
+        // WindowClient: ['self.windowClientInstance']
+      });
+    }
+  }
+);
diff --git a/test/fixtures/wpt/service-workers/service-worker/Service-Worker-Allowed-header.https.html b/test/fixtures/wpt/service-workers/service-worker/Service-Worker-Allowed-header.https.html
new file mode 100644
index 000000000000..6f44bb17e7da
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/Service-Worker-Allowed-header.https.html
@@ -0,0 +1,88 @@
+<!DOCTYPE html>
+<title>Service Worker: Service-Worker-Allowed header</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+const host_info = get_host_info();
+
+// Returns a URL for a service worker script whose Service-Worker-Allowed
+// header value is set to |allowed_path|. If |origin| is specified, that origin
+// is used.
+function build_script_url(allowed_path, origin) {
+  const script = 'resources/empty-worker.js';
+  const url = origin ? `${origin}${base_path()}${script}` : script;
+  return `${url}?pipe=header(Service-Worker-Allowed,${allowed_path})`;
+}
+
+// register_test is a promise_test that registers a service worker.
+function register_test(script, scope, description) {
+  promise_test(async t => {
+    t.add_cleanup(() => {
+      return service_worker_unregister(t, scope);
+    });
+
+    const registration = await service_worker_unregister_and_register(
+        t, script, scope);
+    assert_true(registration instanceof ServiceWorkerRegistration, 'registered');
+    assert_equals(registration.scope, normalizeURL(scope));
+  }, description);
+}
+
+// register_fail_test is like register_test but expects a SecurityError.
+function register_fail_test(script, scope, description) {
+  promise_test(async t => {
+    t.add_cleanup(() => {
+      return service_worker_unregister(t, scope);
+    });
+
+    await service_worker_unregister(t, scope);
+    await promise_rejects_dom(t,
+                          'SecurityError',
+                          navigator.serviceWorker.register(script, {scope}));
+  }, description);
+}
+
+register_test(
+    build_script_url('/allowed-path'),
+    '/allowed-path',
+    'Registering within Service-Worker-Allowed path');
+
+register_test(
+    build_script_url(new URL('/allowed-path', document.location)),
+    '/allowed-path',
+    'Registering within Service-Worker-Allowed path (absolute URL)');
+
+register_test(
+    build_script_url('../allowed-path-with-parent'),
+    'allowed-path-with-parent',
+    'Registering within Service-Worker-Allowed path with parent reference');
+
+register_fail_test(
+    build_script_url('../allowed-path'),
+    '/disallowed-path',
+    'Registering outside Service-Worker-Allowed path'),
+
+register_fail_test(
+    build_script_url('../allowed-path-with-parent'),
+    '/allowed-path-with-parent',
+    'Registering outside Service-Worker-Allowed path with parent reference');
+
+register_fail_test(
+    build_script_url(host_info.HTTPS_REMOTE_ORIGIN + '/'),
+    'resources/this-scope-is-normally-allowed',
+    'Service-Worker-Allowed is cross-origin to script, registering on a normally allowed scope');
+
+register_fail_test(
+    build_script_url(host_info.HTTPS_REMOTE_ORIGIN + '/'),
+    '/this-scope-is-normally-disallowed',
+    'Service-Worker-Allowed is cross-origin to script, registering on a normally disallowed scope');
+
+register_fail_test(
+    build_script_url(host_info.HTTPS_REMOTE_ORIGIN + '/cross-origin/',
+                     host_info.HTTPS_REMOTE_ORIGIN),
+    '/cross-origin/',
+    'Service-Worker-Allowed is cross-origin to page, same-origin to script');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/WEB_FEATURES.yml b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/WEB_FEATURES.yml
new file mode 100644
index 000000000000..41cd63e4cb42
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/WEB_FEATURES.yml
@@ -0,0 +1,3 @@
+rules:
+- isSecureContext*: [is-secure-context]
+- "*": [service-workers]
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/close.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/close.https.html
new file mode 100644
index 000000000000..3e3cc8b2b089
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/close.https.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<title>ServiceWorkerGlobalScope: close operation</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+
+service_worker_test(
+  'resources/close-worker.js', 'ServiceWorkerGlobalScope: close operation');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/error-message-event-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/error-message-event-worker.js
new file mode 100644
index 000000000000..525bc96e763e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/error-message-event-worker.js
@@ -0,0 +1,2 @@
+self.onmessageerror = e => { e.source.postMessage("received error event"); };
+self.onmessage = e => { e.source.postMessage("received message event"); };
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/error-message-event.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/error-message-event.https.html
new file mode 100644
index 000000000000..0a35cc7c39cf
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/error-message-event.https.html
@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Service Worker GlobalScope onerror event</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+</head>
+<body>
+<canvas id=canvas></canvas>
+<script>
+var scope = "resources";
+var registration;
+var frame;
+
+var url1 = "/WebKit/service-workers/resources/response-full-of-headers.py";
+var url2 = get_host_info().HTTPS_REMOTE_ORIGIN + url1;
+
+async function registerServiceWorker(scope)
+{
+    const registration = await navigator.serviceWorker.register("error-message-event-worker.js", { scope : scope });
+    let activeWorker = registration.active;
+    if (activeWorker)
+        return registration;
+    activeWorker = registration.installing;
+    return new Promise(resolve => {
+        activeWorker.addEventListener('statechange', () => {
+            if (activeWorker.state === "activated")
+                resolve(registration);
+        });
+    });
+}
+
+promise_test(async (test) => {
+    registration = await registerServiceWorker(scope);
+
+    const stream = canvas.captureStream();
+    const track = stream.getVideoTracks()[0];
+    // MediaStreamTrack is not defined in service worker contexts.
+    registration.active.postMessage({ track }, [track]);
+
+    const result = await new Promise(resolve => navigator.serviceWorker.onmessage = e => resolve(e.data));
+    assert_equals(result, "received error event");
+}, "Verify error event is received");
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/extendable-message-event-constructor.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/extendable-message-event-constructor.https.html
new file mode 100644
index 000000000000..525245fe9ece
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/extendable-message-event-constructor.https.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<title>ServiceWorkerGlobalScope: ExtendableMessageEvent Constructor</title>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='../resources/test-helpers.sub.js'></script>
+<script>
+service_worker_test(
+    'resources/extendable-message-event-constructor-worker.js', document.title
+  );
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/extendable-message-event.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/extendable-message-event.https.html
new file mode 100644
index 000000000000..89efd7a4a615
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/extendable-message-event.https.html
@@ -0,0 +1,226 @@
+<!DOCTYPE html>
+<title>ServiceWorkerGlobalScope: ExtendableMessageEvent</title>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='../resources/test-helpers.sub.js'></script>
+<script src='./resources/extendable-message-event-utils.js'></script>
+<script>
+promise_test(function(t) {
+    var script = 'resources/extendable-message-event-worker.js';
+    var scope = 'resources/scope/extendable-message-event-from-toplevel';
+    var registration;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(r) {
+          registration = r;
+          add_completion_callback(function() { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          var saw_message = new Promise(function(resolve) {
+              navigator.serviceWorker.onmessage =
+                  function(event) { resolve(event.data); }
+            });
+          var channel = new MessageChannel;
+          registration.active.postMessage('', [channel.port1]);
+          return saw_message;
+        })
+      .then(function(results) {
+          var expected = {
+            constructor: { name: 'ExtendableMessageEvent' },
+            origin: location.origin,
+            lastEventId: '',
+            source: {
+                constructor: { name: 'WindowClient' },
+                frameType: 'top-level',
+                url: location.href,
+                visibilityState: 'visible',
+                focused: true
+            },
+            ports: [ { constructor: { name: 'MessagePort' } } ]
+          };
+          ExtendableMessageEventUtils.assert_equals(results, expected);
+        });
+  }, 'Post an extendable message from a top-level client');
+
+promise_test(function(t) {
+    var script = 'resources/extendable-message-event-worker.js';
+    var scope = 'resources/scope/extendable-message-event-from-nested';
+    var frame;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          add_completion_callback(function() { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          frame = f;
+          add_completion_callback(function() { frame.remove(); });
+          var saw_message = new Promise(function(resolve) {
+              frame.contentWindow.navigator.serviceWorker.onmessage =
+                  function(event) { resolve(event.data); }
+            });
+          f.contentWindow.navigator.serviceWorker.controller.postMessage('');
+          return saw_message;
+        })
+      .then(function(results) {
+          var expected = {
+              constructor: { name: 'ExtendableMessageEvent' },
+              origin: location.origin,
+              lastEventId: '',
+              source: {
+                  constructor: { name: 'WindowClient' },
+                  url: frame.contentWindow.location.href,
+                  frameType: 'nested',
+                  visibilityState: 'visible',
+                  focused: false
+              },
+              ports: []
+            };
+          ExtendableMessageEventUtils.assert_equals(results, expected);
+        });
+  }, 'Post an extendable message from a nested client');
+
+promise_test(function(t) {
+    var script = 'resources/extendable-message-event-loopback-worker.js';
+    var scope = 'resources/scope/extendable-message-event-loopback';
+    var registration;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(r) {
+          registration = r;
+          add_completion_callback(function() { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          var results = [];
+          var saw_message = new Promise(function(resolve) {
+              navigator.serviceWorker.onmessage = function(event) {
+                switch (event.data.type) {
+                  case 'record':
+                    results.push(event.data.results);
+                    break;
+                  case 'finish':
+                    resolve(results);
+                    break;
+                }
+              };
+            });
+          registration.active.postMessage({type: 'start'});
+          return saw_message;
+        })
+      .then(function(results) {
+          assert_equals(results.length, 2);
+
+          var expected_trial_1 = {
+              constructor: { name: 'ExtendableMessageEvent' },
+              origin: location.origin,
+              lastEventId: '',
+              source: {
+                  constructor: { name: 'ServiceWorker' },
+                  scriptURL: normalizeURL(script),
+                  state: 'activated'
+              },
+              ports: []
+          };
+          assert_equals(results[0].trial, 1);
+          ExtendableMessageEventUtils.assert_equals(
+              results[0].event, expected_trial_1
+          );
+
+          var expected_trial_2 = {
+              constructor: { name: 'ExtendableMessageEvent' },
+              origin: location.origin,
+              lastEventId: '',
+              source: {
+                  constructor: { name: 'ServiceWorker' },
+                  scriptURL: normalizeURL(script),
+                  state: 'activated'
+              },
+              ports: [],
+          };
+          assert_equals(results[1].trial, 2);
+          ExtendableMessageEventUtils.assert_equals(
+              results[1].event, expected_trial_2
+          );
+        });
+  }, 'Post loopback extendable messages');
+
+promise_test(function(t) {
+    var script1 = 'resources/extendable-message-event-ping-worker.js';
+    var script2 = 'resources/extendable-message-event-pong-worker.js';
+    var scope = 'resources/scope/extendable-message-event-pingpong';
+    var registration;
+
+    return service_worker_unregister_and_register(t, script1, scope)
+      .then(function(r) {
+          registration = r;
+          add_completion_callback(function() { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          // A controlled frame is necessary for keeping a waiting worker.
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          add_completion_callback(function() { frame.remove(); });
+          return navigator.serviceWorker.register(script2, {scope: scope});
+        })
+      .then(function(r) {
+          return wait_for_state(t, r.installing, 'installed');
+        })
+      .then(function() {
+          var results = [];
+          var saw_message = new Promise(function(resolve) {
+              navigator.serviceWorker.onmessage = function(event) {
+                switch (event.data.type) {
+                  case 'record':
+                    results.push(event.data.results);
+                    break;
+                  case 'finish':
+                    resolve(results);
+                    break;
+                }
+              };
+            });
+          registration.active.postMessage({type: 'start'});
+          return saw_message;
+        })
+      .then(function(results) {
+          assert_equals(results.length, 2);
+
+          var expected_ping = {
+              constructor: { name: 'ExtendableMessageEvent' },
+              origin: location.origin,
+              lastEventId: '',
+              source: {
+                  constructor: { name: 'ServiceWorker' },
+                  scriptURL: normalizeURL(script1),
+                  state: 'activated'
+              },
+              ports: []
+          };
+          assert_equals(results[0].pingOrPong, 'ping');
+          ExtendableMessageEventUtils.assert_equals(
+              results[0].event, expected_ping
+          );
+
+          var expected_pong = {
+              constructor: { name: 'ExtendableMessageEvent' },
+              origin: location.origin,
+              lastEventId: '',
+              source: {
+                  constructor: { name: 'ServiceWorker' },
+                  scriptURL: normalizeURL(script2),
+                  state: 'installed'
+              },
+              ports: []
+          };
+          assert_equals(results[1].pingOrPong, 'pong');
+          ExtendableMessageEventUtils.assert_equals(
+              results[1].event, expected_pong
+          );
+        });
+  }, 'Post extendable messages among service workers');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/fetch-on-the-right-interface.https.any.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/fetch-on-the-right-interface.https.any.js
new file mode 100644
index 000000000000..5ca5f65680c9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/fetch-on-the-right-interface.https.any.js
@@ -0,0 +1,14 @@
+// META: title=fetch method on the right interface
+// META: global=serviceworker
+
+test(function() {
+    assert_false(self.hasOwnProperty('fetch'), 'ServiceWorkerGlobalScope ' +
+        'instance should not have "fetch" method as its property.');
+    assert_inherits(self, 'fetch', 'ServiceWorkerGlobalScope should ' +
+        'inherit "fetch" method.');
+    assert_own_property(Object.getPrototypeOf(Object.getPrototypeOf(self)), 'fetch',
+        'WorkerGlobalScope should have "fetch" propery in its prototype.');
+    assert_equals(self.fetch, Object.getPrototypeOf(Object.getPrototypeOf(self)).fetch,
+        'ServiceWorkerGlobalScope.fetch should be the same as ' +
+        'WorkerGlobalScope.fetch.');
+}, 'Fetch method on the right interface');
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/isSecureContext.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/isSecureContext.https.html
new file mode 100644
index 000000000000..399820dd2c31
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/isSecureContext.https.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Service Worker: isSecureContext</title>
+</head>
+<body>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+promise_test(async (t) => {
+    var url = 'isSecureContext.serviceworker.js';
+    var scope = 'empty.html';
+    var frame_sw, sw_registration;
+
+    await service_worker_unregister(t, scope);
+    var f = await with_iframe(scope);
+    t.add_cleanup(function() {
+        f.remove();
+    });
+    frame_sw = f.contentWindow.navigator.serviceWorker;
+    var registration = await navigator.serviceWorker.register(url, {scope: scope});
+    sw_registration = registration;
+    await wait_for_state(t, registration.installing, 'activated');
+    fetch_tests_from_worker(sw_registration.active);
+}, 'Setting up tests');
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/isSecureContext.serviceworker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/isSecureContext.serviceworker.js
new file mode 100644
index 000000000000..5033594e34ba
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/isSecureContext.serviceworker.js
@@ -0,0 +1,5 @@
+importScripts("/resources/testharness.js");
+
+test(() => {
+    assert_true(self.isSecureContext, true);
+}, "isSecureContext");
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/message-event-ports-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/message-event-ports-worker.js
new file mode 100644
index 000000000000..78cd0d86c010
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/message-event-ports-worker.js
@@ -0,0 +1,3 @@
+self.onmessage = e => {
+    e.source.postMessage(e.ports === e.ports ? "same ports array" : "different ports array");
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/message-event-ports.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/message-event-ports.https.html
new file mode 100644
index 000000000000..a0eac39e9b35
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/message-event-ports.https.html
@@ -0,0 +1,43 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Service Worker GlobalScope onerror event</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+</head>
+<body>
+<canvas id=canvas></canvas>
+<script>
+var registration;
+
+async function registerServiceWorker()
+{
+    const registration = await navigator.serviceWorker.register("message-event-ports-worker.js", { scope : "." });
+    let activeWorker = registration.active;
+    if (activeWorker)
+        return registration;
+    activeWorker = registration.installing;
+    return new Promise(resolve => {
+        activeWorker.addEventListener('statechange', () => {
+            if (activeWorker.state === "activated")
+                resolve(registration);
+        });
+    });
+}
+
+promise_test(async (test) => {
+    registration = await registerServiceWorker();
+
+    registration.active.postMessage("test");
+    let result = await new Promise(resolve => navigator.serviceWorker.onmessage = e => resolve(e.data));
+    assert_equals(result, "same ports array", "empty array");
+
+    const channel = new MessageChannel();;
+    const port = channel.port1;
+    registration.active.postMessage({ port }, [port]);
+    result = await new Promise(resolve => navigator.serviceWorker.onmessage = e => resolve(e.data));
+    assert_equals(result, "same ports array", "not empty array");
+}, "Verify MessageEvent.ports getter returns the same object");
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/postmessage.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/postmessage.https.html
new file mode 100644
index 000000000000..99dedebf2e56
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/postmessage.https.html
@@ -0,0 +1,83 @@
+<!DOCTYPE html>
+<title>ServiceWorkerGlobalScope: postMessage</title>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='../resources/test-helpers.sub.js'></script>
+<script>
+
+promise_test(function(t) {
+    var script = 'resources/postmessage-loopback-worker.js';
+    var scope = 'resources/scope/postmessage-loopback';
+    var registration;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          var channel = new MessageChannel();
+          var saw_message = new Promise(function(resolve) {
+              channel.port1.onmessage = function(event) {
+                resolve(event.data);
+              };
+            });
+          registration.active.postMessage({port: channel.port2},
+                                          [channel.port2]);
+          return saw_message;
+        })
+      .then(function(result) {
+          assert_equals(result, 'OK');
+        });
+  }, 'Post loopback messages');
+
+promise_test(function(t) {
+    var script1 = 'resources/postmessage-ping-worker.js';
+    var script2 = 'resources/postmessage-pong-worker.js';
+    var scope = 'resources/scope/postmessage-pingpong';
+    var registration;
+    var frame;
+
+    return service_worker_unregister_and_register(t, script1, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          // A controlled frame is necessary for keeping a waiting worker.
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          return navigator.serviceWorker.register(script2, {scope: scope});
+        })
+      .then(function(r) {
+          return wait_for_state(t, r.installing, 'installed');
+        })
+      .then(function() {
+          var channel = new MessageChannel();
+          var saw_message = new Promise(function(resolve) {
+              channel.port1.onmessage = function(event) {
+                resolve(event.data);
+              };
+            });
+          registration.active.postMessage({port: channel.port2},
+                                          [channel.port2]);
+          return saw_message;
+        })
+      .then(function(result) {
+          assert_equals(result, 'OK');
+          frame.remove();
+        });
+  }, 'Post messages among service workers');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/registration-attribute.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/registration-attribute.https.html
new file mode 100644
index 000000000000..aa3c74a13bb2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/registration-attribute.https.html
@@ -0,0 +1,107 @@
+<!DOCTYPE html>
+<title>ServiceWorkerGlobalScope: registration</title>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='../resources/test-helpers.sub.js'></script>
+<script>
+
+promise_test(function(t) {
+    var script = 'resources/registration-attribute-worker.js';
+    var scope = 'resources/scope/registration-attribute';
+    var registration;
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(reg) {
+          registration = reg;
+          add_result_callback(function() { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(frame) {
+          var expected_events_seen = [
+            'updatefound',
+            'install',
+            'statechange(installed)',
+            'statechange(activating)',
+            'activate',
+            'statechange(activated)',
+            'fetch',
+          ];
+
+          assert_equals(
+              frame.contentDocument.body.textContent,
+              expected_events_seen.toString(),
+              'Service Worker should respond to fetch');
+          frame.remove();
+          return registration.unregister();
+        });
+  }, 'Verify registration attributes on ServiceWorkerGlobalScope');
+
+promise_test(function(t) {
+    var script = 'resources/registration-attribute-worker.js';
+    var newer_script = 'resources/registration-attribute-newer-worker.js';
+    var scope = 'resources/scope/registration-attribute';
+    var newer_worker;
+    var registration;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(reg) {
+          registration = reg;
+          add_result_callback(function() { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return navigator.serviceWorker.register(newer_script, {scope: scope});
+        })
+      .then(function(reg) {
+          assert_equals(reg, registration);
+          newer_worker = registration.installing;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          var channel = new MessageChannel;
+          var saw_message = new Promise(function(resolve) {
+              channel.port1.onmessage = function(e) { resolve(e.data); };
+            });
+          newer_worker.postMessage({port: channel.port2}, [channel.port2]);
+          return saw_message;
+        })
+      .then(function(results) {
+          var script_url = normalizeURL(script);
+          var newer_script_url = normalizeURL(newer_script);
+          var expectations = [
+            'evaluate',
+            '  installing: empty',
+            '  waiting: empty',
+            '  active: ' + script_url,
+            'updatefound',
+            '  installing: ' + newer_script_url,
+            '  waiting: empty',
+            '  active: ' + script_url,
+            'install',
+            '  installing: ' + newer_script_url,
+            '  waiting: empty',
+            '  active: ' + script_url,
+            'statechange(installed)',
+            '  installing: empty',
+            '  waiting: ' + newer_script_url,
+            '  active: ' + script_url,
+            'statechange(activating)',
+            '  installing: empty',
+            '  waiting: empty',
+            '  active: ' + newer_script_url,
+            'activate',
+            '  installing: empty',
+            '  waiting: empty',
+            '  active: ' + newer_script_url,
+            'statechange(activated)',
+            '  installing: empty',
+            '  waiting: empty',
+            '  active: ' + newer_script_url,
+          ];
+          assert_array_equals(results, expectations);
+          return registration.unregister();
+        });
+  }, 'Verify registration attributes on ServiceWorkerGlobalScope of the ' +
+     'newer worker');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/close-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/close-worker.js
new file mode 100644
index 000000000000..41a8bc069af8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/close-worker.js
@@ -0,0 +1,5 @@
+importScripts('../../resources/worker-testharness.js');
+
+test(function() {
+  assert_false('close' in self);
+}, 'ServiceWorkerGlobalScope close operation');
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/error-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/error-worker.js
new file mode 100644
index 000000000000..f6838ffb3947
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/error-worker.js
@@ -0,0 +1,12 @@
+var source;
+
+self.addEventListener('message', function(e) {
+  source = e.source;
+  throw 'testError';
+});
+
+self.addEventListener('error', function(e) {
+  source.postMessage({
+    error: e.error, filename: e.filename, message: e.message, lineno: e.lineno,
+    colno: e.colno});
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-constructor-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-constructor-worker.js
new file mode 100644
index 000000000000..42da5825c56d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-constructor-worker.js
@@ -0,0 +1,197 @@
+importScripts('/resources/testharness.js');
+
+const TEST_OBJECT = { wanwan: 123 };
+const CHANNEL1 = new MessageChannel();
+const CHANNEL2 = new MessageChannel();
+const PORTS = [CHANNEL1.port1, CHANNEL1.port2, CHANNEL2.port1];
+function createEvent(initializer) {
+  if (initializer === undefined)
+    return new ExtendableMessageEvent('type');
+  return new ExtendableMessageEvent('type', initializer);
+}
+
+// These test cases are mostly copied from the following file in the Chromium
+// project (as of commit 848ad70823991e0f12b437d789943a4ab24d65bb):
+// third_party/WebKit/LayoutTests/fast/events/constructors/message-event-constructor.html
+
+test(function() {
+  assert_false(createEvent().bubbles);
+  assert_false(createEvent().cancelable);
+  assert_equals(createEvent().data, null);
+  assert_equals(createEvent().origin, '');
+  assert_equals(createEvent().lastEventId, '');
+  assert_equals(createEvent().source, null);
+  assert_array_equals(createEvent().ports, []);
+}, 'no initializer specified');
+
+test(function() {
+  assert_false(createEvent({ bubbles: false }).bubbles);
+  assert_true(createEvent({ bubbles: true }).bubbles);
+}, '`bubbles` is specified');
+
+test(function() {
+  assert_false(createEvent({ cancelable: false }).cancelable);
+  assert_true(createEvent({ cancelable: true }).cancelable);
+}, '`cancelable` is specified');
+
+test(function() {
+  assert_equals(createEvent({ data: TEST_OBJECT }).data, TEST_OBJECT);
+  assert_equals(createEvent({ data: undefined }).data, null);
+  assert_equals(createEvent({ data: null }).data, null);
+  assert_equals(createEvent({ data: false }).data, false);
+  assert_equals(createEvent({ data: true }).data, true);
+  assert_equals(createEvent({ data: '' }).data, '');
+  assert_equals(createEvent({ data: 'chocolate' }).data, 'chocolate');
+  assert_equals(createEvent({ data: 12345 }).data, 12345);
+  assert_equals(createEvent({ data: 18446744073709551615 }).data,
+                            18446744073709552000);
+  assert_equals(createEvent({ data: NaN }).data, NaN);
+  // Note that valueOf() is not called, when the left hand side is
+  // evaluated.
+  assert_false(
+      createEvent({ data: {
+          valueOf: function() { return TEST_OBJECT; } } }).data ==
+      TEST_OBJECT);
+  assert_equals(createEvent({ get data(){ return 123; } }).data, 123);
+  let thrown = { name: 'Error' };
+  assert_throws_exactly(thrown, function() {
+      createEvent({ get data() { throw thrown; } }); });
+}, '`data` is specified');
+
+test(function() {
+  assert_equals(createEvent({ origin: 'melancholy' }).origin, 'melancholy');
+  assert_equals(createEvent({ origin: '' }).origin, '');
+  assert_equals(createEvent({ origin: null }).origin, 'null');
+  assert_equals(createEvent({ origin: false }).origin, 'false');
+  assert_equals(createEvent({ origin: true }).origin, 'true');
+  assert_equals(createEvent({ origin: 12345 }).origin, '12345');
+  assert_equals(
+      createEvent({ origin: 18446744073709551615 }).origin,
+      '18446744073709552000');
+  assert_equals(createEvent({ origin: NaN }).origin, 'NaN');
+  assert_equals(createEvent({ origin: [] }).origin, '');
+  assert_equals(createEvent({ origin: [1, 2, 3] }).origin, '1,2,3');
+  assert_equals(
+      createEvent({ origin: { melancholy: 12345 } }).origin,
+      '[object Object]');
+  // Note that valueOf() is not called, when the left hand side is
+  // evaluated.
+  assert_equals(
+      createEvent({ origin: {
+          valueOf: function() { return 'melancholy'; } } }).origin,
+      '[object Object]');
+  assert_equals(
+      createEvent({ get origin() { return 123; } }).origin, '123');
+  let thrown = { name: 'Error' };
+  assert_throws_exactly(thrown, function() {
+      createEvent({ get origin() { throw thrown; } }); });
+}, '`origin` is specified');
+
+test(function() {
+  assert_equals(
+      createEvent({ lastEventId: 'melancholy' }).lastEventId, 'melancholy');
+  assert_equals(createEvent({ lastEventId: '' }).lastEventId, '');
+  assert_equals(createEvent({ lastEventId: null }).lastEventId, 'null');
+  assert_equals(createEvent({ lastEventId: false }).lastEventId, 'false');
+  assert_equals(createEvent({ lastEventId: true }).lastEventId, 'true');
+  assert_equals(createEvent({ lastEventId: 12345 }).lastEventId, '12345');
+  assert_equals(
+      createEvent({ lastEventId: 18446744073709551615 }).lastEventId,
+      '18446744073709552000');
+  assert_equals(createEvent({ lastEventId: NaN }).lastEventId, 'NaN');
+  assert_equals(createEvent({ lastEventId: [] }).lastEventId, '');
+  assert_equals(
+      createEvent({ lastEventId: [1, 2, 3] }).lastEventId, '1,2,3');
+  assert_equals(
+      createEvent({ lastEventId: { melancholy: 12345 } }).lastEventId,
+      '[object Object]');
+  // Note that valueOf() is not called, when the left hand side is
+  // evaluated.
+  assert_equals(
+      createEvent({ lastEventId: {
+          valueOf: function() { return 'melancholy'; } } }).lastEventId,
+      '[object Object]');
+  assert_equals(
+      createEvent({ get lastEventId() { return 123; } }).lastEventId,
+      '123');
+  let thrown = { name: 'Error' };
+  assert_throws_exactly(thrown, function() {
+      createEvent({ get lastEventId() { throw thrown; } }); });
+}, '`lastEventId` is specified');
+
+test(function() {
+  assert_equals(createEvent({ source: CHANNEL1.port1 }).source, CHANNEL1.port1);
+  assert_equals(
+      createEvent({ source: self.registration.active }).source,
+      self.registration.active);
+  assert_equals(
+      createEvent({ source: CHANNEL1.port1 }).source, CHANNEL1.port1);
+  assert_throws_js(
+      TypeError, function() { createEvent({ source: this }); },
+      'source should be Client or ServiceWorker or MessagePort');
+}, '`source` is specified');
+
+test(function() {
+  // Valid message ports.
+  var passed_ports = createEvent({ ports: PORTS}).ports;
+  assert_equals(passed_ports[0], CHANNEL1.port1);
+  assert_equals(passed_ports[1], CHANNEL1.port2);
+  assert_equals(passed_ports[2], CHANNEL2.port1);
+  assert_array_equals(createEvent({ ports: [] }).ports, []);
+  assert_array_equals(createEvent({ ports: undefined }).ports, []);
+
+  // Invalid message ports.
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: [1, 2, 3] }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: TEST_OBJECT }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: null }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: this }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: false }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: true }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: '' }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: 'chocolate' }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: 12345 }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: 18446744073709551615 }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: NaN }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ get ports() { return 123; } }); });
+  let thrown = { name: 'Error' };
+  assert_throws_exactly(thrown, function() {
+      createEvent({ get ports() { throw thrown; } }); });
+  // Note that valueOf() is not called, when the left hand side is
+  // evaluated.
+  var valueOf = function() { return PORTS; };
+  assert_throws_js(TypeError, function() {
+      createEvent({ ports: { valueOf: valueOf } }); });
+}, '`ports` is specified');
+
+test(function() {
+  var initializers = {
+      bubbles: true,
+      cancelable: true,
+      data: TEST_OBJECT,
+      origin: 'wonderful',
+      lastEventId: 'excellent',
+      source: CHANNEL1.port1,
+      ports: PORTS
+  };
+  assert_equals(createEvent(initializers).bubbles, true);
+  assert_equals(createEvent(initializers).cancelable, true);
+  assert_equals(createEvent(initializers).data, TEST_OBJECT);
+  assert_equals(createEvent(initializers).origin, 'wonderful');
+  assert_equals(createEvent(initializers).lastEventId, 'excellent');
+  assert_equals(createEvent(initializers).source, CHANNEL1.port1);
+  assert_equals(createEvent(initializers).ports[0], PORTS[0]);
+  assert_equals(createEvent(initializers).ports[1], PORTS[1]);
+  assert_equals(createEvent(initializers).ports[2], PORTS[2]);
+}, 'all initial values are specified');
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-loopback-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-loopback-worker.js
new file mode 100644
index 000000000000..13cae88d800d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-loopback-worker.js
@@ -0,0 +1,36 @@
+importScripts('./extendable-message-event-utils.js');
+
+self.addEventListener('message', function(event) {
+    switch (event.data.type) {
+      case 'start':
+        self.registration.active.postMessage(
+            {type: '1st', client_id: event.source.id});
+        break;
+      case '1st':
+        // 1st loopback message via ServiceWorkerRegistration.active.
+        var results = {
+            trial: 1,
+            event: ExtendableMessageEventUtils.serialize(event)
+        };
+        var client_id = event.data.client_id;
+        event.source.postMessage({type: '2nd', client_id: client_id});
+        event.waitUntil(clients.get(client_id)
+            .then(function(client) {
+                client.postMessage({type: 'record', results: results});
+              }));
+        break;
+      case '2nd':
+        // 2nd loopback message via ExtendableMessageEvent.source.
+        var results = {
+            trial: 2,
+            event: ExtendableMessageEventUtils.serialize(event)
+        };
+        var client_id = event.data.client_id;
+        event.waitUntil(clients.get(client_id)
+            .then(function(client) {
+                client.postMessage({type: 'record', results: results});
+                client.postMessage({type: 'finish'});
+              }));
+        break;
+      }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-ping-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-ping-worker.js
new file mode 100644
index 000000000000..d07b22959cc0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-ping-worker.js
@@ -0,0 +1,23 @@
+importScripts('./extendable-message-event-utils.js');
+
+self.addEventListener('message', function(event) {
+    switch (event.data.type) {
+      case 'start':
+        // Send a ping message to another service worker.
+        self.registration.waiting.postMessage(
+            {type: 'ping', client_id: event.source.id});
+        break;
+      case 'pong':
+        var results = {
+            pingOrPong: 'pong',
+            event: ExtendableMessageEventUtils.serialize(event)
+        };
+        var client_id = event.data.client_id;
+        event.waitUntil(clients.get(client_id)
+            .then(function(client) {
+                client.postMessage({type: 'record', results: results});
+                client.postMessage({type: 'finish'});
+              }));
+        break;
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-pong-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-pong-worker.js
new file mode 100644
index 000000000000..5e9669e83c4b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-pong-worker.js
@@ -0,0 +1,18 @@
+importScripts('./extendable-message-event-utils.js');
+
+self.addEventListener('message', function(event) {
+    switch (event.data.type) {
+      case 'ping':
+        var results = {
+            pingOrPong: 'ping',
+            event: ExtendableMessageEventUtils.serialize(event)
+        };
+        var client_id = event.data.client_id;
+        event.waitUntil(clients.get(client_id)
+            .then(function(client) {
+                client.postMessage({type: 'record', results: results});
+                event.source.postMessage({type: 'pong', client_id: client_id});
+              }));
+        break;
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-utils.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-utils.js
new file mode 100644
index 000000000000..d6a3b483f539
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-utils.js
@@ -0,0 +1,78 @@
+var ExtendableMessageEventUtils = {};
+
+// Create a representation of a given ExtendableMessageEvent that is suitable
+// for transmission via the `postMessage` API.
+ExtendableMessageEventUtils.serialize = function(event) {
+  var ports = event.ports.map(function(port) {
+        return { constructor: { name: port.constructor.name } };
+    });
+  return {
+    constructor: {
+      name: event.constructor.name
+    },
+    origin: event.origin,
+    lastEventId: event.lastEventId,
+    source: {
+      constructor: {
+        name: event.source.constructor.name
+      },
+      url: event.source.url,
+      frameType: event.source.frameType,
+      visibilityState: event.source.visibilityState,
+      focused: event.source.focused
+    },
+    ports: ports
+  };
+};
+
+// Compare the actual and expected values of an ExtendableMessageEvent that has
+// been transformed using the `serialize` function defined in this file.
+ExtendableMessageEventUtils.assert_equals = function(actual, expected) {
+  assert_equals(
+    actual.constructor.name, expected.constructor.name, 'event constructor'
+  );
+  assert_equals(actual.origin, expected.origin, 'event `origin` property');
+  assert_equals(
+    actual.lastEventId,
+    expected.lastEventId,
+    'event `lastEventId` property'
+  );
+
+  assert_equals(
+    actual.source.constructor.name,
+    expected.source.constructor.name,
+    'event `source` property constructor'
+  );
+  assert_equals(
+    actual.source.url, expected.source.url, 'event `source` property `url`'
+  );
+  assert_equals(
+    actual.source.frameType,
+    expected.source.frameType,
+    'event `source` property `frameType`'
+  );
+  assert_equals(
+    actual.source.visibilityState,
+    expected.source.visibilityState,
+    'event `source` property `visibilityState`'
+  );
+  assert_equals(
+    actual.source.focused,
+    expected.source.focused,
+    'event `source` property `focused`'
+  );
+
+  assert_equals(
+    actual.ports.length,
+    expected.ports.length,
+    'event `ports` property length'
+  );
+
+  for (var idx = 0; idx < expected.ports.length; ++idx) {
+    assert_equals(
+      actual.ports[idx].constructor.name,
+      expected.ports[idx].constructor.name,
+      'MessagePort #' + idx + ' constructor'
+    );
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-worker.js
new file mode 100644
index 000000000000..f5e7647e3e76
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-worker.js
@@ -0,0 +1,5 @@
+importScripts('./extendable-message-event-utils.js');
+
+self.addEventListener('message', function(event) {
+    event.source.postMessage(ExtendableMessageEventUtils.serialize(event));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-loopback-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-loopback-worker.js
new file mode 100644
index 000000000000..083e9aa2a85d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-loopback-worker.js
@@ -0,0 +1,15 @@
+self.addEventListener('message', function(event) {
+    if ('port' in event.data) {
+      var port = event.data.port;
+
+      var channel = new MessageChannel();
+      channel.port1.onmessage = function(event) {
+        if ('pong' in event.data)
+          port.postMessage(event.data.pong);
+      };
+      self.registration.active.postMessage({ping: channel.port2},
+                                           [channel.port2]);
+    } else if ('ping' in event.data) {
+      event.data.ping.postMessage({pong: 'OK'});
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-ping-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-ping-worker.js
new file mode 100644
index 000000000000..ebb1eccce2da
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-ping-worker.js
@@ -0,0 +1,15 @@
+self.addEventListener('message', function(event) {
+    if ('port' in event.data) {
+      var port = event.data.port;
+
+      var channel = new MessageChannel();
+      channel.port1.onmessage = function(event) {
+        if ('pong' in event.data)
+          port.postMessage(event.data.pong);
+      };
+
+      // Send a ping message to another service worker.
+      self.registration.waiting.postMessage({ping: channel.port2},
+                                            [channel.port2]);
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-pong-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-pong-worker.js
new file mode 100644
index 000000000000..4a0d90b6182f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-pong-worker.js
@@ -0,0 +1,4 @@
+self.addEventListener('message', function(event) {
+    if ('ping' in event.data)
+      event.data.ping.postMessage({pong: 'OK'});
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/registration-attribute-newer-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/registration-attribute-newer-worker.js
new file mode 100644
index 000000000000..44f3e2e8e9bd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/registration-attribute-newer-worker.js
@@ -0,0 +1,33 @@
+// TODO(nhiroki): stop using global states because service workers can be killed
+// at any point. Instead, we could post a message to the page on each event via
+// Client object (http://crbug.com/558244).
+var results = [];
+
+function stringify(worker) {
+  return worker ? worker.scriptURL : 'empty';
+}
+
+function record(event_name) {
+  results.push(event_name);
+  results.push('  installing: ' + stringify(self.registration.installing));
+  results.push('  waiting: ' + stringify(self.registration.waiting));
+  results.push('  active: ' + stringify(self.registration.active));
+}
+
+record('evaluate');
+
+self.registration.addEventListener('updatefound', function() {
+    record('updatefound');
+    var worker = self.registration.installing;
+    self.registration.installing.addEventListener('statechange', function() {
+        record('statechange(' + worker.state + ')');
+      });
+  });
+
+self.addEventListener('install', function(e) { record('install'); });
+
+self.addEventListener('activate', function(e) { record('activate'); });
+
+self.addEventListener('message', function(e) {
+    e.data.port.postMessage(results);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/registration-attribute-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/registration-attribute-worker.js
new file mode 100644
index 000000000000..315f43759324
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/registration-attribute-worker.js
@@ -0,0 +1,139 @@
+importScripts('../../resources/test-helpers.sub.js');
+importScripts('../../resources/worker-testharness.js');
+
+// TODO(nhiroki): stop using global states because service workers can be killed
+// at any point. Instead, we could post a message to the page on each event via
+// Client object (http://crbug.com/558244).
+var events_seen = [];
+
+// TODO(nhiroki): Move these assertions to registration-attribute.html because
+// an assertion failure on the worker is not shown on the result page and
+// handled as timeout. See registration-attribute-newer-worker.js for example.
+
+assert_equals(
+  self.registration.scope,
+  normalizeURL('scope/registration-attribute'),
+  'On worker script evaluation, registration attribute should be set');
+assert_equals(
+  self.registration.installing,
+  null,
+  'On worker script evaluation, installing worker should be null');
+assert_equals(
+  self.registration.waiting,
+  null,
+  'On worker script evaluation, waiting worker should be null');
+assert_equals(
+  self.registration.active,
+  null,
+  'On worker script evaluation, active worker should be null');
+
+self.registration.addEventListener('updatefound', function() {
+    events_seen.push('updatefound');
+
+    assert_equals(
+      self.registration.scope,
+      normalizeURL('scope/registration-attribute'),
+      'On updatefound event, registration attribute should be set');
+    assert_equals(
+      self.registration.installing.scriptURL,
+      normalizeURL('registration-attribute-worker.js'),
+      'On updatefound event, installing worker should be set');
+    assert_equals(
+      self.registration.waiting,
+      null,
+      'On updatefound event, waiting worker should be null');
+    assert_equals(
+      self.registration.active,
+      null,
+      'On updatefound event, active worker should be null');
+
+    assert_equals(
+      self.registration.installing.state,
+      'installing',
+      'On updatefound event, worker should be in the installing state');
+
+    var worker = self.registration.installing;
+    self.registration.installing.addEventListener('statechange', function() {
+        events_seen.push('statechange(' + worker.state + ')');
+      });
+  });
+
+self.addEventListener('install', function(e) {
+    events_seen.push('install');
+
+    assert_equals(
+      self.registration.scope,
+      normalizeURL('scope/registration-attribute'),
+      'On install event, registration attribute should be set');
+    assert_equals(
+      self.registration.installing.scriptURL,
+      normalizeURL('registration-attribute-worker.js'),
+      'On install event, installing worker should be set');
+    assert_equals(
+      self.registration.waiting,
+      null,
+      'On install event, waiting worker should be null');
+    assert_equals(
+      self.registration.active,
+      null,
+      'On install event, active worker should be null');
+
+    assert_equals(
+      self.registration.installing.state,
+      'installing',
+      'On install event, worker should be in the installing state');
+  });
+
+self.addEventListener('activate', function(e) {
+    events_seen.push('activate');
+
+    assert_equals(
+      self.registration.scope,
+      normalizeURL('scope/registration-attribute'),
+      'On activate event, registration attribute should be set');
+    assert_equals(
+      self.registration.installing,
+      null,
+      'On activate event, installing worker should be null');
+    assert_equals(
+      self.registration.waiting,
+      null,
+      'On activate event, waiting worker should be null');
+    assert_equals(
+      self.registration.active.scriptURL,
+      normalizeURL('registration-attribute-worker.js'),
+      'On activate event, active worker should be set');
+
+    assert_equals(
+      self.registration.active.state,
+      'activating',
+      'On activate event, worker should be in the activating state');
+  });
+
+self.addEventListener('fetch', function(e) {
+    events_seen.push('fetch');
+
+    assert_equals(
+      self.registration.scope,
+      normalizeURL('scope/registration-attribute'),
+      'On fetch event, registration attribute should be set');
+    assert_equals(
+      self.registration.installing,
+      null,
+      'On fetch event, installing worker should be null');
+    assert_equals(
+      self.registration.waiting,
+      null,
+      'On fetch event, waiting worker should be null');
+    assert_equals(
+      self.registration.active.scriptURL,
+      normalizeURL('registration-attribute-worker.js'),
+      'On fetch event, active worker should be set');
+
+    assert_equals(
+      self.registration.active.state,
+      'activated',
+      'On fetch event, worker should be in the activated state');
+
+    e.respondWith(new Response(events_seen));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/unregister-controlling-worker.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/unregister-controlling-worker.html
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/unregister-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/unregister-worker.js
new file mode 100644
index 000000000000..6da397dd1526
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/unregister-worker.js
@@ -0,0 +1,25 @@
+function matchQuery(query) {
+  return self.location.href.indexOf(query) != -1;
+}
+
+if (matchQuery('?evaluation'))
+  self.registration.unregister();
+
+self.addEventListener('install', function(e) {
+    if (matchQuery('?install')) {
+      // Don't do waitUntil(unregister()) as that would deadlock as specified.
+      self.registration.unregister();
+    }
+  });
+
+self.addEventListener('activate', function(e) {
+    if (matchQuery('?activate'))
+      e.waitUntil(self.registration.unregister());
+  });
+
+self.addEventListener('message', function(e) {
+    e.waitUntil(self.registration.unregister()
+      .then(function(result) {
+          e.data.port.postMessage({result: result});
+        }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/update-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/update-worker.js
new file mode 100644
index 000000000000..8be8a1ffebe0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/update-worker.js
@@ -0,0 +1,22 @@
+var events_seen = [];
+
+self.registration.addEventListener('updatefound', function() {
+    events_seen.push('updatefound');
+  });
+
+self.addEventListener('activate', function(e) {
+    events_seen.push('activate');
+  });
+
+self.addEventListener('fetch', function(e) {
+    events_seen.push('fetch');
+    e.respondWith(new Response(events_seen));
+  });
+
+self.addEventListener('message', function(e) {
+    events_seen.push('message');
+    self.registration.update();
+  });
+
+// update() during the script evaluation should be ignored.
+self.registration.update();
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/service-worker-error-event.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/service-worker-error-event.https.html
new file mode 100644
index 000000000000..988f5466b9e1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/service-worker-error-event.https.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<title>ServiceWorkerGlobalScope: Error event error message</title>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='../resources/test-helpers.sub.js'></script>
+<script>
+promise_test(t => {
+    var script = 'resources/error-worker.js';
+    var scope = 'resources/scope/service-worker-error-event';
+    var error_name = 'testError'
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          var worker = registration.installing;
+          add_completion_callback(() => { registration.unregister(); });
+          return new Promise(function(resolve) {
+              navigator.serviceWorker.onmessage = resolve;
+              worker.postMessage('');
+            });
+        })
+      .then(e => {
+          assert_equals(e.data.error, error_name, 'error type');
+          assert_greater_than(
+            e.data.message.indexOf(error_name), -1, 'error message');
+          assert_greater_than(
+            e.data.filename.indexOf(script), -1, 'filename');
+          assert_equals(e.data.lineno, 5, 'error line number');
+          assert_equals(e.data.colno, 3, 'error column number');
+        });
+  }, 'Error handlers inside serviceworker should see the attributes of ' +
+     'ErrorEvent');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/unregister.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/unregister.https.html
new file mode 100644
index 000000000000..1a124d727687
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/unregister.https.html
@@ -0,0 +1,139 @@
+<!DOCTYPE html>
+<title>ServiceWorkerGlobalScope: unregister</title>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='../resources/test-helpers.sub.js'></script>
+<script>
+
+promise_test(function(t) {
+    var script = 'resources/unregister-worker.js?evaluation';
+    var scope = 'resources/scope/unregister-on-script-evaluation';
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'redundant');
+        })
+      .then(function() {
+          return navigator.serviceWorker.getRegistration(scope);
+        })
+      .then(function(result) {
+          assert_equals(
+            result,
+            undefined,
+            'After unregister(), the registration should not found');
+        });
+  }, 'Unregister on script evaluation');
+
+promise_test(function(t) {
+    var script = 'resources/unregister-worker.js?install';
+    var scope = 'resources/scope/unregister-on-install-event';
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'redundant');
+        })
+      .then(function() {
+          return navigator.serviceWorker.getRegistration(scope);
+        })
+      .then(function(result) {
+          assert_equals(
+            result,
+            undefined,
+            'After unregister(), the registration should not found');
+        });
+  }, 'Unregister on installing event');
+
+promise_test(function(t) {
+    var script = 'resources/unregister-worker.js?activate';
+    var scope = 'resources/scope/unregister-on-activate-event';
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'redundant');
+        })
+      .then(function() {
+          return navigator.serviceWorker.getRegistration(scope);
+        })
+      .then(function(result) {
+          assert_equals(
+            result,
+            undefined,
+            'After unregister(), the registration should not found');
+        });
+  }, 'Unregister on activate event');
+
+promise_test(function(t) {
+    var script = 'resources/unregister-worker.js';
+    var scope = 'resources/unregister-controlling-worker.html';
+
+    var controller;
+    var frame;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          frame = f;
+          controller = frame.contentWindow.navigator.serviceWorker.controller;
+
+          assert_equals(
+            controller.scriptURL,
+            normalizeURL(script),
+            'Service worker should control a new document')
+
+          // Wait for the completion of unregister() on the worker.
+          var channel = new MessageChannel();
+          var promise = new Promise(function(resolve) {
+              channel.port1.onmessage = t.step_func(function(e) {
+                  assert_true(e.data.result,
+                              'unregister() should successfully finish');
+                  resolve();
+                });
+            });
+          controller.postMessage({port: channel.port2}, [channel.port2]);
+          return promise;
+        })
+      .then(function() {
+          return navigator.serviceWorker.getRegistration(scope);
+        })
+      .then(function(result) {
+          assert_equals(
+            result,
+            undefined,
+            'After unregister(), the registration should not found');
+          assert_equals(
+            frame.contentWindow.navigator.serviceWorker.controller,
+            controller,
+            'After unregister(), the worker should still control the document');
+          return with_iframe(scope);
+        })
+      .then(function(new_frame) {
+          assert_equals(
+            new_frame.contentWindow.navigator.serviceWorker.controller,
+            null,
+            'After unregister(), the worker should not control a new document');
+
+          frame.remove();
+          new_frame.remove();
+        })
+  }, 'Unregister controlling service worker');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/update.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/update.https.html
new file mode 100644
index 000000000000..a7dde2233972
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/update.https.html
@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<title>ServiceWorkerGlobalScope: update</title>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='../resources/test-helpers.sub.js'></script>
+<script>
+
+promise_test(function(t) {
+    var script = 'resources/update-worker.py';
+    var scope = 'resources/scope/update';
+    var registration;
+    var frame1;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          frame1 = f;
+          registration.active.postMessage('update');
+          return wait_for_update(t, registration);
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(frame2) {
+          var expected_events_seen = [
+            'updatefound',  // by register().
+            'activate',
+            'fetch',
+            'message',
+            'updatefound',  // by update() in the message handler.
+            'fetch',
+          ];
+          assert_equals(
+              frame2.contentDocument.body.textContent,
+              expected_events_seen.toString(),
+              'events seen by the worker');
+          frame1.remove();
+          frame2.remove();
+        });
+  }, 'Update a registration on ServiceWorkerGlobalScope');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/WEB_FEATURES.yml b/test/fixtures/wpt/service-workers/service-worker/WEB_FEATURES.yml
new file mode 100644
index 000000000000..d729f2cd79b2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/WEB_FEATURES.yml
@@ -0,0 +1,4 @@
+rules:
+- registration-script-module.https.html: [js-modules-service-workers]
+- update-registration-with-type.https.html: [js-modules-service-workers]
+- "*": [service-workers]
diff --git a/test/fixtures/wpt/service-workers/service-worker/about-blank-replacement.https.html b/test/fixtures/wpt/service-workers/service-worker/about-blank-replacement.https.html
new file mode 100644
index 000000000000..b6efe3ec5620
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/about-blank-replacement.https.html
@@ -0,0 +1,181 @@
+<!DOCTYPE html>
+<title>Service Worker: about:blank replacement handling</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+// This test attempts to verify various initial about:blank document
+// creation is accurately reflected via the Clients API.  The goal is
+// for Clients API to reflect what the browser actually does and not
+// to make special cases for the API.
+//
+// If your browser does not create an about:blank document in certain
+// cases then please just mark the test expected fail for now.  The
+// reuse of globals from about:blank documents to the final load document
+// has particularly bad interop at the moment.  Hopefully we can evolve
+// tests like this to eventually align browsers.
+
+const worker = 'resources/about-blank-replacement-worker.js';
+
+// Helper routine that creates an iframe that internally has some kind
+// of nested window.  The nested window could be another iframe or
+// it could be a popup window.
+function createFrameWithNestedWindow(url) {
+  return new Promise((resolve, reject) => {
+    let frame = document.createElement('iframe');
+    frame.src = url;
+    document.body.appendChild(frame);
+
+    window.addEventListener('message', function onMsg(evt) {
+      if (evt.data.type !== 'NESTED_LOADED') {
+        return;
+      }
+      window.removeEventListener('message', onMsg);
+      if (evt.data.result && evt.data.result.startsWith('failure:')) {
+        reject(evt.data.result);
+        return;
+      }
+      resolve(frame);
+    });
+  });
+}
+
+// Helper routine to request the given worker find the client with
+// the specified URL using the clients.matchAll() API.
+function getClientIdByURL(worker, url) {
+  return new Promise(resolve => {
+    navigator.serviceWorker.addEventListener('message', function onMsg(evt) {
+      if (evt.data.type !== 'GET_CLIENT_ID') {
+        return;
+      }
+      navigator.serviceWorker.removeEventListener('message', onMsg);
+      resolve(evt.data.result);
+    });
+    worker.postMessage({ type: 'GET_CLIENT_ID', url: url.toString() });
+  });
+}
+
+async function doAsyncTest(t, scope) {
+  let reg = await service_worker_unregister_and_register(t, worker, scope);
+
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Load the scope as a frame.  We expect this in turn to have a nested
+  // iframe.  The service worker will intercept the load of the nested
+  // iframe and populate its body with the client ID of the initial
+  // about:blank document it sees via clients.matchAll().
+  let frame = await createFrameWithNestedWindow(scope);
+  let initialResult = frame.contentWindow.nested().document.body.textContent;
+  assert_false(initialResult.startsWith('failure:'), `result: ${initialResult}`);
+
+  assert_equals(frame.contentWindow.navigator.serviceWorker.controller.scriptURL,
+                frame.contentWindow.nested().navigator.serviceWorker.controller.scriptURL,
+                'nested about:blank should have same controlling service worker');
+
+  // Next, ask the service worker to find the final client ID for the fully
+  // loaded nested frame.
+  let nestedURL = new URL(frame.contentWindow.nested().location);
+  let finalResult = await getClientIdByURL(reg.active, nestedURL);
+  assert_false(finalResult.startsWith('failure:'), `result: ${finalResult}`);
+
+  // If the nested frame doesn't have a URL to load, then there is no fetch
+  // event and the body should be empty.  We can't verify the final client ID
+  // against anything.
+  if (nestedURL.href === 'about:blank' ||
+      nestedURL.href === 'about:srcdoc') {
+    assert_equals('', initialResult, 'about:blank text content should be blank');
+  }
+
+  // If the nested URL is not about:blank, though, then the fetch event handler
+  // should have populated the body with the client id of the initial about:blank.
+  // Verify the final client id matches.
+  else {
+    assert_equals(initialResult, finalResult, 'client ID values should match');
+  }
+
+  frame.remove();
+}
+
+promise_test(async function(t) {
+  // Execute a test where the nested frame is simply loaded normally.
+  await doAsyncTest(t, 'resources/about-blank-replacement-frame.py');
+}, 'Initial about:blank is controlled, exposed to clients.matchAll(), and ' +
+   'matches final Client.');
+
+promise_test(async function(t) {
+  // Execute a test where the nested frame is modified immediately by
+  // its parent.  In this case we add a message listener so the service
+  // worker can ping the client to verify its existence.  This ping-pong
+  // check is performed during the initial load and when verifying the
+  // final loaded client.
+  await doAsyncTest(t, 'resources/about-blank-replacement-ping-frame.py');
+}, 'Initial about:blank modified by parent is controlled, exposed to ' +
+   'clients.matchAll(), and matches final Client.');
+
+promise_test(async function(t) {
+  // Execute a test where the nested window is a popup window instead of
+  // an iframe.  This should behave the same as the simple iframe case.
+  await doAsyncTest(t, 'resources/about-blank-replacement-popup-frame.py');
+}, 'Popup initial about:blank is controlled, exposed to clients.matchAll(), and ' +
+   'matches final Client.');
+
+promise_test(async function(t) {
+  const scope = 'resources/about-blank-replacement-uncontrolled-nested-frame.html';
+
+  let reg = await service_worker_unregister_and_register(t, worker, scope);
+
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Load the scope as a frame.  We expect this in turn to have a nested
+  // iframe.  Unlike the other tests in this file the nested iframe URL
+  // is not covered by a service worker scope.  It should end up as
+  // uncontrolled even though its initial about:blank is controlled.
+  let frame = await createFrameWithNestedWindow(scope);
+  let nested = frame.contentWindow.nested();
+  let initialResult = nested.document.body.textContent;
+
+  // The nested iframe should not have been intercepted by the service
+  // worker.  The empty.html nested frame has "hello world" for its body.
+  assert_equals(initialResult.trim(), 'hello world', `result: ${initialResult}`);
+
+  assert_not_equals(frame.contentWindow.navigator.serviceWorker.controller, null,
+                'outer frame should be controlled');
+
+  assert_equals(nested.navigator.serviceWorker.controller, null,
+                'nested frame should not be controlled');
+
+  frame.remove();
+}, 'Initial about:blank is controlled, exposed to clients.matchAll(), and ' +
+   'final Client is not controlled by a service worker.');
+
+promise_test(async function(t) {
+  // Execute a test where the nested frame is an iframe without a src
+  // attribute.  This simple nested about:blank should still inherit the
+  // controller and be visible to clients.matchAll().
+  await doAsyncTest(t, 'resources/about-blank-replacement-blank-nested-frame.html');
+}, 'Simple about:blank is controlled and is exposed to clients.matchAll().');
+
+promise_test(async function(t) {
+  // Execute a test where the nested frame is an iframe using a non-empty
+  // srcdoc containing only a tag pair so its textContent is still empty.
+  // This nested iframe should still inherit the controller and be visible
+  // to clients.matchAll().
+  await doAsyncTest(t, 'resources/about-blank-replacement-srcdoc-nested-frame.html');
+}, 'Nested about:srcdoc is controlled and is exposed to clients.matchAll().');
+
+promise_test(async function(t) {
+  // Execute a test where the nested frame is dynamically added without a src
+  // attribute.  This simple nested about:blank should still inherit the
+  // controller and be visible to clients.matchAll().
+  await doAsyncTest(t, 'resources/about-blank-replacement-blank-dynamic-nested-frame.html');
+}, 'Dynamic about:blank is controlled and is exposed to clients.matchAll().');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/activate-event-after-install-state-change.https.html b/test/fixtures/wpt/service-workers/service-worker/activate-event-after-install-state-change.https.html
new file mode 100644
index 000000000000..016a52c13c82
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/activate-event-after-install-state-change.https.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<title>Service Worker: registration events</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+  var script = 'resources/empty-worker.js';
+  var scope = 'resources/blank.html';
+  var registration;
+
+  return service_worker_unregister_and_register(t, script, scope)
+    .then(function(registration) {
+        t.add_cleanup(function() {
+            return service_worker_unregister(t, scope);
+          });
+
+        var sw = registration.installing;
+
+        return new Promise(t.step_func(function(resolve) {
+          sw.onstatechange = t.step_func(function() {
+            if (sw.state === 'installed') {
+              assert_equals(registration.active, null,
+                            'installed event should be fired before activating service worker');
+              resolve();
+            }
+          });
+        }));
+      })
+    .catch(unreached_rejection(t));
+  }, 'installed event should be fired before activating service worker');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/activation-after-registration.https.html b/test/fixtures/wpt/service-workers/service-worker/activation-after-registration.https.html
new file mode 100644
index 000000000000..29f97e3e3f4c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/activation-after-registration.https.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<title>Service Worker: Activation occurs after registration</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+promise_test(function(t) {
+    var scope = 'resources/blank.html';
+    var registration;
+
+    return service_worker_unregister_and_register(
+        t, 'resources/empty-worker.js', scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          assert_equals(
+              r.installing.state,
+              'installing',
+              'worker should be in the "installing" state upon registration');
+          return wait_for_state(t, r.installing, 'activated');
+        });
+}, 'activation occurs after registration');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/activation.https.html b/test/fixtures/wpt/service-workers/service-worker/activation.https.html
new file mode 100644
index 000000000000..278454d3383e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/activation.https.html
@@ -0,0 +1,168 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<meta name="timeout" content="long">
+<title>service worker: activation</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+// Returns {registration, iframe}, where |registration| has an active and
+// waiting worker. The active worker controls |iframe| and has an inflight
+// message event that can be finished by calling
+// |registration.active.postMessage('go')|.
+function setup_activation_test(t, scope, worker_url) {
+  var registration;
+  var iframe;
+  return navigator.serviceWorker.getRegistration(scope)
+    .then(r => {
+        if (r)
+          return r.unregister();
+      })
+    .then(() => {
+        // Create an in-scope iframe. Do this prior to registration to avoid
+        // racing between an update triggered by navigation and the update()
+        // call below.
+        return with_iframe(scope);
+      })
+    .then(f => {
+        iframe = f;
+        // Create an active worker.
+        return navigator.serviceWorker.register(worker_url, { scope: scope });
+      })
+    .then(r => {
+        registration = r;
+        add_result_callback(() => registration.unregister());
+        return wait_for_state(t, r.installing, 'activated');
+      })
+    .then(() => {
+        // Check that the frame was claimed.
+        assert_not_equals(
+            iframe.contentWindow.navigator.serviceWorker.controller, null);
+        // Create an in-flight request.
+        registration.active.postMessage('wait');
+        // Now there is both a controllee and an in-flight request.
+        // Initiate an update.
+        return registration.update();
+      })
+    .then(() => {
+        // Wait for a waiting worker.
+        return wait_for_state(t, registration.installing, 'installed');
+      })
+    .then(() => {
+        return wait_for_activation_on_sample_scope(t, self);
+      })
+    .then(() => {
+        assert_not_equals(registration.waiting, null);
+        assert_not_equals(registration.active, null);
+        return Promise.resolve({registration: registration, iframe: iframe});
+      });
+}
+promise_test(t => {
+    var scope = 'resources/no-controllee';
+    var worker_url = 'resources/mint-new-worker.py';
+    var registration;
+    var iframe;
+    var new_worker;
+    return setup_activation_test(t, scope, worker_url)
+      .then(result => {
+          registration = result.registration;
+          iframe = result.iframe;
+          // Finish the in-flight request.
+          registration.active.postMessage('go');
+          return wait_for_activation_on_sample_scope(t, self);
+        })
+      .then(() => {
+          // The new worker is still waiting. Remove the frame and it should
+          // activate.
+          new_worker = registration.waiting;
+          assert_equals(new_worker.state, 'installed');
+          var reached_active = wait_for_state(t, new_worker, 'activating');
+          iframe.remove();
+          return reached_active;
+        })
+      .then(() => {
+          assert_equals(new_worker, registration.active);
+        });
+  }, 'loss of controllees triggers activation');
+promise_test(t => {
+    var scope = 'resources/no-request';
+    var worker_url = 'resources/mint-new-worker.py';
+    var registration;
+    var iframe;
+    var new_worker;
+    return setup_activation_test(t, scope, worker_url)
+      .then(result => {
+          registration = result.registration;
+          iframe = result.iframe;
+          // Remove the iframe.
+          iframe.remove();
+          return new Promise(resolve => setTimeout(resolve, 0));
+        })
+      .then(() => {
+          // Finish the request.
+          new_worker = registration.waiting;
+          var reached_active = wait_for_state(t, new_worker, 'activating');
+          registration.active.postMessage('go');
+          return reached_active;
+        })
+      .then(() => {
+          assert_equals(registration.active, new_worker);
+        });
+  }, 'finishing a request triggers activation');
+promise_test(t => {
+    var scope = 'resources/skip-waiting';
+    var worker_url = 'resources/mint-new-worker.py?skip-waiting';
+    var registration;
+    var iframe;
+    var new_worker;
+    return setup_activation_test(t, scope, worker_url)
+      .then(result => {
+          registration = result.registration;
+          iframe = result.iframe;
+          // Finish the request. The iframe does not need to be removed because
+          // skipWaiting() was called.
+          new_worker = registration.waiting;
+          var reached_active = wait_for_state(t, new_worker, 'activating');
+          registration.active.postMessage('go');
+          return reached_active;
+        })
+      .then(() => {
+          assert_equals(registration.active, new_worker);
+          // Remove the iframe.
+          iframe.remove();
+        });
+  }, 'skipWaiting bypasses no controllee requirement');
+
+// This test is not really about activation, but otherwise is very
+// similar to the other tests here.
+promise_test(t => {
+    var scope = 'resources/unregister';
+    var worker_url = 'resources/mint-new-worker.py';
+    var registration;
+    var iframe;
+    var new_worker;
+    return setup_activation_test(t, scope, worker_url)
+      .then(result => {
+          registration = result.registration;
+          iframe = result.iframe;
+          // Remove the iframe.
+          iframe.remove();
+          return registration.unregister();
+        })
+      .then(() => {
+          // The unregister operation should wait for the active worker to
+          // finish processing its events before clearing the registration.
+          new_worker = registration.waiting;
+          var reached_redundant = wait_for_state(t, new_worker, 'redundant');
+          registration.active.postMessage('go');
+          return reached_redundant;
+        })
+      .then(() => {
+          assert_equals(registration.installing, null);
+          assert_equals(registration.waiting, null);
+          assert_equals(registration.active, null);
+        });
+  }, 'finishing a request triggers unregister');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/active.https.html b/test/fixtures/wpt/service-workers/service-worker/active.https.html
new file mode 100644
index 000000000000..350a34b802f7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/active.https.html
@@ -0,0 +1,50 @@
+<!DOCTYPE html>
+<title>ServiceWorker: navigator.serviceWorker.active</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+const SCRIPT = 'resources/empty-worker.js';
+const SCOPE = 'resources/blank.html';
+
+// "active" is set
+promise_test(async t => {
+
+  t.add_cleanup(async() => {
+    if (frame)
+      frame.remove();
+    if (registration)
+      await registration.unregister();
+  });
+
+  await service_worker_unregister(t, SCOPE);
+  const frame = await with_iframe(SCOPE);
+  const registration =
+      await navigator.serviceWorker.register(SCRIPT, {scope: SCOPE});
+  await wait_for_state(t, registration.installing, 'activating');
+  const container = frame.contentWindow.navigator.serviceWorker;
+  assert_equals(container.controller, null, 'controller');
+  assert_equals(registration.active.state, 'activating',
+                'registration.active');
+  assert_equals(registration.waiting, null, 'registration.waiting');
+  assert_equals(registration.installing, null, 'registration.installing');
+
+  // FIXME: Add a test for a frame created after installation.
+  // Should the existing frame ("frame") block activation?
+}, 'active is set');
+
+// Tests that the ServiceWorker objects returned from active attribute getter
+// that represent the same service worker are the same objects.
+promise_test(async t => {
+  const registration1 =
+      await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+  const registration2 = await navigator.serviceWorker.getRegistration(SCOPE);
+  assert_equals(registration1.active, registration2.active,
+                'ServiceWorkerRegistration.active should return the same ' +
+                'object');
+  await registration1.unregister();
+}, 'The ServiceWorker objects returned from active attribute getter that ' +
+   'represent the same service worker are the same objects');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/add-routes.https.html b/test/fixtures/wpt/service-workers/service-worker/add-routes.https.html
new file mode 100644
index 000000000000..fbab7cdedfa3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/add-routes.https.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: addRoutes() executes in installing</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/static-router-helpers.sub.js"></script>
+<script>
+
+promise_test(async t => {
+  const script = 'resources/add-routes.js';
+  const scope = 'resources/blank.html';
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+  const sw = reg.active;
+  const addRoutesError = await get_info_from_worker(sw);
+
+  assert_equals(addRoutesError.install, null,
+    'addRoutes() should execute successfully in installing');
+  assert_true(addRoutesError.activate instanceof Error,
+    'addRoutes() should throw outside of installing');
+
+}, 'addRoutes() will not be executed outside of installing');
+
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/claim-affect-other-registration.https.html b/test/fixtures/wpt/service-workers/service-worker/claim-affect-other-registration.https.html
new file mode 100644
index 000000000000..52555ac271b5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/claim-affect-other-registration.https.html
@@ -0,0 +1,136 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Service Worker: claim() should affect other registration</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(function(t) {
+  var frame;
+
+  var init_scope = 'resources/blank.html?affect-other';
+  var init_worker_url = 'resources/empty.js';
+  var init_registration;
+  var init_workers = [undefined, undefined];
+
+  var claim_scope = 'resources/blank.html?affect-other-registration';
+  var claim_worker_url = 'resources/claim-worker.js';
+  var claim_registration;
+  var claim_worker;
+
+  return Promise.resolve()
+    // Register the first service worker to init_scope.
+    .then(() => navigator.serviceWorker.register(init_worker_url + '?v1',
+                                                 {scope: init_scope}))
+    .then(r => {
+      init_registration = r;
+      init_workers[0] = r.installing;
+      return Promise.resolve()
+        .then(() => wait_for_state(t, init_workers[0], 'activated'))
+        .then(() => assert_array_equals([init_registration.active,
+                                         init_registration.waiting,
+                                         init_registration.installing],
+                                        [init_workers[0],
+                                         null,
+                                         null],
+                                        'Wrong workers.'));
+    })
+
+    // Create an iframe as the client of the first service worker of init_scope.
+    .then(() => with_iframe(claim_scope))
+    .then(f => frame = f)
+
+    // Check the controller.
+    .then(() => frame.contentWindow.navigator.serviceWorker.getRegistration(
+                  normalizeURL(init_scope)))
+    .then(r => assert_equals(frame.contentWindow.navigator.serviceWorker.controller,
+                             r.active,
+                             '.controller should belong to init_scope.'))
+
+    // Register the second service worker to init_scope.
+    .then(() => navigator.serviceWorker.register(init_worker_url + '?v2',
+                                                 {scope: init_scope}))
+    .then(r => {
+      assert_equals(r, init_registration, 'Should be the same registration');
+      init_workers[1] = r.installing;
+      return Promise.resolve()
+        .then(() => wait_for_state(t, init_workers[1], 'installed'))
+        .then(() => assert_array_equals([init_registration.active,
+                                         init_registration.waiting,
+                                         init_registration.installing],
+                                        [init_workers[0],
+                                         init_workers[1],
+                                         null],
+                                        'Wrong workers.'));
+    })
+
+    // Register a service worker to claim_scope.
+    .then(() => navigator.serviceWorker.register(claim_worker_url,
+                                                 {scope: claim_scope}))
+    .then(r => {
+      claim_registration = r;
+      claim_worker = r.installing;
+      return wait_for_state(t, claim_worker, 'activated')
+    })
+
+    // Let claim_worker claim the created iframe.
+    .then(function() {
+      var channel = new MessageChannel();
+      var saw_message = new Promise(function(resolve) {
+        channel.port1.onmessage = t.step_func(function(e) {
+          assert_equals(e.data, 'PASS',
+                        'Worker call to claim() should fulfill.');
+          resolve();
+        });
+      });
+
+      claim_worker.postMessage({port: channel.port2}, [channel.port2]);
+      return saw_message;
+    })
+
+    // Check the controller.
+    .then(() => frame.contentWindow.navigator.serviceWorker.getRegistration(
+                  normalizeURL(claim_scope)))
+    .then(r => assert_equals(frame.contentWindow.navigator.serviceWorker.controller,
+                             r.active,
+                             '.controller should belong to claim_scope.'))
+
+    // Check the status of created registrations and service workers.
+    .then(() => wait_for_state(t, init_workers[1], 'activated'))
+    .then(() => {
+      assert_array_equals([claim_registration.active,
+                           claim_registration.waiting,
+                           claim_registration.installing],
+                          [claim_worker,
+                           null,
+                           null],
+                          'claim_worker should be the only worker.')
+
+      assert_array_equals([init_registration.active,
+                           init_registration.waiting,
+                           init_registration.installing],
+                          [init_workers[1],
+                           null,
+                           null],
+                          'The waiting sw should become the active worker.')
+
+      assert_array_equals([init_workers[0].state,
+                           init_workers[1].state,
+                           claim_worker.state],
+                          ['redundant',
+                           'activated',
+                           'activated'],
+                          'Wrong worker states.');
+    })
+
+    // Cleanup and finish testing.
+    .then(() => frame.remove())
+    .then(() => Promise.all([
+      init_registration.unregister(),
+      claim_registration.unregister()
+    ]))
+    .then(() => t.done());
+}, 'claim() should affect the originally controlling registration.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/claim-fetch.https.html b/test/fixtures/wpt/service-workers/service-worker/claim-fetch.https.html
new file mode 100644
index 000000000000..ae0082df06bf
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/claim-fetch.https.html
@@ -0,0 +1,90 @@
+<!doctype html>
+<meta charset=utf-8>
+<title></title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+async function tryFetch(fetchFunc, path) {
+  let response;
+  try {
+   response = await fetchFunc(path);
+  } catch (err) {
+    throw (`fetch() threw: ${err}`);
+  }
+
+  let responseText;
+  try {
+   responseText = await response.text();
+  } catch (err) {
+   throw (`text() threw: ${err}`);
+  }
+
+  return responseText;
+}
+
+promise_test(async function(t) {
+  const scope = 'resources/';
+  const script = 'resources/claim-worker.js';
+  const resource = 'simple.txt';
+
+  // Create the test frame.
+  const frame = await with_iframe('resources/blank.html');
+  t.add_cleanup(() => frame.remove());
+
+  // Check the controller and test with fetch.
+  assert_equals(frame.contentWindow.navigator.controller, undefined,
+                'Should have no controller.');
+  let response;
+  try {
+    response = await tryFetch(frame.contentWindow.fetch, resource);
+  } catch (err) {
+    assert_unreached(`uncontrolled fetch failed: ${err}`);
+  }
+  assert_equals(response, 'a simple text file\n',
+                'fetch() should not be intercepted.');
+
+  // Register a service worker.
+  const registration =
+    await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => registration.unregister());
+  const worker = registration.installing;
+  await wait_for_state(t, worker, 'activated');
+
+  // Register a controllerchange event to wait until the controller is updated
+  // and check if the frame is controlled by a service worker.
+  const controllerChanged = new Promise((resolve) => {
+    frame.contentWindow.navigator.serviceWorker.oncontrollerchange = () => {
+      resolve(frame.contentWindow.navigator.serviceWorker.controller);
+    };
+  });
+
+  // Tell the service worker to claim the iframe.
+  const sawMessage = new Promise((resolve) => {
+    const channel = new MessageChannel();
+    channel.port1.onmessage = t.step_func((event) => {
+      resolve(event.data);
+    });
+    worker.postMessage({port: channel.port2}, [channel.port2]);
+  });
+  const data = await sawMessage;
+  assert_equals(data, 'PASS', 'Worker call to claim() should fulfill.');
+
+  // Check if the controller is updated after claim() and test with fetch.
+  const controller = await controllerChanged;
+  assert_true(controller instanceof frame.contentWindow.ServiceWorker,
+              'iframe should be controlled.');
+  try {
+    response = await tryFetch(frame.contentWindow.fetch, resource);
+  } catch (err) {
+    assert_unreached(`controlled fetch failed: ${err}`);
+  }
+  assert_equals(response, 'Intercepted!',
+                'fetch() should be intercepted.');
+}, 'fetch() should be intercepted after the client is claimed.');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/claim-not-using-registration.https.html b/test/fixtures/wpt/service-workers/service-worker/claim-not-using-registration.https.html
new file mode 100644
index 000000000000..fd61d05ba4ea
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/claim-not-using-registration.https.html
@@ -0,0 +1,131 @@
+<!DOCTYPE html>
+<title>Service Worker: claim client not using registration</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+promise_test(function(t) {
+    var init_scope = 'resources/blank.html?not-using-init';
+    var claim_scope = 'resources/blank.html?not-using';
+    var init_worker_url = 'resources/empty.js';
+    var claim_worker_url = 'resources/claim-worker.js';
+    var claim_worker, claim_registration, frame1, frame2;
+    return service_worker_unregister_and_register(
+        t, init_worker_url, init_scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, init_scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return Promise.all(
+              [with_iframe(init_scope), with_iframe(claim_scope)]);
+        })
+      .then(function(frames) {
+          frame1 = frames[0];
+          frame2 = frames[1];
+          assert_equals(
+              frame1.contentWindow.navigator.serviceWorker.controller.scriptURL,
+              normalizeURL(init_worker_url),
+              'Frame1 controller should not be null');
+          assert_equals(
+              frame2.contentWindow.navigator.serviceWorker.controller, null,
+              'Frame2 controller should be null');
+          return navigator.serviceWorker.register(claim_worker_url,
+                                                  {scope: claim_scope});
+        })
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, claim_scope);
+            });
+
+          claim_worker = registration.installing;
+          claim_registration = registration;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          var saw_controllerchanged = new Promise(function(resolve) {
+              frame2.contentWindow.navigator.serviceWorker.oncontrollerchange =
+                  function() { resolve(); }
+            });
+          var channel = new MessageChannel();
+          var saw_message = new Promise(function(resolve) {
+              channel.port1.onmessage = t.step_func(function(e) {
+                  assert_equals(e.data, 'PASS',
+                                'Worker call to claim() should fulfill.');
+                  resolve();
+                });
+            });
+          claim_worker.postMessage({port: channel.port2}, [channel.port2]);
+          return Promise.all([saw_controllerchanged, saw_message]);
+        })
+      .then(function() {
+          assert_equals(
+              frame1.contentWindow.navigator.serviceWorker.controller.scriptURL,
+              normalizeURL(init_worker_url),
+              'Frame1 should not be influenced');
+          assert_equals(
+              frame2.contentWindow.navigator.serviceWorker.controller.scriptURL,
+              normalizeURL(claim_worker_url),
+              'Frame2 should be controlled by the new registration');
+          frame1.remove();
+          frame2.remove();
+          return claim_registration.unregister();
+        });
+  }, 'Test claim client which is not using registration');
+
+promise_test(function(t) {
+    var scope = 'resources/blank.html?longer-matched';
+    var claim_scope = 'resources/blank.html?longer';
+    var claim_worker_url = 'resources/claim-worker.js';
+    var installing_worker_url = 'resources/empty-worker.js';
+    var frame, claim_worker;
+    return with_iframe(scope)
+      .then(function(f) {
+          frame = f;
+          return navigator.serviceWorker.register(
+              claim_worker_url, {scope: claim_scope});
+        })
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, claim_scope);
+            });
+
+          claim_worker = registration.installing;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return navigator.serviceWorker.register(
+              installing_worker_url, {scope: scope});
+        })
+      .then(function() {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          var channel = new MessageChannel();
+          var saw_message = new Promise(function(resolve) {
+              channel.port1.onmessage = t.step_func(function(e) {
+                  assert_equals(e.data, 'PASS',
+                                'Worker call to claim() should fulfill.');
+                  resolve();
+                });
+            });
+          claim_worker.postMessage({port: channel.port2}, [channel.port2]);
+          return saw_message;
+        })
+      .then(function() {
+          assert_equals(
+              frame.contentWindow.navigator.serviceWorker.controller, null,
+              'Frame should not be claimed when a longer-matched ' +
+              'registration exists');
+          frame.remove();
+        });
+  }, 'Test claim client when there\'s a longer-matched registration not ' +
+     'already used by the page');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/claim-shared-worker-fetch.https.html b/test/fixtures/wpt/service-workers/service-worker/claim-shared-worker-fetch.https.html
new file mode 100644
index 000000000000..f5f44886baa2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/claim-shared-worker-fetch.https.html
@@ -0,0 +1,71 @@
+<!doctype html>
+<meta charset=utf-8>
+<title></title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+promise_test(function(t) {
+  var frame;
+  var resource = 'simple.txt';
+
+  var worker;
+  var scope = 'resources/';
+  var script = 'resources/claim-worker.js';
+
+  return Promise.resolve()
+    // Create the test iframe with a shared worker.
+    .then(() => with_iframe('resources/claim-shared-worker-fetch-iframe.html'))
+    .then(f => frame = f)
+
+    // Check the controller and test with fetch in the shared worker.
+    .then(() => assert_equals(frame.contentWindow.navigator.controller,
+                              undefined,
+                              'Should have no controller.'))
+    .then(() => frame.contentWindow.fetch_in_shared_worker(resource))
+    .then(response_text => assert_equals(response_text,
+                                         'a simple text file\n',
+                                         'fetch() should not be intercepted.'))
+    // Register a service worker.
+    .then(() => service_worker_unregister_and_register(t, script, scope))
+    .then(r => {
+        t.add_cleanup(() => service_worker_unregister(t, scope));
+
+        worker = r.installing;
+
+        return wait_for_state(t, worker, 'activated')
+      })
+    // Let the service worker claim the iframe and the shared worker.
+    .then(() => {
+      var channel = new MessageChannel();
+      var saw_message = new Promise(function(resolve) {
+        channel.port1.onmessage = t.step_func(function(e) {
+          assert_equals(e.data, 'PASS',
+                        'Worker call to claim() should fulfill.');
+          resolve();
+        });
+      });
+      worker.postMessage({port: channel.port2}, [channel.port2]);
+      return saw_message;
+    })
+
+    // Check the controller and test with fetch in the shared worker.
+    .then(() => frame.contentWindow.navigator.serviceWorker.getRegistration(scope))
+    .then(r => assert_equals(frame.contentWindow.navigator.serviceWorker.controller,
+                             r.active,
+                             'Test iframe should be claimed.'))
+    // TODO(horo): Check the SharedWorker's navigator.seviceWorker.controller.
+    .then(() => frame.contentWindow.fetch_in_shared_worker(resource))
+    .then(response_text =>
+          assert_equals(response_text,
+                        'Intercepted!',
+                        'fetch() in the shared worker should be intercepted.'))
+
+    // Cleanup this testcase.
+    .then(() => frame.remove());
+}, 'fetch() in SharedWorker should be intercepted after the client is claimed.')
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/claim-using-registration.https.html b/test/fixtures/wpt/service-workers/service-worker/claim-using-registration.https.html
new file mode 100644
index 000000000000..a02f8e9ca6f1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/claim-using-registration.https.html
@@ -0,0 +1,103 @@
+<!DOCTYPE html>
+<title>Service Worker: claim client using registration</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(function(t) {
+    var scope = 'resources/';
+    var frame_url = 'resources/blank.html?using-different-registration';
+    var url1 = 'resources/empty.js';
+    var url2 = 'resources/claim-worker.js';
+    var worker, sw_registration, frame;
+    return service_worker_unregister_and_register(t, url1, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(frame_url);
+        })
+      .then(function(f) {
+          frame = f;
+          return navigator.serviceWorker.register(url2, {scope: frame_url});
+        })
+      .then(function(registration) {
+          worker = registration.installing;
+          sw_registration = registration;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          var saw_controllerchanged = new Promise(function(resolve) {
+              frame.contentWindow.navigator.serviceWorker.oncontrollerchange =
+                  function() { resolve(); }
+            });
+          var channel = new MessageChannel();
+          var saw_message = new Promise(function(resolve) {
+              channel.port1.onmessage = t.step_func(function(e) {
+                  assert_equals(e.data, 'PASS',
+                                'Worker call to claim() should fulfill.');
+                  resolve();
+                });
+            });
+          worker.postMessage({port: channel.port2}, [channel.port2]);
+          return Promise.all([saw_controllerchanged, saw_message]);
+        })
+      .then(function() {
+          assert_equals(
+              frame.contentWindow.navigator.serviceWorker.controller.scriptURL,
+              normalizeURL(url2),
+              'Frame1 controller scriptURL should be changed to url2');
+          frame.remove();
+          return sw_registration.unregister();
+        });
+  }, 'Test worker claims client which is using another registration');
+
+promise_test(function(t) {
+    var scope = 'resources/blank.html?using-same-registration';
+    var url1 = 'resources/empty.js';
+    var url2 = 'resources/claim-worker.js';
+    var frame, worker;
+    return service_worker_unregister_and_register(t, url1, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          return navigator.serviceWorker.register(url2, {scope: scope});
+        })
+      .then(function(registration) {
+          worker = registration.installing;
+          return wait_for_state(t, registration.installing, 'installed');
+        })
+      .then(function() {
+          var channel = new MessageChannel();
+          var saw_message = new Promise(function(resolve) {
+              channel.port1.onmessage = t.step_func(function(e) {
+                  assert_equals(e.data, 'FAIL: exception: InvalidStateError',
+                                'Worker call to claim() should reject with ' +
+                                'InvalidStateError');
+                  resolve();
+                });
+            });
+          worker.postMessage({port: channel.port2}, [channel.port2]);
+          return saw_message;
+        })
+      .then(function() {
+          frame.remove();
+        });
+  }, 'Test for the waiting worker claims a client which is using the ' +
+     'same registration');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/claim-with-redirect.https.html b/test/fixtures/wpt/service-workers/service-worker/claim-with-redirect.https.html
new file mode 100644
index 000000000000..fd89cb9b00a1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/claim-with-redirect.https.html
@@ -0,0 +1,59 @@
+<!DOCTYPE html>
+<title>Service Worker: Claim() when update happens after redirect</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var host_info = get_host_info();
+var BASE_URL = host_info['HTTPS_ORIGIN'] + base_path();
+var OTHER_BASE_URL = host_info['HTTPS_REMOTE_ORIGIN'] + base_path();
+
+var WORKER_URL = OTHER_BASE_URL + 'resources/update-claim-worker.py'
+var SCOPE_URL = OTHER_BASE_URL + 'resources/redirect.py'
+var OTHER_IFRAME_URL = OTHER_BASE_URL +
+                       'resources/claim-with-redirect-iframe.html';
+
+// Different origin from the registration
+var REDIRECT_TO_URL = BASE_URL +
+                      'resources/claim-with-redirect-iframe.html?redirected';
+
+var REGISTER_IFRAME_URL = OTHER_IFRAME_URL + '?register=' +
+                          encodeURIComponent(WORKER_URL) + '&' +
+                          'scope=' + encodeURIComponent(SCOPE_URL);
+var REDIRECT_IFRAME_URL = SCOPE_URL + '?Redirect=' +
+                          encodeURIComponent(REDIRECT_TO_URL);
+var UPDATE_IFRAME_URL = OTHER_IFRAME_URL + '?update=' +
+                        encodeURIComponent(SCOPE_URL);
+var UNREGISTER_IFRAME_URL = OTHER_IFRAME_URL + '?unregister=' +
+                            encodeURIComponent(SCOPE_URL);
+
+var waiting_resolver = undefined;
+
+addEventListener('message', e => {
+    if (waiting_resolver !== undefined) {
+      waiting_resolver(e.data);
+    }
+  });
+
+function assert_with_iframe(url, expected_message) {
+  return new Promise(resolve => {
+        waiting_resolver = resolve;
+        with_iframe(url);
+      })
+    .then(data => assert_equals(data.message, expected_message));
+}
+
+// This test checks behavior when browser got a redirect header from in-scope
+// page and navigated to out-of-scope page which has a different origin from any
+// registrations.
+promise_test(t => {
+  return assert_with_iframe(REGISTER_IFRAME_URL, 'registered')
+    .then(() => assert_with_iframe(REDIRECT_IFRAME_URL, 'redirected'))
+    .then(() => assert_with_iframe(UPDATE_IFRAME_URL, 'updated'))
+    .then(() => assert_with_iframe(UNREGISTER_IFRAME_URL, 'unregistered'));
+  }, 'Claim works after redirection to another origin');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/claim-worker-fetch.https.html b/test/fixtures/wpt/service-workers/service-worker/claim-worker-fetch.https.html
new file mode 100644
index 000000000000..7cb26c742b97
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/claim-worker-fetch.https.html
@@ -0,0 +1,83 @@
+<!doctype html>
+<meta charset=utf-8>
+<title></title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+promise_test((t) => {
+  return runTest(t, 'resources/claim-worker-fetch-iframe.html');
+}, 'fetch() in Worker should be intercepted after the client is claimed.');
+
+promise_test((t) => {
+  return runTest(t, 'resources/claim-nested-worker-fetch-iframe.html');
+}, 'fetch() in nested Worker should be intercepted after the client is claimed.');
+
+promise_test((t) => {
+  return runTest(t, 'resources/claim-blob-url-worker-fetch-iframe.html');
+}, 'fetch() in blob URL Worker should be intercepted after the client is claimed.');
+
+promise_test((t) => {
+  return runTest(t, 'resources/nested-blob-url-workers.html');
+}, 'fetch() in nested blob URL Worker created from a blob URL Worker should be intercepted after the client is claimed.');
+
+promise_test((t) => {
+  return runTest(t, 'resources/nested-worker-created-from-blob-url-worker.html');
+}, 'fetch() in nested Worker created from a blob URL Worker should be intercepted after the client is claimed.');
+
+promise_test((t) => {
+  return runTest(t, 'resources/nested-blob-url-worker-created-from-worker.html');
+}, 'fetch() in nested blob URL Worker created from a Worker should be intercepted after the client is claimed.');
+
+async function runTest(t, iframe_url) {
+  const resource = 'simple.txt';
+  const scope = 'resources/';
+  const script = 'resources/claim-worker.js';
+
+  // Create the test iframe with a dedicated worker.
+  const frame = await with_iframe(iframe_url);
+  t.add_cleanup(_ => frame.remove());
+
+  // Check the controller and test with fetch in the worker.
+  assert_equals(frame.contentWindow.navigator.controller,
+                undefined, 'Should have no controller.');
+  {
+    const response_text = await frame.contentWindow.fetch_in_worker(resource);
+    assert_equals(response_text, 'a simple text file\n',
+                  'fetch() should not be intercepted.');
+  }
+
+  // Register a service worker.
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(_ => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Let the service worker claim the iframe and the worker.
+  const channel = new MessageChannel();
+  const saw_message = new Promise(function(resolve) {
+    channel.port1.onmessage = t.step_func(function(e) {
+      assert_equals(e.data, 'PASS', 'Worker call to claim() should fulfill.');
+      resolve();
+    });
+  });
+  reg.active.postMessage({port: channel.port2}, [channel.port2]);
+  await saw_message;
+
+  // Check the controller and test with fetch in the worker.
+  const reg2 =
+    await frame.contentWindow.navigator.serviceWorker.getRegistration(scope);
+  assert_equals(frame.contentWindow.navigator.serviceWorker.controller,
+                reg2.active, 'Test iframe should be claimed.');
+
+  {
+    // TODO(horo): Check the worker's navigator.seviceWorker.controller.
+    const response_text = await frame.contentWindow.fetch_in_worker(resource);
+    assert_equals(response_text, 'Intercepted!',
+                  'fetch() in the worker should be intercepted.');
+  }
+}
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/client-id.https.html b/test/fixtures/wpt/service-workers/service-worker/client-id.https.html
new file mode 100644
index 000000000000..b93b34189999
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/client-id.https.html
@@ -0,0 +1,60 @@
+<!DOCTYPE html>
+<title>Service Worker: Client.id</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var scope = 'resources/blank.html?client-id';
+var frame1, frame2;
+
+promise_test(function(t) {
+    return service_worker_unregister_and_register(
+        t, 'resources/client-id-worker.js', scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope + '#1'); })
+      .then(function(f) {
+          frame1 = f;
+          // To be sure Clients.matchAll() iterates in the same order.
+          f.focus();
+          return with_iframe(scope + '#2');
+        })
+      .then(function(f) {
+          frame2 = f;
+          var channel = new MessageChannel();
+
+          return new Promise(function(resolve, reject) {
+              channel.port1.onmessage = resolve;
+              channel.port1.onmessageerror = reject;
+              f.contentWindow.navigator.serviceWorker.controller.postMessage(
+                  {port:channel.port2}, [channel.port2]);
+            });
+        })
+      .then(on_message);
+  }, 'Client.id returns the client\'s ID.');
+
+function on_message(e) {
+  // The result of two sequential clients.matchAll() calls in the SW.
+  // 1st matchAll() results in e.data[0], e.data[1].
+  // 2nd matchAll() results in e.data[2], e.data[3].
+  assert_equals(e.data.length, 4);
+  // All should be string values.
+  assert_equals(typeof e.data[0], 'string');
+  assert_equals(typeof e.data[1], 'string');
+  assert_equals(typeof e.data[2], 'string');
+  assert_equals(typeof e.data[3], 'string');
+  // Different clients should have different ids.
+  assert_not_equals(e.data[0], e.data[1]);
+  assert_not_equals(e.data[2], e.data[3]);
+  // Same clients should have an identical id.
+  assert_equals(e.data[0], e.data[2]);
+  assert_equals(e.data[1], e.data[3]);
+  frame1.remove();
+  frame2.remove();
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/client-navigate.https.html b/test/fixtures/wpt/service-workers/service-worker/client-navigate.https.html
new file mode 100644
index 000000000000..f40a08635cfd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/client-navigate.https.html
@@ -0,0 +1,107 @@
+<!doctype html>
+<meta charset=utf-8>
+<meta name="timeout" content="long">
+<title>Service Worker: WindowClient.navigate</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+  function wait_for_message(msg) {
+    return new Promise(function(resolve, reject) {
+      var get_message_data = function get_message_data(e) {
+        window.removeEventListener("message", get_message_data);
+        resolve(e.data);
+      }
+      window.addEventListener("message", get_message_data, false);
+    });
+  }
+
+  function run_test(controller, clientId, test) {
+    return new Promise(function(resolve, reject) {
+      var channel = new MessageChannel();
+      channel.port1.onmessage = function(e) {
+        resolve(e.data);
+      };
+      var message = {
+        port: channel.port2,
+        test: test,
+        clientId: clientId,
+      };
+      controller.postMessage(
+        message, [channel.port2]);
+    });
+  }
+
+  async function with_controlled_iframe_and_url(t, name, f) {
+    const SCRIPT = "resources/client-navigate-worker.js";
+    const SCOPE = "resources/client-navigate-frame.html";
+
+    // Register service worker and wait for it to become activated
+    const registration = await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+    t.add_cleanup(() => registration.unregister());
+    const worker = registration.installing;
+    await wait_for_state(t, worker, 'activated');
+
+    // Create child iframe and make sure we register a listener for the message
+    // it sends before it's created
+    const client_id_promise = wait_for_message();
+    const iframe = await with_iframe(SCOPE);
+    t.add_cleanup(() => iframe.remove());
+    const { id } = await client_id_promise;
+
+    // Run the test in the service worker and fetch it
+    const { result, url } = await run_test(worker, id, name);
+    fetch_tests_from_worker(worker);
+    assert_equals(result, name);
+
+    // Hand over the iframe and URL from the service worker to the callback
+    await f(iframe, url);
+  }
+
+  promise_test(function(t) {
+    return with_controlled_iframe_and_url(t, 'test_client_navigate_success', async (iframe, url) => {
+      assert_equals(
+        url, new URL("resources/client-navigated-frame.html",
+                      location).toString());
+      assert_equals(
+        iframe.contentWindow.location.href,
+        new URL("resources/client-navigated-frame.html",
+                location).toString());
+    });
+  }, "Frame location should update on successful navigation");
+
+  promise_test(function(t) {
+    return with_controlled_iframe_and_url(t, 'test_client_navigate_redirect', async (iframe, url) => {
+      assert_equals(url, "");
+      assert_throws_dom("SecurityError", function() { return iframe.contentWindow.location.href });
+    });
+  }, "Frame location should not be accessible after redirect");
+
+  promise_test(function(t) {
+    return with_controlled_iframe_and_url(t, 'test_client_navigate_cross_origin', async (iframe, url) => {
+      assert_equals(url, "");
+      assert_throws_dom("SecurityError", function() { return iframe.contentWindow.location.href });
+    });
+  }, "Frame location should not be accessible after cross-origin navigation");
+
+  promise_test(function(t) {
+    return with_controlled_iframe_and_url(t, 'test_client_navigate_about_blank', async (iframe, url) => {
+      assert_equals(
+          iframe.contentWindow.location.href,
+          new URL("resources/client-navigate-frame.html",
+                  location).toString());
+      iframe.contentWindow.document.body.style = "background-color: green"
+    });
+  }, "Frame location should not update on failed about:blank navigation");
+
+  promise_test(function(t) {
+    return with_controlled_iframe_and_url(t, 'test_client_navigate_mixed_content', async (iframe, url) => {
+      assert_equals(
+          iframe.contentWindow.location.href,
+          new URL("resources/client-navigate-frame.html",
+                  location).toString());
+      iframe.contentWindow.document.body.style = "background-color: green"
+    });
+  }, "Frame location should not update on failed mixed-content navigation");
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/client-url-creation-url.https.html b/test/fixtures/wpt/service-workers/service-worker/client-url-creation-url.https.html
new file mode 100644
index 000000000000..ba597d893d34
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/client-url-creation-url.https.html
@@ -0,0 +1,129 @@
+<!DOCTYPE html>
+<title>Service Worker: Client.url is Window creation URL tests</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// These tests all validate that the Service Worker's Client.url property is
+// correct for different types of Window client navigations.
+// All test cases involve an iframe navigating in some manner and then
+// the service worker validating that the Client.url property is correct.
+
+// Waits for and returns the next postMessage from `frame` to this window.
+function wait_for_message_from_frame(frame) {
+  return new Promise(resolve => {
+    const message_handler = e => {
+      if (e.source === frame.contentWindow) {
+        frame.removeEventListener('message', message_handler);
+        resolve(e.data);
+      }
+    };
+    window.addEventListener('message', message_handler);
+  });
+}
+
+// Returns a promise to get a client URL under the ServiceWorker's
+// (client-url-creation-url-sw.js) control. `target` should be an active
+// ServiceWorker to post message.  We expect it to send back the client URL
+// via the given channel.
+function post_message_and_wait_for_response(
+    target, data) {
+  return new Promise(resolve => {
+    const channel = new MessageChannel();
+    channel.port1.onmessage = e => {
+      resolve(e.data);
+    };
+    target.postMessage(
+        {message: data, port: channel.port2},
+        [channel.port2]);
+  });
+}
+
+const SCOPE = 'resources/client-url-creation-url';
+const IFRAME_URL = SCOPE + '-iframe.html?step=1';
+
+// The test helper function implements a test case by
+// using an iframe to navigate in various ways described by `navigation_kinds`
+// and then validates the ServiceWorker Client.url property of the iframe
+// against the provided `expected_client_url`.
+// `navigation_kinds` is an array of strings each of which is one of the
+// navigation actions supported by client-url-creation-url-iframe.html.
+async function test_client_url_helper(
+    t, navigation_kinds, expected_client_url) {
+  const registration = await service_worker_unregister_and_register(
+      t, 'resources/client-url-creation-url-sw.js', SCOPE);
+  t.add_cleanup(_ => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const frame = await with_iframe(IFRAME_URL);
+  t.add_cleanup(_ => frame.remove());
+  const message = await wait_for_message_from_frame(frame);
+  assert_equals(message, 'done', 'iframe loaded successfully');
+
+  for (let navigation_kind_idx = 0;
+      navigation_kind_idx < navigation_kinds.length;
+      ++navigation_kind_idx) {
+    const navigation_kind = navigation_kinds[navigation_kind_idx];
+
+    frame.contentWindow.postMessage(navigation_kind);
+    const result = await wait_for_message_from_frame(frame);
+    assert_equals(result, 'done', 'iframe navigation successfully completed');
+  }
+
+  const actual_client_url = await post_message_and_wait_for_response(
+      registration.active, "get_client_url");
+
+  assert_equals(
+      actual_client_url, expected_client_url, 'Client.url should match');
+}
+
+const EXPECTED_URL_STEP_1 = new URL(
+    './resources/client-url-creation-url-iframe.html?step=1', location).href;
+const EXPECTED_URL_STEP_2 = new URL(
+    './resources/client-url-creation-url-iframe.html?step=2', location).href;
+
+// Tests that perform navigations that don't create a new document
+promise_test(async t => {
+  await test_client_url_helper(t, [], EXPECTED_URL_STEP_1);
+}, 'No navigation creation URL is same as window URL');
+
+promise_test(async t => {
+  await test_client_url_helper(t, ['fragment'], EXPECTED_URL_STEP_1);
+}, 'Fragment only navigation doesn\'t change creation URL');
+
+promise_test(async t => {
+  await test_client_url_helper(t, ['pushstate'], EXPECTED_URL_STEP_1);
+}, 'Pushstate doesn\'t change creation URL');
+
+promise_test(async t => {
+  await test_client_url_helper(t, ['replacestate'], EXPECTED_URL_STEP_1);
+}, 'Replacestate doesn\'t change creation URL');
+
+promise_test(async t => {
+  await test_client_url_helper(
+      t, ['pushstate', 'pushstate', 'back-within-same-document'], EXPECTED_URL_STEP_1);
+}, 'Going back over pushstate to other pushstate via back');
+
+// Tests that perform navigations that create new document(s)
+promise_test(async t => {
+  await test_client_url_helper(t, ['query'], EXPECTED_URL_STEP_2);
+}, 'Query navigation changes creation URL');
+
+promise_test(async t => {
+  await test_client_url_helper(t, ['reload'], EXPECTED_URL_STEP_1);
+}, 'Reloading doesn\'t change creation URL');
+
+promise_test(async t => {
+  await test_client_url_helper(t, ['pushstate', 'reload'], EXPECTED_URL_STEP_2);
+}, 'Reloading pushstate URL changes creation URL');
+
+promise_test(async t => {
+  await test_client_url_helper(
+      t, ['query', 'pushstate', 'back-within-same-document'], EXPECTED_URL_STEP_2);
+}, 'Going back over pushstate to creation URL');
+
+promise_test(async t => {
+  await test_client_url_helper(
+      t, ['query', 'query', 'back-cross-document'], EXPECTED_URL_STEP_2);
+}, 'Going back to new document changes creation URL');
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/client-url-of-blob-url-worker.https.html b/test/fixtures/wpt/service-workers/service-worker/client-url-of-blob-url-worker.https.html
new file mode 100644
index 000000000000..97a2fcf98f29
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/client-url-of-blob-url-worker.https.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<title>Service Worker: client.url of a worker created from a blob URL</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+const SCRIPT = 'resources/client-url-of-blob-url-worker.js';
+const SCOPE = 'resources/client-url-of-blob-url-worker.html';
+
+promise_test(async (t) => {
+  const reg = await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+  t.add_cleanup(_ => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  const frame = await with_iframe(SCOPE);
+  t.add_cleanup(_ => frame.remove());
+  assert_not_equals(frame.contentWindow.navigator.serviceWorker.controller,
+                    null, 'frame should be controlled');
+
+  const response = await frame.contentWindow.createAndFetchFromBlobWorker();
+
+  assert_not_equals(response.result, 'one worker client should exist',
+                    'worker client should exist');
+  assert_equals(response.result, response.expected,
+                'client.url and worker location href should be the same');
+
+}, 'Client.url of a blob URL worker should be a blob URL.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-get-client-types.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-get-client-types.https.html
new file mode 100644
index 000000000000..63e3e51b3202
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-get-client-types.https.html
@@ -0,0 +1,108 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.get with window and worker clients</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var scope = 'resources/clients-get-client-types';
+var frame_url = scope + '-frame.html';
+var shared_worker_url = scope + '-shared-worker.js';
+var worker_url = scope + '-worker.js';
+var client_ids = [];
+var registration;
+var frame;
+promise_test(function(t) {
+    return service_worker_unregister_and_register(
+        t, 'resources/clients-get-worker.js', scope)
+      .then(function(r) {
+          registration = r;
+          add_completion_callback(function() { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(frame_url);
+        })
+      .then(function(f) {
+          frame = f;
+          add_completion_callback(function() { frame.remove(); });
+          frame.focus();
+          return wait_for_clientId();
+        })
+      .then(function(client_id) {
+          client_ids.push(client_id);
+          return new Promise(function(resolve) {
+              var w = new SharedWorker(shared_worker_url);
+              w.port.onmessage = function(e) {
+                resolve(e.data.clientId);
+              };
+            });
+        })
+      .then(function(client_id) {
+          client_ids.push(client_id);
+          var channel = new MessageChannel();
+          var w = new Worker(worker_url);
+          w.postMessage({cmd:'GetClientId', port:channel.port2},
+              [channel.port2]);
+          return new Promise(function(resolve) {
+              channel.port1.onmessage = function(e) {
+                resolve(e.data.clientId);
+              };
+            });
+        })
+      .then(function(client_id) {
+          client_ids.push(client_id);
+          var channel = new MessageChannel();
+          frame.contentWindow.postMessage('StartWorker', '*', [channel.port2]);
+          return new Promise(function(resolve) {
+              channel.port1.onmessage = function(e) {
+                resolve(e.data.clientId);
+              };
+            });
+        })
+      .then(function(client_id) {
+          client_ids.push(client_id);
+          var saw_message = new Promise(function(resolve) {
+              navigator.serviceWorker.onmessage = resolve;
+            });
+          registration.active.postMessage({clientIds: client_ids});
+          return saw_message;
+        })
+      .then(function(e) {
+          assert_equals(e.data.length, expected.length);
+          // We use these assert_not_equals because assert_array_equals doesn't
+          // print the error description when passed an undefined value.
+          assert_not_equals(e.data[0], undefined,
+              'Window client should not be undefined');
+          assert_array_equals(e.data[0], expected[0], 'Window client');
+          assert_not_equals(e.data[1], undefined,
+              'Shared worker client should not be undefined');
+          assert_array_equals(e.data[1], expected[1], 'Shared worker client');
+          assert_not_equals(e.data[2], undefined,
+              'Worker(Started by main frame) client should not be undefined');
+          assert_array_equals(e.data[2], expected[2],
+              'Worker(Started by main frame) client');
+          assert_not_equals(e.data[3], undefined,
+              'Worker(Started by sub frame) client should not be undefined');
+          assert_array_equals(e.data[3], expected[3],
+              'Worker(Started by sub frame) client');
+        });
+  }, 'Test Clients.get() with window and worker clients');
+
+function wait_for_clientId() {
+  return new Promise(function(resolve) {
+      function get_client_id(e) {
+        window.removeEventListener('message', get_client_id);
+        resolve(e.data.clientId);
+      }
+      window.addEventListener('message', get_client_id, false);
+    });
+}
+
+var expected = [
+    // visibilityState, focused, url, type, frameType
+    ['visible', true, normalizeURL(scope) + '-frame.html', 'window', 'nested'],
+    [undefined, undefined, normalizeURL(scope) + '-shared-worker.js', 'sharedworker', 'none'],
+    [undefined, undefined, normalizeURL(scope) + '-worker.js', 'worker', 'none'],
+    [undefined, undefined, normalizeURL(scope) + '-frame-worker.js', 'worker', 'none']
+];
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-get-cross-origin.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-get-cross-origin.https.html
new file mode 100644
index 000000000000..1e4acfb286c6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-get-cross-origin.https.html
@@ -0,0 +1,69 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.get across origins</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var host_info = get_host_info();
+
+var scope = 'resources/clients-get-frame.html';
+var other_origin_iframe = host_info['HTTPS_REMOTE_ORIGIN'] + base_path() +
+                          'resources/clients-get-cross-origin-frame.html';
+// The ID of a client from the same origin as us.
+var my_origin_client_id;
+// This test asserts the behavior of the Client API in cases where the client
+// belongs to a foreign origin. It does this by creating an iframe with a
+// foreign origin which connects to a server worker in the current origin.
+promise_test(function(t) {
+    return service_worker_unregister_and_register(
+        t, 'resources/clients-get-worker.js', scope)
+      .then(function(registration) {
+          add_completion_callback(function() { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      // Create a same-origin client and use it to populate |my_origin_client_id|.
+      .then(function(frame1) {
+          add_completion_callback(function() { frame1.remove(); });
+          return new Promise(function(resolve, reject) {
+            function get_client_id(e) {
+              window.removeEventListener('message', get_client_id);
+              resolve(e.data.clientId);
+            }
+            window.addEventListener('message', get_client_id, false);
+          });
+        })
+      // Create a cross-origin client. We'll communicate with this client to
+      // test the cross-origin service worker's behavior.
+      .then(function(client_id) {
+          my_origin_client_id = client_id;
+          return with_iframe(other_origin_iframe);
+        })
+      // Post the 'getClientId' message to the cross-origin client. The client
+      // will then ask its service worker to look up |my_origin_client_id| via
+      // Clients#get. Since this client ID is for a different origin, we expect
+      // the client to not be found.
+      .then(function(frame2) {
+          add_completion_callback(function() { frame2.remove(); });
+
+          frame2.contentWindow.postMessage(
+            {clientId: my_origin_client_id, type: 'getClientId'},
+            host_info['HTTPS_REMOTE_ORIGIN']
+          );
+
+          return new Promise(function(resolve) {
+              window.addEventListener('message', function(e) {
+                  if (e.data && e.data.type === 'clientId') {
+                    resolve(e.data.value);
+                  }
+                });
+            });
+        })
+      .then(function(client_id) {
+          assert_equals(client_id, undefined, 'iframe client ID');
+        });
+  }, 'Test Clients.get() cross origin');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-get-resultingClientId.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-get-resultingClientId.https.html
new file mode 100644
index 000000000000..3419cf14b523
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-get-resultingClientId.https.html
@@ -0,0 +1,177 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test clients.get(resultingClientId)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const scope = "resources/";
+let worker;
+
+// Setup. Keep this as the first promise_test.
+promise_test(async (t) => {
+  const registration = await service_worker_unregister_and_register(
+      t, 'resources/get-resultingClientId-worker.js',
+      scope);
+  worker = registration.installing;
+  await wait_for_state(t, worker, 'activated');
+}, 'global setup');
+
+// Sends |command| to the worker and returns a promise that resolves to its
+// response. There should only be one inflight command at a time.
+async function sendCommand(command) {
+  const saw_message = new Promise((resolve) => {
+    navigator.serviceWorker.onmessage = (event) => {
+      resolve(event.data);
+    };
+  });
+  worker.postMessage(command);
+  return saw_message;
+}
+
+// Wrapper for 'startTest' command. Tells the worker a test is starting,
+// so it resets state and keeps itself alive until 'finishTest'.
+async function startTest(t) {
+  const result = await sendCommand({command: 'startTest'});
+  assert_equals(result, 'ok', 'startTest');
+
+  t.add_cleanup(async () => {
+    return finishTest();
+  });
+}
+
+// Wrapper for 'finishTest' command.
+async function finishTest() {
+  const result = await sendCommand({command: 'finishTest'});
+  assert_equals(result, 'ok', 'finishTest');
+}
+
+// Wrapper for 'getResultingClient' command. Tells the worker to return
+// clients.get(event.resultingClientId) for the navigation that occurs
+// during this test.
+//
+// The return value describes how clients.get() settled. It also includes
+// |queriedId| which is the id passed to clients.get() (the resultingClientId
+// in this case).
+//
+// Example value:
+// {
+//   queriedId: 'abc',
+//   promiseState: fulfilled,
+//   promiseValue: client,
+//   client: {
+//     id: 'abc',
+//     url: '//example.com/client'
+//   }
+// }
+async function getResultingClient() {
+  return sendCommand({command: 'getResultingClient'});
+}
+
+// Wrapper for 'getClient' command. Tells the worker to return
+// clients.get(|id|). The return value is as in the getResultingClient()
+// documentation.
+async function getClient(id) {
+  return sendCommand({command: 'getClient', id: id});
+}
+
+// Navigates to |url|. Returns the result of clients.get() on the
+// resultingClientId.
+async function navigateAndGetResultingClient(t, url) {
+  const resultPromise = getResultingClient();
+  const frame = await with_iframe(url);
+  t.add_cleanup(() => {
+    frame.remove();
+  });
+  const result = await resultPromise;
+  const resultingClientId = result.queriedId;
+
+  // First test clients.get(event.resultingClientId) inside the fetch event. The
+  // behavior of this is subtle due to the use of iframes and about:blank
+  // replacement. The spec probably requires that it resolve to the original
+  // about:blank client, and that later that client should be discarded after
+  // load if the load was to another origin. Implementations might differ. For
+  // now, this test just asserts that the promise resolves. See
+  // https://github.com/w3c/ServiceWorker/issues/1385.
+  assert_equals(result.promiseState, 'fulfilled',
+                'get(event.resultingClientId) in the fetch event should fulfill');
+
+  // Test clients.get() on the previous resultingClientId again. By this
+  // time the load finished, so it's more straightforward how this promise
+  // should settle. Return the result of this promise.
+  return await getClient(resultingClientId);
+}
+
+// Test get(resultingClientId) in the basic same-origin case.
+promise_test(async (t) => {
+  await startTest(t);
+
+  const url = new URL('resources/empty.html', window.location);
+  const result = await navigateAndGetResultingClient(t, url);
+  assert_equals(result.promiseState, 'fulfilled', 'promiseState');
+  assert_equals(result.promiseValue, 'client', 'promiseValue');
+  assert_equals(result.client.url, url.href, 'client.url',);
+  assert_equals(result.client.id, result.queriedId, 'client.id');
+}, 'get(resultingClientId) for same-origin document');
+
+// Test get(resultingClientId) when the response redirects to another origin.
+promise_test(async (t) => {
+  await startTest(t);
+
+  // Navigate to a URL that redirects to another origin.
+  const base_url = new URL('.', window.location);
+  const host_info = get_host_info();
+  const other_origin_url = new URL(base_url.pathname + 'resources/empty.html',
+                                   host_info['HTTPS_REMOTE_ORIGIN']);
+  const url = new URL('resources/empty.html', window.location);
+  const pipe = `status(302)|header(Location, ${other_origin_url})`;
+  url.searchParams.set('pipe', pipe);
+
+  // The original reserved client should have been discarded on cross-origin
+  // redirect.
+  const result = await navigateAndGetResultingClient(t, url);
+  assert_equals(result.promiseState, 'fulfilled', 'promiseState');
+  assert_equals(result.promiseValue, 'undefinedValue', 'promiseValue');
+}, 'get(resultingClientId) on cross-origin redirect');
+
+// Test get(resultingClientId) when the document is sandboxed to a unique
+// origin using a CSP HTTP response header.
+promise_test(async (t) => {
+  await startTest(t);
+
+  // Navigate to a URL that has CSP sandboxing set in the HTTP response header.
+  const url = new URL('resources/empty.html', window.location);
+  const pipe = 'header(Content-Security-Policy, sandbox)';
+  url.searchParams.set('pipe', pipe);
+
+  // The original reserved client should have been discarded upon loading
+  // the sandboxed document.
+  const result = await navigateAndGetResultingClient(t, url);
+  assert_equals(result.promiseState, 'fulfilled', 'promiseState');
+  assert_equals(result.promiseValue, 'undefinedValue', 'promiseValue');
+}, 'get(resultingClientId) for document sandboxed by CSP header');
+
+// Test get(resultingClientId) when the document is sandboxed with
+// allow-same-origin.
+promise_test(async (t) => {
+  await startTest(t);
+
+  // Navigate to a URL that has CSP sandboxing set in the HTTP response header.
+  const url = new URL('resources/empty.html', window.location);
+  const pipe = 'header(Content-Security-Policy, sandbox allow-same-origin)';
+  url.searchParams.set('pipe', pipe);
+
+  // The client should be the original reserved client, as it's same-origin.
+  const result = await navigateAndGetResultingClient(t, url);
+  assert_equals(result.promiseState, 'fulfilled', 'promiseState');
+  assert_equals(result.promiseValue, 'client', 'promiseValue');
+  assert_equals(result.client.url, url.href, 'client.url',);
+  assert_equals(result.client.id, result.queriedId, 'client.id');
+}, 'get(resultingClientId) for document sandboxed by CSP header with allow-same-origin');
+
+// Cleanup. Keep this as the last promise_test.
+promise_test(async (t) => {
+  return service_worker_unregister(t, scope);
+}, 'global cleanup');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-get.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-get.https.html
new file mode 100644
index 000000000000..4cfbf595cade
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-get.https.html
@@ -0,0 +1,154 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.get</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function wait_for_clientId() {
+  return new Promise(function(resolve, reject) {
+    window.onmessage = e => {
+      resolve(e.data.clientId);
+    };
+  });
+}
+
+promise_test(async t => {
+  // Register service worker.
+  const scope = 'resources/clients-get-frame.html';
+  const client_ids = [];
+  const registration = await service_worker_unregister_and_register(
+    t, 'resources/clients-get-worker.js', scope);
+  t.add_cleanup(() => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+
+  // Prepare for test cases.
+  // Case 1: frame1 which is focused.
+  const frame1 = await with_iframe(scope + '#1');
+  t.add_cleanup(() => frame1.remove());
+  frame1.focus();
+  client_ids.push(await wait_for_clientId());
+  // Case 2: frame2 which is not focused.
+  const frame2 = await with_iframe(scope + '#2');
+  t.add_cleanup(() =>  frame2.remove());
+  client_ids.push(await wait_for_clientId());
+  // Case 3: invalid id.
+  client_ids.push('invalid-id');
+
+  // Call clients.get() for each id on the service worker.
+  const message_event = await new Promise(resolve => {
+    navigator.serviceWorker.onmessage = resolve;
+    registration.active.postMessage({clientIds: client_ids});
+  });
+
+  const expected = [
+    // visibilityState, focused, url, type, frameType
+    ['visible', true, normalizeURL(scope) + '#1', 'window', 'nested'],
+    ['visible', false, normalizeURL(scope) + '#2', 'window', 'nested'],
+    undefined
+  ];
+  assert_equals(message_event.data.length, 3);
+  assert_array_equals(message_event.data[0], expected[0]);
+  assert_array_equals(message_event.data[1], expected[1]);
+  assert_equals(message_event.data[2], expected[2]);
+}, 'Test Clients.get()');
+
+promise_test(async t => {
+  // Register service worker.
+  const scope = 'resources/simple.html';
+  const registration = await service_worker_unregister_and_register(
+    t, 'resources/clients-get-resultingClientId-worker.js', scope)
+  t.add_cleanup(() =>  registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+  const worker = registration.active;
+
+  // Load frame within the scope.
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+  frame.focus();
+
+  // Get resulting client id.
+  const resultingClientId = await new Promise(resolve => {
+    navigator.serviceWorker.onmessage = e => {
+      if (e.data.msg == 'getResultingClientId') {
+        resolve(e.data.resultingClientId);
+      }
+    };
+    worker.postMessage({msg: 'getResultingClientId'});
+  });
+
+  // Query service worker for clients.get(resultingClientId).
+  const isResultingClientUndefined = await new Promise(resolve => {
+    navigator.serviceWorker.onmessage = e => {
+      if (e.data.msg == 'getIsResultingClientUndefined') {
+        resolve(e.data.isResultingClientUndefined);
+      }
+    };
+    worker.postMessage({msg: 'getIsResultingClientUndefined',
+                        resultingClientId});
+  });
+
+  assert_false(
+    isResultingClientUndefined,
+    'Clients.get(FetchEvent.resultingClientId) resolved with a Client');
+}, 'Test successful Clients.get(FetchEvent.resultingClientId)');
+
+promise_test(async t => {
+  // Register service worker.
+  const scope = 'resources/simple.html?fail';
+  const registration = await service_worker_unregister_and_register(
+    t, 'resources/clients-get-resultingClientId-worker.js', scope);
+  t.add_cleanup(() =>  registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+
+  // Load frame, and destroy it while loading.
+  const worker = registration.active;
+  let frame = document.createElement('iframe');
+  frame.src = scope;
+  t.add_cleanup(() => {
+    if (frame) {
+      frame.remove();
+    }
+  });
+
+  await new Promise(resolve => {
+    navigator.serviceWorker.onmessage = e => {
+      // The service worker posts a message to remove the iframe during fetch
+      // event.
+      if (e.data.msg == 'destroyResultingClient') {
+        frame.remove();
+        frame = null;
+        worker.postMessage({msg: 'resultingClientDestroyed'});
+        resolve();
+      }
+    };
+    document.body.appendChild(frame);
+  });
+
+  resultingDestroyedClientId = await new Promise(resolve => {
+    navigator.serviceWorker.onmessage = e => {
+      // The worker sends a message back when it receives the message
+      // 'resultingClientDestroyed' with the resultingClientId.
+      if (e.data.msg == 'resultingClientDestroyedAck') {
+        assert_equals(frame, null, 'Frame should be destroyed at this point.');
+        resolve(e.data.resultingDestroyedClientId);
+      }
+    };
+  });
+
+  // Query service worker for clients.get(resultingDestroyedClientId).
+  const isResultingClientUndefined = await new Promise(resolve => {
+    navigator.serviceWorker.onmessage = e => {
+      if (e.data.msg == 'getIsResultingClientUndefined') {
+        resolve(e.data.isResultingClientUndefined);
+      }
+    };
+    worker.postMessage({msg: 'getIsResultingClientUndefined',
+                        resultingClientId: resultingDestroyedClientId });
+  });
+
+  assert_true(
+    isResultingClientUndefined,
+    'Clients.get(FetchEvent.resultingClientId) resolved with `undefined`');
+}, 'Test unsuccessful Clients.get(FetchEvent.resultingClientId)');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-matchall-blob-url-worker.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-blob-url-worker.https.html
new file mode 100644
index 000000000000..c29bac8b894a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-blob-url-worker.https.html
@@ -0,0 +1,85 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.matchAll with a blob URL worker client</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const SCRIPT = 'resources/clients-matchall-worker.js';
+
+promise_test(async (t) => {
+  const scope = 'resources/clients-matchall-blob-url-worker.html';
+
+  const reg = await service_worker_unregister_and_register(t, SCRIPT, scope);
+  t.add_cleanup(_ => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  const frame = await with_iframe(scope);
+  t.add_cleanup(_ => frame.remove());
+
+  {
+    const message = await frame.contentWindow.waitForWorker();
+    assert_equals(message.data, 'Worker is ready.',
+                  'Worker should reply to the message.');
+  }
+
+  const channel = new MessageChannel();
+  const message = await new Promise(resolve => {
+    channel.port1.onmessage = resolve;
+    frame.contentWindow.navigator.serviceWorker.controller.postMessage(
+      {port: channel.port2, options: {type: 'worker'}}, [channel.port2]);
+  });
+
+  checkMessageEvent(message);
+
+}, 'Test Clients.matchAll() with a blob URL worker client.');
+
+promise_test(async (t) => {
+  const scope = 'resources/blank.html';
+
+  const reg = await service_worker_unregister_and_register(t, SCRIPT, scope);
+  t.add_cleanup(_ => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  const workerScript = `
+    self.onmessage = (e) => {
+      self.postMessage("Worker is ready.");
+    };
+  `;
+  const blob = new Blob([workerScript], { type: 'text/javascript' });
+  const blobUrl = URL.createObjectURL(blob);
+  const worker = new Worker(blobUrl);
+
+  {
+    const message = await new Promise(resolve => {
+      worker.onmessage = resolve;
+      worker.postMessage("Ping to worker.");
+    });
+    assert_equals(message.data, 'Worker is ready.',
+                  'Worker should reply to the message.');
+  }
+
+  const channel = new MessageChannel();
+  const message = await new Promise(resolve => {
+    channel.port1.onmessage = resolve;
+    reg.active.postMessage(
+      {port: channel.port2,
+       options: {includeUncontrolled: true, type: 'worker'}},
+      [channel.port2]
+    );
+  });
+
+  checkMessageEvent(message);
+
+}, 'Test Clients.matchAll() with an uncontrolled blob URL worker client.');
+
+function checkMessageEvent(e) {
+  assert_equals(e.data.length, 1);
+
+  const workerClient = e.data[0];
+  assert_equals(workerClient[0], undefined); // visibilityState
+  assert_equals(workerClient[1], undefined); // focused
+  assert_true(workerClient[2].includes('blob:')); // url
+  assert_equals(workerClient[3], 'worker'); // type
+  assert_equals(workerClient[4], 'none'); // frameType
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-matchall-client-types.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-client-types.https.html
new file mode 100644
index 000000000000..54f182b6202c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-client-types.https.html
@@ -0,0 +1,92 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.matchAll with various clientTypes</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const scope = 'resources/clients-matchall-client-types';
+const iframe_url = scope + '-iframe.html';
+const shared_worker_url = scope + '-shared-worker.js';
+const dedicated_worker_url = scope + '-dedicated-worker.js';
+
+/* visibilityState, focused, url, type, frameType */
+const expected_only_window = [
+    ['visible', true, new URL(iframe_url, location).href, 'window', 'nested']
+];
+const expected_only_shared_worker = [
+    [undefined, undefined, new URL(shared_worker_url, location).href, 'sharedworker', 'none']
+];
+const expected_only_dedicated_worker = [
+    [undefined, undefined, new URL(dedicated_worker_url, location).href, 'worker', 'none']
+];
+
+// These are explicitly sorted by URL in the service worker script.
+const expected_all_clients = [
+    expected_only_dedicated_worker[0],
+    expected_only_window[0],
+    expected_only_shared_worker[0],
+];
+
+async function test_matchall(frame, expected, query_options) {
+  // Make sure the frame gets focus.
+  frame.focus();
+  const data = await new Promise(resolve => {
+    const channel = new MessageChannel();
+    channel.port1.onmessage = e => resolve(e.data);
+    frame.contentWindow.navigator.serviceWorker.controller.postMessage(
+        {port:channel.port2, options:query_options},
+        [channel.port2]);
+  });
+
+  if (typeof data === 'string') {
+    throw new Error(data);
+  }
+
+  assert_equals(data.length, expected.length, 'result count');
+
+  for (let i = 0; i < data.length; ++i) {
+    assert_array_equals(data[i], expected[i]);
+  }
+}
+
+promise_test(async t => {
+  const registration = await service_worker_unregister_and_register(
+      t, 'resources/clients-matchall-worker.js', scope);
+  t.add_cleanup(_ => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+  const frame = await with_iframe(iframe_url);
+  t.add_cleanup(_ => frame.remove());
+  await test_matchall(frame, expected_only_window, {});
+  await test_matchall(frame, expected_only_window, {type:'window'});
+}, 'Verify matchAll() with window client type');
+
+promise_test(async t => {
+  const registration = await service_worker_unregister_and_register(
+      t, 'resources/clients-matchall-worker.js', scope);
+  t.add_cleanup(_ => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+  const frame = await with_iframe(iframe_url);
+  t.add_cleanup(_ => frame.remove());
+
+  // Set up worker clients.
+  const shared_worker = await new Promise((resolve, reject) => {
+    const w = new SharedWorker(shared_worker_url);
+    w.onerror = e => reject(e.message);
+    w.port.onmessage = _ => resolve(w);
+  });
+  const dedicated_worker = await new Promise((resolve, reject) => {
+    const w = new Worker(dedicated_worker_url);
+    w.onerror = e => reject(e.message);
+    w.onmessage = _ => resolve(w);
+    w.postMessage('Start');
+  });
+
+  await test_matchall(frame, expected_only_window, {});
+  await test_matchall(frame, expected_only_window, {type:'window'});
+  await test_matchall(frame, expected_only_shared_worker,
+                      {type:'sharedworker'});
+  await test_matchall(frame, expected_only_dedicated_worker, {type:'worker'});
+  await test_matchall(frame, expected_all_clients, {type:'all'});
+}, 'Verify matchAll() with {window, sharedworker, worker} client types');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-matchall-exact-controller.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-exact-controller.https.html
new file mode 100644
index 000000000000..a61c8af70196
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-exact-controller.https.html
@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.matchAll with exact controller</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const scope = 'resources/blank.html?clients-matchAll';
+let frames = [];
+
+function checkWorkerClients(worker, expected) {
+  return new Promise((resolve, reject) => {
+    let channel = new MessageChannel();
+    channel.port1.onmessage = evt => {
+      try {
+        assert_equals(evt.data.length, expected.length);
+        for (let i = 0; i < expected.length; ++i) {
+          assert_array_equals(evt.data[i], expected[i]);
+        }
+        resolve();
+      } catch (e) {
+        reject(e);
+      }
+    };
+
+    worker.postMessage({port:channel.port2}, [channel.port2]);
+  });
+}
+
+let expected = [
+    // visibilityState, focused, url, type, frameType
+    ['visible', true, new URL(scope + '#1', location).toString(), 'window', 'nested'],
+    ['visible', false, new URL(scope + '#2', location).toString(), 'window', 'nested']
+];
+
+promise_test(t => {
+    let script = 'resources/clients-matchall-worker.js';
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          t.add_cleanup(() => service_worker_unregister(t, scope));
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(_ => with_iframe(scope + '#1') )
+      .then(frame1 => {
+          frames.push(frame1);
+          frame1.focus();
+          return with_iframe(scope + '#2');
+        })
+      .then(frame2 => {
+          frames.push(frame2);
+          return navigator.serviceWorker.register(script + '?updated', { scope: scope });
+        })
+      .then(registration => {
+          return wait_for_state(t, registration.installing, 'installed')
+            .then(_ => registration);
+        })
+      .then(registration => {
+          return Promise.all([
+            checkWorkerClients(registration.waiting, []),
+            checkWorkerClients(registration.active, expected),
+          ]);
+        })
+      .then(_ => {
+          frames.forEach(f => f.remove() );
+        });
+}, 'Test Clients.matchAll() with exact controller');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-matchall-frozen.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-frozen.https.html
new file mode 100644
index 000000000000..479c28a60f2e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-frozen.https.html
@@ -0,0 +1,64 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.matchAll</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var scope = 'resources/clients-frame-freeze.html';
+var windows = [];
+var expected_window_1 =
+    {visibilityState: 'visible', focused: false, lifecycleState: "frozen", url: new URL(scope + '#1', location).toString(), type: 'window', frameType: 'top-level'};
+var expected_window_2 =
+    {visibilityState: 'visible', focused: false, lifecycleState: "active", url: new URL(scope + '#2', location).toString(), type: 'window', frameType: 'top-level'};
+function with_window(url, name) {
+  return new Promise(function(resolve) {
+    var child = window.open(url, name);
+    window.onmessage = () => {resolve(child)};
+  });
+}
+
+promise_test(function(t) {
+    return service_worker_unregister_and_register(
+        t, 'resources/clients-matchall-worker.js', scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_window(scope + '#1', 'Child 1'); })
+      .then(function(window1) {
+          windows.push(window1);
+          return with_window(scope + '#2', 'Child 2');
+        })
+      .then(function(window2) {
+          windows.push(window2);
+          return new Promise(function(resolve) {
+              window.onmessage = resolve;
+              windows[0].postMessage('freeze');
+            });
+        })
+      .then(function() {
+          var channel = new MessageChannel();
+
+          return new Promise(function(resolve) {
+              channel.port1.onmessage = resolve;
+              windows[1].navigator.serviceWorker.controller.postMessage(
+                  {port:channel.port2, includeLifecycleState: true}, [channel.port2]);
+            });
+        })
+      .then(function(e) {
+          assert_equals(e.data.length, 2);
+          // No specific order is required, so support inversion.
+          if (e.data[0][3] == new URL(scope + '#2', location)) {
+            assert_object_equals(e.data[0], expected_window_2);
+            assert_object_equals(e.data[1], expected_window_1);
+          } else {
+            assert_object_equals(e.data[0], expected_window_1);
+            assert_object_equals(e.data[1], expected_window_2);
+          }
+      });
+}, 'Test Clients.matchAll()');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-matchall-include-uncontrolled.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-include-uncontrolled.https.html
new file mode 100644
index 000000000000..9f34e5709eb3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-include-uncontrolled.https.html
@@ -0,0 +1,117 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.matchAll with includeUncontrolled</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function test_matchall(service_worker, expected, query_options) {
+  expected.sort((a, b) => a[2] > b[2] ? 1 : -1);
+  return new Promise((resolve, reject) => {
+    const channel = new MessageChannel();
+    channel.port1.onmessage = e => {
+      const data = e.data.filter(info => {
+        return info[2].indexOf('clients-matchall') > -1;
+      });
+      data.sort((a, b) => a[2] > b[2] ? 1 : -1);
+      assert_equals(data.length, expected.length);
+      for (let i = 0; i < data.length; i++)
+        assert_array_equals(data[i], expected[i]);
+      resolve();
+    };
+    service_worker.postMessage({port:channel.port2, options:query_options},
+                               [channel.port2]);
+  });
+}
+
+// Run clients.matchAll without and with includeUncontrolled=true.
+// (We want to run the two tests sequentially in the same promise_test
+// so that we can use the same set of iframes without intefering each other.
+promise_test(async t => {
+  // |base_url| is out-of-scope.
+  const base_url = 'resources/blank.html?clients-matchall';
+  const scope = base_url + '-includeUncontrolled';
+
+  const registration =
+      await service_worker_unregister_and_register(
+          t, 'resources/clients-matchall-worker.js', scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+  const service_worker = registration.installing;
+  await wait_for_state(t, service_worker, 'activated');
+
+  // Creates 3 iframes, 2 for in-scope and 1 for out-of-scope.
+  let frames = [];
+  frames.push(await with_iframe(base_url));
+  frames.push(await with_iframe(scope + '#1'));
+  frames.push(await with_iframe(scope + '#2'));
+
+  // Make sure we have focus for '#2' frame and its parent window.
+  frames[2].focus();
+  frames[2].contentWindow.focus();
+
+  const expected_without_include_uncontrolled = [
+    // visibilityState, focused, url, type, frameType
+    ['visible', false, new URL(scope + '#1', location).toString(), 'window', 'nested'],
+    ['visible', true, new URL(scope + '#2', location).toString(), 'window', 'nested']
+  ];
+  const expected_with_include_uncontrolled = [
+    // visibilityState, focused, url, type, frameType
+    ['visible', true, location.href, 'window', 'top-level'],
+    ['visible', false, new URL(scope + '#1', location).toString(), 'window', 'nested'],
+    ['visible', true, new URL(scope + '#2', location).toString(), 'window', 'nested'],
+    ['visible', false, new URL(base_url, location).toString(), 'window', 'nested']
+  ];
+
+  await test_matchall(service_worker, expected_without_include_uncontrolled);
+  await test_matchall(service_worker, expected_with_include_uncontrolled,
+                      { includeUncontrolled: true });
+}, 'Verify matchAll() with windows respect includeUncontrolled');
+
+// TODO: Add tests for clients.matchAll for dedicated workers.
+
+async function create_shared_worker(script_url) {
+  const shared_worker = new SharedWorker(script_url);
+  const msgEvent = await new Promise(r => shared_worker.port.onmessage = r);
+  assert_equals(msgEvent.data, 'started');
+  return shared_worker;
+}
+
+// Run clients.matchAll for shared workers without and with
+// includeUncontrolled=true.
+promise_test(async t => {
+  const script_url = 'resources/clients-matchall-client-types-shared-worker.js';
+  const uncontrolled_script_url =
+      new URL(script_url + '?uncontrolled', location).toString();
+  const controlled_script_url =
+      new URL(script_url + '?controlled', location).toString();
+
+  // Start a shared worker that is not controlled by a service worker.
+  const uncontrolled_shared_worker =
+      await create_shared_worker(uncontrolled_script_url);
+
+  // Register a service worker.
+  const registration =
+      await service_worker_unregister_and_register(
+          t, 'resources/clients-matchall-worker.js', script_url);
+  t.add_cleanup(() => service_worker_unregister(t, script_url));
+  const service_worker = registration.installing;
+  await wait_for_state(t, service_worker, 'activated');
+
+  // Start another shared worker controlled by the service worker.
+  await create_shared_worker(controlled_script_url);
+
+  const expected_without_include_uncontrolled = [
+    // visibilityState, focused, url, type, frameType
+    [undefined, undefined, controlled_script_url, 'sharedworker', 'none'],
+  ];
+  const expected_with_include_uncontrolled = [
+    // visibilityState, focused, url, type, frameType
+    [undefined, undefined, controlled_script_url, 'sharedworker', 'none'],
+    [undefined, undefined, uncontrolled_script_url, 'sharedworker', 'none'],
+  ];
+
+  await test_matchall(service_worker, expected_without_include_uncontrolled,
+                      { type: 'sharedworker' });
+  await test_matchall(service_worker, expected_with_include_uncontrolled,
+                      { includeUncontrolled: true, type: 'sharedworker' });
+}, 'Verify matchAll() with shared workers respect includeUncontrolled');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-matchall-on-evaluation.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-on-evaluation.https.html
new file mode 100644
index 000000000000..8705f85b5684
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-on-evaluation.https.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.matchAll on script evaluation</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var script = 'resources/clients-matchall-on-evaluation-worker.js';
+    var scope = 'resources/blank.html?clients-matchAll-on-evaluation';
+
+    var saw_message = new Promise(function(resolve) {
+        navigator.serviceWorker.onmessage = function(e) {
+            assert_equals(e.data, 'matched');
+            resolve();
+          };
+      });
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          add_completion_callback(function() { registration.unregister(); });
+          return saw_message;
+        });
+  }, 'Test Clients.matchAll() on script evaluation');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-matchall-order.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-order.https.html
new file mode 100644
index 000000000000..ec650f2264df
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-order.https.html
@@ -0,0 +1,427 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.matchAll ordering</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+// Utility function for URLs this test will open.
+function makeURL(name, num, type) {
+  let u = new URL('resources/empty.html', location);
+  u.searchParams.set('name', name);
+  if (num !== undefined) {
+    u.searchParams.set('q', num);
+  }
+  if (type === 'nested') {
+    u.searchParams.set('nested', true);
+  }
+  return u.href;
+}
+
+// Non-test URLs that will be open during each test.  The harness URLs
+// are from the WPT harness.  The "extra" URL is a final window opened
+// by the test.
+const EXTRA_URL = makeURL('extra');
+const TEST_HARNESS_URL = location.href;
+const TOP_HARNESS_URL = new URL('/testharness_runner.html', location).href;
+
+// Utility function to open an iframe in the target parent window.  We
+// can't just use with_iframe() because it does not support a configurable
+// parent window.
+function openFrame(parentWindow, url) {
+  return new Promise(resolve => {
+    let frame = parentWindow.document.createElement('iframe');
+    frame.src = url;
+    parentWindow.document.body.appendChild(frame);
+
+    frame.contentWindow.addEventListener('load', evt => {
+      resolve(frame);
+    }, { once: true });
+  });
+}
+
+// Utility function to open a window and wait for it to load.  The
+// window may optionally have a nested iframe as well.  Returns
+// a result like `{ top: <frame ref> nested: <nested frame ref if present> }`.
+function openFrameConfig(opts) {
+  let url = new URL(opts.url, location.href);
+  return openFrame(window, url.href).then(top => {
+    if (!opts.withNested) {
+      return { top: top };
+    }
+
+    url.searchParams.set('nested', true);
+    return openFrame(top.contentWindow, url.href).then(nested => {
+      return { top: top, nested: nested };
+    });
+  });
+}
+
+// Utility function that takes a list of configurations and opens the
+// corresponding windows in sequence.  An array of results is returned.
+function openFrameConfigList(optList) {
+  let resultList = [];
+  function openNextWindow(optList, nextWindow) {
+    if (nextWindow >= optList.length) {
+      return resultList;
+    }
+    return openFrameConfig(optList[nextWindow]).then(result => {
+      resultList.push(result);
+      return openNextWindow(optList, nextWindow + 1);
+    });
+  }
+  return openNextWindow(optList, 0);
+}
+
+// Utility function that focuses the given entry in window result list.
+function executeFocus(frameResultList, opts) {
+  return new Promise(resolve => {
+    let w = frameResultList[opts.index][opts.type];
+    let target = w.contentWindow ? w.contentWindow : w;
+    target.addEventListener('focus', evt => {
+      resolve();
+    }, { once: true });
+    target.focus();
+  });
+}
+
+// Utility function that performs a list of focus commands in sequence
+// based on the window result list.
+function executeFocusList(frameResultList, optList) {
+  function executeNextCommand(frameResultList, optList, nextCommand) {
+    if (nextCommand >= optList.length) {
+      return;
+    }
+    return executeFocus(frameResultList, optList[nextCommand]).then(_ => {
+      return executeNextCommand(frameResultList, optList, nextCommand + 1);
+    });
+  }
+  return executeNextCommand(frameResultList, optList, 0);
+}
+
+// Perform a `clients.matchAll()` in the service worker with the given
+// options dictionary.
+function doMatchAll(worker, options) {
+  return new Promise(resolve => {
+    let channel = new MessageChannel();
+    channel.port1.onmessage = evt => {
+      resolve(evt.data);
+    };
+    worker.postMessage({ port: channel.port2, options: options, disableSort: true },
+                       [channel.port2]);
+  });
+}
+
+// Function that performs a single test case.  It takes a configuration object
+// describing the windows to open, how to focus them, the matchAll options,
+// and the resulting expectations.  See the test cases for examples of how to
+// use this.
+function matchAllOrderTest(t, opts) {
+  let script = 'resources/clients-matchall-worker.js';
+  let worker;
+  let frameResultList;
+  let extraWindowResult;
+  return service_worker_unregister_and_register(t, script, opts.scope).then(swr => {
+    t.add_cleanup(() => service_worker_unregister(t, opts.scope));
+
+    worker = swr.installing;
+    return wait_for_state(t, worker, 'activated');
+  }).then(_ => {
+    return openFrameConfigList(opts.frameConfigList);
+  }).then(results => {
+    frameResultList = results;
+    return openFrameConfig({ url: EXTRA_URL });
+  }).then(result => {
+    extraWindowResult = result;
+    return executeFocusList(frameResultList, opts.focusConfigList);
+  }).then(_ => {
+    return doMatchAll(worker, opts.matchAllOptions);
+  }).then(data => {
+    assert_equals(data.length, opts.expected.length);
+    for (let i = 0; i < data.length; ++i) {
+      assert_equals(data[i][2], opts.expected[i], 'expected URL index ' + i);
+    }
+  }).then(_ => {
+    frameResultList.forEach(result => result.top.remove());
+    extraWindowResult.top.remove();
+  }).catch(e => {
+    if (frameResultList) {
+      frameResultList.forEach(result => result.top.remove());
+    }
+    if (extraWindowResult) {
+      extraWindowResult.top.remove();
+    }
+    throw(e);
+  });
+}
+
+// ----------
+// Test cases
+// ----------
+
+promise_test(t => {
+  let name = 'no-focus-controlled-windows';
+  let opts = {
+    scope: makeURL(name),
+
+    frameConfigList: [
+      { url: makeURL(name, 0), withNested: false },
+      { url: makeURL(name, 1), withNested: false },
+      { url: makeURL(name, 2), withNested: false },
+    ],
+
+    focusConfigList: [
+      // no focus commands
+    ],
+
+    matchAllOptions: {
+      includeUncontrolled: false
+    },
+
+    expected: [
+      makeURL(name, 0),
+      makeURL(name, 1),
+      makeURL(name, 2),
+    ],
+  };
+
+  return matchAllOrderTest(t, opts);
+}, 'Clients.matchAll() returns non-focused controlled windows in creation order.');
+
+promise_test(t => {
+  let name = 'focus-controlled-windows-1';
+  let opts = {
+    scope: makeURL(name),
+
+    frameConfigList: [
+      { url: makeURL(name, 0), withNested: false },
+      { url: makeURL(name, 1), withNested: false },
+      { url: makeURL(name, 2), withNested: false },
+    ],
+
+    focusConfigList: [
+      { index: 0, type: 'top' },
+      { index: 1, type: 'top' },
+      { index: 2, type: 'top' },
+    ],
+
+    matchAllOptions: {
+      includeUncontrolled: false
+    },
+
+    expected: [
+      makeURL(name, 2),
+      makeURL(name, 1),
+      makeURL(name, 0),
+    ],
+  };
+
+  return matchAllOrderTest(t, opts);
+}, 'Clients.matchAll() returns controlled windows in focus order.  Case 1.');
+
+promise_test(t => {
+  let name = 'focus-controlled-windows-2';
+  let opts = {
+    scope: makeURL(name),
+
+    frameConfigList: [
+      { url: makeURL(name, 0), withNested: false },
+      { url: makeURL(name, 1), withNested: false },
+      { url: makeURL(name, 2), withNested: false },
+    ],
+
+    focusConfigList: [
+      { index: 2, type: 'top' },
+      { index: 1, type: 'top' },
+      { index: 0, type: 'top' },
+    ],
+
+    matchAllOptions: {
+      includeUncontrolled: false
+    },
+
+    expected: [
+      makeURL(name, 0),
+      makeURL(name, 1),
+      makeURL(name, 2),
+    ],
+  };
+
+  return matchAllOrderTest(t, opts);
+}, 'Clients.matchAll() returns controlled windows in focus order.  Case 2.');
+
+promise_test(t => {
+  let name = 'no-focus-uncontrolled-windows';
+  let opts = {
+    scope: makeURL(name + '-outofscope'),
+
+    frameConfigList: [
+      { url: makeURL(name, 0), withNested: false },
+      { url: makeURL(name, 1), withNested: false },
+      { url: makeURL(name, 2), withNested: false },
+    ],
+
+    focusConfigList: [
+      // no focus commands
+    ],
+
+    matchAllOptions: {
+      includeUncontrolled: true
+    },
+
+    expected: [
+      // The harness windows have been focused, so appear first
+      TEST_HARNESS_URL,
+      TOP_HARNESS_URL,
+
+      // Test frames have not been focused, so appear in creation order
+      makeURL(name, 0),
+      makeURL(name, 1),
+      makeURL(name, 2),
+      EXTRA_URL,
+    ],
+  };
+
+  return matchAllOrderTest(t, opts);
+}, 'Clients.matchAll() returns non-focused uncontrolled windows in creation order.');
+
+promise_test(t => {
+  let name = 'focus-uncontrolled-windows-1';
+  let opts = {
+    scope: makeURL(name + '-outofscope'),
+
+    frameConfigList: [
+      { url: makeURL(name, 0), withNested: false },
+      { url: makeURL(name, 1), withNested: false },
+      { url: makeURL(name, 2), withNested: false },
+    ],
+
+    focusConfigList: [
+      { index: 0, type: 'top' },
+      { index: 1, type: 'top' },
+      { index: 2, type: 'top' },
+    ],
+
+    matchAllOptions: {
+      includeUncontrolled: true
+    },
+
+    expected: [
+      // The test harness window is a parent of all test frames.  It will
+      // always have the same focus time or later as its frames.  So it
+      // appears first.
+      TEST_HARNESS_URL,
+
+      makeURL(name, 2),
+      makeURL(name, 1),
+      makeURL(name, 0),
+
+      // The overall harness has been focused
+      TOP_HARNESS_URL,
+
+      // The extra frame was never focused
+      EXTRA_URL,
+    ],
+  };
+
+  return matchAllOrderTest(t, opts);
+}, 'Clients.matchAll() returns uncontrolled windows in focus order.  Case 1.');
+
+promise_test(t => {
+  let name = 'focus-uncontrolled-windows-2';
+  let opts = {
+    scope: makeURL(name + '-outofscope'),
+
+    frameConfigList: [
+      { url: makeURL(name, 0), withNested: false },
+      { url: makeURL(name, 1), withNested: false },
+      { url: makeURL(name, 2), withNested: false },
+    ],
+
+    focusConfigList: [
+      { index: 2, type: 'top' },
+      { index: 1, type: 'top' },
+      { index: 0, type: 'top' },
+    ],
+
+    matchAllOptions: {
+      includeUncontrolled: true
+    },
+
+    expected: [
+      // The test harness window is a parent of all test frames.  It will
+      // always have the same focus time or later as its frames.  So it
+      // appears first.
+      TEST_HARNESS_URL,
+
+      makeURL(name, 0),
+      makeURL(name, 1),
+      makeURL(name, 2),
+
+      // The overall harness has been focused
+      TOP_HARNESS_URL,
+
+      // The extra frame was never focused
+      EXTRA_URL,
+    ],
+  };
+
+  return matchAllOrderTest(t, opts);
+}, 'Clients.matchAll() returns uncontrolled windows in focus order.  Case 2.');
+
+promise_test(t => {
+  let name = 'focus-controlled-nested-windows';
+  let opts = {
+    scope: makeURL(name),
+
+    frameConfigList: [
+      { url: makeURL(name, 0), withNested: true },
+      { url: makeURL(name, 1), withNested: true },
+      { url: makeURL(name, 2), withNested: true },
+    ],
+
+    focusConfigList: [
+      { index: 0, type: 'top' },
+
+      // Note, some browsers don't let programmatic focus of a frame unless
+      // an ancestor window is already focused.  So focus the window and
+      // then the frame.
+      { index: 1, type: 'top' },
+      { index: 1, type: 'nested' },
+
+      { index: 2, type: 'top' },
+    ],
+
+    matchAllOptions: {
+      includeUncontrolled: false
+    },
+
+    expected: [
+      // Focus order for window 2, but not its frame.  We only focused
+      // the window.
+      makeURL(name, 2),
+
+      // Window 1 is next via focus order, but the window is always
+      // shown first here.  The window gets its last focus time updated
+      // when the frame is focused.  Since the times match between the
+      // two it falls back to creation order.  The window was created
+      // before the frame.  This behavior is being discussed in:
+      // https://github.com/w3c/ServiceWorker/issues/1080
+      makeURL(name, 1),
+      makeURL(name, 1, 'nested'),
+
+      // Focus order for window 0, but not its frame.  We only focused
+      // the window.
+      makeURL(name, 0),
+
+      // Creation order of the frames since they are not focused by
+      // default when they are created.
+      makeURL(name, 0, 'nested'),
+      makeURL(name, 2, 'nested'),
+    ],
+  };
+
+  return matchAllOrderTest(t, opts);
+}, 'Clients.matchAll() returns controlled windows and frames in focus order.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-matchall.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-matchall.https.html
new file mode 100644
index 000000000000..ce44f1924d54
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-matchall.https.html
@@ -0,0 +1,50 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.matchAll</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var scope = 'resources/blank.html?clients-matchAll';
+var frames = [];
+promise_test(function(t) {
+    return service_worker_unregister_and_register(
+        t, 'resources/clients-matchall-worker.js', scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope + '#1'); })
+      .then(function(frame1) {
+          frames.push(frame1);
+          frame1.focus();
+          return with_iframe(scope + '#2');
+        })
+      .then(function(frame2) {
+          frames.push(frame2);
+          var channel = new MessageChannel();
+
+          return new Promise(function(resolve) {
+              channel.port1.onmessage = resolve;
+              frame2.contentWindow.navigator.serviceWorker.controller.postMessage(
+                  {port:channel.port2}, [channel.port2]);
+            });
+        })
+      .then(onMessage);
+}, 'Test Clients.matchAll()');
+
+var expected = [
+    // visibilityState, focused, url, type, frameType
+    ['visible', true, new URL(scope + '#1', location).toString(), 'window', 'nested'],
+    ['visible', false, new URL(scope + '#2', location).toString(), 'window', 'nested']
+];
+
+function onMessage(e) {
+  assert_equals(e.data.length, 2);
+  assert_array_equals(e.data[0], expected[0]);
+  assert_array_equals(e.data[1], expected[1]);
+  frames.forEach(function(f) { f.remove(); });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/controlled-dedicatedworker-postMessage.https.html b/test/fixtures/wpt/service-workers/service-worker/controlled-dedicatedworker-postMessage.https.html
new file mode 100644
index 000000000000..5ef91dd1b11c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/controlled-dedicatedworker-postMessage.https.html
@@ -0,0 +1,45 @@
+<html>
+<head>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+</head>
+<body>
+<script>
+promise_test(async (test) => {
+    const registration = await navigator.serviceWorker.register("postMessage-client-worker.js", { scope : 'resources' });
+    activeWorker = registration.active;
+    if (activeWorker)
+        return;
+
+    activeWorker = registration.installing;
+    await new Promise(resolve => {
+        activeWorker.addEventListener('statechange', () => {
+            if (activeWorker.state === "activated")
+                resolve();
+        });
+    });
+}, "Register service worker");
+
+promise_test(async (test) => {
+    const worker = new Worker('resources/controlled-worker-postMessage.js');
+    const event = await new Promise((resolve, reject) => {
+       test.step_timeout(() => reject("test timed out"), 3000);
+       worker.onmessage = resolve;
+    });
+    assert_equals(event.data, 0);
+}, "Verify dedicated worker gets messages if setting event listener early");
+
+promise_test(async (test) => {
+    const worker = new Worker('resources/controlled-worker-late-postMessage.js?repeatMessages');
+    const event = await new Promise((resolve, reject) => {
+       test.step_timeout(() => reject("test timed out"), 3000);
+       worker.onmessage = resolve;
+    });
+    assert_not_equals(event.data, "No message received");
+    assert_true(event.data > 0);
+}, "Verify dedicated worker does not get all messages if not setting event listener early");
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/controlled-iframe-postMessage.https.html b/test/fixtures/wpt/service-workers/service-worker/controlled-iframe-postMessage.https.html
new file mode 100644
index 000000000000..c3f390a5a455
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/controlled-iframe-postMessage.https.html
@@ -0,0 +1,68 @@
+<html>
+<head>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+</head>
+<body>
+<script>
+promise_test(async (test) => {
+    const registration = await navigator.serviceWorker.register("postMessage-client-worker.js", { scope : 'resources' });
+    activeWorker = registration.active;
+    if (activeWorker)
+        return;
+
+    activeWorker = registration.installing;
+    await new Promise(resolve => {
+        activeWorker.addEventListener('statechange', () => {
+            if (activeWorker.state === "activated")
+                resolve();
+        });
+    });
+}, "Register service worker");
+
+function with_iframe(test, url) {
+    return new Promise(function(resolve, reject) {
+        test.step_timeout(() => reject("with_iframe timed out"), 2000);
+        var frame = document.createElement('iframe');
+        frame.className = 'test-iframe';
+        frame.src = url;
+        frame.onload = function() { resolve(frame); };
+        document.body.appendChild(frame);
+    });
+}
+
+promise_test(async (test) => {
+    const frame = await with_iframe(test, 'resources/controlled-frame-postMessage.html');
+    let counter = 0;
+    while (counter++ < 100 && frame.contentWindow.messageData == undefined)
+       await new Promise(resolve => test.step_timeout(resolve, 50));
+    assert_equals(frame.contentWindow.messageData, 0);
+    frame.remove();
+}, "Verify frame gets early messages if setting synchronously message event listener");
+
+promise_test(async (test) => {
+    const frame = await with_iframe(test, 'resources/controlled-frame-postMessage.html?repeatMessages');
+    let counter = 0;
+    while (counter++ < 100 && frame.contentWindow.messageData == undefined)
+       await new Promise(resolve => test.step_timeout(resolve, 50));
+    assert_not_equals(frame.contentWindow.messageData, 0);
+    frame.remove();
+}, "Verify frame does not get all messages if not setting event listener early");
+
+promise_test(async (test) => {
+    const frame = await with_iframe(test, 'resources/controlled-frame-postMessage.html?repeatMessages&listener');
+    let counter = 0;
+    while (counter++ < 100 && frame.contentWindow.messageData.length < 5)
+       await new Promise(resolve => test.step_timeout(resolve, 50));
+
+    assert_less_than(counter, 100);
+    data = frame.contentWindow.messageData;
+    for (let cptr = 1; cptr < data.length; cptr++)
+        assert_true(data[cptr - 1] < data[cptr]);
+    frame.remove();
+}, "Verify frame does get messages in order");
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/controller-on-disconnect.https.html b/test/fixtures/wpt/service-workers/service-worker/controller-on-disconnect.https.html
new file mode 100644
index 000000000000..f23dfe71bac5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/controller-on-disconnect.https.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<title>Service Worker: Controller on load</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+promise_test(function(t) {
+    var url = 'resources/empty-worker.js';
+    var scope = 'resources/blank.html';
+    var registration;
+    var controller;
+    var frame;
+    return service_worker_unregister_and_register(t, url, scope)
+      .then(function(swr) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = swr;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope)
+        })
+      .then(function(f) {
+          frame = f;
+          var w = frame.contentWindow;
+          var swc = w.navigator.serviceWorker;
+          assert_true(swc.controller instanceof w.ServiceWorker,
+                      'controller should be a ServiceWorker object');
+
+          frame.remove();
+
+          assert_equals(swc.controller, null,
+                        'disconnected frame should not be controlled');
+        });
+}, 'controller is cleared on disconnected window');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/controller-on-load.https.html b/test/fixtures/wpt/service-workers/service-worker/controller-on-load.https.html
new file mode 100644
index 000000000000..e4c5e5f81f81
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/controller-on-load.https.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<title>Service Worker: Controller on load</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+promise_test(function(t) {
+    var url = 'resources/empty-worker.js';
+    var scope = 'resources/blank.html';
+    var registration;
+    var controller;
+    var frame;
+    return service_worker_unregister_and_register(t, url, scope)
+      .then(function(swr) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = swr;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          var w = frame.contentWindow;
+          controller = w.navigator.serviceWorker.controller;
+          assert_true(controller instanceof w.ServiceWorker,
+                      'controller should be a ServiceWorker object');
+          assert_equals(controller.scriptURL, normalizeURL(url));
+
+          // objects from different windows should not be equal
+          assert_not_equals(controller, registration.active);
+
+          return w.navigator.serviceWorker.getRegistration();
+        })
+      .then(function(frameRegistration) {
+          // SW objects from same window should be equal
+          assert_equals(frameRegistration.active, controller);
+          frame.remove();
+        });
+}, 'controller is set for a controlled document');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/controller-on-reload.https.html b/test/fixtures/wpt/service-workers/service-worker/controller-on-reload.https.html
new file mode 100644
index 000000000000..2e966d425788
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/controller-on-reload.https.html
@@ -0,0 +1,58 @@
+<!DOCTYPE html>
+<title>Service Worker: Controller on reload</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+promise_test(function(t) {
+    const iframe_scope = 'blank.html';
+    const scope = 'resources/' + iframe_scope;
+    var frame;
+    var registration;
+    var controller;
+    return service_worker_unregister(t, scope)
+      .then(function() {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          return frame.contentWindow.navigator.serviceWorker.register(
+              'empty-worker.js', {scope: iframe_scope});
+        })
+      .then(function(swr) {
+          registration = swr;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          var w = frame.contentWindow;
+          assert_equals(w.navigator.serviceWorker.controller, null,
+                        'controller should be null until the document is ' +
+                        'reloaded');
+          return new Promise(function(resolve) {
+              frame.onload = function() { resolve(); }
+              w.location.reload();
+            });
+        })
+      .then(function() {
+          var w = frame.contentWindow;
+          controller = w.navigator.serviceWorker.controller;
+          assert_true(controller instanceof w.ServiceWorker,
+                      'controller should be a ServiceWorker object upon reload');
+
+          // objects from separate windows should not be equal
+          assert_not_equals(controller, registration.active);
+
+          return w.navigator.serviceWorker.getRegistration(iframe_scope);
+        })
+      .then(function(frameRegistration) {
+          assert_equals(frameRegistration.active, controller);
+          frame.remove();
+        });
+  }, 'controller is set upon reload after registration');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/controller-with-no-fetch-event-handler.https.html b/test/fixtures/wpt/service-workers/service-worker/controller-with-no-fetch-event-handler.https.html
new file mode 100644
index 000000000000..d947139c9e21
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/controller-with-no-fetch-event-handler.https.html
@@ -0,0 +1,56 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: controller without a fetch event handler</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<body>
+<script>
+let registration;
+let frame;
+const host_info = get_host_info();
+const remote_base_url =
+    new URL(`${host_info.HTTPS_REMOTE_ORIGIN}${base_path()}resources/`);
+
+promise_test(async t => {
+  const script = 'resources/empty.js'
+  const scope = 'resources/';
+
+  promise_test(async t => {
+    if (frame)
+      frame.remove();
+
+    if (registration)
+      await registration.unregister();
+  }, 'cleanup global state');
+
+  registration = await
+      service_worker_unregister_and_register(t, script, scope);
+  await wait_for_state(t, registration.installing, 'activated');
+  frame = await with_iframe(scope + 'blank.html');
+}, 'global setup');
+
+promise_test(async t => {
+    const url = new URL('cors-approved.txt', remote_base_url);
+    const response = await frame.contentWindow.fetch(url, {mode:'no-cors'});
+    const text = await response.text();
+    assert_equals(text, '');
+}, 'cross-origin request, no-cors mode');
+
+
+promise_test(async t => {
+    const url = new URL('cors-denied.txt', remote_base_url);
+    const response = frame.contentWindow.fetch(url);
+    await promise_rejects_js(t, frame.contentWindow.TypeError, response);
+}, 'cross-origin request, cors denied');
+
+promise_test(async t => {
+    const url = new URL('cors-approved.txt', remote_base_url);
+    response = await frame.contentWindow.fetch(url);
+    let text = await response.text();
+    text = text.trim();
+    assert_equals(text, 'plaintext');
+}, 'cross-origin request, cors approved');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/credentials.https.html b/test/fixtures/wpt/service-workers/service-worker/credentials.https.html
new file mode 100644
index 000000000000..0a90dc2897c2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/credentials.https.html
@@ -0,0 +1,100 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Credentials for service worker scripts</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/common/utils.js"></script>
+<script src="/cookies/resources/cookie-helper.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+// Check if the service worker's script has appropriate credentials for a new
+// worker and byte-for-byte checking.
+
+const SCOPE = 'resources/in-scope';
+const COOKIE_NAME = `service-worker-credentials-${Math.random()}`;
+
+promise_test(async t => {
+  // Set-Cookies for path=/.
+  await fetch(
+      `/cookies/resources/set-cookie.py?name=${COOKIE_NAME}&path=%2F`);
+}, 'Set cookies as initialization');
+
+async function get_cookies(worker) {
+  worker.postMessage('get cookie');
+  const message = await new Promise(resolve =>
+      navigator.serviceWorker.addEventListener('message', resolve));
+  return message.data;
+}
+
+promise_test(async t => {
+  const key = token();
+  const registration = await service_worker_unregister_and_register(
+      t, `resources/echo-cookie-worker.py?key=${key}`, SCOPE);
+  t.add_cleanup(() => registration.unregister());
+  const worker = registration.installing;
+
+  const cookies = await get_cookies(worker);
+  assert_equals(cookies[COOKIE_NAME], '1', 'new worker has credentials');
+
+  await registration.update();
+  const updated_worker = registration.installing;
+  const updated_cookies = await get_cookies(updated_worker);
+  assert_equals(updated_cookies[COOKIE_NAME], '1',
+                'updated worker has credentials');
+}, 'Main script should have credentials');
+
+promise_test(async t => {
+  const key = token();
+  const registration = await service_worker_unregister_and_register(
+      t, `resources/import-echo-cookie-worker.js?key=${key}`, SCOPE);
+  t.add_cleanup(() => registration.unregister());
+  const worker = registration.installing;
+
+  const cookies = await get_cookies(worker);
+  assert_equals(cookies[COOKIE_NAME], '1', 'new worker has credentials');
+
+  await registration.update();
+  const updated_worker = registration.installing;
+  const updated_cookies = await get_cookies(updated_worker);
+  assert_equals(updated_cookies[COOKIE_NAME], '1',
+                'updated worker has credentials');
+}, 'Imported script should have credentials');
+
+promise_test(async t => {
+  const key = token();
+  const registration = await service_worker_unregister_and_register(
+      t, `resources/import-echo-cookie-worker-module.py?key=${key}`, SCOPE, {type: 'module'});
+  t.add_cleanup(() => registration.unregister());
+  const worker = registration.installing;
+
+  const cookies = await get_cookies(worker);
+  assert_equals(cookies[COOKIE_NAME], undefined, 'new module worker should not have credentials');
+
+  await registration.update();
+  const updated_worker = registration.installing;
+  const updated_cookies = await get_cookies(updated_worker);
+  assert_equals(updated_cookies[COOKIE_NAME], undefined,
+                'updated worker should not have credentials');
+}, 'Module with an imported statement should not have credentials');
+
+promise_test(async t => {
+  const key = token();
+  const registration = await service_worker_unregister_and_register(
+t, `resources/echo-cookie-worker.py?key=${key}`, SCOPE, {type: 'module'});
+  t.add_cleanup(() => registration.unregister());
+  const worker = registration.installing;
+
+  const cookies = await get_cookies(worker);
+  assert_equals(cookies[COOKIE_NAME], undefined, 'new module worker should not have credentials');
+
+  await registration.update();
+  const updated_worker = registration.installing;
+  const updated_cookies = await get_cookies(updated_worker);
+  assert_equals(updated_cookies[COOKIE_NAME], undefined,
+                'updated worker should not have credentials');
+}, 'Script with service worker served as modules should not have credentials');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/css-sw-same-origin-substitution.https.html b/test/fixtures/wpt/service-workers/service-worker/css-sw-same-origin-substitution.https.html
new file mode 100644
index 000000000000..3a79c07f95c2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/css-sw-same-origin-substitution.https.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<title>Service Worker: a same-origin response substituted for a cross-origin CSS request must not taint the stylesheet</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// Regression test for the canvas/CSS over-taint: when a service worker serves a
+// SAME-ORIGIN response to a CROSS-ORIGIN request, the resulting stylesheet is
+// same-origin and its rules must be readable.
+promise_test(async t => {
+  const SCOPE = 'resources/css-sw-same-origin-substitution-iframe.sub.html';
+  const SCRIPT = 'resources/css-sw-same-origin-substitution-worker.js';
+  const registration =
+      await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+  t.add_cleanup(() => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const frame = await with_iframe(SCOPE);
+  t.add_cleanup(() => frame.remove());
+
+  assert_equals(frame.contentDocument.styleSheets.length, 1,
+                'the substituted stylesheet should have loaded');
+  const sheet = frame.contentDocument.styleSheets[0];
+  // Accessing cssRules throws SecurityError if the sheet is (over-)tainted.
+  assert_greater_than(
+      sheet.cssRules.length, 0,
+      'a same-origin response substituted by the service worker for a ' +
+      'cross-origin request must be readable (not over-tainted)');
+}, 'SW same-origin substitution for a cross-origin CSS request must not taint ' +
+   'the stylesheet');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/data-iframe.html b/test/fixtures/wpt/service-workers/service-worker/data-iframe.html
new file mode 100644
index 000000000000..d767d574345b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/data-iframe.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<title>Service Workers in data iframes</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body></body>
+<script>
+'use strict';
+
+promise_test(t => {
+  const url = encodeURI(`data:text/html,<!DOCTYPE html>
+  <script>
+    parent.postMessage({ isDefined: 'serviceWorker' in navigator }, '*');
+  </` + `script>`);
+  var p = new Promise((resolve, reject) => {
+    window.addEventListener('message', event => {
+      resolve(event.data.isDefined);
+    });
+  });
+  with_iframe(url);
+  return p.then(isDefined => {
+    assert_false(isDefined, 'navigator.serviceWorker should not be defined in iframe');
+  });
+}, 'navigator.serviceWorker is not available in a data: iframe');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/data-transfer-files.https.html b/test/fixtures/wpt/service-workers/service-worker/data-transfer-files.https.html
new file mode 100644
index 000000000000..c503a28f965b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/data-transfer-files.https.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Post a file in a navigation controlled by a service worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<iframe id=testframe name=testframe></iframe>
+<form id=testform method=post action="/html/semantics/forms/form-submission-0/resources/file-submission.py" target=testframe enctype="multipart/form-data">
+<input name=testinput id=testinput type=file>
+</form>
+<script>
+// Test that DataTransfer with a File entry works when posted to a
+// service worker that falls back to network. Regression test for
+// https://crbug.com/944145.
+promise_test(async (t) => {
+  const scope = '/html/semantics/forms/form-submission-0/resources/';
+  const header = `pipe=header(Service-Worker-Allowed,${scope})`;
+  const script = `resources/fetch-event-network-fallback-worker.js?${header}`;
+
+  const registration = await service_worker_unregister_and_register(
+      t, script, scope);
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const dataTransfer = new DataTransfer();
+  dataTransfer.items.add(new File(['foobar'], 'name'));
+  assert_equals(1, dataTransfer.files.length);
+
+  testinput.files = dataTransfer.files;
+  testform.submit();
+
+  const data = await new Promise(resolve => {
+    onmessage = e => {
+      if (e.source !== testframe) return;
+      resolve(e.data);
+    };
+  });
+  assert_equals(data, "foobar");
+}, 'Posting a File in a navigation handled by a service worker');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/dedicated-worker-service-worker-interception.https.html b/test/fixtures/wpt/service-workers/service-worker/dedicated-worker-service-worker-interception.https.html
new file mode 100644
index 000000000000..2144f4827121
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/dedicated-worker-service-worker-interception.https.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: ServiceWorker interception</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+// Note that Chrome cannot pass these tests because of https://crbug.com/731599.
+
+function service_worker_interception_test(url, description) {
+  promise_test(async t => {
+    // Register a service worker whose scope includes |url|.
+    const kServiceWorkerScriptURL =
+        'resources/service-worker-interception-service-worker.js';
+    const registration = await service_worker_unregister_and_register(
+        t, kServiceWorkerScriptURL, url);
+    add_result_callback(() => registration.unregister());
+    await wait_for_state(t, registration.installing, 'activated');
+
+    // Start a dedicated worker for |url|. The top-level script request and any
+    // module imports should be intercepted by the service worker.
+    const worker = new Worker(url, { type: 'module' });
+    const msg_event = await new Promise(resolve => worker.onmessage = resolve);
+    assert_equals(msg_event.data, 'LOADED_FROM_SERVICE_WORKER');
+  }, description);
+}
+
+service_worker_interception_test(
+    'resources/service-worker-interception-network-worker.js',
+    'Top-level module loading should be intercepted by a service worker.');
+
+service_worker_interception_test(
+    'resources/service-worker-interception-static-import-worker.js',
+    'Static import should be intercepted by a service worker.');
+
+service_worker_interception_test(
+    'resources/service-worker-interception-dynamic-import-worker.js',
+    'Dynamic import should be intercepted by a service worker.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/detached-context.https.html b/test/fixtures/wpt/service-workers/service-worker/detached-context.https.html
new file mode 100644
index 000000000000..ce8e4cc8400c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/detached-context.https.html
@@ -0,0 +1,124 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service WorkerRegistration from a removed iframe</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+</body>
+<script>
+// NOTE: This file tests corner case behavior that might not be defined in the
+// spec. See https://github.com/w3c/ServiceWorker/issues/1221
+
+promise_test(t => {
+    const url = 'resources/blank.html';
+    const scope_for_iframe = 'removed-registration'
+    const scope_for_main = 'resources/' + scope_for_iframe;
+    const script = 'resources/empty-worker.js';
+    let frame;
+    let resolvedCount = 0;
+
+    return service_worker_unregister(t, scope_for_main)
+      .then(() => {
+          return with_iframe(url);
+        })
+      .then(f => {
+          frame = f;
+          return navigator.serviceWorker.register(script,
+                                                  {scope: scope_for_main});
+        })
+      .then(r => {
+          add_completion_callback(() => { r.unregister(); });
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(() => {
+          return frame.contentWindow.navigator.serviceWorker.getRegistration(
+            scope_for_iframe);
+        })
+      .then(r => {
+          frame.remove();
+          assert_equals(r.installing, null);
+          assert_equals(r.waiting, null);
+          assert_equals(r.active.state, 'activated');
+          assert_equals(r.scope, normalizeURL(scope_for_main));
+          r.onupdatefound = () => { /* empty */ };
+
+          // We want to verify that unregister() and update() do not
+          // resolve on a detached registration.  We can't check for
+          // an explicit rejection, though, because not all browsers
+          // fire rejection callbacks on detached promises.  Instead
+          // we wait for a sample scope to install, activate, and
+          // unregister before declaring that the promises did not
+          // resolve.
+          r.unregister().then(() => resolvedCount += 1,
+                              () => {});
+          r.update().then(() => resolvedCount += 1,
+                          () => {});
+          return wait_for_activation_on_sample_scope(t, window);
+        })
+      .then(() => {
+          assert_equals(resolvedCount, 0,
+                        'methods called on a detached registration should not resolve');
+          frame.remove();
+        })
+  }, 'accessing a ServiceWorkerRegistration from a removed iframe');
+
+promise_test(t => {
+    const script = 'resources/empty-worker.js';
+    const scope = 'resources/scope/serviceworker-from-detached';
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          add_completion_callback(() => { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(() => { return with_iframe(scope); })
+      .then(frame => {
+          const worker = frame.contentWindow.navigator.serviceWorker.controller;
+          const ctor = frame.contentWindow.DOMException;
+          frame.remove();
+          assert_equals(worker.scriptURL, normalizeURL(script));
+          assert_equals(worker.state, 'activated');
+          worker.onstatechange = () => { /* empty */ };
+          assert_throws_dom(
+              'InvalidStateError',
+               ctor,
+              () => { worker.postMessage(''); },
+              'postMessage on a detached client should throw an exception.');
+        });
+  }, 'accessing a ServiceWorker object from a removed iframe');
+
+promise_test(t => {
+    const iframe = document.createElement('iframe');
+    iframe.src = 'resources/blank.html';
+    document.body.appendChild(iframe);
+    const f = iframe.contentWindow.Function;
+    function get_navigator() {
+      return f('return navigator')();
+    }
+    return new Promise(resolve => {
+        assert_equals(iframe.contentWindow.navigator, get_navigator());
+        iframe.src = 'resources/blank.html?navigate-to-new-url';
+        iframe.onload = resolve;
+      }).then(function() {
+        assert_not_equals(get_navigator().serviceWorker, null);
+        assert_equals(
+            get_navigator().serviceWorker,
+            iframe.contentWindow.navigator.serviceWorker);
+        iframe.remove();
+      });
+  }, 'accessing navigator.serviceWorker on a detached iframe');
+
+test(t => {
+    const iframe = document.createElement('iframe');
+    iframe.src = 'resources/blank.html';
+    document.body.appendChild(iframe);
+    const f = iframe.contentWindow.Function;
+    function get_navigator() {
+      return f('return navigator')();
+    }
+    assert_not_equals(get_navigator().serviceWorker, null);
+    iframe.remove();
+    assert_not_equals(get_navigator().serviceWorker, null);
+  }, 'accessing navigator on a removed frame');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/detached-register-crash.https.html b/test/fixtures/wpt/service-workers/service-worker/detached-register-crash.https.html
new file mode 100644
index 000000000000..2785142a3cf4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/detached-register-crash.https.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Assures navigator.serviceWorker.register() doesn't crash when rejecting being called in a detached frame</title>
+<link rel="author" href="mailto:caseq@chromium.org">
+<link rel="help" href="http://crbug.com/398910931">
+<body>
+<iframe></iframe>
+<script>
+const frame = document.getElementsByTagName("iframe")[0];
+const container = frame.contentWindow.navigator.serviceWorker;
+frame.remove();
+container.register("data:,");
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/embed-and-object-are-not-intercepted.https.html b/test/fixtures/wpt/service-workers/service-worker/embed-and-object-are-not-intercepted.https.html
new file mode 100644
index 000000000000..581dbeca9772
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/embed-and-object-are-not-intercepted.https.html
@@ -0,0 +1,104 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>embed and object are not intercepted</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<body>
+<script>
+let registration;
+
+const kScript = 'resources/embed-and-object-are-not-intercepted-worker.js';
+const kScope = 'resources/';
+
+promise_test(t => {
+    return service_worker_unregister_and_register(t, kScript, kScope)
+      .then(registration => {
+          promise_test(() => {
+              return registration.unregister();
+            }, 'restore global state');
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+  }, 'initialize global state');
+
+promise_test(t => {
+    let frame;
+    return with_iframe('resources/embed-is-not-intercepted-iframe.html')
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          return frame.contentWindow.test_promise;
+        })
+      .then(result => {
+          assert_equals(result, 'request for embedded content was not intercepted');
+        });
+  }, 'requests for EMBED elements of embedded HTML content should not be intercepted by service workers');
+
+promise_test(t => {
+    let frame;
+    return with_iframe('resources/object-is-not-intercepted-iframe.html')
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          return frame.contentWindow.test_promise;
+        })
+      .then(result => {
+          assert_equals(result, 'request for embedded content was not intercepted');
+        });
+  }, 'requests for OBJECT elements of embedded HTML content should not be intercepted by service workers');
+
+promise_test(t => {
+    let frame;
+    return with_iframe('resources/embed-image-is-not-intercepted-iframe.html')
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          return frame.contentWindow.test_promise;
+        })
+      .then(result => {
+          assert_equals(result, 'request was not intercepted');
+        });
+  }, 'requests for EMBED elements of an image should not be intercepted by service workers');
+
+promise_test(t => {
+    let frame;
+    return with_iframe('resources/object-image-is-not-intercepted-iframe.html')
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          return frame.contentWindow.test_promise;
+        })
+      .then(result => {
+          assert_equals(result, 'request was not intercepted');
+        });
+  }, 'requests for OBJECT elements of an image should not be intercepted by service workers');
+
+promise_test(t => {
+    let frame;
+    return with_iframe('resources/object-navigation-is-not-intercepted-iframe.html')
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          return frame.contentWindow.test_promise;
+        })
+      .then(result => {
+          assert_equals(result, 'request for embedded content was not intercepted');
+        });
+  }, 'post-load navigation of OBJECT elements should not be intercepted by service workers');
+
+
+promise_test(t => {
+    let frame;
+    return with_iframe('resources/embed-navigation-is-not-intercepted-iframe.html')
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          return frame.contentWindow.test_promise;
+        })
+      .then(result => {
+          assert_equals(result, 'request for embedded content was not intercepted');
+        });
+  }, 'post-load navigation of EMBED elements should not be intercepted by service workers');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/extendable-event-async-waituntil.https.html b/test/fixtures/wpt/service-workers/service-worker/extendable-event-async-waituntil.https.html
new file mode 100644
index 000000000000..04e98266b4f1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/extendable-event-async-waituntil.https.html
@@ -0,0 +1,120 @@
+<!DOCTYPE html>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+function sync_message(worker, message, transfer) {
+  let wait = new Promise((res, rej) => {
+    navigator.serviceWorker.addEventListener('message', function(e) {
+        if (e.data === 'ACK') {
+          res();
+        } else {
+          rej();
+        }
+      });
+    });
+  worker.postMessage(message, transfer);
+  return wait;
+}
+
+function runTest(test, step, testBody) {
+  var scope = './resources/' + step;
+  var script = 'resources/extendable-event-async-waituntil.js?' + scope;
+  return service_worker_unregister_and_register(test, script, scope)
+    .then(function(registration) {
+        test.add_cleanup(function() {
+            return service_worker_unregister(test, scope);
+          });
+
+        let worker = registration.installing;
+        var channel = new MessageChannel();
+        var saw_message = new Promise(function(resolve) {
+          channel.port1.onmessage = function(e) { resolve(e.data); }
+        });
+
+        return wait_for_state(test, worker, 'activated')
+          .then(function() {
+              return sync_message(worker, { step: 'init', port: channel.port2 },
+                [channel.port2]);
+            })
+          .then(function() { return testBody(worker); })
+          .then(function() { return saw_message; })
+          .then(function(output) {
+              assert_equals(output.result, output.expected);
+            })
+          .then(function() { return sync_message(worker, { step: 'done' }); });
+      });
+}
+
+function msg_event_test(scope, test) {
+  var testBody = function(worker) {
+    return sync_message(worker, { step: scope });
+  };
+  return runTest(test, scope, testBody);
+}
+
+promise_test(msg_event_test.bind(this, 'no-current-extension-different-task'),
+  'Test calling waitUntil in a task at the end of the event handler without an existing extension throws');
+
+promise_test(msg_event_test.bind(this, 'no-current-extension-different-microtask'),
+  'Test calling waitUntil in a microtask at the end of the event handler without an existing extension suceeds');
+
+promise_test(msg_event_test.bind(this, 'current-extension-different-task'),
+  'Test calling waitUntil in a different task an existing extension succeeds');
+
+promise_test(msg_event_test.bind(this, 'during-event-dispatch-current-extension-expired-same-microtask-turn'),
+  'Test calling waitUntil at the end of an existing extension promise handler succeeds (event is still being dispatched)');
+
+promise_test(msg_event_test.bind(this, 'during-event-dispatch-current-extension-expired-same-microtask-turn-extra'),
+  'Test calling waitUntil in a microtask at the end of an existing extension promise handler succeeds (event is still being dispatched)');
+
+promise_test(msg_event_test.bind(this, 'after-event-dispatch-current-extension-expired-same-microtask-turn'),
+  'Test calling waitUntil in an existing extension promise handler succeeds (event is not being dispatched)');
+
+promise_test(msg_event_test.bind(this, 'after-event-dispatch-current-extension-expired-same-microtask-turn-extra'),
+  'Test calling waitUntil in a microtask at the end of an existing extension promise handler throws (event is not being dispatched)');
+
+promise_test(msg_event_test.bind(this, 'current-extension-expired-different-task'),
+  'Test calling waitUntil after the current extension expired in a different task fails');
+
+promise_test(msg_event_test.bind(this, 'script-extendable-event'),
+  'Test calling waitUntil on a script constructed ExtendableEvent throws exception');
+
+promise_test(function(t) {
+    var testBody = function(worker) {
+      return with_iframe('./resources/pending-respondwith-async-waituntil');
+    }
+    return runTest(t, 'pending-respondwith-async-waituntil', testBody);
+  }, 'Test calling waitUntil asynchronously with pending respondWith promise.');
+
+promise_test(function(t) {
+    var testBody = function(worker) {
+      return with_iframe('./resources/during-event-dispatch-respondwith-microtask-sync-waituntil');
+    }
+    return runTest(t, 'during-event-dispatch-respondwith-microtask-sync-waituntil', testBody);
+  }, 'Test calling waitUntil synchronously inside microtask of respondWith promise (event is being dispatched).');
+
+promise_test(function(t) {
+    var testBody = function(worker) {
+      return with_iframe('./resources/during-event-dispatch-respondwith-microtask-async-waituntil');
+    }
+    return runTest(t, 'during-event-dispatch-respondwith-microtask-async-waituntil', testBody);
+  }, 'Test calling waitUntil asynchronously inside microtask of respondWith promise (event is being dispatched).');
+
+promise_test(function(t) {
+    var testBody = function(worker) {
+      return with_iframe('./resources/after-event-dispatch-respondwith-microtask-sync-waituntil');
+    }
+    return runTest(t, 'after-event-dispatch-respondwith-microtask-sync-waituntil', testBody);
+  }, 'Test calling waitUntil synchronously inside microtask of respondWith promise (event is not being dispatched).');
+
+promise_test(function(t) {
+    var testBody = function(worker) {
+      return with_iframe('./resources/after-event-dispatch-respondwith-microtask-async-waituntil');
+    }
+    return runTest(t, 'after-event-dispatch-respondwith-microtask-async-waituntil', testBody);
+  }, 'Test calling waitUntil asynchronously inside microtask of respondWith promise (event is not being dispatched).');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/extendable-event-waituntil.https.html b/test/fixtures/wpt/service-workers/service-worker/extendable-event-waituntil.https.html
new file mode 100644
index 000000000000..33b4eac5c185
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/extendable-event-waituntil.https.html
@@ -0,0 +1,140 @@
+<!DOCTYPE html>
+<title>ExtendableEvent: waitUntil</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function runTest(test, scope, onRegister) {
+  var script = 'resources/extendable-event-waituntil.js?' + scope;
+  return service_worker_unregister_and_register(test, script, scope)
+    .then(function(registration) {
+        test.add_cleanup(function() {
+            return service_worker_unregister(test, scope);
+          });
+
+        return onRegister(registration.installing);
+      });
+}
+
+// Sends a SYN to the worker and asynchronously listens for an ACK; sets
+// |obj.synced| to true once ack'd.
+function syncWorker(worker, obj) {
+  var channel = new MessageChannel();
+  worker.postMessage({port: channel.port2}, [channel.port2]);
+  return new Promise(function(resolve) {
+      channel.port1.onmessage = resolve;
+    }).then(function(e) {
+      var message = e.data;
+      assert_equals(message, 'SYNC',
+                    'Should receive sync message from worker.');
+      obj.synced = true;
+      channel.port1.postMessage('ACK');
+    });
+}
+
+promise_test(function(t) {
+    // Passing scope as the test switch for worker script.
+    var scope = 'resources/install-fulfilled';
+    var onRegister = function(worker) {
+        var obj = {};
+
+        return Promise.all([
+            syncWorker(worker, obj),
+            wait_for_state(t, worker, 'installed')
+          ]).then(function() {
+              assert_true(
+                obj.synced,
+                'state should be "installed" after the waitUntil promise ' +
+                    'for "oninstall" is fulfilled.');
+              service_worker_unregister_and_done(t, scope);
+            });
+      };
+    return runTest(t, scope, onRegister);
+  }, 'Test install event waitUntil fulfilled');
+
+promise_test(function(t) {
+    var scope = 'resources/install-multiple-fulfilled';
+    var onRegister = function(worker) {
+        var obj1 = {};
+        var obj2 = {};
+
+        return Promise.all([
+            syncWorker(worker, obj1),
+            syncWorker(worker, obj2),
+            wait_for_state(t, worker, 'installed')
+          ]).then(function() {
+              assert_true(
+                obj1.synced && obj2.synced,
+                'state should be "installed" after all waitUntil promises ' +
+                    'for "oninstall" are fulfilled.');
+            });
+      };
+    return runTest(t, scope, onRegister);
+  }, 'Test ExtendableEvent multiple waitUntil fulfilled.');
+
+promise_test(function(t) {
+    var scope = 'resources/install-reject-precedence';
+    var onRegister = function(worker) {
+        var obj1 = {};
+        var obj2 = {};
+
+        return Promise.all([
+            syncWorker(worker, obj1)
+              .then(function() {
+                  syncWorker(worker, obj2);
+                }),
+            wait_for_state(t, worker, 'redundant')
+          ]).then(function() {
+              assert_true(
+                obj1.synced,
+                'The "redundant" state was entered after the first "extend ' +
+                  'lifetime promise" resolved.'
+              );
+              assert_true(
+                obj2.synced,
+                'The "redundant" state was entered after the third "extend ' +
+                  'lifetime promise" resolved.'
+              );
+            });
+      };
+    return runTest(t, scope, onRegister);
+  }, 'Test ExtendableEvent waitUntil reject precedence.');
+
+promise_test(function(t) {
+    var scope = 'resources/activate-fulfilled';
+    var onRegister = function(worker) {
+        var obj = {};
+        return wait_for_state(t, worker, 'activating')
+          .then(function() {
+              return Promise.all([
+                syncWorker(worker, obj),
+                wait_for_state(t, worker, 'activated')
+              ]);
+            })
+          .then(function() {
+              assert_true(
+                obj.synced,
+                'state should be "activated" after the waitUntil promise ' +
+                    'for "onactivate" is fulfilled.');
+            });
+      };
+    return runTest(t, scope, onRegister);
+  }, 'Test activate event waitUntil fulfilled');
+
+promise_test(function(t) {
+    var scope = 'resources/install-rejected';
+    var onRegister = function(worker) {
+        return wait_for_state(t, worker, 'redundant');
+      };
+    return runTest(t, scope, onRegister);
+  }, 'Test install event waitUntil rejected');
+
+promise_test(function(t) {
+    var scope = 'resources/activate-rejected';
+    var onRegister = function(worker) {
+        return wait_for_state(t, worker, 'activated');
+      };
+    return runTest(t, scope, onRegister);
+  }, 'Test activate event waitUntil rejected.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-audio-tainting.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-audio-tainting.https.html
new file mode 100644
index 000000000000..9821759bc7b3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-audio-tainting.https.html
@@ -0,0 +1,47 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+promise_test(async (t) => {
+    const SCOPE = 'resources/empty.html';
+    const SCRIPT = 'resources/fetch-rewrite-worker.js';
+    const host_info = get_host_info();
+    const REMOTE_ORIGIN = host_info.HTTPS_REMOTE_ORIGIN;
+
+    const reg = await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+    await wait_for_state(t, reg.installing, 'activated');
+    const frame = await with_iframe(SCOPE);
+
+    const doc = frame.contentDocument;
+    const win = frame.contentWindow;
+
+    const context = new win.AudioContext();
+    try {
+      context.suspend();
+      const audio = doc.createElement('audio');
+      audio.autoplay = true;
+      const source = context.createMediaElementSource(audio);
+      const spn = context.createScriptProcessor(16384, 1, 1);
+      source.connect(spn).connect(context.destination);
+      const url = `${REMOTE_ORIGIN}/webaudio/resources/sin_440Hz_-6dBFS_1s.wav`;
+      audio.src = '/test?url=' + encodeURIComponent(url);
+      doc.body.appendChild(audio);
+
+      await new Promise((resolve) => {
+        audio.addEventListener('playing', resolve);
+      });
+      await context.resume();
+      const event = await new Promise((resolve) => {
+        spn.addEventListener('audioprocess', resolve);
+      });
+      const data = event.inputBuffer.getChannelData(0);
+      for (const e of data) {
+        assert_equals(e, 0);
+      }
+    } finally {
+      context.close();
+    }
+  }, 'Verify CORS XHR of fetch() in a Service Worker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-double-write.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-double-write.https.html
new file mode 100644
index 000000000000..dab2153baa6f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-double-write.https.html
@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<meta charset="utf-8">
+<title>canvas tainting when written twice</title>
+<script>
+function loadImage(doc, url) {
+  return new Promise((resolve, reject) => {
+    const image = doc.createElement('img');
+    image.onload = () => { resolve(image); }
+    image.onerror = () => { reject('failed to load: ' + url); };
+    image.src = url;
+  });
+}
+
+// Tests that a canvas is tainted after it's written to with both a clear image
+// and opaque image from the same URL. A bad implementation might cache the
+// info of the clear image and assume the opaque image is also clear because
+// it's from the same URL. See https://crbug.com/907047 for details.
+promise_test(async (t) => {
+  // Set up a service worker and a controlled iframe.
+  const script = 'resources/fetch-canvas-tainting-double-write-worker.js';
+  const scope = 'resources/fetch-canvas-tainting-double-write-iframe.html';
+  const registration = await service_worker_unregister_and_register(
+      t, script, scope);
+  t.add_cleanup(() => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+  const iframe = await with_iframe(scope);
+  t.add_cleanup(() => iframe.remove());
+
+  // Load the same cross-origin image URL through the controlled iframe and
+  // this uncontrolled frame. The service worker responds with a same-origin
+  // image for the controlled iframe, so it is cleartext.
+  const imagePath = base_path() + 'resources/fetch-access-control.py?PNGIMAGE';
+  const imageUrl = get_host_info()['HTTPS_REMOTE_ORIGIN'] + imagePath;
+  const clearImage = await loadImage(iframe.contentDocument, imageUrl);
+  const opaqueImage = await loadImage(document, imageUrl);
+
+  // Set up a canvas for testing tainting.
+  const canvas = document.createElement('canvas');
+  const context = canvas.getContext('2d');
+  canvas.width = clearImage.width;
+  canvas.height = clearImage.height;
+
+  // The clear image and the opaque image have the same src URL. But...
+
+  // ... the clear image doesn't taint the canvas.
+  context.drawImage(clearImage, 0, 0);
+  assert_true(canvas.toDataURL().length > 0);
+
+  // ... the opaque image taints the canvas.
+  context.drawImage(opaqueImage, 0, 0);
+  assert_throws_dom('SecurityError', () => { canvas.toDataURL(); });
+}, 'canvas is tainted after writing both a non-opaque image and an opaque image from the same URL');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-image-cache.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-image-cache.https.html
new file mode 100644
index 000000000000..213238112257
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-image-cache.https.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: canvas tainting of the fetched image using cached responses</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script src="resources/fetch-canvas-tainting-tests.js"></script>
+<body>
+<script>
+do_canvas_tainting_tests({
+  resource_path: base_path() + 'resources/fetch-access-control.py?PNGIMAGE',
+  cache: true
+});
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-image.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-image.https.html
new file mode 100644
index 000000000000..57dc7d98caa2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-image.https.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: canvas tainting of the fetched image</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script src="resources/fetch-canvas-tainting-tests.js"></script>
+<body>
+<script>
+do_canvas_tainting_tests({
+  resource_path: base_path() + 'resources/fetch-access-control.py?PNGIMAGE',
+  cache: false
+});
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video-cache.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video-cache.https.html
new file mode 100644
index 000000000000..c37e8e562448
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video-cache.https.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: canvas tainting of the fetched video using cache responses</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script src="resources/fetch-canvas-tainting-tests.js"></script>
+<body>
+<script>
+do_canvas_tainting_tests({
+  resource_path: base_path() + 'resources/fetch-access-control.py?VIDEO',
+  cache: true
+});
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video-with-range-request.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video-with-range-request.https.html
new file mode 100644
index 000000000000..0ee41e96f298
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video-with-range-request.https.html
@@ -0,0 +1,115 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Canvas tainting due to video whose responses are fetched via a service worker including range requests</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<body>
+<script>
+// These tests try to test canvas tainting due to a <video> element. The video
+// src URL is same-origin as the page, but the response is fetched via a service
+// worker that does tricky things like returning opaque responses from another
+// origin. Furthermore, this tests range requests so there are multiple
+// responses.
+//
+// We test range requests by having the server return 206 Partial Content to the
+// first request (which doesn't necessarily have a "Range" header or one with a
+// byte range). Then the <video> element automatically makes ranged requests
+// (the "Range" HTTP request header specifies a byte range). The server responds
+// to these with 206 Partial Content for the given range.
+let unique = 0; // See https://bugzilla.mozilla.org/show_bug.cgi?id=1129121
+function range_request_test(script, expected, description,
+                            {remote_origin_src} = {}) {
+  promise_test(t => {
+      let frame;
+      let registration;
+      add_result_callback(() => {
+          if (frame) frame.remove();
+          if (registration) registration.unregister();
+        });
+
+      const scope = 'resources/fetch-canvas-tainting-iframe.html';
+      return service_worker_unregister_and_register(t, script, scope)
+        .then(r => {
+            registration = r;
+            return wait_for_state(t, registration.installing, 'activated');
+          })
+        .then(() => {
+            return with_iframe(scope);
+          })
+        .then(f => {
+            frame = f;
+            // Add "?PartialContent&VIDEO" to get a video resource from the
+            // server using range requests.
+            let video_url =
+              'fetch-access-control.py?PartialContent&VIDEO=' + unique++;
+            if (remote_origin_src) {
+              video_url = get_host_info().HTTPS_REMOTE_ORIGIN +
+                base_path() + 'resources/' + video_url;
+            }
+            return frame.contentWindow.create_test_case_promise(video_url);
+          })
+        .then(result => {
+            assert_equals(result, expected);
+          });
+    }, description);
+}
+
+// We want to consider a number of scenarios:
+// (1) Range responses come from a single origin, the same-origin as the page.
+//     The canvas should not be tainted.
+range_request_test(
+  'resources/fetch-event-network-fallback-worker.js',
+  'NOT_TAINTED',
+  'range responses from single origin (same-origin)');
+
+// (2) Range responses come from a single origin, cross-origin from the page
+//     (and without CORS sharing). This is not possible to test, since service
+//     worker can't make a request with a "Range" HTTP header in no-cors mode.
+
+// (3) Range responses come from multiple origins. The first response comes from
+//     cross-origin (and without CORS sharing, so is opaque). Subsequent
+//     responses come from same-origin. This should result in a load error, as regardless of canvas
+//     loading range requests from multiple opaque origins can reveal information across those origins.
+range_request_test(
+  'resources/range-request-to-different-origins-worker.js',
+  'LOAD_ERROR',
+  'range responses from multiple origins (cross-origin first)');
+
+// (4) Range responses come from multiple origins. The first response comes from
+//     same-origin. Subsequent responses come from cross-origin (and without
+//     CORS sharing). Like (2) this is not possible since the service worker
+//     cannot make range requests cross-origin.
+
+// (5) Range responses come from a single origin, with a mix of opaque and
+//     non-opaque responses. The first request uses 'no-cors' mode to
+//     receive an opaque response, and subsequent range requests use 'cors'
+//     to receive non-opaque responses. The canvas should be tainted.
+range_request_test(
+  'resources/range-request-with-different-cors-modes-worker.js',
+  'TAINTED',
+  'range responses from single origin with both opaque and non-opaque responses');
+
+// (6) Range responses come from a single origin, with a mix of opaque and
+//     non-opaque responses. The first request uses 'cors' mode to
+//     receive an non-opaque response, and subsequent range requests use
+//     'no-cors' to receive non-opaque responses. Like (2) this is not possible.
+
+// (7) The first Range response is synthesized using the Response constructor.
+//     Subsequent responses are same-origin, not handled by the service worker.
+range_request_test(
+  'resources/range-request-with-synth-head-worker.js',
+  'NOT_TAINTED',
+  'synth and same-origin fallback range responses');
+
+// (8) The first Range response is synthesized using the Response constructor.
+//     Subsequent responses are cross-origin, not handled by the service worker,
+//     no-cors and opaque.
+range_request_test(
+  'resources/range-request-with-synth-head-worker.js',
+  'LOAD_ERROR',
+  'synth and cross-origin fallback range responses',
+  {remote_origin_src: true});
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video.https.html
new file mode 100644
index 000000000000..e8c23a2edd63
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video.https.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: canvas tainting of the fetched video</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script src="resources/fetch-canvas-tainting-tests.js"></script>
+<body>
+<script>
+do_canvas_tainting_tests({
+  resource_path: base_path() + 'resources/fetch-access-control.py?VIDEO',
+  cache: false
+});
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-cors-exposed-header-names.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-cors-exposed-header-names.https.html
new file mode 100644
index 000000000000..317b02175f2f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-cors-exposed-header-names.https.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<title>Service Worker: CORS-exposed header names should be transferred correctly</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(async function(t) {
+    const SCOPE = 'resources/simple.html';
+    const SCRIPT = 'resources/fetch-cors-exposed-header-names-worker.js';
+    const host_info = get_host_info();
+
+    const URL = get_host_info().HTTPS_REMOTE_ORIGIN +
+      '/service-workers/service-worker/resources/simple.txt?pipe=' +
+      'header(access-control-allow-origin,*)|' +
+      'header(access-control-expose-headers,*)|' +
+      'header(foo,bar)|' +
+      'header(set-cookie,X)';
+
+    const reg = await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+    await wait_for_state(t, reg.installing, 'activated');
+    const frame = await with_iframe(SCOPE);
+
+    const response = await frame.contentWindow.fetch(URL);
+    const headers = response.headers;
+    assert_equals(headers.get('foo'), 'bar');
+    assert_equals(headers.get('set-cookie'), null);
+    assert_equals(headers.get('access-control-expose-headers'), '*');
+  }, 'CORS-exposed header names for a response from sw');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-cors-xhr.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-cors-xhr.https.html
new file mode 100644
index 000000000000..f8ff445673bd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-cors-xhr.https.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<title>Service Worker: CORS XHR of fetch()</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<body>
+<script>
+promise_test(function(t) {
+    var SCOPE = 'resources/fetch-cors-xhr-iframe.html';
+    var SCRIPT = 'resources/fetch-rewrite-worker.js';
+    var host_info = get_host_info();
+
+    return login_https(t)
+      .then(function() {
+          return service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+        })
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, SCOPE);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(function(frame) {
+          t.add_cleanup(function() {
+              frame.remove();
+            });
+
+          return new Promise(function(resolve, reject) {
+              var channel = new MessageChannel();
+              channel.port1.onmessage = (event) => {
+                  if (event.data === 'done') {
+                    resolve();
+                    return;
+                  }
+                  test(() => {
+                    assert_true(event.data.result);
+                  }, event.data.testName);
+              };
+              frame.contentWindow.postMessage({},
+                                              host_info['HTTPS_ORIGIN'],
+                                              [channel.port2]);
+            });
+        });
+  }, 'Verify CORS XHR of fetch() in a Service Worker');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-csp.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-csp.https.html
new file mode 100644
index 000000000000..9e7b242b69aa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-csp.https.html
@@ -0,0 +1,138 @@
+<!DOCTYPE html>
+<title>Service Worker: CSP control of fetch()</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+
+function assert_resolves(promise, description) {
+  return promise.catch(function(reason) {
+      throw new Error(description + ' - ' + reason.message);
+  });
+}
+
+function assert_rejects(promise, description) {
+  return promise.then(
+      function() { throw new Error(description); },
+      function() {});
+}
+
+promise_test(function(t) {
+    var SCOPE = 'resources/fetch-csp-iframe.html';
+    var SCRIPT = 'resources/fetch-rewrite-worker.js';
+    var host_info = get_host_info();
+    var IMAGE_PATH =
+        base_path() + 'resources/fetch-access-control.py?PNGIMAGE';
+    var IMAGE_URL = host_info['HTTPS_ORIGIN'] + IMAGE_PATH;
+    var REMOTE_IMAGE_URL = host_info['HTTPS_REMOTE_ORIGIN'] + IMAGE_PATH;
+    var REDIRECT_URL =
+        host_info['HTTPS_ORIGIN'] + base_path() + 'resources/redirect.py';
+    var frame;
+
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, SCOPE);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(
+              SCOPE + '?' +
+              encodeURIComponent('img-src ' + host_info['HTTPS_ORIGIN'] +
+                                 '; script-src \'unsafe-inline\''));
+        })
+      .then(function(f) {
+          frame = f;
+          return assert_resolves(
+              frame.contentWindow.load_image(IMAGE_URL),
+              'Allowed scope image resource should be loaded.');
+        })
+      .then(function() {
+          return assert_rejects(
+              frame.contentWindow.load_image(REMOTE_IMAGE_URL),
+              'Disallowed scope image resource should not be loaded.');
+        })
+      .then(function() {
+          return assert_resolves(
+              frame.contentWindow.load_image(
+                  // The request for IMAGE_URL will be fetched in SW.
+                  './sample?url=' + encodeURIComponent(IMAGE_URL)),
+              'Allowed scope image resource which was fetched via SW should ' +
+              'be loaded.');
+        })
+      .then(function() {
+          return assert_rejects(
+              frame.contentWindow.load_image(
+                  // The request for REMOTE_IMAGE_URL will be fetched in SW.
+                  './sample?mode=no-cors&url=' +
+                  encodeURIComponent(REMOTE_IMAGE_URL)),
+              'Disallowed scope image resource which was fetched via SW ' +
+              'should not be loaded.');
+        })
+      .then(function() {
+          frame.remove();
+          return with_iframe(
+              SCOPE + '?' +
+              encodeURIComponent(
+                  'img-src ' + REDIRECT_URL +
+                  '; script-src \'unsafe-inline\''));
+        })
+      .then(function(f) {
+          frame = f;
+          return assert_resolves(
+              frame.contentWindow.load_image(
+                  // Set 'ignore' not to call respondWith() in the SW.
+                  REDIRECT_URL + '?ignore&Redirect=' +
+                  encodeURIComponent(IMAGE_URL)),
+              'When the request was redirected, CSP match algorithm should ' +
+              'ignore the path component of the URL.');
+        })
+      .then(function() {
+          return assert_resolves(
+              frame.contentWindow.load_image(
+                  // This request will be fetched via SW and redirected by
+                  // redirect.php.
+                  REDIRECT_URL + '?Redirect=' + encodeURIComponent(IMAGE_URL)),
+              'When the request was redirected via SW, CSP match algorithm ' +
+              'should ignore the path component of the URL.');
+        })
+      .then(function() {
+          return assert_resolves(
+              frame.contentWindow.load_image(
+                  // The request for IMAGE_URL will be fetched in SW.
+                  REDIRECT_URL + '?url=' + encodeURIComponent(IMAGE_URL)),
+              'When the request was fetched via SW, CSP match algorithm ' +
+              'should ignore the path component of the URL.');
+        })
+      .then(function() {
+          return assert_resolves(
+              frame.contentWindow.fetch(IMAGE_URL + "&fetch1", { mode: 'no-cors'}),
+              'Allowed scope fetch resource should be loaded.');
+        })
+      .then(function() {
+          return assert_resolves(
+              frame.contentWindow.fetch(
+                  // The request for IMAGE_URL will be fetched in SW.
+                  './sample?url=' + encodeURIComponent(IMAGE_URL + '&fetch2'), { mode: 'no-cors'}),
+              'Allowed scope fetch resource which was fetched via SW should be loaded.');
+        })
+      .then(function() {
+          return assert_rejects(
+              frame.contentWindow.fetch(REMOTE_IMAGE_URL + "&fetch3", { mode: 'no-cors'}),
+              'Disallowed scope fetch resource should not be loaded.');
+        })
+      .then(function() {
+          return assert_rejects(
+              frame.contentWindow.fetch(
+                  // The request for REMOTE_IMAGE_URL will be fetched in SW.
+                  './sample?url=' + encodeURIComponent(REMOTE_IMAGE_URL + '&fetch4'), { mode: 'no-cors'}),
+              'Disallowed scope fetch resource which was fetched via SW should not be loaded.');
+        })
+      .then(function() {
+          frame.remove();
+        });
+  }, 'Verify CSP control of fetch() in a Service Worker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-error.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-error.https.html
new file mode 100644
index 000000000000..e9fdf5743120
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-error.https.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
+</head>
+<body>
+<script>
+const scope = "./resources/in-scope";
+
+promise_test(async (test) => {
+    const registration = await service_worker_unregister_and_register(
+        test, "./resources/fetch-error-worker.js", scope);
+    promise_test(async () => registration.unregister(),
+                 "Unregister service worker");
+    await wait_for_state(test, registration.installing, 'activated');
+}, "Setup service worker");
+
+promise_test(async (test) => {
+    const iframe = await with_iframe(scope);
+    test.add_cleanup(() => iframe.remove());
+    const response = await iframe.contentWindow.fetch("fetch-error-test");
+    return promise_rejects_js(test, iframe.contentWindow.TypeError,
+                              response.text(), 'text() should reject');
+}, "Make sure a load that makes progress does not time out");
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-add-async.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-add-async.https.html
new file mode 100644
index 000000000000..ac13e4f41675
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-add-async.https.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<title>Service Worker: Fetch event added asynchronously doesn't throw</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+service_worker_test(
+  'resources/fetch-event-add-async-worker.js');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-after-navigation-within-page.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-after-navigation-within-page.https.html
new file mode 100644
index 000000000000..4812d8a91551
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-after-navigation-within-page.https.html
@@ -0,0 +1,71 @@
+<!DOCTYPE html>
+<title>ServiceWorker: navigator.serviceWorker.waiting</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+promise_test(function(t) {
+    var scope =
+        'resources/fetch-event-after-navigation-within-page-iframe.html' +
+        '?hashchange';
+    var worker = 'resources/simple-intercept-worker.js';
+    var frame;
+
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          frame = f;
+          return frame.contentWindow.fetch_url('simple.txt');
+        })
+      .then(function(response) {
+          assert_equals(response, 'intercepted by service worker');
+          frame.contentWindow.location.hash = 'foo';
+          return frame.contentWindow.fetch_url('simple.txt');
+        })
+      .then(function(response) {
+          assert_equals(response, 'intercepted by service worker');
+          frame.remove();
+        })
+  }, 'Service Worker should respond to fetch event after the hash changes');
+
+promise_test(function(t) {
+    var scope =
+        'resources/fetch-event-after-navigation-within-page-iframe.html' +
+        '?pushState';
+    var worker = 'resources/simple-intercept-worker.js';
+    var frame;
+
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          frame = f;
+          return frame.contentWindow.fetch_url('simple.txt');
+        })
+      .then(function(response) {
+          assert_equals(response, 'intercepted by service worker');
+          frame.contentWindow.history.pushState('', '', 'bar');
+          return frame.contentWindow.fetch_url('simple.txt');
+        })
+      .then(function(response) {
+          assert_equals(response, 'intercepted by service worker');
+          frame.remove();
+        })
+  }, 'Service Worker should respond to fetch event after the pushState');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-async-respond-with.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-async-respond-with.https.html
new file mode 100644
index 000000000000..d9147f85494c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-async-respond-with.https.html
@@ -0,0 +1,73 @@
+<!DOCTYPE html>
+<html>
+<title>respondWith cannot be called asynchronously</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// This file has tests that call respondWith() asynchronously.
+
+let frame;
+let worker;
+const script = 'resources/fetch-event-async-respond-with-worker.js';
+const scope = 'resources/simple.html';
+
+// Global setup: this must be the first promise_test.
+promise_test(async (t) => {
+  const registration =
+      await service_worker_unregister_and_register(t, script, scope);
+  worker = registration.installing;
+  await wait_for_state(t, worker, 'activated');
+  frame = await with_iframe(scope);
+}, 'global setup');
+
+// Waits for a single message from the service worker and then removes the
+// message handler. Not safe for concurrent use.
+function wait_for_message() {
+  return new Promise((resolve) => {
+    const handler = (event) => {
+      navigator.serviceWorker.removeEventListener('message', handler);
+      resolve(event.data);
+    };
+    navigator.serviceWorker.addEventListener('message', handler);
+  });
+}
+
+// Does one test case. It fetches |url|. The service worker gets a fetch event
+// for |url| and attempts to call respondWith() asynchronously. It reports back
+// to the test whether an exception was thrown.
+async function do_test(url) {
+  // Send a message to tell the worker a new test case is starting.
+  const message = wait_for_message();
+  worker.postMessage('initializeMessageHandler');
+  const response = await message;
+  assert_equals(response, 'messageHandlerInitialized');
+
+  // Start a fetch.
+  const fetchPromise = frame.contentWindow.fetch(url);
+
+  // Receive the test result from the service worker.
+  const result = wait_for_message();
+  await fetchPromise.then(()=> {}, () => {});
+  return result;
+};
+
+promise_test(async (t) => {
+  const result = await do_test('respondWith-in-task');
+  assert_true(result.didThrow, 'should throw');
+  assert_equals(result.error, 'InvalidStateError');
+}, 'respondWith in a task throws InvalidStateError');
+
+promise_test(async (t) => {
+  const result = await do_test('respondWith-in-microtask');
+  assert_equals(result.didThrow, false, 'should not throw');
+}, 'respondWith in a microtask does not throw');
+
+// Global cleanup: the final promise_test.
+promise_test(async (t) => {
+  if (frame)
+    frame.remove();
+  await service_worker_unregister(t, scope);
+}, 'global cleanup');
+</script>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-handled.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-handled.https.html
new file mode 100644
index 000000000000..08b88ce3773d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-handled.https.html
@@ -0,0 +1,86 @@
+<!DOCTYPE html>
+<html>
+<title>Service Worker: FetchEvent.handled</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+let frame = null;
+let worker = null;
+const script = 'resources/fetch-event-handled-worker.js';
+const scope = 'resources/simple.html';
+const channel = new MessageChannel();
+
+// Wait for a message from the service worker and removes the message handler.
+function wait_for_message_from_worker() {
+  return new Promise((resolve) => channel.port2.onmessage = (event) => resolve(event.data));
+}
+
+// Global setup: this must be the first promise_test.
+promise_test(async (t) => {
+  const registration =
+      await service_worker_unregister_and_register(t, script, scope);
+  worker = registration.installing;
+  if (!worker)
+      worker = registration.active;
+  worker.postMessage({port:channel.port1}, [channel.port1]);
+  await wait_for_state(t, worker, 'activated');
+}, 'global setup');
+
+promise_test(async (t) => {
+  const promise = with_iframe(scope);
+  const message = await wait_for_message_from_worker();
+  frame = await promise;
+  assert_equals(message, 'RESOLVED');
+}, 'FetchEvent.handled should resolve when respondWith() is not called for a' +
+    ' navigation request');
+
+promise_test(async (t) => {
+  frame.contentWindow.fetch('sample.txt?respondWith-not-called');
+  const message = await wait_for_message_from_worker();
+  assert_equals(message, 'RESOLVED');
+}, 'FetchEvent.handled should resolve when respondWith() is not called for a' +
+    ' sub-resource request');
+
+promise_test(async (t) => {
+  frame.contentWindow.fetch(
+      'sample.txt?respondWith-not-called-and-event-canceled').catch((e) => {});
+  const message = await wait_for_message_from_worker();
+  assert_equals(message, 'REJECTED');
+}, 'FetchEvent.handled should reject when respondWith() is not called and the' +
+    ' event is canceled');
+
+promise_test(async (t) => {
+  frame.contentWindow.fetch(
+      'sample.txt?respondWith-called-and-promise-resolved');
+  const message = await wait_for_message_from_worker();
+  assert_equals(message, 'RESOLVED');
+}, 'FetchEvent.handled should resolve when the promise provided' +
+    ' to respondWith() is resolved');
+
+promise_test(async (t) => {
+  frame.contentWindow.fetch(
+      'sample.txt?respondWith-called-and-promise-resolved-to-invalid-response')
+      .catch((e) => {});
+  const message = await wait_for_message_from_worker();
+  assert_equals(message, 'REJECTED');
+}, 'FetchEvent.handled should reject when the promise provided' +
+    ' to respondWith() is resolved to an invalid response');
+
+promise_test(async (t) => {
+  frame.contentWindow.fetch(
+      'sample.txt?respondWith-called-and-promise-rejected').catch((e) => {});
+  const message = await wait_for_message_from_worker();
+  assert_equals(message, 'REJECTED');
+}, 'FetchEvent.handled should reject when the promise provided to' +
+    ' respondWith() is rejected');
+
+// Global cleanup: the final promise_test.
+promise_test(async (t) => {
+  if (frame)
+    frame.remove();
+  await service_worker_unregister(t, scope);
+}, 'global cleanup');
+</script>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-history-backward-navigation-manual.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-history-backward-navigation-manual.https.html
new file mode 100644
index 000000000000..3cf5922f396a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-history-backward-navigation-manual.https.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<body>
+<p>Click <a href="resources/install-worker.html?isHistoryNavigation&amp;script=fetch-event-test-worker.js">this link</a>.
+   Once you see &quot;method = GET,...&quot; in the page, go to another page, and then go back to the page using the Backward button.
+   You should see &quot;method = GET, isHistoryNavigation = true&quot;.
+</p>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-history-forward-navigation-manual.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-history-forward-navigation-manual.https.html
new file mode 100644
index 000000000000..401939b3cb2d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-history-forward-navigation-manual.https.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<body>
+<p>Click <a href="resources/install-worker.html?isHistoryNavigation&amp;script=fetch-event-test-worker.js">this link</a>.
+   Once you see &quot;method = GET,...&quot; in the page, go back to this page using the Backward button, and then go to the second page using the Forward button.
+   You should see &quot;method = GET, isHistoryNavigation = true&quot;.
+</p>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-reload-iframe-navigation-manual.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-reload-iframe-navigation-manual.https.html
new file mode 100644
index 000000000000..cf1feccf6e44
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-reload-iframe-navigation-manual.https.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+const worker = 'resources/fetch-event-test-worker.js';
+
+promise_test(async (t) => {
+  const scope = 'resources/simple.html?isReloadNavigation';
+
+  const reg = await service_worker_unregister_and_register(t, worker, scope);
+  await wait_for_state(t, reg.installing, 'activated');
+  const frame = await with_iframe(scope);
+  assert_equals(frame.contentDocument.body.textContent,
+                'method = GET, isReloadNavigation = false');
+  await new Promise((resolve) => {
+    frame.addEventListener('load', resolve);
+    frame.contentDocument.body.innerText =
+      'Reload this frame manually!';
+  });
+  assert_equals(frame.contentDocument.body.textContent,
+      'method = GET, isReloadNavigation = true');
+  frame.remove();
+  await reg.unregister();
+}, 'FetchEvent#request.isReloadNavigation is true for manual reload.');
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-reload-navigation-manual.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-reload-navigation-manual.https.html
new file mode 100644
index 000000000000..a349f07c36c2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-reload-navigation-manual.https.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<body>
+<p>Click <a href="resources/install-worker.html?isReloadNavigation&script=fetch-event-test-worker.js">this link</a>.
+   Once you see &quot;method = GET,...&quot; in the page, reload the page.
+   You will see &quot;method = GET, isReloadNavigation = true&quot;.
+</p>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-network-error.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-network-error.https.html
new file mode 100644
index 000000000000..fea2ad1e3c26
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-network-error.https.html
@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+<title>Service Worker: Fetch event network error</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var resolve_test_done;
+
+var test_done_promise = new Promise(function(resolve) {
+    resolve_test_done = resolve;
+  });
+
+// Called by the child frame.
+function notify_test_done(result) {
+  resolve_test_done(result);
+}
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-event-network-error-controllee-iframe.html';
+    var script = 'resources/fetch-event-network-error-worker.js';
+    var frame;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          return test_done_promise;
+        })
+      .then(function(result) {
+          frame.remove();
+          assert_equals(result, 'PASS');
+        });
+  }, 'Rejecting the fetch event or using preventDefault() causes a network ' +
+     'error');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-redirect.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-redirect.https.html
new file mode 100644
index 000000000000..522928475702
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-redirect.https.html
@@ -0,0 +1,1038 @@
+<!DOCTYPE html>
+<title>Service Worker: Fetch Event Redirect Handling</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+// ------------------------
+// Utilities for testing non-navigation requests that are intercepted with
+// a redirect.
+
+const host_info = get_host_info();
+const kScript = 'resources/fetch-rewrite-worker.js';
+const kScope = host_info['HTTPS_ORIGIN'] + base_path() +
+               'resources/blank.html?fetch-event-redirect';
+let frame;
+
+function redirect_fetch_test(t, test) {
+  const hostKeySuffix = test['url_credentials'] ? '_WITH_CREDS' : '';
+  const successPath = base_path() + 'resources/success.py';
+
+  let acaOrigin = '';
+  let host = host_info['HTTPS_ORIGIN' + hostKeySuffix];
+  if (test['redirect_dest'] === 'no-cors') {
+    host = host_info['HTTPS_REMOTE_ORIGIN' + hostKeySuffix]
+  } else if (test['redirect_dest'] === 'cors') {
+    acaOrigin = '?ACAOrigin=' + encodeURIComponent(host_info['HTTPS_ORIGIN']);
+    host = host_info['HTTPS_REMOTE_ORIGIN' + hostKeySuffix]
+  }
+
+  const dest = '?Redirect=' + encodeURIComponent(host + successPath + acaOrigin);
+  const expectedTypeParam =
+      test['expected_type']
+          ? '&expected_type=' + test['expected_type']
+          : '';
+  const expectedRedirectedParam =
+      test['expected_redirected']
+          ? '&expected_redirected=' + test['expected_redirected']
+          : '';
+  const url = '/' + test.name +
+            '?url=' + encodeURIComponent('redirect.py' + dest) +
+            expectedTypeParam + expectedRedirectedParam
+  const request = new Request(url, test.request_init);
+
+  if (test.should_reject) {
+    return promise_rejects_js(
+      t,
+      frame.contentWindow.TypeError,
+      frame.contentWindow.fetch(request),
+      'Must fail to fetch: url=' + url);
+  }
+  return frame.contentWindow.fetch(request).then((response) => {
+      assert_equals(response.type, test.expected_type,
+                    'response.type');
+      assert_equals(response.redirected, test.expected_redirected,
+                    'response.redirected');
+      if (response.type === 'opaque' || response.type === 'opaqueredirect') {
+        return;
+      }
+      return response.json().then((json) => {
+        assert_equals(json.result, 'success', 'JSON result must be "success".');
+      });
+    });
+}
+
+// Set up the service worker and the frame.
+promise_test(t => {
+    return service_worker_unregister_and_register(t, kScript, kScope)
+      .then(registration => {
+          promise_test(() => {
+              return registration.unregister();
+            }, 'restore global state');
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(() => {
+          return with_iframe(kScope);
+        })
+      .then(f => {
+          frame = f;
+          add_completion_callback(() => { f.remove(); });
+        });
+  }, 'initialize global state');
+
+// ------------------------
+// Test every combination of:
+//  - RequestMode (same-origin, cors, no-cors)
+//  - RequestRedirect (manual, follow, error)
+//  - redirect destination origin (same-origin, cors, no-cors)
+//  - redirect destination credentials (no user/pass, user/pass)
+//
+// TODO: add navigation requests
+// TODO: add redirects to data URI and verify same-origin data-URL flag behavior
+// TODO: add test where original redirect URI is cross-origin
+// TODO: verify final method is correct for 301, 302, and 303
+// TODO: verify CORS redirect results in all further redirects being
+//       considered cross origin
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-cors-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, cors mode Request redirected to ' +
+   'same-origin without credentials should succeed opaqueredirect ' +
+   'interception and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-cors-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, cors mode Request redirected to ' +
+   'no-cors without credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-cors-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, cors mode Request redirected to ' +
+   'cors without credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-sameorigin-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'same-origin'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, same-origin mode Request redirected to ' +
+   'same-origin without credentials should succeed opaqueredirect ' +
+   'interception and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-sameorigin-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'same-origin'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, same-origin mode Request redirected to ' +
+   'no-cors without credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-sameorigin-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'same-origin'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, same-origin mode Request redirected to ' +
+   'cors without credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-nocors-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'no-cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, no-cors mode Request redirected to ' +
+   'same-origin without credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-nocors-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'no-cors'
+    },
+    // This should succeed because its redirecting from same-origin to
+    // cross-origin.  Since the same-origin URL provides the location
+    // header the manual redirect mode should result in an opaqueredirect
+    // response.
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, no-cors mode Request redirected to ' +
+   'no-cors without credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-nocors-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'no-cors'
+    },
+    // This should succeed because its redirecting from same-origin to
+    // cross-origin.  Since the same-origin URL provides the location
+    // header the manual redirect mode should result in an opaqueredirect
+    // response.
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, no-cors mode Request redirected to ' +
+   'cors without credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-cors-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, cors mode Request redirected to ' +
+   'same-origin with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-cors-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, cors mode Request redirected to ' +
+   'no-cors with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-cors-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, cors mode Request redirected to ' +
+   'cors with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-sameorigin-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'same-origin'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, same-origin mode Request redirected to ' +
+   'same-origin with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-sameorigin-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'same-origin'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, same-origin mode Request redirected to ' +
+   'no-cors with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-sameorigin-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'same-origin'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, same-origin mode Request redirected to ' +
+   'cors with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-nocors-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'no-cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, no-cors mode Request redirected to ' +
+   'same-origin with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-nocors-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'no-cors'
+    },
+    // This should succeed because its redirecting from same-origin to
+    // cross-origin.  Since the same-origin URL provides the location
+    // header the manual redirect mode should result in an opaqueredirect
+    // response.
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, no-cors mode Request redirected to ' +
+   'no-cors with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-nocors-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'no-cors'
+    },
+    // This should succeed because its redirecting from same-origin to
+    // cross-origin.  Since the same-origin URL provides the location
+    // header the manual redirect mode should result in an opaqueredirect
+    // response.
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, no-cors mode Request redirected to ' +
+   'cors with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-cors-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    expected_type: 'basic',
+    expected_redirected: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, cors mode Request redirected to ' +
+   'same-origin without credentials should succeed interception ' +
+   'and response should be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-cors-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'follow',
+      mode: 'cors'
+    },
+    // should reject because CORS requests require CORS headers on cross-origin
+    // resources
+    should_reject: true
+  });
+}, 'Non-navigation, follow redirect, cors mode Request redirected to ' +
+   'no-cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-cors-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    expected_type: 'cors',
+    expected_redirected: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, cors mode Request redirected to ' +
+   'cors without credentials should succeed interception ' +
+   'and response should be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-sameorigin-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    expected_type: 'basic',
+    expected_redirected: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'same-origin'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, same-origin mode Request redirected to ' +
+   'same-origin without credentials should succeed interception ' +
+   'and response should be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-sameorigin-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'follow',
+      mode: 'same-origin'
+    },
+    // should reject because same-origin requests cannot load cross-origin
+    // resources
+    should_reject: true
+  });
+}, 'Non-navigation, follow redirect, same-origin mode Request redirected to ' +
+   'no-cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-sameorigin-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'follow',
+      mode: 'same-origin'
+    },
+    // should reject because same-origin requests cannot load cross-origin
+    // resources
+    should_reject: true
+  });
+}, 'Non-navigation, follow redirect, same-origin mode Request redirected to ' +
+   'cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-nocors-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    expected_type: 'basic',
+    expected_redirected: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'no-cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, no-cors mode Request redirected to ' +
+   'same-origin without credentials should succeed interception ' +
+   'and response should be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-nocors-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    expected_type: 'opaque',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'follow',
+      mode: 'no-cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, no-cors mode Request redirected to ' +
+   'no-cors without credentials should succeed interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-nocors-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    expected_type: 'opaque',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'follow',
+      mode: 'no-cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, no-cors mode Request redirected to ' +
+   'cors without credentials should succeed interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-cors-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    expected_type: 'basic',
+    expected_redirected: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, cors mode Request redirected to ' +
+   'same-origin with credentials should succeed interception ' +
+   'and response should be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-cors-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'cors'
+    },
+    // should reject because CORS requests require CORS headers on cross-origin
+    // resources
+    should_reject: true
+  });
+}, 'Non-navigation, follow redirect, cors mode Request redirected to ' +
+   'no-cors with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-cors-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'cors'
+    },
+    // should reject because CORS requests do not allow user/pass entries in
+    // cross-origin URLs
+    // NOTE: https://github.com/whatwg/fetch/issues/112
+    should_reject: true
+  });
+}, 'Non-navigation, follow redirect, cors mode Request redirected to ' +
+   'cors with credentials should fail interception ' +
+   'and response should be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-sameorigin-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    expected_type: 'basic',
+    expected_redirected: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'same-origin'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, same-origin mode Request redirected to ' +
+   'same-origin with credentials should succeed interception ' +
+   'and response should be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-sameorigin-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'same-origin'
+    },
+    // should reject because same-origin requests cannot load cross-origin
+    // resources
+    should_reject: true
+  });
+}, 'Non-navigation, follow redirect, same-origin mode Request redirected to ' +
+   'no-cors with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-sameorigin-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'same-origin'
+    },
+    // should reject because same-origin requests cannot load cross-origin
+    // resources
+    should_reject: true
+  });
+}, 'Non-navigation, follow redirect, same-origin mode Request redirected to ' +
+   'cors with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-nocors-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    expected_type: 'basic',
+    expected_redirected: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'no-cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, no-cors mode Request redirected to ' +
+   'same-origin with credentials should succeed interception ' +
+   'and response should be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-nocors-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    expected_type: 'opaque',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'follow',
+      mode: 'no-cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, no-cors mode Request redirected to ' +
+   'no-cors with credentials should succeed interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-nocors-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    expected_type: 'opaque',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'follow',
+      mode: 'no-cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, no-cors mode Request redirected to ' +
+   'cors with credentials should succeed interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-cors-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, cors mode Request redirected to ' +
+   'same-origin without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-cors-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, cors mode Request redirected to ' +
+   'no-cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-cors-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, cors mode Request redirected to ' +
+   'cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-sameorigin-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'same-origin'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, same-origin mode Request redirected to ' +
+   'same-origin without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-sameorigin-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'same-origin'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, same-origin mode Request redirected to ' +
+   'no-cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-sameorigin-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'same-origin'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, same-origin mode Request redirected to ' +
+   'cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-nocors-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'no-cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, no-cors mode Request redirected to ' +
+   'same-origin without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-nocors-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'no-cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, no-cors mode Request redirected to ' +
+   'no-cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-nocors-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'no-cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, no-cors mode Request redirected to ' +
+   'cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-cors-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, cors mode Request redirected to ' +
+   'same-origin with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-cors-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, cors mode Request redirected to ' +
+   'no-cors with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-cors-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, cors mode Request redirected to ' +
+   'cors with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-sameorigin-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'same-origin'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, same-origin mode Request redirected to ' +
+   'same-origin with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-sameorigin-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'same-origin'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, same-origin mode Request redirected to ' +
+   'no-cors with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-sameorigin-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'same-origin'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, same-origin mode Request redirected to ' +
+   'cors with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-nocors-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'no-cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, no-cors mode Request redirected to ' +
+   'same-origin with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-nocors-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'no-cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, no-cors mode Request redirected to ' +
+   'no-cors with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-nocors-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'no-cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, no-cors mode Request redirected to ' +
+   'cors with credentials should fail interception and response should not ' +
+   'be redirected');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-referrer-policy.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-referrer-policy.https.html
new file mode 100644
index 000000000000..af4b20a9a4a7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-referrer-policy.https.html
@@ -0,0 +1,274 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var worker = 'resources/fetch-event-test-worker.js';
+
+function do_test(referrer, value, expected, name)
+{
+    test(() => {
+          assert_equals(value, expected);
+    }, name + (referrer ? " - Custom Referrer" : " - Default Referrer"));
+}
+
+function run_referrer_policy_tests(frame, referrer, href, origin) {
+    return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                     {method: "GET", referrer: referrer})
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + href + '\n' +
+            'ReferrerPolicy: strict-origin-when-cross-origin',
+            'Service Worker should respond to fetch with the referrer URL when a member of RequestInit is present');
+          var http_url = get_host_info()['HTTP_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {method: "GET", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: \n' +
+            'ReferrerPolicy: strict-origin-when-cross-origin',
+            'Service Worker should respond to fetch with no referrer when a member of RequestInit is present with an HTTP request');
+          return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                           {referrerPolicy: "", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + href + '\n' +
+            'ReferrerPolicy: strict-origin-when-cross-origin',
+            'Service Worker should respond to fetch with the referrer with ""');
+          var http_url = get_host_info()['HTTP_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: \n' +
+            'ReferrerPolicy: strict-origin-when-cross-origin',
+            'Service Worker should respond to fetch with no referrer with ""');
+          return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                           {referrerPolicy: "origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + origin + '/' + '\n' +
+            'ReferrerPolicy: origin',
+            'Service Worker should respond to fetch with the referrer origin with "origin" and a same origin request');
+          var http_url = get_host_info()['HTTP_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + origin + '/' + '\n' +
+            'ReferrerPolicy: origin',
+            'Service Worker should respond to fetch with the referrer origin with "origin" and a cross origin request');
+          return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                           {referrerPolicy: "origin-when-cross-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + href + '\n' +
+            'ReferrerPolicy: origin-when-cross-origin',
+            'Service Worker should respond to fetch with the referrer URL with "origin-when-cross-origin" and a same origin request');
+          var http_url = get_host_info()['HTTP_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "origin-when-cross-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + origin + '/' + '\n' +
+            'ReferrerPolicy: origin-when-cross-origin',
+            'Service Worker should respond to fetch with the referrer origin with "origin-when-cross-origin" and a cross origin request');
+          return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                           {referrerPolicy: "no-referrer-when-downgrade", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + href + '\n' +
+            'ReferrerPolicy: no-referrer-when-downgrade',
+            'Service Worker should respond to fetch with no referrer with "no-referrer-when-downgrade" and a same origin request');
+          var http_url = get_host_info()['HTTP_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "no-referrer-when-downgrade", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: \n' +
+            'ReferrerPolicy: no-referrer-when-downgrade',
+            'Service Worker should respond to fetch with no referrer with "no-referrer-when-downgrade" and an HTTP request');
+          var http_url = get_host_info()['HTTP_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url, {referrerPolicy: "unsafe-url", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + href + '\n' +
+            'ReferrerPolicy: unsafe-url',
+            'Service Worker should respond to fetch with no referrer with "unsafe-url"');
+          return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                           {referrerPolicy: "no-referrer", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: \n' +
+            'ReferrerPolicy: no-referrer',
+            'Service Worker should respond to fetch with no referrer URL with "no-referrer"');
+          return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                           {referrerPolicy: "same-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + href + '\n' +
+            'ReferrerPolicy: same-origin',
+            'Service Worker should respond to fetch with referrer URL with "same-origin" and a same origin request');
+          var http_url = get_host_info()['HTTPS_REMOTE_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "same-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: \n' +
+            'ReferrerPolicy: same-origin',
+            'Service Worker should respond to fetch with no referrer with "same-origin" and cross origin request');
+          var http_url = get_host_info()['HTTPS_REMOTE_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "strict-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + origin + '/' + '\n' +
+            'ReferrerPolicy: strict-origin',
+            'Service Worker should respond to fetch with the referrer origin  with "strict-origin" and a HTTPS cross origin request');
+          return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                           {referrerPolicy: "strict-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + origin + '/' + '\n' +
+            'ReferrerPolicy: strict-origin',
+            'Service Worker should respond to fetch with the referrer origin with "strict-origin" and a same origin request');
+          var http_url = get_host_info()['HTTP_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "strict-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: \n' +
+            'ReferrerPolicy: strict-origin',
+            'Service Worker should respond to fetch with no referrer with "strict-origin" and a HTTP request');
+          return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                           {referrerPolicy: "strict-origin-when-cross-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + href + '\n' +
+            'ReferrerPolicy: strict-origin-when-cross-origin',
+            'Service Worker should respond to fetch with the referrer URL with "strict-origin-when-cross-origin" and a same origin request');
+          var http_url = get_host_info()['HTTPS_REMOTE_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "strict-origin-when-cross-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + origin + '/' + '\n' +
+            'ReferrerPolicy: strict-origin-when-cross-origin',
+            'Service Worker should respond to fetch with the referrer origin with "strict-origin-when-cross-origin" and a HTTPS cross origin request');
+          var http_url = get_host_info()['HTTP_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "strict-origin-when-cross-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: \n' +
+            'ReferrerPolicy: strict-origin-when-cross-origin',
+            'Service Worker should respond to fetch with no referrer with "strict-origin-when-cross-origin" and a HTTP request');
+        });
+}
+
+promise_test(function(t) {
+    var scope = 'resources/simple.html?referrerPolicy';
+    var frame;
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          frame = f;
+          test(() => {
+            assert_equals(frame.contentDocument.body.textContent, 'ReferrerPolicy: strict-origin-when-cross-origin');
+          }, 'Service Worker should respond to fetch with the default referrer policy');
+          // First, run the referrer policy tests without passing a referrer in RequestInit.
+          return run_referrer_policy_tests(frame, undefined, frame.contentDocument.location.href,
+                                           frame.contentDocument.location.origin);
+        })
+      .then(function() {
+          // Now, run the referrer policy tests while passing a referrer in RequestInit.
+          var referrer = get_host_info()['HTTPS_ORIGIN'] + base_path() + 'resources/fake-referrer';
+          return run_referrer_policy_tests(frame, 'fake-referrer', referrer,
+                                           frame.contentDocument.location.origin);
+        })
+      .then(function() {
+          frame.remove();
+        });
+  }, 'Service Worker responds to fetch event with the referrer policy');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-argument.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-argument.https.html
new file mode 100644
index 000000000000..05e22105243f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-argument.https.html
@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+<title>Service Worker: FetchEvent.respondWith() argument type test.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var resolve_test_done;
+
+var test_done_promise = new Promise(function(resolve) {
+    resolve_test_done = resolve;
+  });
+
+// Called by the child frame.
+function notify_test_done(result) {
+  resolve_test_done(result);
+}
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-event-respond-with-argument-iframe.html';
+    var script = 'resources/fetch-event-respond-with-argument-worker.js';
+    var frame;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          return test_done_promise;
+        })
+      .then(function(result) {
+          frame.remove();
+          assert_equals(result, 'PASS');
+        });
+  }, 'respondWith() takes either a Response or a promise that resolves ' +
+     'with a Response. Other values should raise a network error.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-body-loaded-in-chunk.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-body-loaded-in-chunk.https.html
new file mode 100644
index 000000000000..932f9030c51c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-body-loaded-in-chunk.https.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>respondWith with a response whose body is being loaded from the network by chunks</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+const WORKER = 'resources/fetch-event-respond-with-body-loaded-in-chunk-worker.js';
+const SCOPE = 'resources/fetch-event-respond-with-body-loaded-in-chunk-iframe.html';
+
+promise_test(async t => {
+    var reg = await service_worker_unregister_and_register(t, WORKER, SCOPE);
+    add_completion_callback(() => reg.unregister());
+    await wait_for_state(t, reg.installing, 'activated');
+    let iframe = await with_iframe(SCOPE);
+    t.add_cleanup(() => iframe.remove());
+
+    let response = await iframe.contentWindow.fetch('body-in-chunk');
+    assert_equals(await response.text(), 'TEST_TRICKLE\nTEST_TRICKLE\nTEST_TRICKLE\nTEST_TRICKLE\n');
+}, 'Respond by chunks with a Response being loaded');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-custom-response.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-custom-response.https.html
new file mode 100644
index 000000000000..645a29c9b4f1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-custom-response.https.html
@@ -0,0 +1,82 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>respondWith with a new Response</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+const WORKER =
+  'resources/fetch-event-respond-with-custom-response-worker.js';
+const SCOPE =
+  'resources/blank.html';
+
+// Register a service worker, then create an iframe at url.
+function iframeTest(url, callback, name) {
+  return promise_test(async t => {
+    const reg = await service_worker_unregister_and_register(t, WORKER, SCOPE);
+    add_completion_callback(() => reg.unregister());
+    await wait_for_state(t, reg.installing, 'activated');
+    const iframe = await with_iframe(url);
+    const iwin = iframe.contentWindow;
+    t.add_cleanup(() => iframe.remove());
+    await callback(t, iwin);
+  }, name);
+}
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?type=string');
+  assert_equals(await response.text(), 'PASS');
+}, 'Subresource built from a string');
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?type=blob');
+  assert_equals(await response.text(), 'PASS');
+}, 'Subresource built from a blob');
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?type=buffer');
+  assert_equals(await response.text(), 'PASS');
+}, 'Subresource built from a buffer');
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?type=buffer-view');
+  assert_equals(await response.text(), 'PASS');
+}, 'Subresource built from a buffer-view');
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?type=form-data');
+  const data = await response.formData();
+  assert_equals(data.get('result'), 'PASS');
+}, 'Subresource built from form-data');
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?type=search-params');
+  assert_equals(await response.text(), 'result=PASS');
+}, 'Subresource built from search-params');
+
+// As above, but navigations
+
+iframeTest(SCOPE + '?type=string', (t, iwin) => {
+  assert_equals(iwin.document.body.textContent, 'PASS');
+}, 'Navigation resource built from a string');
+
+iframeTest(SCOPE + '?type=blob', (t, iwin) => {
+  assert_equals(iwin.document.body.textContent, 'PASS');
+}, 'Navigation resource built from a blob');
+
+iframeTest(SCOPE + '?type=buffer', (t, iwin) => {
+  assert_equals(iwin.document.body.textContent, 'PASS');
+}, 'Navigation resource built from a buffer');
+
+iframeTest(SCOPE + '?type=buffer-view', (t, iwin) => {
+  assert_equals(iwin.document.body.textContent, 'PASS');
+}, 'Navigation resource built from a buffer-view');
+
+// Note: not testing form data for a navigation as the boundary header is lost.
+
+iframeTest(SCOPE + '?type=search-params', (t, iwin) => {
+  assert_equals(iwin.document.body.textContent, 'result=PASS');
+}, 'Navigation resource built from search-params');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-partial-stream.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-partial-stream.https.html
new file mode 100644
index 000000000000..505cef297268
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-partial-stream.https.html
@@ -0,0 +1,62 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>respondWith streams data to an intercepted fetch()</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+const WORKER =
+  'resources/fetch-event-respond-with-partial-stream-worker.js';
+const SCOPE =
+  'resources/fetch-event-respond-with-partial-stream-iframe.html';
+
+promise_test(async t => {
+  let reg = await service_worker_unregister_and_register(t, WORKER, SCOPE)
+  add_completion_callback(() => reg.unregister());
+
+  await wait_for_state(t, reg.installing, 'activated');
+
+  let frame = await with_iframe(SCOPE);
+  t.add_cleanup(_ => frame.remove());
+
+  let response = await frame.contentWindow.fetch('partial-stream.txt');
+
+  let reader = response.body.getReader();
+
+  let encoder = new TextEncoder();
+  let decoder = new TextDecoder();
+
+  let expected = 'partial-stream-content';
+  let encodedExpected = encoder.encode(expected);
+  let received = '';
+  let encodedReceivedLength = 0;
+
+  // Accumulate response data from the service worker.  We do this as a loop
+  // to allow the browser the flexibility of rebuffering if it chooses.  We
+  // do expect to get the partial data within the test timeout period, though.
+  // The spec is a bit vague at the moment about this, but it seems reasonable
+  // that the browser should not stall the response stream when the service
+  // worker has only written a partial result, but not closed the stream.
+  while (encodedReceivedLength < encodedExpected.length) {
+    let chunk = await reader.read();
+    assert_false(chunk.done, 'partial body stream should not be closed yet');
+
+    encodedReceivedLength += chunk.value.length;
+    received += decoder.decode(chunk.value);
+  }
+
+  // Note, the spec may allow some re-buffering between the service worker
+  // and the outer intercepted fetch.  We could relax this exact chunk value
+  // match if necessary.  The goal, though, is to ensure the outer fetch is
+  // not completely blocked until the service worker body is closed.
+  assert_equals(received, expected,
+                'should receive partial content through service worker interception');
+
+  reg.active.postMessage('done');
+
+  await reader.closed;
+
+  }, 'respondWith() streams data to an intercepted fetch()');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-readable-stream-chunk.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-readable-stream-chunk.https.html
new file mode 100644
index 000000000000..4544a9e08f56
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-readable-stream-chunk.https.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>respondWith with a response built from a ReadableStream</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+const WORKER = 'resources/fetch-event-respond-with-readable-stream-chunk-worker.js';
+const SCOPE = 'resources/fetch-event-respond-with-readable-stream-chunk-iframe.html';
+
+promise_test(async t => {
+    var reg = await service_worker_unregister_and_register(t, WORKER, SCOPE);
+    add_completion_callback(() => reg.unregister());
+    await wait_for_state(t, reg.installing, 'activated');
+    let iframe = await with_iframe(SCOPE);
+    t.add_cleanup(() => iframe.remove());
+
+    let response = await iframe.contentWindow.fetch('body-stream');
+    assert_equals(await response.text(), 'chunk #1 chunk #2 chunk #3 chunk #4');
+}, 'Respond by chunks with a Response built from a ReadableStream');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-readable-stream.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-readable-stream.https.html
new file mode 100644
index 000000000000..4651258e6ab2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-readable-stream.https.html
@@ -0,0 +1,88 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>respondWith with a response built from a ReadableStream</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/utils.js"></script>
+<script>
+'use strict';
+
+const WORKER =
+  'resources/fetch-event-respond-with-readable-stream-worker.js';
+const SCOPE =
+  'resources/blank.html';
+
+// Register a service worker, then create an iframe at url.
+function iframeTest(url, callback, name) {
+  return promise_test(async t => {
+    const reg = await service_worker_unregister_and_register(t, WORKER, SCOPE);
+    add_completion_callback(() => reg.unregister());
+    await wait_for_state(t, reg.installing, 'activated');
+    const iframe = await with_iframe(url);
+    const iwin = iframe.contentWindow;
+    t.add_cleanup(() => iframe.remove());
+    await callback(t, iwin);
+  }, name);
+}
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?stream');
+  assert_equals(await response.text(), 'PASS');
+}, 'Subresource built from a ReadableStream');
+
+iframeTest(SCOPE + '?stream', (t, iwin) => {
+  assert_equals(iwin.document.body.textContent, 'PASS');
+}, 'Main resource built from a ReadableStream');
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?stream&delay');
+  assert_equals(await response.text(), 'PASS');
+}, 'Subresource built from a ReadableStream - delayed');
+
+iframeTest(SCOPE + '?stream&delay', (t, iwin) => {
+  assert_equals(iwin.document.body.textContent, 'PASS');
+}, 'Main resource built from a ReadableStream - delayed');
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?stream&use-fetch-stream');
+  assert_equals(await response.text(), 'PASS\n');
+}, 'Subresource built from a ReadableStream - fetch stream');
+
+iframeTest(SCOPE + '?stream&use-fetch-stream', (t, iwin) => {
+  assert_equals(iwin.document.body.textContent, 'PASS\n');
+}, 'Main resource built from a ReadableStream - fetch stream');
+
+for (const enqueue of [true, false]) {
+  const withStream = enqueue ? 'with nonempty stream' : 'with empty stream';
+  iframeTest(SCOPE, async (t, iwin) => {
+    const id = token();
+    let response = await iwin.fetch(`?stream&observe-cancel&id=${id}&enqueue=${enqueue}`);
+    response.body.cancel();
+
+    // Wait for a while to avoid a race between the cancel handling and the
+    // second fetch request.
+    await new Promise(r => step_timeout(r, 10));
+
+    response = await iwin.fetch(`?stream&query-cancel&id=${id}`);
+    assert_equals(await response.text(), 'cancelled');
+  }, `Cancellation in the page should be observable in the service worker ${withStream}`);
+
+  iframeTest(SCOPE, async (t, iwin) => {
+    const id = token();
+    const controller = new AbortController();
+    let response = await iwin.fetch(`?stream&observe-cancel&id=${id}&enqueue=${enqueue}`, {
+      signal: controller.signal
+    });
+    controller.abort();
+
+    // Wait for a while to avoid a race between the cancel handling and the
+    // second fetch request.
+    await new Promise(r => step_timeout(r, 10));
+
+    response = await iwin.fetch(`?stream&query-cancel&id=${id}`);
+    assert_equals(await response.text(), 'cancelled');
+  }, `Abort in the page should be observable in the service worker ${withStream}`);
+}
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-response-body-with-invalid-chunk.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-response-body-with-invalid-chunk.https.html
new file mode 100644
index 000000000000..2a44811461a6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-response-body-with-invalid-chunk.https.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>respondWith with response body having invalid chunks</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+const WORKER =
+  'resources/fetch-event-respond-with-response-body-with-invalid-chunk-worker.js';
+const SCOPE =
+  'resources/fetch-event-respond-with-response-body-with-invalid-chunk-iframe.html';
+
+// Called by the iframe when it has the reader promise we should watch.
+var set_reader_promise;
+let reader_promise = new Promise(resolve => set_reader_promise = resolve);
+
+var set_fetch_promise;
+let fetch_promise = new Promise(resolve => set_fetch_promise = resolve);
+
+// This test creates an controlled iframe that makes a fetch request. The
+// service worker returns a response with a body stream containing an invalid
+// chunk.
+promise_test(async t => {
+    // Start off the process.
+    let errorConstructor;
+    await service_worker_unregister_and_register(t, WORKER, SCOPE)
+      .then(reg => {
+           add_completion_callback(() => reg.unregister());
+           return wait_for_state(t, reg.installing, 'activated');
+         })
+      .then(() => with_iframe(SCOPE))
+      .then(frame => {
+          t.add_cleanup(() => frame.remove())
+          errorConstructor = frame.contentWindow.TypeError;
+        });
+
+    await promise_rejects_js(t, errorConstructor, reader_promise,
+                             "read() should be rejected");
+    // Fetch should complete properly, because the reader error is caught in
+    // the subframe.  That is, there should be no errors _other_ than the
+    // reader!
+    return fetch_promise;
+  }, 'Response with a ReadableStream having non-Uint8Array chunks should be transferred as errored');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-stops-propagation.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-stops-propagation.https.html
new file mode 100644
index 000000000000..31fd616b6d6f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-stops-propagation.https.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var script =
+        'resources/fetch-event-respond-with-stops-propagation-worker.js';
+    var scope = 'resources/simple.html';
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          t.add_cleanup(function() { frame.remove(); });
+          var channel = new MessageChannel();
+          var saw_message = new Promise(function(resolve) {
+              channel.port1.onmessage = function(e) { resolve(e.data); }
+            });
+          var worker = frame.contentWindow.navigator.serviceWorker.controller;
+
+          worker.postMessage({port: channel.port2}, [channel.port2]);
+          return saw_message;
+        })
+      .then(function(message) {
+          assert_equals(message, 'PASS');
+        })
+  }, 'respondWith() invokes stopImmediatePropagation()');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-throws-after-respond-with.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-throws-after-respond-with.https.html
new file mode 100644
index 000000000000..d98fb22ff423
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-throws-after-respond-with.https.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<title></title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-event-throws-after-respond-with-iframe.html';
+    var workerscript = 'resources/respond-then-throw-worker.js';
+    var iframe;
+    return service_worker_unregister_and_register(t, workerscript, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated')
+            .then(() => reg.active);
+        })
+      .then(function(worker) {
+          var channel = new MessageChannel();
+          channel.port1.onmessage = function(e) {
+              assert_equals(e.data, 'SYNC', ' Should receive sync message.');
+              channel.port1.postMessage('ACK');
+            }
+          worker.postMessage({port: channel.port2}, [channel.port2]);
+          // The iframe will only be loaded after the sync is completed.
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+        assert_true(frame.contentDocument.body.innerHTML.includes("intercepted"));
+      })
+  }, 'Fetch event handler throws after a successful respondWith()');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-within-sw-manual.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-within-sw-manual.https.html
new file mode 100644
index 000000000000..15a2e95bd39d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-within-sw-manual.https.html
@@ -0,0 +1,122 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+const worker = 'resources/fetch-event-within-sw-worker.js';
+
+function wait(ms) {
+  return new Promise(r => setTimeout(r, ms));
+}
+
+function reset() {
+  for (const iframe of [...document.querySelectorAll('.test-iframe')]) {
+    iframe.remove();
+  }
+  return navigator.serviceWorker.getRegistrations().then(registrations => {
+    return Promise.all(registrations.map(r => r.unregister()));
+  }).then(() => caches.keys()).then(cacheKeys => {
+    return Promise.all(cacheKeys.map(c => caches.delete(c)));
+  });
+}
+
+add_completion_callback(reset);
+
+function regReady(reg) {
+  return new Promise((resolve, reject) => {
+    if (reg.active) {
+      resolve();
+      return;
+    }
+    const nextWorker = reg.waiting || reg.installing;
+
+    nextWorker.addEventListener('statechange', () => {
+      if (nextWorker.state == 'redundant') {
+        reject(Error(`Service worker failed to install`));
+        return;
+      }
+      if (nextWorker.state == 'activated') {
+        resolve();
+      }
+    });
+  });
+}
+
+function getCookies() {
+  return new Map(
+    document.cookie
+      .split(/;/g)
+      .map(c => c.trim().split('=').map(s => s.trim()))
+  );
+}
+
+function registerSwAndOpenFrame() {
+  return reset().then(() => navigator.serviceWorker.register(worker, {scope: 'resources/'}))
+    .then(reg => regReady(reg))
+    .then(() => with_iframe('resources/simple.html'));
+}
+
+function raceBroadcastAndCookie(channel, cookie) {
+  const initialCookie = getCookies().get(cookie);
+  let done = false;
+
+  return Promise.race([
+    new Promise(resolve => {
+      const bc = new BroadcastChannel(channel);
+      bc.onmessage = () => {
+        bc.close();
+        resolve('broadcast');
+      };
+    }),
+    (function checkCookie() {
+      // Stop polling if the broadcast channel won
+      if (done == true) return;
+      if (getCookies().get(cookie) != initialCookie) return 'cookie';
+
+      return wait(200).then(checkCookie);
+    }())
+  ]).then(val => {
+    done = true;
+    return val;
+  });
+}
+
+promise_test(() => {
+  return Notification.requestPermission().then(permission => {
+    if (permission != "granted") {
+      throw Error('You must allow notifications for this origin before running this test.');
+    }
+    return registerSwAndOpenFrame();
+  }).then(iframe => {
+    return Promise.resolve().then(() => {
+      // In this test, the service worker will ping the 'icon-request' channel
+      // if it intercepts a request for 'notification_icon.py'. If the request
+      // reaches the server it sets the 'notification' cookie to the value given
+      // in the URL. "raceBroadcastAndCookie" monitors both and returns which
+      // happens first.
+      const race = raceBroadcastAndCookie('icon-request', 'notification');
+      const notification = new iframe.contentWindow.Notification('test', {
+        icon: `notification_icon.py?set-cookie-notification=${Math.random()}`
+      });
+      notification.close();
+
+      return race.then(winner => {
+        assert_equals(winner, 'broadcast', 'The service worker intercepted the from-window notification icon request');
+      });
+    }).then(() => {
+      // Similar race to above, but this time the service worker requests the
+      // notification.
+      const race = raceBroadcastAndCookie('icon-request', 'notification');
+      iframe.contentWindow.fetch(`show-notification?set-cookie-notification=${Math.random()}`);
+
+      return race.then(winner => {
+        assert_equals(winner, 'broadcast', 'The service worker intercepted the from-service-worker notification icon request');
+      });
+    })
+  });
+}, `Notification requests intercepted both from window and SW`);
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-within-sw.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-within-sw.https.html
new file mode 100644
index 000000000000..0b52b18305fa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-within-sw.https.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+
+<script>
+const worker = 'resources/fetch-event-within-sw-worker.js';
+
+async function registerSwAndOpenFrame(t) {
+  const registration = await navigator.serviceWorker.register(
+      worker, { scope: 'resources/' });
+  t.add_cleanup(() => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const frame = await with_iframe('resources/simple.html');
+  t.add_cleanup(() => frame.remove());
+  return frame;
+}
+
+async function deleteCaches() {
+  const cacheKeys = await caches.keys();
+  await Promise.all(cacheKeys.map(c => caches.delete(c)));
+}
+
+promise_test(async t => {
+  t.add_cleanup(deleteCaches);
+
+  const iframe = await registerSwAndOpenFrame(t);
+  const fetchText =
+      await iframe.contentWindow.fetch('sample.txt').then(r => r.text());
+
+  const cache = await iframe.contentWindow.caches.open('test');
+  await cache.add('sample.txt');
+
+  const response = await cache.match('sample.txt');
+  const cacheText = await (response ? response.text() : 'cache match failed');
+  assert_equals(fetchText, 'intercepted', 'fetch intercepted');
+  assert_equals(cacheText, 'intercepted', 'cache.add intercepted');
+}, 'Service worker intercepts requests from window');
+
+promise_test(async t => {
+  const iframe = await registerSwAndOpenFrame(t);
+  const [fetchText, cacheText] = await Promise.all([
+    iframe.contentWindow.fetch('sample.txt-inner-fetch').then(r => r.text()),
+    iframe.contentWindow.fetch('sample.txt-inner-cache').then(r => r.text())
+  ]);
+  assert_equals(fetchText, 'Hello world\n', 'fetch within SW not intercepted');
+  assert_equals(cacheText, 'Hello world\n',
+                'cache.add within SW not intercepted');
+}, 'Service worker does not intercept fetch/cache requests within service ' +
+   'worker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event.https.h2.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event.https.h2.html
new file mode 100644
index 000000000000..5cd381ec98db
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event.https.h2.html
@@ -0,0 +1,112 @@
+<!DOCTYPE html>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/common/utils.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+const worker = 'resources/fetch-event-test-worker.js';
+
+const method = 'POST';
+const duplex = 'half';
+
+function createBody(t) {
+  const rs = new ReadableStream({start(c) {
+    c.enqueue('i a');
+    c.enqueue('m the request');
+    step_timeout(t.step_func(() => {
+      c.enqueue(' body');
+      c.close();
+    }, 10));
+  }});
+  return rs.pipeThrough(new TextEncoderStream());
+}
+
+promise_test(async t => {
+  const scope = 'resources/';
+  const registration =
+    await service_worker_unregister_and_register(t, worker, scope);
+  await wait_for_state(t, registration.installing, 'activated');
+
+  // This will happen after all other tests
+  promise_test(t => {
+    return registration.unregister();
+  }, 'restore global state');
+}, 'global setup');
+
+// Test that the service worker can read FetchEvent#body when it is made from
+// a ReadableStream. It responds with request body it read.
+promise_test(async t => {
+  const body = createBody(t);
+  // Set page_url to "?ignore" so the service worker falls back to network
+  // for the main resource request, and add a suffix to avoid colliding
+  // with other tests.
+  const page_url = `resources/simple.html?ignore&id=${token()}`;
+  const frame = await with_iframe(page_url);
+  t.add_cleanup(() => { frame.remove(); });
+  const response = await frame.contentWindow.fetch('simple.html?request-body', {
+    method, body, duplex});
+  assert_equals(response.status, 200, 'status');
+  const text = await response.text();
+  assert_equals(text, 'i am the request body', 'body');
+}, 'The streaming request body is readable in the service worker.');
+
+// Network fallback
+promise_test(async t => {
+  const body = createBody(t);
+  // Set page_url to "?ignore" so the service worker falls back to network
+  // for the main resource request, and add a suffix to avoid colliding
+  // with other tests.
+  const page_url = `resources/simple.html?ignore&id=${token()}`;
+  const frame = await with_iframe(page_url);
+  t.add_cleanup(() => { frame.remove(); });
+  // Add "?ignore" so that the service worker falls back to
+  // echo-content.h2.py.
+  const echo_url = '/fetch/api/resources/echo-content.h2.py?ignore';
+  const response =
+    await frame.contentWindow.fetch(echo_url, { method, body, duplex});
+  assert_equals(response.status, 200, 'status');
+  const text = await response.text();
+  assert_equals(text, 'i am the request body', 'body');
+}, 'Network fallback for streaming upload.');
+
+// When the streaming body is used in the service worker, network fallback
+// fails.
+promise_test(async t => {
+  const body = createBody(t);
+  // Set page_url to "?ignore" so the service worker falls back to network
+  // for the main resource request, and add a suffix to avoid colliding
+  // with other tests.
+  const page_url = `resources/simple.html?ignore&id=${token()}`;
+  const frame = await with_iframe(page_url);
+  t.add_cleanup(() => { frame.remove(); });
+  const echo_url = '/fetch/api/resources/echo-content.h2.py?use-and-ignore';
+  const w = frame.contentWindow;
+  await promise_rejects_js(t, w.TypeError, w.fetch(echo_url, {
+    method, body, duplex}));
+}, 'When the streaming request body is used, network fallback fails.');
+
+// When the streaming body is used by clone() in the service worker, network
+// fallback succeeds.
+promise_test(async t => {
+  const body = createBody(t);
+  // Set page_url to "?ignore" so the service worker falls back to network
+  // for the main resource request, and add a suffix to avoid colliding
+  // with other tests.
+  const page_url = `resources/simple.html?ignore&id=${token()}`;
+  const frame = await with_iframe(page_url);
+  t.add_cleanup(() => { frame.remove(); });
+  // Add "?clone-and-ignore" so that the service worker falls back to
+  // echo-content.h2.py.
+  const echo_url = '/fetch/api/resources/echo-content.h2.py?clone-and-ignore';
+  const response = await frame.contentWindow.fetch(echo_url, {
+    method, body, duplex});
+  assert_equals(response.status, 200, 'status');
+  const text = await response.text();
+  assert_equals(text, 'i am the request body', 'body');
+}, 'Running clone() in the service worker does not prevent network fallback.');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event.https.html
new file mode 100644
index 000000000000..2edb5b0e032a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event.https.html
@@ -0,0 +1,1000 @@
+<!DOCTYPE html>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/common/utils.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var worker = 'resources/fetch-event-test-worker.js';
+function wait(ms) {
+    return new Promise(resolve => step_timeout(resolve, ms));
+}
+
+promise_test(async t => {
+    const scope = 'resources/';
+    const registration =
+        await service_worker_unregister_and_register(t, worker, scope);
+    await wait_for_state(t, registration.installing, 'activated');
+
+    // This will happen after all other tests
+    promise_test(t => {
+        return registration.unregister();
+      }, 'restore global state');
+  }, 'global setup');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?headers';
+    return with_iframe(page_url)
+      .then(function(frame) {
+          t.add_cleanup(() => { frame.remove(); });
+          const headers = JSON.parse(frame.contentDocument.body.textContent);
+          const header_names = {};
+          for (const [name, value] of headers) {
+            header_names[name] = true;
+          }
+
+          assert_true(
+            header_names.hasOwnProperty('accept'),
+            'request includes "Accept" header as inserted by Fetch'
+          );
+        });
+  }, 'Service Worker headers in the request of a fetch event');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?string';
+    return with_iframe(page_url)
+      .then(function(frame) {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'Test string',
+            'Service Worker should respond to fetch with a test string');
+          assert_equals(
+            frame.contentDocument.contentType,
+            'text/plain',
+            'The content type of the response created with a string should be text/plain');
+          assert_equals(
+            frame.contentDocument.characterSet,
+            'UTF-8',
+            'The character set of the response created with a string should be UTF-8');
+        });
+  }, 'Service Worker responds to fetch event with string');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?string';
+    var frame;
+    return with_iframe(page_url)
+      .then(function(f) {
+        frame = f;
+        t.add_cleanup(() => { frame.remove(); });
+        return frame.contentWindow.fetch(page_url + "#foo")
+      })
+      .then(function(response) { return response.text() })
+      .then(function(text) {
+          assert_equals(
+            text,
+            'Test string',
+            'Service Worker should respond to fetch with a test string');
+        });
+  }, 'Service Worker responds to fetch event using request fragment with string');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?blob';
+    return with_iframe(page_url)
+      .then(frame => {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'Test blob',
+            'Service Worker should respond to fetch with a test string');
+        });
+  }, 'Service Worker responds to fetch event with blob body');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?referrer';
+      return with_iframe(page_url)
+      .then(frame => {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'Referrer: ' + document.location.href,
+            'Service Worker should respond to fetch with the referrer URL');
+        });
+  }, 'Service Worker responds to fetch event with the referrer URL');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?clientId';
+    var frame;
+    return with_iframe(page_url)
+      .then(function(f) {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'Client ID Not Found',
+            'Service Worker should respond to fetch with a client id');
+          return frame.contentWindow.fetch('resources/other.html?clientId');
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          assert_equals(
+            response_text.substr(0, 15),
+            'Client ID Found',
+            'Service Worker should respond to fetch with an existing client id');
+        });
+  }, 'Service Worker responds to fetch event with an existing client id');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?resultingClientId';
+    const expected_found = 'Resulting Client ID Found';
+    const expected_not_found = 'Resulting Client ID Not Found';
+    return with_iframe(page_url)
+      .then(function(frame) {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(
+            frame.contentDocument.body.textContent.substr(0, expected_found.length),
+            expected_found,
+            'Service Worker should respond with an existing resulting client id for non-subresource requests');
+          return frame.contentWindow.fetch('resources/other.html?resultingClientId');
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          assert_equals(
+            response_text.substr(0),
+            expected_not_found,
+            'Service Worker should respond with an empty resulting client id for subresource requests');
+        });
+  }, 'Service Worker responds to fetch event with the correct resulting client id');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?ignore';
+    return with_iframe(page_url)
+      .then(function(frame) {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(frame.contentDocument.body.textContent,
+                        'Here\'s a simple html file.\n',
+                        'Response should come from fallback to native fetch');
+        });
+  }, 'Service Worker does not respond to fetch event');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?null';
+    return with_iframe(page_url)
+      .then(function(frame) {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(frame.contentDocument.body.textContent,
+                        '',
+                        'Response should be the empty string');
+        });
+  }, 'Service Worker responds to fetch event with null response body');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?fetch';
+    return with_iframe(page_url)
+      .then(function(frame) {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(frame.contentDocument.body.textContent,
+                        'Here\'s an other html file.\n',
+                        'Response should come from fetched other file');
+        });
+  }, 'Service Worker fetches other file in fetch event');
+
+// Creates a form and an iframe and does a form submission that navigates the
+// frame to |action_url|. Returns the frame after navigation.
+function submit_form(action_url) {
+  return new Promise(resolve => {
+      const frame = document.createElement('iframe');
+      frame.name = 'post-frame';
+      document.body.appendChild(frame);
+      const form = document.createElement('form');
+      form.target = frame.name;
+      form.action = action_url;
+      form.method = 'post';
+      const input1 = document.createElement('input');
+      input1.type = 'text';
+      input1.value = 'testValue1';
+      input1.name = 'testName1'
+      form.appendChild(input1);
+      const input2 = document.createElement('input');
+      input2.type = 'text';
+      input2.value = 'testValue2';
+      input2.name = 'testName2'
+      form.appendChild(input2);
+      document.body.appendChild(form);
+      frame.onload = function() {
+        form.remove();
+        resolve(frame);
+      };
+      form.submit();
+    });
+}
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?form-post';
+    return submit_form(page_url)
+      .then(frame => {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(frame.contentDocument.body.textContent,
+                        'POST:application/x-www-form-urlencoded:' +
+                        'testName1=testValue1&testName2=testValue2');
+        });
+  }, 'Service Worker responds to fetch event with POST form');
+
+promise_test(t => {
+    // Add '?ignore' so the service worker falls back to network.
+    const page_url = 'resources/echo-content.py?ignore';
+    return submit_form(page_url)
+      .then(frame => {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(frame.contentDocument.body.textContent,
+                        'testName1=testValue1&testName2=testValue2');
+        });
+  }, 'Service Worker falls back to network in fetch event with POST form');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?multiple-respond-with';
+    return with_iframe(page_url)
+      .then(frame => {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            '(0)(1)[InvalidStateError](2)[InvalidStateError]',
+            'Multiple calls of respondWith must throw InvalidStateErrors.');
+        });
+  }, 'Multiple calls of respondWith must throw InvalidStateErrors');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?used-check';
+    var first_frame;
+    return with_iframe(page_url)
+      .then(function(frame) {
+          assert_equals(frame.contentDocument.body.textContent,
+                        'Here\'s an other html file.\n',
+                        'Response should come from fetched other file');
+          first_frame = frame;
+          t.add_cleanup(() => { first_frame.remove(); });
+          return with_iframe(page_url);
+        })
+      .then(function(frame) {
+          t.add_cleanup(() => { frame.remove(); });
+          // When we access to the page_url in the second time, the content of the
+          // response is generated inside the ServiceWorker. The body contains
+          // the value of bodyUsed of the first response which is already
+          // consumed by FetchEvent.respondWith method.
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'bodyUsed: true',
+            'event.respondWith must set the used flag.');
+        });
+  }, 'Service Worker event.respondWith must set the used flag');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?fragment-check';
+    var fragment = '#/some/fragment';
+    var first_frame;
+    return with_iframe(page_url + fragment)
+      .then(function(frame) {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'Fragment Found :' + fragment,
+            'Service worker should expose URL fragments in request.');
+        });
+  }, 'Service Worker should expose FetchEvent URL fragments.');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?cache';
+    var frame;
+    var cacheTypes = [
+      undefined, 'default', 'no-store', 'reload', 'no-cache', 'force-cache', 'only-if-cached'
+    ];
+    return with_iframe(page_url)
+      .then(function(f) {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(frame.contentWindow.document.body.textContent, 'default');
+          var tests = cacheTypes.map(function(type) {
+            return new Promise(function(resolve, reject) {
+                var init = {cache: type};
+                if (type === 'only-if-cached') {
+                  // For privacy reasons, for the time being, only-if-cached
+                  // requires the mode to be same-origin.
+                  init.mode = 'same-origin';
+                }
+                return frame.contentWindow.fetch(page_url + '=' + type, init)
+                  .then(function(response) { return response.text(); })
+                  .then(function(response_text) {
+                      var expected = (type === undefined) ? 'default' : type;
+                      assert_equals(response_text, expected,
+                                    'Service Worker should respond to fetch with the correct type');
+                    })
+                  .then(resolve)
+                  .catch(reject);
+              });
+          });
+          return Promise.all(tests);
+        })
+      .then(function() {
+          return new Promise(function(resolve, reject) {
+            frame.addEventListener('load', function onLoad() {
+              frame.removeEventListener('load', onLoad);
+              try {
+                assert_equals(frame.contentWindow.document.body.textContent,
+                              'no-cache');
+                resolve();
+              } catch (e) {
+                reject(e);
+              }
+            });
+            frame.contentWindow.location.reload();
+          });
+        });
+  }, 'Service Worker responds to fetch event with the correct cache types');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?eventsource';
+    var frame;
+
+    function test_eventsource(opts) {
+      return new Promise(function(resolve, reject) {
+        var eventSource = new frame.contentWindow.EventSource(page_url, opts);
+        eventSource.addEventListener('message', function(msg) {
+          eventSource.close();
+          try {
+            var data = JSON.parse(msg.data);
+            assert_equals(data.mode, 'cors',
+                          'EventSource should make CORS requests.');
+            assert_equals(data.cache, 'no-store',
+                          'EventSource should bypass the http cache.');
+            var expectedCredentials = opts.withCredentials ? 'include'
+                                                           : 'same-origin';
+            assert_equals(data.credentials, expectedCredentials,
+                          'EventSource should pass correct credentials mode.');
+            resolve();
+          } catch (e) {
+            reject(e);
+          }
+        });
+        eventSource.addEventListener('error', function(e) {
+          eventSource.close();
+          reject('The EventSource fired an error event.');
+        });
+      });
+    }
+
+    return with_iframe(page_url)
+      .then(function(f) {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          return test_eventsource({ withCredentials: false });
+        })
+      .then(function() {
+          return test_eventsource({ withCredentials: true });
+        });
+  }, 'Service Worker should intercept EventSource');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?integrity';
+    var frame;
+    var integrity_metadata = 'gs0nqru8KbsrIt5YToQqS9fYao4GQJXtcId610g7cCU=';
+
+    return with_iframe(page_url)
+      .then(function(f) {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          // A request has associated integrity metadata (a string).
+          // Unless stated otherwise, it is the empty string.
+          assert_equals(
+            frame.contentDocument.body.textContent, '');
+
+          return frame.contentWindow.fetch(page_url, {'integrity': integrity_metadata});
+        })
+      .then(response => {
+          return response.text();
+        })
+      .then(response_text => {
+          assert_equals(response_text, integrity_metadata, 'integrity');
+        });
+  }, 'Service Worker responds to fetch event with the correct integrity_metadata');
+
+// Test that the service worker can read FetchEvent#body when it is a string.
+// It responds with request body it read.
+promise_test(t => {
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = 'resources/simple.html?ignore-for-request-body-string';
+    let frame;
+
+    return with_iframe(page_url)
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          return frame.contentWindow.fetch('simple.html?request-body', {
+              method: 'POST',
+              body: 'i am the request body'
+            });
+        })
+      .then(response => {
+          return response.text();
+        })
+      .then(response_text => {
+          assert_equals(response_text, 'i am the request body');
+        });
+  }, 'FetchEvent#body is a string');
+
+// Test that the service worker can read FetchEvent#body when it is made from
+// a ReadableStream. It responds with request body it read.
+promise_test(async t => {
+    const rs = new ReadableStream({start(c) {
+      c.enqueue('i a');
+      c.enqueue('m the request');
+      step_timeout(t.step_func(() => {
+        c.enqueue(' body');
+        c.close();
+      }, 10));
+    }});
+
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = `resources/simple.html?ignore&id=${token()}`;
+
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    const res = await frame.contentWindow.fetch('simple.html?request-body', {
+      method: 'POST',
+      body: rs.pipeThrough(new TextEncoderStream()),
+      duplex: 'half',
+    });
+    assert_equals(await res.text(), 'i am the request body');
+  }, 'FetchEvent#body is a ReadableStream');
+
+// Test that the request body is sent to network upon network fallback,
+// for a string body.
+promise_test(t => {
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = 'resources/?ignore-for-request-body-fallback-string';
+    let frame;
+
+    return with_iframe(page_url)
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          // Add "?ignore" so the service worker falls back to echo-content.py.
+          const echo_url = '/fetch/api/resources/echo-content.py?ignore';
+          return frame.contentWindow.fetch(echo_url, {
+              method: 'POST',
+              body: 'i am the request body'
+            });
+        })
+      .then(response => {
+          return response.text();
+        })
+      .then(response_text => {
+          assert_equals(
+              response_text,
+              'i am the request body',
+              'the network fallback request should include the request body');
+        });
+  }, 'FetchEvent#body is a string and is passed to network fallback');
+
+// Test that the request body is sent to network upon network fallback,
+// for a ReadableStream body.
+promise_test(async t => {
+    const rs = new ReadableStream({start(c) {
+      c.enqueue('i a');
+      c.enqueue('m the request');
+      t.step_timeout(t.step_func(() => {
+        c.enqueue(' body');
+        c.close();
+      }, 10));
+    }});
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = 'resources/?ignore-for-request-body-fallback-string';
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    // Add "?ignore" so the service worker falls back to echo-content.py.
+    const echo_url = '/fetch/api/resources/echo-content.py?ignore';
+    const w = frame.contentWindow;
+    await promise_rejects_js(t, w.TypeError,  w.fetch(echo_url, {
+        method: 'POST',
+        body: rs
+    }));
+  }, 'FetchEvent#body is a none Uint8Array ReadableStream and is passed to a service worker');
+
+// Test that the request body is sent to network upon network fallback even when
+// the request body is used in the service worker, for a string body.
+promise_test(async t => {
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = 'resources/?ignore-for-request-body-fallback-string';
+
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    // Add "?use-and-ignore" so the service worker falls back to echo-content.py.
+    const echo_url = '/fetch/api/resources/echo-content.py?use-and-ignore';
+    const response = await frame.contentWindow.fetch(echo_url, {
+        method: 'POST',
+        body: 'i am the request body'
+    });
+    const text = await response.text();
+    assert_equals(
+        text,
+        'i am the request body',
+        'the network fallback request should include the request body');
+  }, 'FetchEvent#body is a string, used and passed to network fallback');
+
+// Test that the request body is sent to network upon network fallback even when
+// the request body is used by clone() in the service worker, for a string body.
+promise_test(async t => {
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = 'resources/?ignore-for-request-body-fallback-string';
+
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    // Add "?clone-and-ignore" so the service worker falls back to
+    // echo-content.py.
+    const echo_url = '/fetch/api/resources/echo-content.py?clone-and-ignore';
+    const response = await frame.contentWindow.fetch(echo_url, {
+        method: 'POST',
+        body: 'i am the request body'
+    });
+    const text = await response.text();
+    assert_equals(
+        text,
+        'i am the request body',
+        'the network fallback request should include the request body');
+  }, 'FetchEvent#body is a string, cloned and passed to network fallback');
+
+// Test that the service worker can read FetchEvent#body when it is a blob.
+// It responds with request body it read.
+promise_test(t => {
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = 'resources/simple.html?ignore-for-request-body-blob';
+    let frame;
+
+    return with_iframe(page_url)
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          const blob = new Blob(['it\'s me the blob', ' ', 'and more blob!']);
+          return frame.contentWindow.fetch('simple.html?request-body', {
+              method: 'POST',
+              body: blob
+            });
+        })
+      .then(response => {
+          return response.text();
+        })
+      .then(response_text => {
+          assert_equals(response_text, 'it\'s me the blob and more blob!');
+        });
+  }, 'FetchEvent#body is a blob');
+
+// Test that the request body is sent to network upon network fallback,
+// for a blob body.
+promise_test(t => {
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = 'resources/simple.html?ignore-for-request-body-fallback-blob';
+    let frame;
+
+    return with_iframe(page_url)
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          const blob = new Blob(['it\'s me the blob', ' ', 'and more blob!']);
+          // Add "?ignore" so the service worker falls back to echo-content.py.
+          const echo_url = '/fetch/api/resources/echo-content.py?ignore';
+          return frame.contentWindow.fetch(echo_url, {
+              method: 'POST',
+              body: blob
+            });
+        })
+      .then(response => {
+          return response.text();
+        })
+      .then(response_text => {
+          assert_equals(
+              response_text,
+              'it\'s me the blob and more blob!',
+              'the network fallback request should include the request body');
+        });
+  }, 'FetchEvent#body is a blob and is passed to network fallback');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?keepalive';
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent, 'false');
+    const response = await frame.contentWindow.fetch(page_url, {keepalive: true});
+    const text = await response.text();
+    assert_equals(text, 'true');
+  }, 'Service Worker responds to fetch event with the correct keepalive value');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isReloadNavigation';
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isReloadNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.location.reload();
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isReloadNavigation = true');
+  }, 'FetchEvent#request.isReloadNavigation is true (location.reload())');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isReloadNavigation';
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isReloadNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(0);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isReloadNavigation = true');
+  }, 'FetchEvent#request.isReloadNavigation is true (history.go(0))');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isReloadNavigation';
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isReloadNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      const form = frame.contentDocument.createElement('form');
+      form.method = 'POST';
+      form.name = 'form';
+      form.action = new Request(page_url).url;
+      frame.contentDocument.body.appendChild(form);
+      form.submit();
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = POST, isReloadNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.location.reload();
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = POST, isReloadNavigation = true');
+  }, 'FetchEvent#request.isReloadNavigation is true (POST + location.reload())');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isReloadNavigation';
+    const anotherUrl = new Request('resources/simple.html?ignore').url;
+    let frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isReloadNavigation = false');
+    // Use step_timeout(0) to ensure the history entry is created for Blink
+    // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = anotherUrl;
+    });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(-1);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isReloadNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(0);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isReloadNavigation = true');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(1);
+    });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+  }, 'FetchEvent#request.isReloadNavigation is true (with history traversal)');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isHistoryNavigation';
+    const anotherUrl = new Request('resources/simple.html?ignore').url;
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+    // Use step_timeout(0) to ensure the history entry is created for Blink
+    // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = anotherUrl;
+    });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(-1);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = true');
+  }, 'FetchEvent#request.isHistoryNavigation is true (with history.go(-1))');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isHistoryNavigation';
+    const anotherUrl = new Request('resources/simple.html?ignore').url;
+    const frame = await with_iframe(anotherUrl);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    // Use step_timeout(0) to ensure the history entry is created for Blink
+    // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = page_url;
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(-1);
+    });
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(1);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = true');
+  }, 'FetchEvent#request.isHistoryNavigation is true (with history.go(1))');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isHistoryNavigation';
+    const anotherUrl = new Request('resources/simple.html?ignore').url;
+    const frame =  await with_iframe(anotherUrl);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    // Use step_timeout(0) to ensure the history entry is created for Blink
+    // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = page_url;
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(-1);
+    });
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(1);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = true');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(0);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+  }, 'FetchEvent#request.isHistoryNavigation is false (with history.go(0))');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isHistoryNavigation';
+    const anotherUrl = new Request('resources/simple.html?ignore').url;
+    const frame = await with_iframe(anotherUrl);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    // Use step_timeout(0) to ensure the history entry is created for Blink
+    // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = page_url;
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(-1);
+    });
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(1);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = true');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.location.reload();
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+  }, 'FetchEvent#request.isHistoryNavigation is false (with location.reload)');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isHistoryNavigation';
+    const anotherUrl = new Request('resources/simple.html?ignore').url;
+    const oneAnotherUrl = new Request('resources/simple.html?ignore2').url;
+
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+    // Use step_timeout(0) to ensure the history entry is created for Blink
+    // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = anotherUrl;
+    });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = oneAnotherUrl;
+    });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(-2);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = true');
+  }, 'FetchEvent#request.isHistoryNavigation is true (with history.go(-2))');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isHistoryNavigation';
+    const anotherUrl = new Request('resources/simple.html?ignore').url;
+    const oneAnotherUrl = new Request('resources/simple.html?ignore2').url;
+    const frame = await with_iframe(anotherUrl);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    // Use step_timeout(0) to ensure the history entry is created for Blink
+    // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = oneAnotherUrl;
+    });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = page_url;
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(-2);
+    });
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(2);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = true');
+  }, 'FetchEvent#request.isHistoryNavigation is true (with history.go(2))');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isHistoryNavigation';
+    const anotherUrl = new Request('resources/simple.html?ignore').url;
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      const form = frame.contentDocument.createElement('form');
+      form.method = 'POST';
+      form.name = 'form';
+      form.action = new Request(page_url).url;
+      frame.contentDocument.body.appendChild(form);
+      form.submit();
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = POST, isHistoryNavigation = false');
+    // Use step_timeout(0) to ensure the history entry is created for Blink
+    // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = anotherUrl;
+    });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(-1);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = POST, isHistoryNavigation = true');
+  }, 'FetchEvent#request.isHistoryNavigation is true (POST + history.go(-1))');
+
+// When service worker responds with a Response, no XHR upload progress
+// events are delivered.
+promise_test(async t => {
+    const page_url = 'resources/simple.html?ignore-for-request-body-string';
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+
+    const xhr = new frame.contentWindow.XMLHttpRequest();
+    xhr.open('POST', 'simple.html?request-body');
+    xhr.upload.addEventListener('progress', t.unreached_func('progress'));
+    xhr.upload.addEventListener('error', t.unreached_func('error'));
+    xhr.upload.addEventListener('abort', t.unreached_func('abort'));
+    xhr.upload.addEventListener('timeout', t.unreached_func('timeout'));
+    xhr.upload.addEventListener('load', t.unreached_func('load'));
+    xhr.upload.addEventListener('loadend', t.unreached_func('loadend'));
+    xhr.send('i am the request body');
+
+    await new Promise((resolve) => xhr.addEventListener('load', resolve));
+  }, 'XHR upload progress events for response coming from SW');
+
+// Upload progress events should be delivered for the network fallback case.
+promise_test(async t => {
+    const page_url = 'resources/simple.html?ignore-for-request-body-string';
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+
+    let progress = false;
+    let load = false;
+    let loadend = false;
+
+    const xhr = new frame.contentWindow.XMLHttpRequest();
+    xhr.open('POST', '/fetch/api/resources/echo-content.py?ignore');
+    xhr.upload.addEventListener('progress', () => progress = true);
+    xhr.upload.addEventListener('error', t.unreached_func('error'));
+    xhr.upload.addEventListener('abort', t.unreached_func('abort'));
+    xhr.upload.addEventListener('timeout', t.unreached_func('timeout'));
+    xhr.upload.addEventListener('load', () => load = true);
+    xhr.upload.addEventListener('loadend', () => loadend = true);
+    xhr.send('i am the request body');
+
+    await new Promise((resolve) => xhr.addEventListener('load', resolve));
+    assert_true(progress, 'progress');
+    assert_true(load, 'load');
+    assert_true(loadend, 'loadend');
+  }, 'XHR upload progress events for network fallback');
+
+promise_test(async t => {
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = 'resources/?ignore-for-request-body-fallback-string';
+
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    // Add "?clone-and-ignore" so the service worker falls back to
+    // echo-content.py.
+    const echo_url = '/fetch/api/resources/echo-content.py?status=421';
+    const response = await frame.contentWindow.fetch(echo_url, {
+        method: 'POST',
+        body: 'text body'
+    });
+    assert_equals(response.status, 421);
+    const text = await response.text();
+    assert_equals(
+        text,
+        'text body. Request was sent 1 times.',
+        'the network fallback request should include the request body');
+  }, 'Fetch with POST with text on sw 421 response should not be retried.');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-frame-resource.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-frame-resource.https.html
new file mode 100644
index 000000000000..0d8e38d8b84c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-frame-resource.https.html
@@ -0,0 +1,238 @@
+<!DOCTYPE html>
+<title>Service Worker: Fetch for the frame loading.</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var worker = 'resources/fetch-rewrite-worker.js';
+var path = base_path() + 'resources/fetch-access-control.py';
+var host_info = get_host_info();
+
+function getLoadedObject(t, win, contentFunc, closeFunc) {
+  return new Promise(function(resolve) {
+      function done(contentString) {
+        var result = null;
+        // fetch-access-control.py returns a string like "report( <json> )".
+        // Eval the returned string with a report functionto get the json
+        // object.
+        try {
+          function report(obj) { result = obj };
+          eval(contentString);
+        } catch(e) {
+          // just resolve null if we get unexpected page content
+        }
+        closeFunc(win);
+        resolve(result);
+      }
+
+      // We can't catch the network error on window. So we use the timer.
+      var timeout = t.step_timeout(function() {
+          // Failure pages are considered cross-origin in some browsers.  This
+          // means you cannot even .resolve() the window because the check for
+          // the .then property will throw.  Instead, treat cross-origin
+          // failure pages as the empty string which will fail to parse as the
+          // expected json result.
+          var content = '';
+          try {
+            content = contentFunc(win);
+          } catch(e) {
+            // use default empty string for cross-domain window
+          }
+          done(content);
+        // TODO(https://github.com/w3c/ServiceWorker/issues/1194): adjust timeout.
+        // 10,000 ms was set when `setTimeout()` was used here, which can be too large.
+        }, 10000);
+
+      win.onload = function() {
+          clearTimeout(timeout);
+          let content = '';
+          try {
+            content = contentFunc(win);
+          } catch(e) {
+            // use default empty string for cross-domain window (see above)
+          }
+          done(content);
+        };
+    });
+}
+
+function getLoadedFrameAsObject(t, frame) {
+  return getLoadedObject(t, frame, function(f) {
+      return f.contentDocument.body.textContent;
+    }, function(f) {
+      f.parentNode.removeChild(f);
+    });
+}
+
+function getLoadedWindowAsObject(t, win) {
+  return getLoadedObject(t, win, function(w) {
+      return w.document.body.textContent
+    }, function(w) {
+      w.close();
+    });
+}
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-frame-resource/frame-basic';
+    var frame;
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() {
+          frame = document.createElement('iframe');
+          frame.src =
+            scope + '?url=' +
+            encodeURIComponent(host_info['HTTPS_ORIGIN'] + path);
+          document.body.appendChild(frame);
+          return getLoadedFrameAsObject(t, frame);
+        })
+      .then(function(result) {
+          assert_equals(
+            result.jsonpResult,
+            'success',
+            'Basic type response could be loaded in the iframe.');
+          frame.remove();
+        });
+  }, 'Basic type response could be loaded in the iframe.');
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-frame-resource/frame-cors';
+    var frame;
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() {
+          frame = document.createElement('iframe');
+          frame.src =
+            scope + '?mode=cors&url=' +
+            encodeURIComponent(host_info['HTTPS_REMOTE_ORIGIN'] + path +
+                               '?ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+                               '&ACACredentials=true');
+          document.body.appendChild(frame);
+          return getLoadedFrameAsObject(t, frame);
+        })
+      .then(function(result) {
+          assert_equals(
+            result.jsonpResult,
+            'success',
+            'CORS type response could be loaded in the iframe.');
+          frame.remove();
+        });
+  }, 'CORS type response could be loaded in the iframe.');
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-frame-resource/frame-opaque';
+    var frame;
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() {
+          frame = document.createElement('iframe');
+          frame.src =
+            scope + '?mode=no-cors&url=' +
+            encodeURIComponent(host_info['HTTPS_REMOTE_ORIGIN'] + path);
+          document.body.appendChild(frame);
+          return getLoadedFrameAsObject(t, frame);
+        })
+      .then(function(result) {
+          assert_equals(
+            result,
+            null,
+            'Opaque type response could not be loaded in the iframe.');
+          frame.remove();
+        });
+  }, 'Opaque type response could not be loaded in the iframe.');
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-frame-resource/window-basic';
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() {
+          var win = window.open(
+            scope + '?url=' +
+            encodeURIComponent(host_info['HTTPS_ORIGIN'] + path));
+          return getLoadedWindowAsObject(t, win);
+        })
+      .then(function(result) {
+          assert_equals(
+            result.jsonpResult,
+            'success',
+            'Basic type response could be loaded in the new window.');
+        });
+  }, 'Basic type response could be loaded in the new window.');
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-frame-resource/window-cors';
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() {
+          var win = window.open(
+            scope + '?mode=cors&url=' +
+            encodeURIComponent(host_info['HTTPS_REMOTE_ORIGIN'] + path +
+                               '?ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+                               '&ACACredentials=true'));
+          return getLoadedWindowAsObject(t, win);
+        })
+      .then(function(result) {
+          assert_equals(
+            result.jsonpResult,
+            'success',
+            'CORS type response could be loaded in the new window.');
+        });
+  }, 'CORS type response could be loaded in the new window.');
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-frame-resource/window-opaque';
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() {
+          var win = window.open(
+            scope + '?mode=no-cors&url=' +
+            encodeURIComponent(host_info['HTTPS_REMOTE_ORIGIN'] + path));
+          return getLoadedWindowAsObject(t, win);
+        })
+      .then(function(result) {
+          assert_equals(
+            result,
+            null,
+            'Opaque type response could not be loaded in the new window.');
+        });
+  }, 'Opaque type response could not be loaded in the new window.');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-header-visibility.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-header-visibility.https.html
new file mode 100644
index 000000000000..1f4813c4f8e6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-header-visibility.https.html
@@ -0,0 +1,54 @@
+<!DOCTYPE html>
+<title>Service Worker: Visibility of headers during fetch.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+  var worker = 'resources/fetch-rewrite-worker.js';
+  var path = base_path() + 'resources/fetch-access-control.py';
+  var host_info = get_host_info();
+  var frame;
+
+  promise_test(function(t) {
+    var scope = 'resources/fetch-header-visibility-iframe.html';
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+        t.add_cleanup(function() {
+            return service_worker_unregister(t, scope);
+          });
+
+        return wait_for_state(t, reg.installing, 'activated');
+      })
+      .then(function() {
+        frame = document.createElement('iframe');
+        frame.src = scope;
+        document.body.appendChild(frame);
+
+        // Resolve a promise when we recieve 2 success messages
+        return new Promise(function(resolve, reject) {
+          var remaining = 4;
+          function onMessage(e) {
+            if (e.data == 'PASS') {
+              remaining--;
+              if (remaining == 0) {
+                resolve();
+              } else {
+                return;
+              }
+            } else {
+              reject(e.data);
+            }
+
+            window.removeEventListener('message', onMessage);
+          }
+          window.addEventListener('message', onMessage);
+        });
+      })
+      .then(function(result) {
+        frame.remove();
+      });
+  }, 'Visibility of defaulted headers during interception');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-mixed-content-to-inscope.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-mixed-content-to-inscope.https.html
new file mode 100644
index 000000000000..0e8fa93b32c0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-mixed-content-to-inscope.https.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<title>Service Worker: Mixed content of fetch()</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<body></body>
+<script>
+async_test(function(t) {
+    var host_info = get_host_info();
+    window.addEventListener('message', t.step_func(on_message), false);
+    with_iframe(
+      host_info['HTTPS_ORIGIN'] + base_path() +
+      'resources/fetch-mixed-content-iframe.html?target=inscope');
+    function on_message(e) {
+      assert_equals(e.data.results, 'finish');
+      t.done();
+    }
+  }, 'Verify Mixed content of fetch() in a Service Worker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-mixed-content-to-outscope.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-mixed-content-to-outscope.https.html
new file mode 100644
index 000000000000..391dc5d2c19a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-mixed-content-to-outscope.https.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<title>Service Worker: Mixed content of fetch()</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<body></body>
+<script>
+async_test(function(t) {
+    var host_info = get_host_info();
+    window.addEventListener('message', t.step_func(on_message), false);
+    with_iframe(
+      host_info['HTTPS_ORIGIN'] + base_path() +
+      'resources/fetch-mixed-content-iframe.html?target=outscope');
+    function on_message(e) {
+      assert_equals(e.data.results, 'finish');
+      t.done();
+    }
+  }, 'Verify Mixed content of fetch() in a Service Worker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-body-cancel-worker.js b/test/fixtures/wpt/service-workers/service-worker/fetch-request-body-cancel-worker.js
new file mode 100644
index 000000000000..0a45a02880f2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-body-cancel-worker.js
@@ -0,0 +1,14 @@
+async function cancelBodyTest(event)
+{
+    await new Promise(resolve => setTimeout(resolve, 100));
+    event.request.body.cancel("service worker cancelled body");
+    await new Promise(resolve => setTimeout(resolve, 100));
+    return new Response("PASS");
+}
+
+self.addEventListener("fetch", (event) => {
+    if (!event.request.url.includes("cancel-body-test"))
+        return;
+
+    event.respondWith(cancelBodyTest(event));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-body-cancel.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-body-cancel.https.html
new file mode 100644
index 000000000000..f06633c78442
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-body-cancel.https.html
@@ -0,0 +1,56 @@
+<html>
+<head>
+<title>Service Worker cancelling a fetch upload stream body</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
+</head>
+<body>
+<script>
+var scope = "resources";
+var activeWorker;
+
+promise_test(async (test) => {
+    var registration = await navigator.serviceWorker.register("fetch-request-body-cancel-worker.js", { scope : scope });
+    activeWorker = registration.active;
+    if (activeWorker)
+        return;
+    activeWorker = registration.installing;
+    return new Promise(resolve => {
+        activeWorker.addEventListener('statechange', () => {
+            if (activeWorker.state === "activated")
+                resolve();
+        });
+    });
+}, "Setup worker");
+
+promise_test(async (test) => {
+    const iframe = await with_iframe("resources/empty.html");
+
+    const cancelPromise = new Promise((resolve, reject) => {
+        test.step_timeout(() => reject("cancel timed out"), 3000);
+        var stream = new ReadableStream({
+            start: controller => {
+                controller.enqueue(new Uint8Array([1, 2, 3]));
+            },
+            cancel: reason => {
+                resolve(reason);
+            }
+        });
+
+        var options = { method: "POST", body: stream, duplex: "half" };
+        test.fetchPromise = iframe.contentWindow.fetch("cancel-body-test", options);
+    });
+    const response = await test.fetchPromise;
+    assert_true(response.ok, "fetch should succeed even though the request stream was cancelled");
+    const text = await response.text();
+    assert_equals(text, "PASS");
+
+    iframe.remove();
+
+    // FIXME: We should be able to validate cancelPromise value.
+    await cancelPromise;
+}, "Service worker cancelling event.request.body should cancel the page's upload stream");
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-base-url.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-base-url.https.html
new file mode 100644
index 000000000000..467a66cee464
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-base-url.https.html
@@ -0,0 +1,87 @@
+<!DOCTYPE html>
+<title>Service Worker: CSS's base URL must be the response URL</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+const SCOPE = 'resources/fetch-request-css-base-url-iframe.html';
+const SCRIPT = 'resources/fetch-request-css-base-url-worker.js';
+let worker;
+
+var signalMessage;
+function getNextMessage() {
+  return new Promise(resolve => { signalMessage = resolve; });
+}
+
+promise_test(async (t) => {
+  const registration = await service_worker_unregister_and_register(
+      t, SCRIPT, SCOPE);
+  worker = registration.installing;
+  await wait_for_state(t, worker, 'activated');
+}, 'global setup');
+
+// Creates a test concerning the base URL of a stylesheet. It loads a
+// stylesheet from a controlled page. The stylesheet makes a subresource
+// request for an image. The service worker messages back the details of the
+// image request in order to test the base URL.
+//
+// The request URL for the stylesheet is under "resources/request-url-path/".
+// The service worker may respond in a way such that the response URL is
+// different to the request URL.
+function base_url_test(params) {
+  promise_test(async (t) => {
+    let frame;
+    t.add_cleanup(() => {
+      if (frame)
+        frame.remove();
+    });
+
+    // Ask the service worker to message this page once it gets the request
+    // for the image.
+    let channel = new MessageChannel();
+    const sawPong = getNextMessage();
+    channel.port1.onmessage = (event) => {
+      signalMessage(event.data);
+    };
+    worker.postMessage({port:channel.port2},[channel.port2]);
+
+    // It sends a pong back immediately. This ping/pong protocol helps deflake
+    // the test for browsers where message/fetch ordering isn't guaranteed.
+    assert_equals('pong', await sawPong);
+
+    // Load the frame which will load the stylesheet that makes the image
+    // request.
+    const sawResult = getNextMessage();
+    frame = await with_iframe(params.framePath);
+    const result = await sawResult;
+
+    // Test the image request.
+    const base = new URL('.', document.location).href;
+    assert_equals(result.url,
+                  base + params.expectImageRequestPath,
+                  'request');
+    assert_equals(result.referrer,
+                  base + params.expectImageRequestReferrer,
+                  'referrer');
+  }, params.description);
+}
+
+const cssFile = 'fetch-request-css-base-url-style.css';
+
+base_url_test({
+  framePath: SCOPE + '?fetch',
+  expectImageRequestPath: 'resources/sample.png',
+  expectImageRequestReferrer: `resources/${cssFile}?fetch`,
+  description: 'base URL when service worker does respondWith(fetch(responseUrl)).'});
+
+base_url_test({
+  framePath: SCOPE + '?newResponse',
+  expectImageRequestPath: 'resources/request-url-path/sample.png',
+  expectImageRequestReferrer: `resources/request-url-path/${cssFile}?newResponse`,
+  description: 'base URL when service worker does respondWith(new Response()).'});
+
+// Cleanup step: this must be the last promise_test.
+promise_test(async (t) => {
+  return service_worker_unregister(t, SCOPE);
+}, 'cleanup global state');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-cross-origin.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-cross-origin.https.html
new file mode 100644
index 000000000000..d9c1c7f5df2c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-cross-origin.https.html
@@ -0,0 +1,81 @@
+<!DOCTYPE html>
+<title>Service Worker: Cross-origin CSS files fetched via SW.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+function getElementColorInFrame(frame, id) {
+  var element = frame.contentDocument.getElementById(id);
+  var style = frame.contentWindow.getComputedStyle(element, '');
+  return style['color'];
+}
+
+promise_test(async t => {
+  var SCOPE =
+      'resources/fetch-request-css-cross-origin';
+  var SCRIPT =
+      'resources/fetch-request-css-cross-origin-worker.js';
+  let registration = await service_worker_unregister_and_register(
+    t, SCRIPT, SCOPE);
+  promise_test(async t => {
+    await registration.unregister();
+  }, 'cleanup global state');
+
+  await wait_for_state(t, registration.installing, 'activated');
+}, 'setup global state');
+
+promise_test(async t => {
+  const EXPECTED_COLOR = 'rgb(0, 0, 255)';
+  const PAGE =
+      'resources/fetch-request-css-cross-origin-mime-check-iframe.html';
+
+  const f = await with_iframe(PAGE);
+  t.add_cleanup(() => {f.remove(); });
+  assert_equals(
+      getElementColorInFrame(f, 'crossOriginCss'),
+      EXPECTED_COLOR,
+      'The color must be overridden by cross origin CSS.');
+  assert_equals(
+      getElementColorInFrame(f, 'crossOriginHtml'),
+      EXPECTED_COLOR,
+      'The color must not be overridden by cross origin non CSS file.');
+  assert_equals(
+      getElementColorInFrame(f, 'sameOriginCss'),
+      EXPECTED_COLOR,
+      'The color must be overridden by same origin CSS.');
+  assert_equals(
+      getElementColorInFrame(f, 'sameOriginHtml'),
+      EXPECTED_COLOR,
+      'The color must be overridden by same origin non CSS file.');
+  assert_equals(
+      getElementColorInFrame(f, 'synthetic'),
+      EXPECTED_COLOR,
+      'The color must be overridden by synthetic CSS.');
+}, 'MIME checking of CSS resources fetched via service worker when Content-Type is not set.');
+
+promise_test(async t => {
+  const PAGE =
+      'resources/fetch-request-css-cross-origin-read-contents.html';
+
+  const f = await with_iframe(PAGE);
+  t.add_cleanup(() => {f.remove(); });
+  assert_throws_dom('SecurityError', f.contentWindow.DOMException, () => {
+    f.contentDocument.styleSheets[0].cssRules[0].cssText;
+  });
+  assert_equals(
+    f.contentDocument.styleSheets[1].cssRules[0].cssText,
+    '#crossOriginCss { color: blue; }',
+    'cross-origin CORS approved response');
+  assert_equals(
+    f.contentDocument.styleSheets[2].cssRules[0].cssText,
+    '#sameOriginCss { color: blue; }',
+    'same-origin response');
+  assert_equals(
+    f.contentDocument.styleSheets[3].cssRules[0].cssText,
+    '#synthetic { color: blue; }',
+    'service worker generated response');
+  }, 'Same-origin policy for access to CSS resources fetched via service worker');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-images.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-images.https.html
new file mode 100644
index 000000000000..586dea26135f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-images.https.html
@@ -0,0 +1,214 @@
+<!DOCTYPE html>
+<title>Service Worker: FetchEvent for css image</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+var SCOPE = 'resources/fetch-request-resources-iframe.https.html';
+var SCRIPT = 'resources/fetch-request-resources-worker.js';
+var host_info = get_host_info();
+var LOCAL_URL =
+  host_info['HTTPS_ORIGIN'] + base_path() + 'resources/sample?test';
+var REMOTE_URL =
+  host_info['HTTPS_REMOTE_ORIGIN'] + base_path() + 'resources/sample?test';
+
+function css_image_test(expected_results, frame, url, type,
+                        expected_mode, expected_credentials) {
+  expected_results[url] = {
+      url: url,
+      mode: expected_mode,
+      credentials: expected_credentials,
+      message: 'CSSImage load (url:' + url + ' type:' + type + ')'
+    };
+  return frame.contentWindow.load_css_image(url, type);
+}
+
+function css_image_set_test(expected_results, frame, url, type,
+                            expected_mode, expected_credentials) {
+  expected_results[url] = {
+      url: url,
+      mode: expected_mode,
+      credentials: expected_credentials,
+      message: 'CSSImageSet load (url:' + url + ' type:' + type + ')'
+    };
+  return frame.contentWindow.load_css_image_set(url, type);
+}
+
+function waitForWorker(worker) {
+  return new Promise(function(resolve) {
+    var channel = new MessageChannel();
+    channel.port1.addEventListener('message', function(msg) {
+      if (msg.data.ready) {
+        resolve(channel);
+      }
+    });
+    channel.port1.start();
+    worker.postMessage({port: channel.port2}, [channel.port2]);
+  });
+}
+
+function create_message_promise(channel, expected_results, worker, scope) {
+  return new Promise(function(resolve) {
+    channel.port1.addEventListener('message', function(msg) {
+      var result = msg.data;
+      if (!expected_results[result.url]) {
+        return;
+      }
+      resolve(result);
+    });
+  }).then(function(result) {
+      var expected = expected_results[result.url];
+      assert_equals(
+          result.mode, expected.mode,
+          'mode of ' + expected.message +  ' must be ' +
+          expected.mode + '.');
+      assert_equals(
+          result.credentials, expected.credentials,
+          'credentials of ' + expected.message +  ' must be ' +
+          expected.credentials + '.');
+      delete expected_results[result.url];
+    });
+}
+
+promise_test(function(t) {
+    var scope = SCOPE + "?img=backgroundImage";
+    var expected_results = {};
+    var worker;
+    var frame;
+    return service_worker_unregister_and_register(t, SCRIPT, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          t.add_cleanup(function() {
+              f.remove();
+            });
+          frame = f;
+          return waitForWorker(worker);
+        })
+      .then(function(channel) {
+          css_image_test(expected_results, frame, LOCAL_URL + Date.now(),
+                         'backgroundImage', 'no-cors', 'include');
+          css_image_test(expected_results, frame, REMOTE_URL + Date.now(),
+                        'backgroundImage', 'no-cors', 'include');
+
+          return Promise.all([
+              create_message_promise(channel, expected_results, worker, scope),
+              create_message_promise(channel, expected_results, worker, scope)
+            ]);
+        });
+  }, 'Verify FetchEvent for css image (backgroundImage).');
+
+promise_test(function(t) {
+    var scope = SCOPE + "?img=shapeOutside";
+    var expected_results = {};
+    var worker;
+    var frame;
+    return service_worker_unregister_and_register(t, SCRIPT, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          t.add_cleanup(function() {
+              f.remove();
+            });
+          frame = f;
+          return waitForWorker(worker);
+        })
+      .then(function(channel) {
+          css_image_test(expected_results, frame, LOCAL_URL + Date.now(),
+                         'shapeOutside', 'cors', 'same-origin');
+          css_image_test(expected_results, frame, REMOTE_URL + Date.now(),
+                         'shapeOutside', 'cors', 'same-origin');
+
+          return Promise.all([
+              create_message_promise(channel, expected_results, worker, scope),
+              create_message_promise(channel, expected_results, worker, scope)
+            ]);
+      });
+  }, 'Verify FetchEvent for css image (shapeOutside).');
+
+promise_test(function(t) {
+    var scope = SCOPE + "?img_set=backgroundImage";
+    var expected_results = {};
+    var worker;
+    var frame;
+    return service_worker_unregister_and_register(t, SCRIPT, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          t.add_cleanup(function() {
+              f.remove();;
+            });
+          frame = f;
+          return waitForWorker(worker);
+        })
+      .then(function(channel) {
+          css_image_set_test(expected_results, frame, LOCAL_URL + Date.now(),
+                            'backgroundImage', 'no-cors', 'include');
+          css_image_set_test(expected_results, frame, REMOTE_URL + Date.now(),
+                            'backgroundImage', 'no-cors', 'include');
+
+          return Promise.all([
+              create_message_promise(channel, expected_results, worker, scope),
+              create_message_promise(channel, expected_results, worker, scope)
+            ]);
+      });
+  }, 'Verify FetchEvent for css image-set (backgroundImage).');
+
+promise_test(function(t) {
+    var scope = SCOPE + "?img_set=shapeOutside";
+    var expected_results = {};
+    var worker;
+    var frame;
+    return service_worker_unregister_and_register(t, SCRIPT, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          t.add_cleanup(function() {
+              f.remove();
+            });
+          frame = f;
+          return waitForWorker(worker);
+        })
+      .then(function(channel) {
+          css_image_set_test(expected_results, frame, LOCAL_URL + Date.now(),
+                             'shapeOutside', 'cors', 'same-origin');
+          css_image_set_test(expected_results, frame, REMOTE_URL + Date.now(),
+                            'shapeOutside', 'cors', 'same-origin');
+
+          return Promise.all([
+              create_message_promise(channel, expected_results, worker, scope),
+              create_message_promise(channel, expected_results, worker, scope)
+            ]);
+        });
+  }, 'Verify FetchEvent for css image-set (shapeOutside).');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-fallback.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-fallback.https.html
new file mode 100644
index 000000000000..a29f31d127bc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-fallback.https.html
@@ -0,0 +1,282 @@
+<!DOCTYPE html>
+<title>Service Worker: the fallback behavior of FetchEvent</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function get_fetched_urls(worker) {
+  return new Promise(function(resolve) {
+      var channel = new MessageChannel();
+      channel.port1.onmessage = function(msg) { resolve(msg); };
+      worker.postMessage({port: channel.port2}, [channel.port2]);
+    });
+}
+
+function check_urls(worker, expected_requests) {
+  return get_fetched_urls(worker)
+    .then(function(msg) {
+        var requests = msg.data.requests;
+        assert_object_equals(requests, expected_requests);
+    });
+}
+
+var path = new URL(".", window.location).pathname;
+var SCOPE = 'resources/fetch-request-fallback-iframe.html';
+var SCRIPT = 'resources/fetch-request-fallback-worker.js';
+var host_info = get_host_info();
+var BASE_URL = host_info['HTTPS_ORIGIN'] +
+               path + 'resources/fetch-access-control.py?';
+var BASE_PNG_URL = BASE_URL + 'PNGIMAGE&';
+var OTHER_BASE_URL = host_info['HTTPS_REMOTE_ORIGIN'] +
+                     path + 'resources/fetch-access-control.py?';
+var OTHER_BASE_PNG_URL = OTHER_BASE_URL + 'PNGIMAGE&';
+var REDIRECT_URL = host_info['HTTPS_ORIGIN'] +
+                   path + 'resources/redirect.py?Redirect=';
+var register;
+
+promise_test(function(t) {
+  var registration;
+  var worker;
+
+  register = service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+    .then(function(r) {
+        registration = r;
+        worker = registration.installing;
+        return wait_for_state(t, worker, 'activated');
+      })
+    .then(function() { return with_iframe(SCOPE); })
+    .then(function(frame) {
+        // This test should not be considered complete until after the service
+        // worker has been unregistered. Currently, `testharness.js` does not
+        // support asynchronous global "tear down" logic, so this must be
+        // expressed using a dedicated `promise_test`. Because the other
+        // sub-tests in this file are declared synchronously, this test will be
+        // the final test executed.
+        promise_test(function(t) {
+            t.add_cleanup(function() {
+                frame.remove();
+              });
+            return registration.unregister();
+          }, 'restore global state');
+
+        return {frame: frame, worker: worker};
+      });
+
+    return register;
+  }, 'initialize global state');
+
+function promise_frame_test(body, desc) {
+  promise_test(function(test) {
+      return register.then(function(result) {
+          return body(test, result.frame, result.worker);
+        });
+    }, desc);
+}
+
+promise_frame_test(function(t, frame, worker) {
+      return check_urls(
+          worker,
+          [{
+            url: host_info['HTTPS_ORIGIN'] + path + SCOPE,
+            mode: 'navigate'
+          }]);
+  }, 'The SW must intercept the request for a main resource.');
+
+promise_frame_test(function(t, frame, worker) {
+    return frame.contentWindow.xhr(BASE_URL)
+      .then(function() {
+          return check_urls(
+              worker,
+              [{ url: BASE_URL, mode: 'cors' }]);
+        });
+  }, 'The SW must intercept the request of same origin XHR.');
+
+promise_frame_test(function(t, frame, worker) {
+    return promise_rejects_js(
+        t,
+        frame.contentWindow.Error,
+        frame.contentWindow.xhr(OTHER_BASE_URL),
+        'SW fallbacked CORS-unsupported other origin XHR should fail.')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{ url: OTHER_BASE_URL, mode: 'cors' }]);
+        });
+  }, 'The SW must intercept the request of CORS-unsupported other origin XHR.');
+
+promise_frame_test(function(t, frame, worker) {
+    return frame.contentWindow.xhr(OTHER_BASE_URL + 'ACAOrigin=*')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{ url: OTHER_BASE_URL + 'ACAOrigin=*', mode: 'cors' }]);
+        })
+  }, 'The SW must intercept the request of CORS-supported other origin XHR.');
+
+promise_frame_test(function(t, frame, worker) {
+    return frame.contentWindow.xhr(
+                  REDIRECT_URL + encodeURIComponent(BASE_URL))
+      .then(function() {
+          return check_urls(
+              worker,
+              [{
+                url: REDIRECT_URL + encodeURIComponent(BASE_URL),
+                mode: 'cors'
+              }]);
+        });
+  }, 'The SW must intercept only the first request of redirected XHR.');
+
+promise_frame_test(function(t, frame, worker) {
+    return promise_rejects_js(
+        t,
+        frame.contentWindow.Error,
+        frame.contentWindow.xhr(
+          REDIRECT_URL + encodeURIComponent(OTHER_BASE_URL)),
+        'SW fallbacked XHR which is redirected to CORS-unsupported ' +
+          'other origin should fail.')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{
+                url: REDIRECT_URL + encodeURIComponent(OTHER_BASE_URL),
+                mode: 'cors'
+              }]);
+        });
+  }, 'The SW must intercept only the first request for XHR which is' +
+     ' redirected to CORS-unsupported other origin.');
+
+promise_frame_test(function(t, frame, worker) {
+  return frame.contentWindow.xhr(
+                  REDIRECT_URL +
+                  encodeURIComponent(OTHER_BASE_URL + 'ACAOrigin=*'))
+      .then(function() {
+          return check_urls(
+              worker,
+              [{
+                url: REDIRECT_URL +
+                     encodeURIComponent(OTHER_BASE_URL + 'ACAOrigin=*'),
+                mode: 'cors'
+              }]);
+        });
+  }, 'The SW must intercept only the first request for XHR which is ' +
+     'redirected to CORS-supported other origin.');
+
+promise_frame_test(function(t, frame, worker) {
+  return frame.contentWindow.load_image(BASE_PNG_URL, '')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{ url: BASE_PNG_URL, mode: 'no-cors' }]);
+        });
+  }, 'The SW must intercept the request for image.');
+
+promise_frame_test(function(t, frame, worker) {
+  return frame.contentWindow.load_image(OTHER_BASE_PNG_URL, '')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{ url: OTHER_BASE_PNG_URL, mode: 'no-cors' }]);
+        });
+  }, 'The SW must intercept the request for other origin image.');
+
+promise_frame_test(function(t, frame, worker) {
+  return promise_rejects_js(
+        t,
+        frame.contentWindow.Error,
+        frame.contentWindow.load_image(OTHER_BASE_PNG_URL, 'anonymous'),
+        'SW fallbacked CORS-unsupported other origin image request ' +
+          'should fail.')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{ url: OTHER_BASE_PNG_URL, mode: 'cors' }]);
+        })
+  }, 'The SW must intercept the request for CORS-unsupported other ' +
+     'origin image.');
+
+promise_frame_test(function(t, frame, worker) {
+  return frame.contentWindow.load_image(
+                  OTHER_BASE_PNG_URL + 'ACAOrigin=*', 'anonymous')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{ url: OTHER_BASE_PNG_URL + 'ACAOrigin=*', mode: 'cors' }]);
+        });
+  }, 'The SW must intercept the request for CORS-supported other ' +
+     'origin image.');
+
+promise_frame_test(function(t, frame, worker) {
+  return frame.contentWindow.load_image(
+                  REDIRECT_URL + encodeURIComponent(BASE_PNG_URL), '')
+      .catch(function() {
+          assert_unreached(
+              'SW fallbacked redirected image request should succeed.');
+        })
+      .then(function() {
+          return check_urls(
+              worker,
+              [{
+                url: REDIRECT_URL + encodeURIComponent(BASE_PNG_URL),
+                mode: 'no-cors'
+              }]);
+        });
+  }, 'The SW must intercept only the first request for redirected ' +
+     'image resource.');
+
+promise_frame_test(function(t, frame, worker) {
+  return frame.contentWindow.load_image(
+                  REDIRECT_URL + encodeURIComponent(OTHER_BASE_PNG_URL), '')
+      .catch(function() {
+          assert_unreached(
+              'SW fallbacked image request which is redirected to ' +
+              'other origin should succeed.');
+        })
+      .then(function() {
+          return check_urls(
+              worker,
+              [{
+                url: REDIRECT_URL + encodeURIComponent(OTHER_BASE_PNG_URL),
+                mode: 'no-cors'
+              }]);
+        })
+  }, 'The SW must intercept only the first request for image ' +
+     'resource which is redirected to other origin.');
+
+promise_frame_test(function(t, frame, worker) {
+  return promise_rejects_js(
+        t,
+        frame.contentWindow.Error,
+        frame.contentWindow.load_image(
+            REDIRECT_URL + encodeURIComponent(OTHER_BASE_PNG_URL),
+            'anonymous'),
+        'SW fallbacked image request which is redirected to ' +
+          'CORS-unsupported other origin should fail.')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{
+                url: REDIRECT_URL + encodeURIComponent(OTHER_BASE_PNG_URL),
+                mode: 'cors'
+              }]);
+        });
+  }, 'The SW must intercept only the first request for image ' +
+     'resource which is redirected to CORS-unsupported other origin.');
+
+promise_frame_test(function(t, frame, worker) {
+    return frame.contentWindow.load_image(
+        REDIRECT_URL +
+          encodeURIComponent(OTHER_BASE_PNG_URL + 'ACAOrigin=*'),
+        'anonymous')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{
+                url: REDIRECT_URL +
+                     encodeURIComponent(OTHER_BASE_PNG_URL + 'ACAOrigin=*'),
+                mode: 'cors'
+              }]);
+        });
+  }, 'The SW must intercept only the first request for image ' +
+     'resource which is redirected to CORS-supported other origin.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-no-freshness-headers.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-no-freshness-headers.https.html
new file mode 100644
index 000000000000..03b7d357610a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-no-freshness-headers.https.html
@@ -0,0 +1,55 @@
+<!DOCTYPE html>
+<title>Service Worker: the headers of FetchEvent shouldn't contain freshness headers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+promise_test(function(t) {
+    var SCOPE = 'resources/fetch-request-no-freshness-headers-iframe.html';
+    var SCRIPT = 'resources/fetch-request-no-freshness-headers-worker.js';
+    var worker;
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, SCOPE);
+            });
+
+          worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(function(frame) {
+          return new Promise(function(resolve) {
+              frame.onload = function() {
+                  resolve(frame);
+                };
+              frame.contentWindow.location.reload();
+            });
+        })
+      .then(function(frame) {
+          return new Promise(function(resolve) {
+              var channel = new MessageChannel();
+              channel.port1.onmessage = t.step_func(function(msg) {
+                  frame.remove();
+                  resolve(msg);
+                });
+              worker.postMessage(
+                {port: channel.port2}, [channel.port2]);
+            });
+        })
+      .then(function(msg) {
+          var freshness_headers = {
+            'if-none-match': true,
+            'if-modified-since': true
+          };
+          msg.data.requests.forEach(function(request) {
+              request.headers.forEach(function(header) {
+                  assert_false(
+                      !!freshness_headers[header[0]],
+                      header[0] + ' header must not be set in the ' +
+                      'FetchEvent\'s request. (url = ' + request.url + ')');
+                });
+            })
+        });
+  }, 'The headers of FetchEvent shouldn\'t contain freshness headers.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-redirect.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-redirect.https.html
new file mode 100644
index 000000000000..5ce015b421fc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-redirect.https.html
@@ -0,0 +1,385 @@
+<!DOCTYPE html>
+<title>Service Worker: FetchEvent for resources</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/common/media.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var test_scope = ""
+function assert_resolves(promise, description) {
+    return promise.then(
+        () => test(() => {}, description + " - " + test_scope),
+        (e) => test(() => { throw e; }, description + " - " + test_scope)
+    );
+}
+
+function assert_rejects(promise, description) {
+    return promise.then(
+        () => test(() => { assert_unreached(); }, description + " - " + test_scope),
+        () => test(() => {}, description + " - " + test_scope)
+    );
+}
+
+function iframe_test(url, timeout_enabled) {
+  return new Promise(function(resolve, reject) {
+      var frame = document.createElement('iframe');
+      frame.src = url;
+      if (timeout_enabled) {
+        // We can't catch the network error on iframe. So we use the timer for
+        // failure detection.
+        var timer = setTimeout(function() {
+            reject(new Error('iframe load timeout'));
+            frame.remove();
+          }, 10000);
+      }
+      frame.onload = function() {
+        if (timeout_enabled)
+          clearTimeout(timer);
+        try {
+          if (frame.contentDocument.body.textContent == 'Hello world\n')
+            resolve();
+          else
+            reject(new Error('content mismatch'));
+        } catch (e) {
+          // Chrome treats iframes that failed to load due to a network error as
+          // having a different origin, so accessing contentDocument throws an
+          // error. Other browsers might have different behavior.
+          reject(new Error(e));
+        }
+        frame.remove();
+      };
+      document.body.appendChild(frame);
+    });
+}
+
+promise_test(function(t) {
+    test_scope = "default";
+
+    var SCOPE = 'resources/fetch-request-redirect-iframe.html';
+    var SCRIPT = 'resources/fetch-rewrite-worker.js';
+    var REDIRECT_URL = base_path() + 'resources/redirect.py?Redirect=';
+    var IMAGE_URL = base_path() + 'resources/square.png';
+    var AUDIO_URL = getAudioURI("/media/sound_5");
+    var XHR_URL = base_path() + 'resources/simple.txt';
+    var HTML_URL = base_path() + 'resources/sample.html';
+
+    var REDIRECT_TO_IMAGE_URL = REDIRECT_URL + encodeURIComponent(IMAGE_URL);
+    var REDIRECT_TO_AUDIO_URL = REDIRECT_URL + encodeURIComponent(AUDIO_URL);
+    var REDIRECT_TO_XHR_URL = REDIRECT_URL + encodeURIComponent(XHR_URL);
+    var REDIRECT_TO_HTML_URL = REDIRECT_URL + encodeURIComponent(HTML_URL);
+
+    var worker;
+    var frame;
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(() => service_worker_unregister(t, SCOPE));
+
+          worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(async function(f) {
+            frame = f;
+            // XMLHttpRequest tests.
+            await assert_resolves(frame.contentWindow.xhr(XHR_URL),
+                            'Normal XHR should succeed.');
+            await assert_resolves(frame.contentWindow.xhr(REDIRECT_TO_XHR_URL),
+                            'Redirected XHR should succeed.');
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&redirect-mode=follow'),
+                'Redirected XHR with Request.redirect=follow should succeed.');
+            await assert_rejects(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&redirect-mode=error'),
+                'Redirected XHR with Request.redirect=error should fail.');
+            await assert_rejects(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&redirect-mode=manual'),
+                'Redirected XHR with Request.redirect=manual should fail.');
+
+            // Image loading tests.
+            await assert_resolves(frame.contentWindow.load_image(IMAGE_URL),
+                            'Normal image resource should be loaded.');
+            await assert_resolves(
+                frame.contentWindow.load_image(REDIRECT_TO_IMAGE_URL),
+                'Redirected image resource should be loaded.');
+            await assert_resolves(
+                frame.contentWindow.load_image(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_IMAGE_URL) +
+                    '&redirect-mode=follow'),
+                'Loading redirected image with Request.redirect=follow should' +
+                ' succeed.');
+            await assert_rejects(
+                frame.contentWindow.load_image(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_IMAGE_URL) +
+                    '&redirect-mode=error'),
+                'Loading redirected image with Request.redirect=error should ' +
+                'fail.');
+            await assert_rejects(
+                frame.contentWindow.load_image(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_IMAGE_URL) +
+                    '&redirect-mode=manual'),
+                'Loading redirected image with Request.redirect=manual should' +
+                ' fail.');
+
+            // Audio loading tests.
+            await assert_resolves(frame.contentWindow.load_audio(AUDIO_URL),
+                            'Normal audio resource should be loaded.');
+            await assert_resolves(
+                frame.contentWindow.load_audio(REDIRECT_TO_AUDIO_URL),
+                'Redirected audio resource should be loaded.');
+            await assert_resolves(
+                frame.contentWindow.load_audio(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_AUDIO_URL) +
+                    '&redirect-mode=follow'),
+                'Loading redirected audio with Request.redirect=follow should' +
+                ' succeed.');
+            await assert_rejects(
+                frame.contentWindow.load_audio(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_AUDIO_URL) +
+                    '&redirect-mode=error'),
+                'Loading redirected audio with Request.redirect=error should ' +
+                'fail.');
+            await assert_rejects(
+                frame.contentWindow.load_audio(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_AUDIO_URL) +
+                    '&redirect-mode=manual'),
+                'Loading redirected audio with Request.redirect=manual should' +
+                ' fail.');
+
+            // Iframe tests.
+            await assert_resolves(iframe_test(HTML_URL),
+                            'Normal iframe loading should succeed.');
+            await assert_resolves(
+                iframe_test(REDIRECT_TO_HTML_URL),
+                'Normal redirected iframe loading should succeed.');
+            await assert_rejects(
+                iframe_test(SCOPE + '?url=' +
+                            encodeURIComponent(REDIRECT_TO_HTML_URL) +
+                            '&redirect-mode=follow',
+                            true /* timeout_enabled */),
+                'Redirected iframe loading with Request.redirect=follow should'+
+                ' fail.');
+            await assert_rejects(
+                iframe_test(SCOPE + '?url=' +
+                            encodeURIComponent(REDIRECT_TO_HTML_URL) +
+                            '&redirect-mode=error',
+                            true /* timeout_enabled */),
+                'Redirected iframe loading with Request.redirect=error should '+
+                'fail.');
+            await assert_resolves(
+                iframe_test(SCOPE + '?url=' +
+                            encodeURIComponent(REDIRECT_TO_HTML_URL) +
+                            '&redirect-mode=manual',
+                            true /* timeout_enabled */),
+                'Redirected iframe loading with Request.redirect=manual should'+
+                ' succeed.');
+        })
+      .then(function() {
+          frame.remove();
+        });
+  }, 'Verify redirect mode of Fetch API and ServiceWorker FetchEvent.');
+
+// test for reponse.redirected
+promise_test(function(t) {
+    test_scope = "redirected";
+
+    var SCOPE = 'resources/fetch-request-redirect-iframe.html';
+    var SCRIPT = 'resources/fetch-rewrite-worker.js';
+    var REDIRECT_URL = base_path() + 'resources/redirect.py?Redirect=';
+    var XHR_URL = base_path() + 'resources/simple.txt';
+    var IMAGE_URL = base_path() + 'resources/square.png';
+
+    var REDIRECT_TO_XHR_URL = REDIRECT_URL + encodeURIComponent(XHR_URL);
+
+    var host_info = get_host_info();
+
+    var CROSS_ORIGIN_URL = host_info['HTTPS_REMOTE_ORIGIN'] + IMAGE_URL;
+
+    var REDIRECT_TO_CROSS_ORIGIN = REDIRECT_URL +
+      encodeURIComponent(CROSS_ORIGIN_URL + '?ACAOrigin=*');
+
+    var worker;
+    var frame;
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(() => service_worker_unregister(t, SCOPE));
+
+          worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(async function(f) {
+          frame = f;
+            // XMLHttpRequest tests.
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(XHR_URL) +
+                    '&expected_redirected=false' +
+                    '&expected_resolves=true'),
+                'Normal XHR should be resolved and response should not be ' +
+                'redirected.');
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&expected_redirected=true' +
+                    '&expected_resolves=true'),
+                'Redirected XHR should be resolved and response should be ' +
+                'redirected.');
+
+            // tests for request's mode = cors
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(XHR_URL) +
+                    '&mode=cors' +
+                    '&expected_redirected=false' +
+                    '&expected_resolves=true'),
+                'Normal XHR should be resolved and response should not be ' +
+                'redirected even with CORS mode.');
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&mode=cors' +
+                    '&redirect-mode=follow' +
+                    '&expected_redirected=true' +
+                    '&expected_resolves=true'),
+                'Redirected XHR should be resolved and response.redirected ' +
+                'should be redirected with CORS mode.');
+
+            // tests for request's mode = no-cors
+            // The response.redirect should be false since we will not add
+            // redirected url list when redirect-mode is not follow.
+            await assert_rejects(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&mode=no-cors' +
+                    '&redirect-mode=manual' +
+                    '&expected_redirected=false' +
+                    '&expected_resolves=false'),
+                'Redirected XHR should be reject and response should be ' +
+                'redirected with NO-CORS mode and redirect-mode=manual.');
+
+            // tests for redirecting to a cors
+            await assert_resolves(
+                frame.contentWindow.load_image(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_CROSS_ORIGIN) +
+                    '&mode=no-cors' +
+                    '&redirect-mode=follow' +
+                    '&expected_redirected=false' +
+                    '&expected_resolves=true'),
+                'Redirected CORS image should be reject and response should ' +
+                'not be redirected with NO-CORS mode.');
+        })
+      .then(function() {
+          frame.remove();
+        });
+  }, 'Verify redirected of Response(Fetch API) and ServiceWorker FetchEvent.');
+
+// test for reponse.redirected after cached
+promise_test(function(t) {
+    test_scope = "cache";
+
+    var SCOPE = 'resources/fetch-request-redirect-iframe.html';
+    var SCRIPT = 'resources/fetch-rewrite-worker.js';
+    var REDIRECT_URL = base_path() + 'resources/redirect.py?Redirect=';
+    var XHR_URL = base_path() + 'resources/simple.txt';
+    var IMAGE_URL = base_path() + 'resources/square.png';
+
+    var REDIRECT_TO_XHR_URL = REDIRECT_URL + encodeURIComponent(XHR_URL);
+
+    var host_info = get_host_info();
+
+    var CROSS_ORIGIN_URL = host_info['HTTPS_REMOTE_ORIGIN'] + IMAGE_URL;
+
+    var REDIRECT_TO_CROSS_ORIGIN = REDIRECT_URL +
+      encodeURIComponent(CROSS_ORIGIN_URL + '?ACAOrigin=*');
+
+    var worker;
+    var frame;
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(() => service_worker_unregister(t, SCOPE));
+
+          worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(async function(f) {
+          frame = f;
+            // XMLHttpRequest tests.
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(XHR_URL) +
+                    '&expected_redirected=false' +
+                    '&expected_resolves=true' +
+                    '&cache'),
+                'Normal XHR should be resolved and response should not be ' +
+                'redirected.');
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&expected_redirected=true' +
+                    '&expected_resolves=true' +
+                    '&cache'),
+                'Redirected XHR should be resolved and response should be ' +
+                'redirected.');
+
+            // tests for request's mode = cors
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(XHR_URL) +
+                    '&mode=cors' +
+                    '&expected_redirected=false' +
+                    '&expected_resolves=true' +
+                    '&cache'),
+                'Normal XHR should be resolved and response should not be ' +
+                'redirected even with CORS mode.');
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&mode=cors' +
+                    '&redirect-mode=follow' +
+                    '&expected_redirected=true' +
+                    '&expected_resolves=true' +
+                    '&cache'),
+                'Redirected XHR should be resolved and response.redirected ' +
+                'should be redirected with CORS mode.');
+
+            // tests for request's mode = no-cors
+            // The response.redirect should be false since we will not add
+            // redirected url list when redirect-mode is not follow.
+            await assert_rejects(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&mode=no-cors' +
+                    '&redirect-mode=manual' +
+                    '&expected_redirected=false' +
+                    '&expected_resolves=false' +
+                    '&cache'),
+                'Redirected XHR should be reject and response should be ' +
+                'redirected with NO-CORS mode and redirect-mode=manual.');
+
+            // tests for redirecting to a cors
+            await assert_resolves(
+                frame.contentWindow.load_image(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_CROSS_ORIGIN) +
+                    '&mode=no-cors' +
+                    '&redirect-mode=follow' +
+                    '&expected_redirected=false' +
+                    '&expected_resolves=true' +
+                    '&cache'),
+                'Redirected CORS image should be reject and response should ' +
+                'not be redirected with NO-CORS mode.');
+        })
+      .then(function() {
+          frame.remove();
+        });
+  }, 'Verify redirected of Response(Fetch API), Cache API and ServiceWorker ' +
+     'FetchEvent.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-resources.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-resources.https.html
new file mode 100644
index 000000000000..9524e6d4749b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-resources.https.html
@@ -0,0 +1,375 @@
+<!DOCTYPE html>
+<title>Service Worker: FetchEvent for resources</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+let url_count = 0;
+const expected_results = {};
+
+function add_promise_to_test(url)
+{
+  const expected = expected_results[url];
+  return new Promise((resolve) => {
+    expected.resolve = resolve;
+  });
+}
+
+function image_test(frame, url, cross_origin, expected_mode,
+                    expected_credentials) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      cross_origin: cross_origin,
+      mode: expected_mode,
+      credentials: expected_credentials,
+      redirect: 'follow',
+      integrity: '',
+      destination: 'image',
+      message: `Image load (url:${actual_url} cross_origin:${cross_origin})`
+    };
+  frame.contentWindow.load_image(actual_url, cross_origin);
+  return add_promise_to_test(actual_url);
+}
+
+function script_test(frame, url, cross_origin, expected_mode,
+                     expected_credentials) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      cross_origin: cross_origin,
+      mode: expected_mode,
+      credentials: expected_credentials,
+      redirect: 'follow',
+      integrity: '',
+      destination: 'script',
+      message: `Script load (url:${actual_url} cross_origin:${cross_origin})`
+    };
+  frame.contentWindow.load_script(actual_url, cross_origin);
+  return add_promise_to_test(actual_url);
+}
+
+function css_test(frame, url, cross_origin, expected_mode,
+                  expected_credentials) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      cross_origin: cross_origin,
+      mode: expected_mode,
+      credentials: expected_credentials,
+      redirect: 'follow',
+      integrity: '',
+      destination: 'style',
+      message: `CSS load (url:${actual_url} cross_origin:${cross_origin})`
+    };
+  frame.contentWindow.load_css(actual_url, cross_origin);
+  return add_promise_to_test(actual_url);
+}
+
+function font_face_test(frame, url, expected_mode, expected_credentials) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      url: actual_url,
+      mode: expected_mode,
+      credentials: expected_credentials,
+      redirect: 'follow',
+      integrity: '',
+      destination: 'font',
+      message: `FontFace load (url: ${actual_url})`
+    };
+  frame.contentWindow.load_font(actual_url);
+  return add_promise_to_test(actual_url);
+}
+
+function script_integrity_test(frame, url, integrity, expected_integrity) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      url: actual_url,
+      mode: 'no-cors',
+      credentials: 'include',
+      redirect: 'follow',
+      integrity: expected_integrity,
+      destination: 'script',
+      message: `Script load (url:${actual_url})`
+    };
+  frame.contentWindow.load_script_with_integrity(actual_url, integrity, /*type=*/null);
+  return add_promise_to_test(actual_url);
+}
+
+function module_script_integrity_test(frame, url, integrity, expected_integrity) {
+  const actual_url = url + "_module";
+  expected_results[actual_url] = {
+      url: actual_url,
+      mode: 'cors',
+      credentials: 'same-origin',
+      redirect: 'follow',
+      integrity: expected_integrity,
+      destination: 'script',
+      message: `Module Script load (url:${actual_url})`
+    };
+  frame.contentWindow.load_script_with_integrity(actual_url, integrity, "module");
+  return add_promise_to_test(actual_url);
+}
+
+function modulepreload_integrity_test(frame, url, integrity, expected_integrity) {
+  const actual_url = url + "_modulepreload";
+  expected_results[actual_url] = {
+      url: actual_url,
+      mode: 'cors',
+      credentials: 'same-origin',
+      redirect: 'follow',
+      integrity: expected_integrity,
+      destination: 'script',
+      message: `Module Script load (url:${actual_url})`
+    };
+  frame.contentWindow.load_modulepreload_with_integrity(actual_url, integrity);
+  return add_promise_to_test(actual_url);
+}
+
+function import_module_integrity_test(frame, url, expected_integrity) {
+  const actual_url = url + "_moduleimport";
+  expected_results[actual_url] = {
+      url: actual_url,
+      mode: 'cors',
+      credentials: 'same-origin',
+      redirect: 'follow',
+      integrity: expected_integrity,
+      destination: 'script',
+      message: `Module Script load (url:${actual_url})`
+    };
+  frame.contentWindow.import_modulescript(actual_url);
+  return add_promise_to_test(actual_url);
+}
+
+function import_dynamic_module_integrity_test(frame, url, expected_integrity) {
+  const actual_url = url + "_moduleimportdynamic";
+  expected_results[actual_url] = {
+      url: actual_url,
+      mode: 'cors',
+      credentials: 'same-origin',
+      redirect: 'follow',
+      integrity: expected_integrity,
+      destination: 'script',
+      message: `Module Script load (url:${actual_url})`
+    };
+  frame.contentWindow.import_dynamic_modulescript(actual_url);
+  return add_promise_to_test(actual_url);
+}
+
+function css_integrity_test(frame, url, integrity, expected_integrity) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      url: actual_url,
+      mode: 'no-cors',
+      credentials: 'include',
+      redirect: 'follow',
+      integrity: expected_integrity,
+      destination: 'style',
+      message: `CSS load (url:${actual_url})`
+    };
+  frame.contentWindow.load_css_with_integrity(actual_url, integrity);
+  return add_promise_to_test(actual_url);
+}
+
+function fetch_test(frame, url, mode, credentials,
+                    expected_mode, expected_credentials) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      mode: expected_mode,
+      credentials: expected_credentials,
+      redirect: 'follow',
+      integrity: '',
+      destination: '',
+      message: `fetch (url:${actual_url} mode:${mode} ` +
+               `credentials:${credentials})`
+    };
+  frame.contentWindow.fetch(
+      new Request(actual_url, {mode: mode, credentials: credentials}));
+  return add_promise_to_test(actual_url);
+}
+
+function audio_test(frame, url, cross_origin,
+                    expected_mode, expected_credentials) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      mode: expected_mode,
+      credentials: expected_credentials,
+      redirect: 'follow',
+      integrity: '',
+      destination: 'audio',
+      message: `Audio load (url:${actual_url} cross_origin:${cross_origin})`
+    };
+  frame.contentWindow.load_audio(actual_url, cross_origin);
+  return add_promise_to_test(actual_url);
+}
+
+
+function video_test(frame, url, cross_origin,
+                    expected_mode, expected_credentials) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      mode: expected_mode,
+      credentials: expected_credentials,
+      redirect: 'follow',
+      integrity: '',
+      destination: 'video',
+      message: `Video load (url:${actual_url} cross_origin:${cross_origin})`
+    };
+  frame.contentWindow.load_video(actual_url, cross_origin);
+  return add_promise_to_test(actual_url);
+}
+
+promise_test(async t => {
+  const SCOPE = 'resources/fetch-request-resources-iframe.https.html';
+  const SCRIPT = 'resources/fetch-request-resources-worker.js';
+  const host_info = get_host_info();
+  const LOCAL_URL =
+      host_info['HTTPS_ORIGIN'] + base_path() + 'resources/sample?test';
+  const REMOTE_URL =
+      host_info['HTTPS_REMOTE_ORIGIN'] + base_path() + 'resources/sample?test';
+
+  const registration =
+      await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+  t.add_cleanup(() => registration.unregister());
+  const worker = registration.installing;
+  await wait_for_state(t, worker, 'activated');
+
+  await new Promise((resolve, reject) => {
+    const channel = new MessageChannel();
+    channel.port1.onmessage = t.step_func(msg => {
+      if (msg.data.ready) {
+        resolve();
+        return;
+      }
+      const result = msg.data;
+      const expected = expected_results[result.url];
+      if (!expected) {
+        return;
+      }
+      test(() => {
+        assert_equals(
+            result.mode, expected.mode,
+            `mode of must be ${expected.mode}.`);
+        assert_equals(
+            result.credentials, expected.credentials,
+            `credentials of ${expected.message} must be ` +
+            `${expected.credentials}.`);
+        assert_equals(
+            result.redirect, expected.redirect,
+            `redirect mode of ${expected.message} must be ` +
+            `${expected.redirect}.`);
+        assert_equals(
+            result.integrity, expected.integrity,
+            `integrity of ${expected.message} must be ` +
+            `${expected.integrity}.`);
+        assert_equals(
+            result.destination, expected.destination,
+            `destination of ${expected.message} must be ` +
+            `${expected.destination}.`);
+      }, expected.message);
+      expected.resolve();
+      delete expected_results[result.url];
+    });
+    worker.postMessage({port: channel.port2}, [channel.port2]);
+  });
+
+  const f = await with_iframe(SCOPE);
+  t.add_cleanup(() => f.remove());
+
+  await image_test(f, LOCAL_URL, '', 'no-cors', 'include');
+  await image_test(f, REMOTE_URL, '', 'no-cors', 'include');
+  await css_test(f, LOCAL_URL, '', 'no-cors', 'include');
+  await css_test(f, REMOTE_URL, '', 'no-cors', 'include');
+
+  await image_test(f, LOCAL_URL, 'anonymous', 'cors', 'same-origin');
+  await image_test(f, LOCAL_URL, 'use-credentials', 'cors', 'include');
+  await image_test(f, REMOTE_URL, '', 'no-cors', 'include');
+  await image_test(f, REMOTE_URL, 'anonymous', 'cors', 'same-origin');
+  await image_test(f, REMOTE_URL, 'use-credentials', 'cors', 'include');
+
+  await script_test(f, LOCAL_URL, '', 'no-cors', 'include');
+  await script_test(f, LOCAL_URL, 'anonymous', 'cors', 'same-origin');
+  await script_test(f, LOCAL_URL, 'use-credentials', 'cors', 'include');
+  await script_test(f, REMOTE_URL, '', 'no-cors', 'include');
+  await script_test(f, REMOTE_URL, 'anonymous', 'cors', 'same-origin');
+  await script_test(f, REMOTE_URL, 'use-credentials', 'cors', 'include');
+
+  await css_test(f, LOCAL_URL, '', 'no-cors', 'include');
+  await css_test(f, LOCAL_URL, 'anonymous', 'cors', 'same-origin');
+  await css_test(f, LOCAL_URL, 'use-credentials', 'cors', 'include');
+  await css_test(f, REMOTE_URL, '', 'no-cors', 'include');
+  await css_test(f, REMOTE_URL, 'anonymous', 'cors', 'same-origin');
+  await css_test(f, REMOTE_URL, 'use-credentials', 'cors', 'include');
+
+  await font_face_test(f, LOCAL_URL, 'cors', 'same-origin');
+  await font_face_test(f, REMOTE_URL, 'cors', 'same-origin');
+
+  await script_integrity_test(f, LOCAL_URL, '     ', '     ');
+  await script_integrity_test(
+      f, LOCAL_URL,
+      'This is not a valid integrity because it has no dashes',
+      'This is not a valid integrity because it has no dashes');
+  await script_integrity_test(f, LOCAL_URL, 'sha256-', 'sha256-');
+  await script_integrity_test(f, LOCAL_URL, 'sha256-foo?123', 'sha256-foo?123');
+  await script_integrity_test(f, LOCAL_URL, 'sha256-foo sha384-abc ',
+                              'sha256-foo sha384-abc ');
+  await script_integrity_test(f, LOCAL_URL, 'sha256-foo sha256-abc',
+                              'sha256-foo sha256-abc');
+  await module_script_integrity_test(f, LOCAL_URL,
+                                     null,
+                                     'sha384-foobar');
+
+  await modulepreload_integrity_test(f, LOCAL_URL,
+                                     null,
+                                     'sha384-foobar');
+
+  await import_module_integrity_test(f, LOCAL_URL,
+                                     'sha384-foobar');
+
+  await import_dynamic_module_integrity_test(f, LOCAL_URL,
+                                     'sha384-foobar');
+
+  await css_integrity_test(f, LOCAL_URL, '     ', '     ');
+  await css_integrity_test(
+      f, LOCAL_URL,
+      'This is not a valid integrity because it has no dashes',
+      'This is not a valid integrity because it has no dashes');
+  await css_integrity_test(f, LOCAL_URL, 'sha256-', 'sha256-');
+  await css_integrity_test(f, LOCAL_URL, 'sha256-foo?123', 'sha256-foo?123');
+  await css_integrity_test(f, LOCAL_URL, 'sha256-foo sha384-abc ',
+                           'sha256-foo sha384-abc ');
+  await css_integrity_test(f, LOCAL_URL, 'sha256-foo sha256-abc',
+                           'sha256-foo sha256-abc');
+
+  await fetch_test(f, LOCAL_URL, 'same-origin', 'omit', 'same-origin', 'omit');
+  await fetch_test(f, LOCAL_URL, 'same-origin', 'same-origin',
+                   'same-origin', 'same-origin');
+  await fetch_test(f, LOCAL_URL, 'same-origin', 'include',
+                   'same-origin', 'include');
+  await fetch_test(f, LOCAL_URL, 'no-cors', 'omit', 'no-cors', 'omit');
+  await fetch_test(f, LOCAL_URL, 'no-cors', 'same-origin',
+                   'no-cors', 'same-origin');
+  await fetch_test(f, LOCAL_URL, 'no-cors', 'include', 'no-cors', 'include');
+  await fetch_test(f, LOCAL_URL, 'cors', 'omit', 'cors', 'omit');
+  await fetch_test(f, LOCAL_URL, 'cors', 'same-origin', 'cors', 'same-origin');
+  await fetch_test(f, LOCAL_URL, 'cors', 'include', 'cors', 'include');
+  await fetch_test(f, REMOTE_URL, 'no-cors', 'omit', 'no-cors', 'omit');
+  await fetch_test(f, REMOTE_URL, 'no-cors', 'same-origin', 'no-cors', 'same-origin');
+  await fetch_test(f, REMOTE_URL, 'no-cors', 'include', 'no-cors', 'include');
+  await fetch_test(f, REMOTE_URL, 'cors', 'omit', 'cors', 'omit');
+  await fetch_test(f, REMOTE_URL, 'cors', 'same-origin', 'cors', 'same-origin');
+  await fetch_test(f, REMOTE_URL, 'cors', 'include', 'cors', 'include');
+
+  await audio_test(f, LOCAL_URL, '', 'no-cors', 'include');
+  await audio_test(f, LOCAL_URL, 'anonymous', 'cors', 'same-origin');
+  await audio_test(f, LOCAL_URL, 'use-credentials', 'cors', 'include');
+  await audio_test(f, REMOTE_URL, '', 'no-cors', 'include');
+  await audio_test(f, REMOTE_URL, 'anonymous', 'cors', 'same-origin');
+  await audio_test(f, REMOTE_URL, 'use-credentials', 'cors', 'include');
+
+  await video_test(f, LOCAL_URL, '', 'no-cors', 'include');
+  await video_test(f, LOCAL_URL, 'anonymous', 'cors', 'same-origin');
+  await video_test(f, LOCAL_URL, 'use-credentials', 'cors', 'include');
+  await video_test(f, REMOTE_URL, '', 'no-cors', 'include');
+  await video_test(f, REMOTE_URL, 'anonymous', 'cors', 'same-origin');
+  await video_test(f, REMOTE_URL, 'use-credentials', 'cors', 'include');
+}, 'Verify FetchEvent for resources.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync-error.https.window.js b/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync-error.https.window.js
new file mode 100644
index 000000000000..e6c021392866
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync-error.https.window.js
@@ -0,0 +1,19 @@
+// META: script=resources/test-helpers.sub.js
+
+"use strict";
+
+promise_test(async t => {
+  const url = "resources/fetch-request-xhr-sync-error-worker.js";
+  const scope = "resources/fetch-request-xhr-sync-iframe.html";
+
+  const registration = await service_worker_unregister_and_register(t, url, scope);
+  t.add_cleanup(() => registration.unregister());
+
+  await wait_for_state(t, registration.installing, 'activated');
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+
+  assert_throws_dom("NetworkError", frame.contentWindow.DOMException, () => frame.contentWindow.performSyncXHR("non-existent-stream-1.txt"));
+  assert_throws_dom("NetworkError", frame.contentWindow.DOMException, () => frame.contentWindow.performSyncXHR("non-existent-stream-2.txt"));
+  assert_throws_dom("NetworkError", frame.contentWindow.DOMException, () => frame.contentWindow.performSyncXHR("non-existent-stream-3.txt"));
+}, "Verify synchronous XMLHttpRequest always throws a NetworkError for ReadableStream errors");
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync-on-worker.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync-on-worker.https.html
new file mode 100644
index 000000000000..9f18096aa29b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync-on-worker.https.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<title>Service Worker: Synchronous XHR on Worker is intercepted</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+promise_test((t) => {
+    const url = 'resources/fetch-request-xhr-sync-on-worker-worker.js';
+    const scope = 'resources/fetch-request-xhr-sync-on-worker-scope/';
+    const non_existent_file = 'non-existent-file.txt';
+
+    // In Chromium, the service worker scope matching for workers is based on
+    // the URL of the parent HTML. So this test creates an iframe which is
+    // controlled by the service worker first, and creates a worker from the
+    // iframe.
+    return service_worker_unregister_and_register(t, url, scope)
+      .then((registration) => {
+          t.add_cleanup(() => registration.unregister());
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(() => { return with_iframe(scope + 'iframe_page'); })
+      .then((frame) => {
+          t.add_cleanup(() => frame.remove());
+          return frame.contentWindow.performSyncXHROnWorker(non_existent_file);
+        })
+      .then((result) => {
+          assert_equals(
+              result.status,
+              200,
+              'HTTP response status code for intercepted request'
+            );
+          assert_equals(
+            result.responseText,
+              'Response from service worker',
+              'HTTP response text for intercepted request'
+            );
+        });
+  }, 'Verify SyncXHR on Worker is intercepted');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync.https.html
new file mode 100644
index 000000000000..ec27fb898343
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync.https.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<title>Service Worker: Synchronous XHR is intercepted</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+promise_test(function(t) {
+    var url = 'resources/fetch-request-xhr-sync-worker.js';
+    var scope = 'resources/fetch-request-xhr-sync-iframe.html';
+    var non_existent_file = 'non-existent-file.txt';
+
+    return service_worker_unregister_and_register(t, url, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return registration.unregister();
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(frame) {
+          t.add_cleanup(function() {
+              frame.remove();
+            });
+
+          return new Promise(function(resolve, reject) {
+              t.step_timeout(function() {
+                  var xhr;
+                  try {
+                    xhr = frame.contentWindow.performSyncXHR(non_existent_file);
+                    resolve(xhr);
+                  } catch (err) {
+                    reject(err);
+                  }
+                }, 0);
+            })
+        })
+      .then(function(xhr) {
+          assert_equals(
+              xhr.status,
+              200,
+              'HTTP response status code for intercepted request'
+            );
+          assert_equals(
+              xhr.responseText,
+              'Response from service worker',
+              'HTTP response text for intercepted request'
+            );
+        });
+  }, 'Verify SyncXHR is intercepted');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr.https.html
new file mode 100644
index 000000000000..37a457393b05
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr.https.html
@@ -0,0 +1,75 @@
+<!DOCTYPE html>
+<title>Service Worker: the body of FetchEvent using XMLHttpRequest</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe-sub"></script>
+<script>
+let frame;
+
+// Set up the service worker and the frame.
+promise_test(t => {
+    const kScope = 'resources/fetch-request-xhr-iframe.https.html';
+    const kScript = 'resources/fetch-request-xhr-worker.js';
+    return service_worker_unregister_and_register(t, kScript, kScope)
+      .then(registration => {
+          promise_test(() => {
+              return registration.unregister();
+            }, 'restore global state');
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(() => {
+          return with_iframe(kScope);
+        })
+      .then(f => {
+          frame = f;
+          add_completion_callback(() => { f.remove(); });
+        });
+  }, 'initialize global state');
+
+// Run the tests.
+promise_test(t => {
+    return frame.contentWindow.get_header_test();
+  }, 'event.request has the expected headers for same-origin GET.');
+
+promise_test(t => {
+    return frame.contentWindow.post_header_test();
+  }, 'event.request has the expected headers for same-origin POST.');
+
+promise_test(t => {
+    return frame.contentWindow.cross_origin_get_header_test();
+  }, 'event.request has the expected headers for cross-origin GET.');
+
+promise_test(t => {
+    return frame.contentWindow.cross_origin_post_header_test();
+  }, 'event.request has the expected headers for cross-origin POST.');
+
+promise_test(t => {
+    return frame.contentWindow.string_test();
+  }, 'FetchEvent#request.body contains XHR request data (string)');
+
+promise_test(t => {
+    return frame.contentWindow.blob_test();
+  }, 'FetchEvent#request.body contains XHR request data (blob)');
+
+promise_test(t => {
+    return frame.contentWindow.custom_method_test();
+  }, 'FetchEvent#request.method is set to XHR method');
+
+promise_test(t => {
+    return frame.contentWindow.options_method_test();
+  }, 'XHR using OPTIONS method');
+
+promise_test(t => {
+    return frame.contentWindow.form_data_test();
+  }, 'XHR with form data');
+
+promise_test(t => {
+    return frame.contentWindow.mode_credentials_test();
+  }, 'XHR with mode/credentials set');
+
+promise_test(t => {
+    return frame.contentWindow.data_url_test();
+  }, 'XHR to data URL');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-response-taint.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-response-taint.https.html
new file mode 100644
index 000000000000..8e190f48506c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-response-taint.https.html
@@ -0,0 +1,223 @@
+<!DOCTYPE html>
+<title>Service Worker: Tainting of responses fetched via SW.</title>
+<!-- This test makes a large number of requests sequentially. -->
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var host_info = get_host_info();
+var BASE_ORIGIN = host_info.HTTPS_ORIGIN;
+var OTHER_ORIGIN = host_info.HTTPS_REMOTE_ORIGIN;
+var BASE_URL = BASE_ORIGIN + base_path() +
+               'resources/fetch-access-control.py?';
+var OTHER_BASE_URL = OTHER_ORIGIN + base_path() +
+                     'resources/fetch-access-control.py?';
+
+function frame_fetch(frame, url, mode, credentials) {
+  var foreignPromise = frame.contentWindow.fetch(
+      new Request(url, {mode: mode, credentials: credentials}))
+
+  // Event loops should be shared between contexts of similar origin, not all
+  // browsers adhere to this expectation at the time of this writing. Incorrect
+  // behavior in this regard can interfere with test execution when the
+  // provided iframe is removed from the document.
+  //
+  // WPT maintains a test dedicated the expected treatment of event loops, so
+  // the following workaround is acceptable in this context.
+  return Promise.resolve(foreignPromise);
+}
+
+var login_and_register;
+promise_test(function(t) {
+    var SCOPE = 'resources/fetch-response-taint-iframe.html';
+    var SCRIPT = 'resources/fetch-rewrite-worker.js';
+    var registration;
+
+    login_and_register = login_https(t, host_info.HTTPS_ORIGIN, host_info.HTTPS_REMOTE_ORIGIN)
+      .then(function() {
+          return service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+        })
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(function(f) {
+          // This test should not be considered complete until after the
+          // service worker has been unregistered. Currently, `testharness.js`
+          // does not support asynchronous global "tear down" logic, so this
+          // must be expressed using a dedicated `promise_test`. Because the
+          // other sub-tests in this file are declared synchronously, this
+          // test will be the final test executed.
+          promise_test(function(t) {
+              f.remove();
+              return registration.unregister();
+            }, 'restore global state');
+
+          return f;
+        });
+    return login_and_register;
+  }, 'initialize global state');
+
+function ng_test(url, mode, credentials) {
+  promise_test(function(t) {
+      return login_and_register
+        .then(function(frame) {
+            var fetchRequest = frame_fetch(frame, url, mode, credentials);
+            return promise_rejects_js(t, frame.contentWindow.TypeError, fetchRequest);
+          });
+    }, 'url:\"' + url + '\" mode:\"' + mode +
+       '\" credentials:\"' + credentials + '\" should fail.');
+}
+
+function ok_test(url, mode, credentials, expected_type, expected_username) {
+  promise_test(function() {
+      return login_and_register.then(function(frame) {
+            return frame_fetch(frame, url, mode, credentials)
+          })
+        .then(function(res) {
+            assert_equals(res.type, expected_type, 'response type');
+            return res.text();
+          })
+        .then(function(text) {
+            if (expected_type == 'opaque') {
+              assert_equals(text, '');
+            } else {
+              return new Promise(function(resolve) {
+                    var report = resolve;
+                    // text must contain report() call.
+                    eval(text);
+                  })
+                .then(function(result) {
+                    assert_equals(result.username, expected_username);
+                  });
+            }
+          });
+    }, 'fetching url:\"' + url + '\" mode:\"' + mode +
+                        '\" credentials:\"' + credentials + '\" should ' +
+                        'succeed.');
+}
+
+function build_rewrite_url(origin, url, mode, credentials) {
+  return origin + '/?url=' + encodeURIComponent(url) + '&mode=' + mode +
+      '&credentials=' + credentials + '&';
+}
+
+function for_each_origin_mode_credentials(callback) {
+  [BASE_ORIGIN, OTHER_ORIGIN].forEach(function(origin) {
+      ['same-origin', 'no-cors', 'cors'].forEach(function(mode) {
+          ['omit', 'same-origin', 'include'].forEach(function(credentials) {
+              callback(origin, mode, credentials);
+            });
+        });
+    });
+}
+
+ok_test(BASE_URL, 'same-origin', 'omit', 'basic', 'undefined');
+ok_test(BASE_URL, 'same-origin', 'same-origin', 'basic', 'username2s');
+ok_test(BASE_URL, 'same-origin', 'include', 'basic', 'username2s');
+ok_test(BASE_URL, 'no-cors', 'omit', 'basic', 'undefined');
+ok_test(BASE_URL, 'no-cors', 'same-origin', 'basic', 'username2s');
+ok_test(BASE_URL, 'no-cors', 'include', 'basic', 'username2s');
+ok_test(BASE_URL, 'cors', 'omit', 'basic', 'undefined');
+ok_test(BASE_URL, 'cors', 'same-origin', 'basic', 'username2s');
+ok_test(BASE_URL, 'cors', 'include', 'basic', 'username2s');
+ng_test(OTHER_BASE_URL, 'same-origin', 'omit');
+ng_test(OTHER_BASE_URL, 'same-origin', 'same-origin');
+ng_test(OTHER_BASE_URL, 'same-origin', 'include');
+ok_test(OTHER_BASE_URL, 'no-cors', 'omit', 'opaque');
+ok_test(OTHER_BASE_URL, 'no-cors', 'same-origin', 'opaque');
+ok_test(OTHER_BASE_URL, 'no-cors', 'include', 'opaque');
+ng_test(OTHER_BASE_URL, 'cors', 'omit');
+ng_test(OTHER_BASE_URL, 'cors', 'same-origin');
+ng_test(OTHER_BASE_URL, 'cors', 'include');
+ok_test(OTHER_BASE_URL + 'ACAOrigin=*', 'cors', 'omit', 'cors', 'undefined');
+ok_test(OTHER_BASE_URL + 'ACAOrigin=*', 'cors', 'same-origin', 'cors',
+        'undefined');
+ng_test(OTHER_BASE_URL + 'ACAOrigin=*', 'cors', 'include');
+ok_test(OTHER_BASE_URL + 'ACAOrigin=' + BASE_ORIGIN + '&ACACredentials=true',
+        'cors', 'include', 'cors', 'username1s')
+
+for_each_origin_mode_credentials(function(origin, mode, credentials) {
+  var url = build_rewrite_url(
+      origin, BASE_URL, 'same-origin', 'omit');
+  // Fetch to the other origin with same-origin mode should fail.
+  if (origin == OTHER_ORIGIN && mode == 'same-origin') {
+    ng_test(url, mode, credentials);
+  } else {
+    // The response type from the SW should be basic
+    ok_test(url, mode, credentials, 'basic', 'undefined');
+  }
+});
+
+for_each_origin_mode_credentials(function(origin, mode, credentials) {
+  var url = build_rewrite_url(
+      origin, BASE_URL, 'same-origin', 'same-origin');
+
+  // Fetch to the other origin with same-origin mode should fail.
+  if (origin == OTHER_ORIGIN && mode == 'same-origin') {
+    ng_test(url, mode, credentials);
+  } else {
+    // The response type from the SW should be basic.
+    ok_test(url, mode, credentials, 'basic', 'username2s');
+  }
+});
+
+for_each_origin_mode_credentials(function(origin, mode, credentials) {
+  var url = build_rewrite_url(
+      origin, OTHER_BASE_URL, 'same-origin', 'omit');
+  // The response from the SW should be an error.
+  ng_test(url, mode, credentials);
+});
+
+for_each_origin_mode_credentials(function(origin, mode, credentials) {
+  var url = build_rewrite_url(
+      origin, OTHER_BASE_URL, 'no-cors', 'omit');
+
+  // SW can respond only to no-cors requests.
+  if (mode != 'no-cors') {
+    ng_test(url, mode, credentials);
+  } else {
+    // The response type from the SW should be opaque.
+    ok_test(url, mode, credentials, 'opaque');
+  }
+});
+
+for_each_origin_mode_credentials(function(origin, mode, credentials) {
+  var url = build_rewrite_url(
+      origin, OTHER_BASE_URL + 'ACAOrigin=*', 'cors', 'omit');
+
+  // Fetch to the other origin with same-origin mode should fail.
+  if (origin == OTHER_ORIGIN && mode == 'same-origin') {
+    ng_test(url, mode, credentials);
+  } else if (origin == BASE_ORIGIN && mode == 'same-origin') {
+    // Cors type response to a same-origin mode request should fail
+    ng_test(url, mode, credentials);
+  } else {
+    // The response from the SW should be cors.
+    ok_test(url, mode, credentials, 'cors', 'undefined');
+  }
+});
+
+for_each_origin_mode_credentials(function(origin, mode, credentials) {
+  var url = build_rewrite_url(
+      origin,
+      OTHER_BASE_URL + 'ACAOrigin=' + BASE_ORIGIN +
+      '&ACACredentials=true',
+      'cors', 'include');
+  // Fetch to the other origin with same-origin mode should fail.
+  if (origin == OTHER_ORIGIN && mode == 'same-origin') {
+    ng_test(url, mode, credentials);
+  } else if (origin == BASE_ORIGIN && mode == 'same-origin') {
+    // Cors type response to a same-origin mode request should fail
+    ng_test(url, mode, credentials);
+  } else {
+    // The response from the SW should be cors.
+    ok_test(url, mode, credentials, 'cors', 'username1s');
+  }
+});
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-response-xhr.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-response-xhr.https.html
new file mode 100644
index 000000000000..891eb029422b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-response-xhr.https.html
@@ -0,0 +1,50 @@
+<!DOCTYPE html>
+<title>Service Worker: the response of FetchEvent using XMLHttpRequest</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var SCOPE = 'resources/fetch-response-xhr-iframe.https.html';
+    var SCRIPT = 'resources/fetch-response-xhr-worker.js';
+    var host_info = get_host_info();
+
+    window.addEventListener('message', t.step_func(on_message), false);
+    function on_message(e) {
+      assert_equals(e.data.results, 'foo, bar');
+      e.source.postMessage('ACK', host_info['HTTPS_ORIGIN']);
+    }
+
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, SCOPE);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(function(frame) {
+          var channel;
+
+          t.add_cleanup(function() {
+              frame.remove();
+            });
+
+          channel = new MessageChannel();
+          var onPortMsg = new Promise(function(resolve) {
+              channel.port1.onmessage = resolve;
+            });
+
+          frame.contentWindow.postMessage('START',
+                                          host_info['HTTPS_ORIGIN'],
+                                          [channel.port2]);
+
+          return onPortMsg;
+        })
+      .then(function(e) {
+          assert_equals(e.data.results, 'finish');
+        });
+  }, 'Verify the response of FetchEvent using XMLHttpRequest');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-waits-for-activate.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-waits-for-activate.https.html
new file mode 100644
index 000000000000..7c888450f0d5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-waits-for-activate.https.html
@@ -0,0 +1,128 @@
+<!DOCTYPE html>
+<title>Service Worker: Fetch Event Waits for Activate Event</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+const worker_url = 'resources/fetch-waits-for-activate-worker.js';
+const normalized_worker_url = normalizeURL(worker_url);
+const worker_scope = 'resources/fetch-waits-for-activate/';
+
+// Resolves with the Service Worker's registration once it's reached the
+// "activating" state. (The Service Worker should remain "activating" until
+// explicitly told advance to the "activated" state).
+async function registerAndWaitForActivating(t) {
+  const registration = await service_worker_unregister_and_register(
+      t, worker_url, worker_scope);
+  t.add_cleanup(() => service_worker_unregister(t, worker_scope));
+
+  await wait_for_state(t, registration.installing, 'activating');
+
+  return registration;
+}
+
+// Attempts to ensure that the "Handle Fetch" algorithm has reached the step
+//
+//   "If activeWorker’s state is "activating", wait for activeWorker’s state to
+//    become "activated"."
+//
+// by waiting for some time to pass.
+//
+// WARNING: whether the algorithm has reached that step isn't directly
+// observable, so this is best effort and can race. Note that this can only
+// result in false positives (where the algorithm hasn't reached that step yet
+// and any functional events haven't actually been handled by the Service
+// Worker).
+async function ensureFunctionalEventsAreWaiting(registration) {
+  await (new Promise(resolve => { setTimeout(resolve, 1000); }));
+
+  assert_equals(registration.active.scriptURL, normalized_worker_url,
+                'active worker should be present');
+  assert_equals(registration.active.state, 'activating',
+                'active worker should be in activating state');
+}
+
+promise_test(async t => {
+  const registration = await registerAndWaitForActivating(t);
+
+  let frame = null;
+  t.add_cleanup(() => {
+    if (frame) {
+      frame.remove();
+    }
+  });
+
+  // This should block until we message the worker to tell it to complete
+  // the activate event.
+  const frameLoadPromise = with_iframe(worker_scope).then(function(f) {
+    frame = f;
+  });
+
+  await ensureFunctionalEventsAreWaiting(registration);
+  assert_equals(frame, null, 'frame should not be loaded');
+
+  registration.active.postMessage('ACTIVATE');
+
+  await frameLoadPromise;
+  assert_equals(frame.contentWindow.navigator.serviceWorker.controller.scriptURL,
+                normalized_worker_url,
+                'frame should now be loaded and controlled');
+  assert_equals(registration.active.state, 'activated',
+                'active worker should be in activated state');
+}, 'Navigation fetch events should wait for the activate event to complete.');
+
+promise_test(async t => {
+  const frame = await with_iframe(worker_scope);
+  t.add_cleanup(() => { frame.remove(); });
+
+  const registration = await registerAndWaitForActivating(t);
+
+  // Make the Service Worker control the frame so the frame can perform an
+  // intercepted fetch.
+  await (new Promise(resolve => {
+    navigator.serviceWorker.onmessage = e => {
+      assert_equals(
+        frame.contentWindow.navigator.serviceWorker.controller.scriptURL,
+        normalized_worker_url, 'frame should be controlled');
+      resolve();
+    };
+
+    registration.active.postMessage('CLAIM');
+  }));
+
+  const fetch_url = `${worker_scope}non/existent/path`;
+  const expected_fetch_result = 'Hello world';
+  let fetch_promise_settled = false;
+
+  // This should block until we message the worker to tell it to complete
+  // the activate event.
+  const fetchPromise = frame.contentWindow.fetch(fetch_url, {
+    method: 'POST',
+    body: expected_fetch_result,
+  }).then(response => {
+    fetch_promise_settled = true;
+    return response;
+  });
+
+  await ensureFunctionalEventsAreWaiting(registration);
+  assert_false(fetch_promise_settled,
+               "fetch()-ing a Service Worker-controlled scope shouldn't have " +
+               "settled yet");
+
+  registration.active.postMessage('ACTIVATE');
+
+  const response = await fetchPromise;
+  assert_equals(await response.text(), expected_fetch_result,
+                "Service Worker should have responded to request to" +
+                fetch_url)
+  assert_equals(registration.active.state, 'activated',
+                'active worker should be in activated state');
+}, 'Subresource fetch events should wait for the activate event to complete.');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-with-body.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-with-body.https.html
new file mode 100644
index 000000000000..21ded3f32725
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-with-body.https.html
@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+const SCRIPT = 'resources/fetch-with-body-worker.js';
+const SCOPE = 'resources/blank.html';
+
+let frame, registration;
+
+promise_test(async t => {
+  t.add_cleanup(async() => {
+    if (frame)
+      frame.remove();
+    if (registration)
+      await registration.unregister();
+  });
+
+  await service_worker_unregister(t, SCOPE);
+  registration = await navigator.serviceWorker.register(SCRIPT, {scope: SCOPE});
+  await wait_for_state(t, registration.installing, 'activating');
+  frame = await with_iframe(SCOPE);
+
+  const request1 = new Request("resources/fetch-with-body-worker.py", {
+    method: "GET",
+  });
+
+  const response1 = await frame.contentWindow.fetch(request1);
+  assert_false(response1.ok);
+
+  const request2 = new Request("resources/fetch-with-body-worker.py", {
+    method: "POST",
+    body: "BODY",
+    headers: { "Content-Type": "text/ascii" },
+  });
+
+  const response2 = await frame.contentWindow.fetch(request2);
+  assert_true(response2.ok);
+}, 'Validate body is preserved');
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/getregistration.https.html b/test/fixtures/wpt/service-workers/service-worker/getregistration.https.html
new file mode 100644
index 000000000000..634c2efa1246
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/getregistration.https.html
@@ -0,0 +1,108 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+async_test(function(t) {
+    var documentURL = 'no-such-worker';
+    navigator.serviceWorker.getRegistration(documentURL)
+      .then(function(value) {
+          assert_equals(value, undefined,
+                        'getRegistration should resolve with undefined');
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'getRegistration');
+
+promise_test(function(t) {
+    var scope = 'resources/scope/getregistration/normal';
+    var registration;
+    return service_worker_unregister_and_register(t, 'resources/empty-worker.js',
+                                                  scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          return navigator.serviceWorker.getRegistration(scope);
+        })
+      .then(function(value) {
+          assert_equals(
+              value, registration,
+              'getRegistration should resolve to the same registration object');
+        });
+  }, 'Register then getRegistration');
+
+promise_test(function(t) {
+    var scope = 'resources/scope/getregistration/url-with-fragment';
+    var documentURL = scope + '#ref';
+    var registration;
+    return service_worker_unregister_and_register(t, 'resources/empty-worker.js',
+                                                  scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          return navigator.serviceWorker.getRegistration(documentURL);
+        })
+      .then(function(value) {
+          assert_equals(
+              value, registration,
+              'getRegistration should resolve to the same registration object');
+        });
+  }, 'Register then getRegistration with a URL having a fragment');
+
+async_test(function(t) {
+    var documentURL = 'http://example.com/';
+    navigator.serviceWorker.getRegistration(documentURL)
+      .then(function() {
+          assert_unreached(
+              'getRegistration with an out of origin URL should fail');
+      }, function(reason) {
+          assert_equals(
+              reason.name, 'SecurityError',
+              'getRegistration with an out of origin URL should fail');
+          t.done();
+      })
+      .catch(unreached_rejection(t));
+  }, 'getRegistration with a cross origin URL');
+
+async_test(function(t) {
+    var scope = 'resources/scope/getregistration/register-unregister';
+    service_worker_unregister_and_register(t, 'resources/empty-worker.js',
+                                           scope)
+      .then(function(registration) {
+          return registration.unregister();
+        })
+      .then(function() {
+          return navigator.serviceWorker.getRegistration(scope);
+        })
+      .then(function(value) {
+          assert_equals(value, undefined,
+                        'getRegistration should resolve with undefined');
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Register then Unregister then getRegistration');
+
+
+promise_test(async function(t) {
+  const scope = 'resources/scope/getregistration/register-unregister';
+  const registration = await service_worker_unregister_and_register(
+    t, 'resources/empty-worker.js', scope
+  );
+
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+
+  const frameNav = frame.contentWindow.navigator;
+  await registration.unregister();
+  const value = await frameNav.serviceWorker.getRegistration(scope);
+
+  assert_equals(value, undefined, 'getRegistration should resolve with undefined');
+}, 'Register then Unregister then getRegistration in controlled iframe');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/getregistrations.https.html b/test/fixtures/wpt/service-workers/service-worker/getregistrations.https.html
new file mode 100644
index 000000000000..3a9b9a23317b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/getregistrations.https.html
@@ -0,0 +1,134 @@
+<!DOCTYPE html>
+<title>Service Worker: getRegistrations()</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script>
+// Purge the existing registrations for the origin.
+// getRegistrations() is used in order to avoid adding additional complexity
+// e.g. adding an internal function.
+promise_test(async () => {
+  const registrations = await navigator.serviceWorker.getRegistrations();
+  await Promise.all(registrations.map(r => r.unregister()));
+  const value = await navigator.serviceWorker.getRegistrations();
+  assert_array_equals(
+      value, [],
+      'getRegistrations should resolve with an empty array.');
+}, 'registrations are not returned following unregister');
+
+promise_test(async t => {
+  const scope = 'resources/scope/getregistrations/normal';
+  const script = 'resources/empty-worker.js';
+  const registrations = [
+      await service_worker_unregister_and_register(t, script, scope)];
+  t.add_cleanup(() => registrations[0].unregister());
+  const value = await navigator.serviceWorker.getRegistrations();
+  assert_array_equals(value, registrations,
+      'getRegistrations should resolve with an array of registrations');
+}, 'Register then getRegistrations');
+
+promise_test(async t => {
+  const scope1 = 'resources/scope/getregistrations/scope1';
+  const scope2 = 'resources/scope/getregistrations/scope2';
+  const scope3 = 'resources/scope/getregistrations/scope12';
+
+  const script = 'resources/empty-worker.js';
+  t.add_cleanup(() => service_worker_unregister(t, scope1));
+  t.add_cleanup(() => service_worker_unregister(t, scope2));
+  t.add_cleanup(() => service_worker_unregister(t, scope3));
+
+  const registrations = [
+      await service_worker_unregister_and_register(t, script, scope1),
+      await service_worker_unregister_and_register(t, script, scope2),
+      await service_worker_unregister_and_register(t, script, scope3),
+  ];
+
+  const value = await navigator.serviceWorker.getRegistrations();
+  assert_array_equals(value, registrations);
+}, 'Register multiple times then getRegistrations');
+
+promise_test(async t => {
+  const scope = 'resources/scope/getregistrations/register-unregister';
+  const script = 'resources/empty-worker.js';
+  const registration = await service_worker_unregister_and_register(t, script, scope);
+  await registration.unregister();
+  const value = await navigator.serviceWorker.getRegistrations();
+  assert_array_equals(
+      value, [], 'getRegistrations should resolve with an empty array.');
+}, 'Register then Unregister then getRegistrations');
+
+promise_test(async t => {
+  const scope = 'resources/scope/getregistrations/register-unregister-controlled';
+  const script = 'resources/empty-worker.js';
+  const registration = await service_worker_unregister_and_register(t, script, scope);
+  await wait_for_state(t, registration.installing, 'activated');
+
+  // Create a frame controlled by the service worker and unregister the
+  // worker.
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+  await registration.unregister();
+
+  const value = await navigator.serviceWorker.getRegistrations();
+  assert_array_equals(
+      value, [],
+      'getRegistrations should resolve with an empty array.');
+  assert_equals(registration.installing, null);
+  assert_equals(registration.waiting, null);
+  assert_equals(registration.active.state, 'activated');
+}, 'Register then Unregister with controlled frame then getRegistrations');
+
+promise_test(async t => {
+  const host_info = get_host_info();
+  // Rewrite the url to point to remote origin.
+  const frame_same_origin_url = new URL("resources/frame-for-getregistrations.html", window.location);
+  const frame_url = host_info['HTTPS_REMOTE_ORIGIN'] + frame_same_origin_url.pathname;
+  const scope = 'resources/scope-for-getregistrations';
+  const script = 'resources/empty-worker.js';
+
+  // Loads an iframe and waits for 'ready' message from it to resolve promise.
+  // Caller is responsible for removing frame.
+  function with_iframe_ready(url) {
+      return new Promise(resolve => {
+          const frame = document.createElement('iframe');
+          frame.src = url;
+          window.addEventListener('message', function onMessage(e) {
+            window.removeEventListener('message', onMessage);
+            if (e.data == 'ready') {
+              resolve(frame);
+            }
+          });
+          document.body.appendChild(frame);
+      });
+  }
+
+  // We need this special frame loading function because the frame is going
+  // to register it's own service worker and there is the possibility that that
+  // register() finishes after the register() for the same domain later in the
+  // test. So we have to wait until the cross origin register() is done, and not
+  // just until the frame loads.
+  const frame = await with_iframe_ready(frame_url);
+  t.add_cleanup(async () => {
+    // Wait until the cross-origin worker is unregistered.
+    let resolve;
+    const channel = new MessageChannel();
+    channel.port1.onmessage = e => {
+      if (e.data == 'unregistered')
+        resolve();
+    };
+    frame.contentWindow.postMessage('unregister', '*', [channel.port2]);
+    await new Promise(r => { resolve = r; });
+
+    frame.remove();
+  });
+
+  const registrations = [
+    await service_worker_unregister_and_register(t, script, scope)];
+  t.add_cleanup(() => registrations[0].unregister());
+  const value = await navigator.serviceWorker.getRegistrations();
+  assert_array_equals(
+      value, registrations,
+      'getRegistrations should only return same origin registrations.');
+}, 'getRegistrations promise resolves only with same origin registrations.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/global-serviceworker.https.any.js b/test/fixtures/wpt/service-workers/service-worker/global-serviceworker.https.any.js
new file mode 100644
index 000000000000..19d77847c426
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/global-serviceworker.https.any.js
@@ -0,0 +1,53 @@
+// META: title=serviceWorker on service worker global
+// META: global=serviceworker
+
+test(() => {
+  assert_equals(registration.installing, null, 'registration.installing');
+  assert_equals(registration.waiting, null, 'registration.waiting');
+  assert_equals(registration.active, null, 'registration.active');
+  assert_true('serviceWorker' in self, 'self.serviceWorker exists');
+  assert_equals(serviceWorker.state, 'parsed', 'serviceWorker.state');
+  assert_readonly(self, 'serviceWorker', `self.serviceWorker is read only`);
+}, 'First run');
+
+// Cache this for later tests.
+const initialServiceWorker = self.serviceWorker;
+
+async_test((t) => {
+  assert_true('serviceWorker' in self, 'self.serviceWorker exists');
+  serviceWorker.postMessage({ messageTest: true });
+
+  // The rest of the test runs once this receives the above message.
+  addEventListener('message', t.step_func((event) => {
+    // Ignore unrelated messages.
+    if (!event.data.messageTest) return;
+    assert_equals(event.source, serviceWorker, 'event.source');
+    t.done();
+  }));
+}, 'Can post message to self during startup');
+
+// The test is registered now so there isn't a race condition when collecting tests, but the asserts
+// don't happen until the 'install' event fires.
+async_test((t) => {
+  addEventListener('install', t.step_func_done(() => {
+    assert_true('serviceWorker' in self, 'self.serviceWorker exists');
+    assert_equals(serviceWorker, initialServiceWorker, `self.serviceWorker hasn't changed`);
+    assert_equals(registration.installing, serviceWorker, 'registration.installing');
+    assert_equals(registration.waiting, null, 'registration.waiting');
+    assert_equals(registration.active, null, 'registration.active');
+    assert_equals(serviceWorker.state, 'installing', 'serviceWorker.state');
+  }));
+}, 'During install');
+
+// The test is registered now so there isn't a race condition when collecting tests, but the asserts
+// don't happen until the 'activate' event fires.
+async_test((t) => {
+  addEventListener('activate', t.step_func_done(() => {
+    assert_true('serviceWorker' in self, 'self.serviceWorker exists');
+    assert_equals(serviceWorker, initialServiceWorker, `self.serviceWorker hasn't changed`);
+    assert_equals(registration.installing, null, 'registration.installing');
+    assert_equals(registration.waiting, null, 'registration.waiting');
+    assert_equals(registration.active, serviceWorker, 'registration.active');
+    assert_equals(serviceWorker.state, 'activating', 'serviceWorker.state');
+  }));
+}, 'During activate');
diff --git a/test/fixtures/wpt/service-workers/service-worker/historical.https.any.js b/test/fixtures/wpt/service-workers/service-worker/historical.https.any.js
new file mode 100644
index 000000000000..20b3ddfbf7b8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/historical.https.any.js
@@ -0,0 +1,5 @@
+// META: global=serviceworker
+
+test((t) => {
+  assert_false('targetClientId' in FetchEvent.prototype)
+}, 'targetClientId should not be on FetchEvent');
diff --git a/test/fixtures/wpt/service-workers/service-worker/http-to-https-redirect-and-register.https.html b/test/fixtures/wpt/service-workers/service-worker/http-to-https-redirect-and-register.https.html
new file mode 100644
index 000000000000..5626237dcccb
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/http-to-https-redirect-and-register.https.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<title>register on a secure page after redirect from an non-secure url</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+'use strict';
+
+var host_info = get_host_info();
+
+// Loads a non-secure url in a new window, which redirects to |target_url|.
+// That page then registers a service worker, and messages back with the result.
+// Returns a promise that resolves with the result.
+function redirect_and_register(target_url) {
+  var redirect_url = host_info.HTTP_REMOTE_ORIGIN + base_path() +
+    'resources/redirect.py?Redirect=';
+  var child = window.open(redirect_url + encodeURIComponent(target_url));
+  return new Promise(resolve => {
+        window.addEventListener('message', e => resolve(e.data));
+      })
+    .then(function(result) {
+        child.close();
+        return result;
+      });
+}
+
+promise_test(function(t) {
+  var target_url = window.location.origin + base_path() +
+      'resources/http-to-https-redirect-and-register-iframe.html';
+
+    return redirect_and_register(target_url)
+      .then(result => {
+          assert_equals(result, 'OK');
+        });
+  }, 'register on a secure page after redirect from an non-secure url');
+
+promise_test(function(t) {
+    var target_url = host_info.HTTP_REMOTE_ORIGIN + base_path() +
+      'resources/http-to-https-redirect-and-register-iframe.html';
+
+    return redirect_and_register(target_url)
+      .then(result => {
+          assert_equals(result, 'FAIL: navigator.serviceWorker is undefined');
+        });
+  }, 'register on a non-secure page after redirect from an non-secure url');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/immutable-prototype-serviceworker.https.html b/test/fixtures/wpt/service-workers/service-worker/immutable-prototype-serviceworker.https.html
new file mode 100644
index 000000000000..e63f6b348a86
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/immutable-prototype-serviceworker.https.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+'use strict';
+
+let expected = ['immutable', 'immutable', 'immutable', 'immutable', 'immutable'];
+
+promise_test(t =>
+  navigator.serviceWorker.register('resources/immutable-prototype-serviceworker.js', {scope: './resources/'})
+      .then(registration => {
+    let worker = registration.installing || registration.waiting || registration.active;
+    let channel = new MessageChannel()
+    worker.postMessage(channel.port2, [channel.port2]);
+    let resolve;
+    let promise = new Promise(r => resolve = r);
+    channel.port1.onmessage = resolve;
+    return promise.then(result => assert_array_equals(expected, result.data));
+  }),
+'worker prototype chain should be immutable');
+</script>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/import-scripts-cross-origin.https.html b/test/fixtures/wpt/service-workers/service-worker/import-scripts-cross-origin.https.html
new file mode 100644
index 000000000000..773708a9fbce
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/import-scripts-cross-origin.https.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Tests for importScripts: cross-origin</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+promise_test(async t => {
+    const scope = 'resources/import-scripts-cross-origin';
+    await service_worker_unregister(t, scope);
+    let reg = await navigator.serviceWorker.register(
+      'resources/import-scripts-cross-origin-worker.sub.js', { scope: scope });
+    t.add_cleanup(_ => reg.unregister());
+    assert_not_equals(reg.installing, null, 'worker is installing');
+  }, 'importScripts() supports cross-origin requests');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/import-scripts-data-url.https.html b/test/fixtures/wpt/service-workers/service-worker/import-scripts-data-url.https.html
new file mode 100644
index 000000000000..f0922193dd01
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/import-scripts-data-url.https.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Tests for importScripts: data: URL</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+promise_test(async t => {
+    const scope = 'resources/import-scripts-data-url';
+    await service_worker_unregister(t, scope);
+    let reg = await navigator.serviceWorker.register(
+      'resources/import-scripts-data-url-worker.js', { scope: scope });
+    t.add_cleanup(_ => reg.unregister());
+    assert_not_equals(reg.installing, null, 'worker is installing');
+  }, 'importScripts() supports data URLs');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/import-scripts-mime-types.https.html b/test/fixtures/wpt/service-workers/service-worker/import-scripts-mime-types.https.html
new file mode 100644
index 000000000000..1679831d0f2b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/import-scripts-mime-types.https.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Tests for importScripts: MIME types</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+/**
+ * Test that a Service Worker's importScript() only accepts valid MIME types.
+ */
+let serviceWorker = null;
+
+promise_test(async t => {
+  const scope = 'resources/import-scripts-mime-types';
+  const registration = await service_worker_unregister_and_register(t,
+    'resources/import-scripts-mime-types-worker.js', scope);
+
+  add_completion_callback(() => { registration.unregister(); });
+
+  await wait_for_state(t, registration.installing, 'activated');
+
+  serviceWorker = registration.active;
+}, 'Global setup');
+
+promise_test(async t => {
+  await fetch_tests_from_worker(serviceWorker);
+}, 'Fetch importScripts tests from service worker')
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/import-scripts-redirect.https.html b/test/fixtures/wpt/service-workers/service-worker/import-scripts-redirect.https.html
new file mode 100644
index 000000000000..07ea49439eba
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/import-scripts-redirect.https.html
@@ -0,0 +1,55 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Tests for importScripts: redirect</title>
+<script src="/common/utils.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+promise_test(async t => {
+    const scope = 'resources/import-scripts-redirect';
+    await service_worker_unregister(t, scope);
+    let reg = await navigator.serviceWorker.register(
+      'resources/import-scripts-redirect-worker.js', { scope: scope });
+    assert_not_equals(reg.installing, null, 'worker is installing');
+    await reg.unregister();
+  }, 'importScripts() supports redirects');
+
+promise_test(async t => {
+    const scope = 'resources/import-scripts-redirect';
+    await service_worker_unregister(t, scope);
+    let reg = await navigator.serviceWorker.register(
+      'resources/import-scripts-redirect-worker.js', { scope: scope });
+    assert_not_equals(reg.installing, null, 'before update');
+    await wait_for_state(t, reg.installing, 'activated');
+    await Promise.all([
+      wait_for_update(t, reg),
+      reg.update()
+    ]);
+    assert_not_equals(reg.installing, null, 'after update');
+    await reg.unregister();
+  },
+  "an imported script redirects, and the body changes during the update check");
+
+promise_test(async t => {
+    const key = token();
+    const scope = 'resources/import-scripts-redirect';
+    await service_worker_unregister(t, scope);
+    let reg = await navigator.serviceWorker.register(
+      `resources/import-scripts-redirect-on-second-time-worker.js?Key=${key}`,
+      { scope });
+    t.add_cleanup(() => reg.unregister());
+
+    assert_not_equals(reg.installing, null, 'before update');
+    await wait_for_state(t, reg.installing, 'activated');
+    await Promise.all([
+      wait_for_update(t, reg),
+      reg.update()
+    ]);
+    assert_not_equals(reg.installing, null, 'after update');
+  },
+  "an imported script doesn't redirect initially, then redirects during " +
+  "the update check and the body changes");
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/import-scripts-resource-map.https.html b/test/fixtures/wpt/service-workers/service-worker/import-scripts-resource-map.https.html
new file mode 100644
index 000000000000..4742bd012683
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/import-scripts-resource-map.https.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<meta charset="utf-8" />
+<title>Tests for importScripts: script resource map</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+  <script>
+    // This test registers a worker that imports a script multiple times. The
+    // script should be stored on the first import and thereafter that stored
+    // script should be loaded. The worker asserts that the stored script was
+    // loaded; if the assert fails then registration fails.
+
+    promise_test(async t => {
+      const SCOPE = "resources/import-scripts-resource-map";
+      const SCRIPT = "resources/import-scripts-resource-map-worker.js";
+      await service_worker_unregister(t, SCOPE);
+      const registration = await navigator.serviceWorker.register(SCRIPT, {
+        scope: SCOPE
+      });
+      await registration.unregister();
+    }, "import the same script URL multiple times");
+
+    promise_test(async t => {
+      const SCOPE = "resources/import-scripts-diff-resource-map";
+      const SCRIPT = "resources/import-scripts-diff-resource-map-worker.js";
+      await service_worker_unregister(t, SCOPE);
+      const registration = await navigator.serviceWorker.register(SCRIPT, {
+        scope: SCOPE
+      });
+      await registration.unregister();
+    }, "call importScripts() with multiple arguments");
+  </script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/import-scripts-updated-flag.https.html b/test/fixtures/wpt/service-workers/service-worker/import-scripts-updated-flag.https.html
new file mode 100644
index 000000000000..09b4496aa0ec
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/import-scripts-updated-flag.https.html
@@ -0,0 +1,83 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Tests for importScripts: import scripts updated flag</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+// This test registers a worker that calls importScripts at various stages of
+// service worker lifetime. The sub-tests trigger subsequent `importScript`
+// invocations via the `message` event.
+
+var register;
+
+function post_and_wait_for_reply(worker, message) {
+  return new Promise(resolve => {
+      navigator.serviceWorker.onmessage = e => { resolve(e.data); };
+      worker.postMessage(message);
+    });
+}
+
+promise_test(function(t) {
+    const scope = 'resources/import-scripts-updated-flag';
+    let registration;
+
+    register = service_worker_unregister_and_register(
+        t, 'resources/import-scripts-updated-flag-worker.js', scope)
+      .then(r => {
+          registration = r;
+          add_completion_callback(() => { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(() => {
+          // This test should not be considered complete until after the
+          // service worker has been unregistered. Currently, `testharness.js`
+          // does not support asynchronous global "tear down" logic, so this
+          // must be expressed using a dedicated `promise_test`. Because the
+          // other sub-tests in this file are declared synchronously, this test
+          // will be the final test executed.
+          promise_test(function(t) {
+              return registration.unregister();
+            });
+
+          return registration.active;
+        });
+
+    return register;
+  }, 'initialize global state');
+
+promise_test(t => {
+    return register
+      .then(function(worker) {
+          return post_and_wait_for_reply(worker, 'root-and-message');
+        })
+      .then(result => {
+          assert_equals(result.error, null);
+          assert_equals(result.value, 'root-and-message');
+        });
+  }, 'import script previously imported at worker evaluation time');
+
+promise_test(t => {
+    return register
+      .then(function(worker) {
+          return post_and_wait_for_reply(worker, 'install-and-message');
+        })
+      .then(result => {
+          assert_equals(result.error, null);
+          assert_equals(result.value, 'install-and-message');
+        });
+  }, 'import script previously imported at worker install time');
+
+promise_test(t => {
+    return register
+      .then(function(worker) {
+          return post_and_wait_for_reply(worker, 'message');
+        })
+      .then(result => {
+          assert_equals(result.error, 'NetworkError');
+          assert_equals(result.value, null);
+        });
+  }, 'import script not previously imported');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/indexeddb.https.html b/test/fixtures/wpt/service-workers/service-worker/indexeddb.https.html
new file mode 100644
index 000000000000..be9be4968f7b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/indexeddb.https.html
@@ -0,0 +1,78 @@
+<!DOCTYPE html>
+<title>Service Worker: Indexed DB</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function readDB() {
+  return new Promise(function(resolve, reject) {
+      var openRequest = indexedDB.open('db');
+
+      openRequest.onerror = reject;
+      openRequest.onsuccess = function() {
+          var db = openRequest.result;
+          var tx = db.transaction('store');
+          var store = tx.objectStore('store');
+          var getRequest = store.get('key');
+
+          getRequest.onerror = function() {
+              db.close();
+              reject(getRequest.error);
+            };
+          getRequest.onsuccess = function() {
+              db.close();
+              resolve(getRequest.result);
+            };
+        };
+    });
+}
+
+function send(worker, action) {
+  return new Promise(function(resolve, reject) {
+      var messageChannel = new MessageChannel();
+      messageChannel.port1.onmessage = function(event) {
+          if (event.data.type === 'error') {
+            reject(event.data.reason);
+          }
+
+          resolve();
+        };
+
+      worker.postMessage(
+        {action: action, port: messageChannel.port2},
+        [messageChannel.port2]);
+    });
+}
+
+promise_test(function(t) {
+    var scope = 'resources/blank.html';
+
+    return service_worker_unregister_and_register(
+        t, 'resources/indexeddb-worker.js', scope)
+      .then(function(registration) {
+          var worker = registration.installing;
+
+          promise_test(function() {
+              return registration.unregister();
+            }, 'clean up: registration');
+
+          return send(worker, 'create')
+            .then(function() {
+                promise_test(function() {
+                  return new Promise(function(resolve, reject) {
+                        var delete_request = indexedDB.deleteDatabase('db');
+
+                        delete_request.onsuccess = resolve;
+                        delete_request.onerror = reject;
+                      });
+                    }, 'clean up: database');
+              })
+            .then(readDB)
+            .then(function(value) {
+                assert_equals(
+                  value, 'value',
+                  'The get() result should match what the worker put().');
+              });
+        });
+  }, 'Verify Indexed DB operation in a Service Worker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/install-event-type.https.html b/test/fixtures/wpt/service-workers/service-worker/install-event-type.https.html
new file mode 100644
index 000000000000..7e74af85c3ae
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/install-event-type.https.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function wait_for_install_event(worker) {
+  return new Promise(function(resolve) {
+      worker.addEventListener('statechange', function(event) {
+          if (worker.state == 'installed')
+            resolve(true);
+          else if (worker.state == 'redundant')
+            resolve(false);
+        });
+    });
+}
+
+promise_test(function(t) {
+      var script = 'resources/install-event-type-worker.js';
+      var scope = 'resources/install-event-type';
+      return service_worker_unregister_and_register(t, script, scope)
+        .then(function(registration) {
+            return wait_for_install_event(registration.installing);
+          })
+        .then(function(did_install) {
+           assert_true(did_install, 'The worker was installed');
+          })
+    }, 'install event type');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/installing.https.html b/test/fixtures/wpt/service-workers/service-worker/installing.https.html
new file mode 100644
index 000000000000..0f257b6aba4f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/installing.https.html
@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<title>ServiceWorker: navigator.serviceWorker.installing</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+const SCRIPT = 'resources/empty-worker.js';
+const SCOPE = 'resources/blank.html';
+
+// "installing" is set
+promise_test(async t => {
+
+  t.add_cleanup(async() => {
+    if (frame)
+      frame.remove();
+    if (registration)
+      await registration.unregister();
+  });
+
+  await service_worker_unregister(t, SCOPE);
+  const frame = await with_iframe(SCOPE);
+  const registration =
+      await navigator.serviceWorker.register(SCRIPT, {scope: SCOPE});
+  const container = frame.contentWindow.navigator.serviceWorker;
+  assert_equals(container.controller, null, 'controller');
+  assert_equals(registration.active, null, 'registration.active');
+  assert_equals(registration.waiting, null, 'registration.waiting');
+  assert_equals(registration.installing.scriptURL, normalizeURL(SCRIPT),
+                'registration.installing.scriptURL');
+  // FIXME: Add a test for a frame created after installation.
+  // Should the existing frame ("frame") block activation?
+}, 'installing is set');
+
+// Tests that The ServiceWorker objects returned from installing attribute getter
+// that represent the same service worker are the same objects.
+promise_test(async t => {
+  const registration1 =
+      await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+  const registration2 = await navigator.serviceWorker.getRegistration(SCOPE);
+  assert_equals(registration1.installing, registration2.installing,
+                'ServiceWorkerRegistration.installing should return the ' +
+                'same object');
+  await registration1.unregister();
+}, 'The ServiceWorker objects returned from installing attribute getter that ' +
+   'represent the same service worker are the same objects');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/intercepted-referrer.https.html b/test/fixtures/wpt/service-workers/service-worker/intercepted-referrer.https.html
new file mode 100644
index 000000000000..72d789451390
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/intercepted-referrer.https.html
@@ -0,0 +1,51 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Service Worker intercepted navigation preserves document.referrer</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
+
+<body>
+<h1>Service Worker intercepted navigation preserves document.referrer</h1>
+<script>
+promise_test(async t => {
+  // Scope where the SW will control navigations.
+  // This lives under the same directory as the SW script below.
+  const scope = 'resources/referrer-scope/';
+
+  // Ensure a clean registration, then register the SW.
+  const reg = await service_worker_unregister_and_register(
+      t, 'resources/intercepted-referrer-sw.js', scope);
+
+  // Wait for activation (handles fresh or already-active cases).
+  const worker = reg.installing || reg.waiting || reg.active;
+  await wait_for_state(t, worker, 'activated');
+
+  // We’ll get one message back from the intercepted document.
+  const messagePromise = new Promise(resolve => {
+    window.addEventListener('message', e => resolve(e.data), { once: true });
+  });
+
+  // Create a navigation under the SW’s scope. The SW will synthesize the page.
+  const iframe = document.createElement('iframe');
+  t.add_cleanup(() => iframe.remove());
+  iframe.src = scope + 'navigated.html';
+  document.body.append(iframe);
+
+  const data = await messagePromise;
+
+  // Basic sanity from the child payload.
+  assert_equals(data && data.source, 'sw-intercepted', 'Child payload is from SW response');
+
+  // document.referrer should be the full URL of this test page (same-origin default policy).
+  // WPT servers send same-origin requests with full referrer (default "strict-origin-when-cross-origin").
+  const expectedReferrer = location.href;
+
+  assert_equals(data.referrer, expectedReferrer,
+    'document.referrer inside the SW-synthesized document equals the parent test page URL');
+
+  // Clean up: unregister the SW.
+  t.add_cleanup(() => reg.unregister());
+}, 'document.referrer for a navigation intercepted by a Service Worker is unchanged and matches the parent URL');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/interface-requirements-sw.https.html b/test/fixtures/wpt/service-workers/service-worker/interface-requirements-sw.https.html
new file mode 100644
index 000000000000..eef868c889f0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/interface-requirements-sw.https.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<title>Service Worker Global Scope Interfaces</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+// interface-requirements-worker.sub.js checks additional interface
+// requirements, on top of the basic IDL that is validated in
+// service-workers/idlharness.any.js
+service_worker_test(
+  'resources/interface-requirements-worker.sub.js',
+  'Interfaces and attributes in ServiceWorkerGlobalScope');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/invalid-blobtype.https.html b/test/fixtures/wpt/service-workers/service-worker/invalid-blobtype.https.html
new file mode 100644
index 000000000000..1c5920fb0391
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/invalid-blobtype.https.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<title>Service Worker: respondWith with header value containing a null byte</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var SCOPE = 'resources/invalid-blobtype-iframe.https.html';
+    var SCRIPT = 'resources/invalid-blobtype-worker.js';
+    var host_info = get_host_info();
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, SCOPE);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(function(frame) {
+          t.add_cleanup(function() {
+              frame.remove();
+            });
+
+          var channel = new MessageChannel();
+          var onMsg = new Promise(function(resolve) {
+              channel.port1.onmessage = resolve;
+            });
+
+          frame.contentWindow.postMessage({},
+                                          host_info['HTTPS_ORIGIN'],
+                                          [channel.port2]);
+          return onMsg;
+        })
+      .then(function(e) {
+          assert_equals(e.data.results, 'finish');
+        });
+  }, 'Verify the response of FetchEvent using XMLHttpRequest');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/invalid-header.https.html b/test/fixtures/wpt/service-workers/service-worker/invalid-header.https.html
new file mode 100644
index 000000000000..1bc976979046
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/invalid-header.https.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<title>Service Worker: respondWith with header value containing a null byte</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var SCOPE = 'resources/invalid-header-iframe.https.html';
+    var SCRIPT = 'resources/invalid-header-worker.js';
+    var host_info = get_host_info();
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, SCOPE);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(function(frame) {
+          t.add_cleanup(function() {
+              frame.remove();
+            });
+
+          var channel = new MessageChannel();
+          var onMsg = new Promise(function(resolve) {
+              channel.port1.onmessage = resolve;
+            });
+          frame.contentWindow.postMessage({},
+                                          host_info['HTTPS_ORIGIN'],
+                                          [channel.port2]);
+          return onMsg;
+        })
+      .then(function(e) {
+          assert_equals(e.data.results, 'finish');
+        });
+  }, 'Verify the response of FetchEvent using XMLHttpRequest');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/iso-latin1-header.https.html b/test/fixtures/wpt/service-workers/service-worker/iso-latin1-header.https.html
new file mode 100644
index 000000000000..c27a5f48a5b9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/iso-latin1-header.https.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<title>Service Worker: respondWith with header value containing an ISO Latin 1 (ISO-8859-1 Character Set) string</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var SCOPE = 'resources/iso-latin1-header-iframe.html';
+    var SCRIPT = 'resources/iso-latin1-header-worker.js';
+    var host_info = get_host_info();
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, SCOPE);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(function(frame) {
+          var channel = new MessageChannel();
+          t.add_cleanup(function() {
+              frame.remove();
+            });
+
+          var onMsg = new Promise(function(resolve) {
+              channel.port1.onmessage = resolve;
+            });
+
+          frame.contentWindow.postMessage({},
+                                          host_info['HTTPS_ORIGIN'],
+                                          [channel.port2]);
+          return onMsg;
+        })
+      .then(function(e) {
+          assert_equals(e.data.results, 'finish');
+        });
+  }, 'Verify the response of FetchEvent using XMLHttpRequest');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/local-url-inherit-controller.https.html b/test/fixtures/wpt/service-workers/service-worker/local-url-inherit-controller.https.html
new file mode 100644
index 000000000000..867e1b006d65
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/local-url-inherit-controller.https.html
@@ -0,0 +1,133 @@
+<!DOCTYPE html>
+<title>Service Worker: local URL windows and workers inherit controller</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+const SCRIPT = 'resources/local-url-inherit-controller-worker.js';
+const SCOPE = 'resources/local-url-inherit-controller-frame.html';
+
+async function doAsyncTest(t, opts) {
+  let name = `${opts.scheme}-${opts.child}-${opts.check}`;
+  let scope = SCOPE + '?name=' + name;
+  let reg = await service_worker_unregister_and_register(t, SCRIPT, scope);
+  add_completion_callback(_ => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  let frame = await with_iframe(scope);
+  add_completion_callback(_ => frame.remove());
+  assert_not_equals(frame.contentWindow.navigator.serviceWorker.controller, null,
+                    'frame should be controlled');
+
+  let result = await frame.contentWindow.checkChildController(opts);
+  result = result.data;
+
+  let expect = 'unexpected';
+  if (opts.check === 'controller') {
+    expect = opts.expect === 'inherit'
+               ? frame.contentWindow.navigator.serviceWorker.controller.scriptURL
+               : null;
+  } else if (opts.check === 'fetch') {
+    // The service worker FetchEvent handler will provide an "intercepted"
+    // body.  If the local URL ends up with an opaque origin and is not
+    // intercepted then it will get an opaque Response.  In that case it
+    // should see an empty string body.
+    expect = opts.expect === 'intercept' ? 'intercepted' : '';
+  }
+
+  assert_equals(result, expect,
+                `${opts.scheme} URL ${opts.child} should ${opts.expect} ${opts.check}`);
+}
+
+promise_test(function(t) {
+  return doAsyncTest(t, {
+    scheme: 'blob',
+    child: 'iframe',
+    check: 'controller',
+    expect: 'inherit',
+  });
+}, 'Same-origin blob URL iframe should inherit service worker controller.');
+
+promise_test(function(t) {
+  return doAsyncTest(t, {
+    scheme: 'blob',
+    child: 'iframe',
+    check: 'fetch',
+    expect: 'intercept',
+  });
+}, 'Same-origin blob URL iframe should intercept fetch().');
+
+promise_test(function(t) {
+  return doAsyncTest(t, {
+    scheme: 'blob',
+    child: 'worker',
+    check: 'controller',
+    expect: 'inherit',
+  });
+}, 'Same-origin blob URL worker should inherit service worker controller.');
+
+promise_test(function(t) {
+  return doAsyncTest(t, {
+    scheme: 'blob',
+    child: 'worker',
+    check: 'fetch',
+    expect: 'intercept',
+  });
+}, 'Same-origin blob URL worker should intercept fetch().');
+
+promise_test(function(t) {
+  return doAsyncTest(t, {
+    scheme: 'blob',
+    child: 'sharedworker',
+    check: 'controller',
+    expect: 'inherit',
+  });
+}, 'Same-origin blob URL sharedworker should inherit service worker controller.');
+
+promise_test(function(t) {
+  return doAsyncTest(t, {
+    scheme: 'blob',
+    child: 'sharedworker',
+    check: 'fetch',
+    expect: 'intercept',
+  });
+}, 'Same-origin blob URL sharedworker should intercept fetch().');
+
+promise_test(function(t) {
+  return doAsyncTest(t, {
+    scheme: 'data',
+    child: 'iframe',
+    check: 'fetch',
+    expect: 'not intercept',
+  });
+}, 'Data URL iframe should not intercept fetch().');
+
+promise_test(function(t) {
+  // Data URLs should result in an opaque origin and should probably not
+  // have access to a cross-origin service worker.  See:
+  //
+  // https://github.com/w3c/ServiceWorker/issues/1262
+  //
+  return doAsyncTest(t, {
+    scheme: 'data',
+    child: 'worker',
+    check: 'controller',
+    expect: 'not inherit',
+  });
+}, 'Data URL worker should not inherit service worker controller.');
+
+promise_test(function(t) {
+  return doAsyncTest(t, {
+    scheme: 'data',
+    child: 'worker',
+    check: 'fetch',
+    expect: 'not intercept',
+  });
+}, 'Data URL worker should not intercept fetch().');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/mime-sniffing.https.html b/test/fixtures/wpt/service-workers/service-worker/mime-sniffing.https.html
new file mode 100644
index 000000000000..8175bcdf8779
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/mime-sniffing.https.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<title>Service Worker: MIME sniffing</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    const SCOPE = 'resources/blank.html?mime-sniffing';
+    const SCRIPT = 'resources/mime-sniffing-worker.js';
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(registration => {
+          add_completion_callback(() => registration.unregister());
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(_ => with_iframe(SCOPE))
+      .then(frame => {
+          add_completion_callback(() => frame.remove());
+          assert_equals(frame.contentWindow.document.body.innerText, 'test');
+          const h1 = frame.contentWindow.document.getElementById('testid');
+          assert_equals(h1.innerText,'test');
+        });
+  }, 'The response from service worker should be correctly MIME siniffed.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/WEB_FEATURES.yml b/test/fixtures/wpt/service-workers/service-worker/multi-globals/WEB_FEATURES.yml
new file mode 100644
index 000000000000..5bee18ab21d0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [service-workers]
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/current/current.https.html b/test/fixtures/wpt/service-workers/service-worker/multi-globals/current/current.https.html
new file mode 100644
index 000000000000..82a48d409901
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/current/current.https.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<title>Current page used as a test helper</title>
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/current/test-sw.js b/test/fixtures/wpt/service-workers/service-worker/multi-globals/current/test-sw.js
new file mode 100644
index 000000000000..e673292f2c0c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/current/test-sw.js
@@ -0,0 +1 @@
+// Service worker for current/
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/incumbent/incumbent.https.html b/test/fixtures/wpt/service-workers/service-worker/multi-globals/incumbent/incumbent.https.html
new file mode 100644
index 000000000000..4585f15b0f45
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/incumbent/incumbent.https.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title>Incumbent page used as a test helper</title>
+
+<iframe src="../current/current.https.html" id="c"></iframe>
+<iframe src="../relevant/relevant.https.html" id="r"></iframe>
+
+<script>
+'use strict';
+
+const current = document.querySelector('#c').contentWindow;
+const relevant = document.querySelector('#r').contentWindow;
+
+window.testRegister = options => {
+    return current.navigator.serviceWorker.register.call(relevant.navigator.serviceWorker, 'test-sw.js', options);
+};
+
+window.testGetRegistration = () => {
+    return current.navigator.serviceWorker.getRegistration.call(relevant.navigator.serviceWorker, 'test-sw.js');
+};
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/incumbent/test-sw.js b/test/fixtures/wpt/service-workers/service-worker/multi-globals/incumbent/test-sw.js
new file mode 100644
index 000000000000..e2a0e93b5839
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/incumbent/test-sw.js
@@ -0,0 +1 @@
+// Service worker for incumbent/
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/relevant/relevant.https.html b/test/fixtures/wpt/service-workers/service-worker/multi-globals/relevant/relevant.https.html
new file mode 100644
index 000000000000..44f42eda493c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/relevant/relevant.https.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<title>Relevant page used as a test helper</title>
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/relevant/test-sw.js b/test/fixtures/wpt/service-workers/service-worker/multi-globals/relevant/test-sw.js
new file mode 100644
index 000000000000..ff44cdf0867b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/relevant/test-sw.js
@@ -0,0 +1 @@
+// Service worker for relevant/
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/test-sw.js b/test/fixtures/wpt/service-workers/service-worker/multi-globals/test-sw.js
new file mode 100644
index 000000000000..ce3c940eced8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/test-sw.js
@@ -0,0 +1 @@
+// Service worker for /
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/url-parsing.https.html b/test/fixtures/wpt/service-workers/service-worker/multi-globals/url-parsing.https.html
new file mode 100644
index 000000000000..b9dfe3634353
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/url-parsing.https.html
@@ -0,0 +1,73 @@
+<!DOCTYPE html>
+<title>register()/getRegistration() URL parsing, with multiple globals in play</title>
+<link rel="help" href="https://w3c.github.io/ServiceWorker/spec/service_worker/index.html#service-worker-container-register-method">
+<link rel="help" href="https://w3c.github.io/ServiceWorker/spec/service_worker/index.html#service-worker-container-getregistration-method">
+<link rel="author" title="Domenic Denicola" href="mailto:d@domenic.me">
+<script src="/resources/testharness.js"></script>
+<script src="../resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+
+<!-- This is the entry global -->
+
+<iframe src="incumbent/incumbent.https.html"></iframe>
+
+<script>
+'use strict';
+
+const loadPromise = new Promise(resolve => {
+    window.addEventListener('load', () => resolve());
+});
+
+promise_test(t => {
+    let registration;
+
+    return loadPromise.then(() => {
+        return frames[0].testRegister();
+    }).then(r => {
+        registration = r;
+        return wait_for_state(t, registration.installing, 'activated');
+    }).then(_ => {
+        assert_equals(registration.active.scriptURL, normalizeURL('relevant/test-sw.js'), 'the script URL should be parsed against the relevant global');
+        assert_equals(registration.scope, normalizeURL('relevant/'), 'the default scope URL should be parsed against the parsed script URL');
+
+        return registration.unregister();
+    });
+}, 'register should use the relevant global of the object it was called on to resolve the script URL and the default scope URL');
+
+promise_test(t => {
+    let registration;
+
+    return loadPromise.then(() => {
+        return frames[0].testRegister({ scope: 'scope' });
+    }).then(r => {
+        registration = r;
+        return wait_for_state(t, registration.installing, 'activated');
+    }).then(_ => {
+        assert_equals(registration.active.scriptURL, normalizeURL('relevant/test-sw.js'), 'the script URL should be parsed against the relevant global');
+        assert_equals(registration.scope, normalizeURL('relevant/scope'), 'the given scope URL should be parsed against the relevant global');
+
+        return registration.unregister();
+    });
+}, 'register should use the relevant global of the object it was called on to resolve the script URL and the given scope URL');
+
+promise_test(t => {
+    let registration;
+
+    return loadPromise.then(() => {
+        return navigator.serviceWorker.register(normalizeURL('relevant/test-sw.js'));
+    }).then(r => {
+        registration = r;
+        return frames[0].testGetRegistration();
+    })
+    .then(gottenRegistration => {
+        assert_not_equals(registration, null, 'the registration should not be null');
+        assert_not_equals(gottenRegistration, null, 'the registration from the other frame should not be null');
+        assert_equals(gottenRegistration.scope, registration.scope,
+            'the retrieved registration\'s scope should be equal to the original\'s scope');
+
+        return registration.unregister();
+    });
+}, 'getRegistration should use the relevant global of the object it was called on to resolve the script URL');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/multipart-image.https.html b/test/fixtures/wpt/service-workers/service-worker/multipart-image.https.html
new file mode 100644
index 000000000000..00c20d25f90a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multipart-image.https.html
@@ -0,0 +1,68 @@
+<!DOCTYPE html>
+<title>Tests for cross-origin multipart image returned by service worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+
+<script>
+// This tests loading a multipart image via service worker. The service worker responds with
+// an opaque or a non-opaque response. The content of opaque response should not be readable.
+
+const script = 'resources/multipart-image-worker.js';
+const scope = 'resources/multipart-image-iframe.html';
+let frame;
+
+function check_image_data(data) {
+    assert_equals(data[0], 255);
+    assert_equals(data[1], 0);
+    assert_equals(data[2], 0);
+    assert_equals(data[3], 255);
+}
+
+promise_test(t => {
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          promise_test(() => {
+              if (frame) {
+                  frame.remove();
+              }
+              return registration.unregister();
+            }, 'restore global state');
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(() => with_iframe(scope))
+      .then(f => {
+          frame = f;
+      });
+  }, 'initialize global state');
+
+promise_test(t => {
+    return frame.contentWindow.load_multipart_image('same-origin-multipart-image')
+      .then(img => frame.contentWindow.get_image_data(img))
+      .then(img_data => {
+          check_image_data(img_data.data);
+      });
+  }, 'same-origin multipart image via SW should be readable');
+
+promise_test(t => {
+    return frame.contentWindow.load_multipart_image('cross-origin-multipart-image-with-cors-approved')
+      .then(img => frame.contentWindow.get_image_data(img))
+      .then(img_data => {
+          check_image_data(img_data.data);
+      });
+  }, 'cross-origin multipart image via SW with approved CORS should be readable');
+
+promise_test(t => {
+    return frame.contentWindow.load_multipart_image('cross-origin-multipart-image-with-no-cors')
+      .then(img => {
+        assert_throws_dom('SecurityError', frame.contentWindow.DOMException,
+                          () => frame.contentWindow.get_image_data(img));
+      });
+  }, 'cross-origin multipart image with no-cors via SW should not be readable');
+
+promise_test(t => {
+    const promise = frame.contentWindow.load_multipart_image('cross-origin-multipart-image-with-cors-rejected');
+    return promise_rejects_dom(t, 'NetworkError', frame.contentWindow.DOMException, promise);
+  }, 'cross-origin multipart image via SW with rejected CORS should fail to load');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/multiple-register.https.html b/test/fixtures/wpt/service-workers/service-worker/multiple-register.https.html
new file mode 100644
index 000000000000..752e132fc13a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multiple-register.https.html
@@ -0,0 +1,117 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var worker_url = 'resources/empty-worker.js';
+
+async_test(function(t) {
+  var scope = 'resources/scope/subsequent-register-from-same-window';
+  var registration;
+
+  service_worker_unregister_and_register(t, worker_url, scope)
+    .then(function(r) {
+        registration = r;
+        return wait_for_state(t, r.installing, 'activated');
+      })
+    .then(function() {
+        return navigator.serviceWorker.register(worker_url, { scope: scope });
+      })
+    .then(function(new_registration) {
+        assert_equals(new_registration, registration,
+                      'register should resolve to the same registration');
+        assert_equals(new_registration.active, registration.active,
+                      'register should resolve to the same worker');
+        assert_equals(new_registration.active.state, 'activated',
+                      'the worker should be in state "activated"');
+        return registration.unregister();
+      })
+    .then(function() { t.done(); })
+    .catch(unreached_rejection(t));
+}, 'Subsequent registrations resolve to the same registration object');
+
+async_test(function(t) {
+  var scope = 'resources/scope/subsequent-register-from-different-iframe';
+  var frame;
+  var registration;
+
+  service_worker_unregister_and_register(t, worker_url, scope)
+    .then(function(r) {
+        registration = r;
+        return wait_for_state(t, r.installing, 'activated');
+      })
+    .then(function() { return with_iframe('resources/404.py'); })
+    .then(function(f) {
+        frame = f;
+        return frame.contentWindow.navigator.serviceWorker.register(
+            'empty-worker.js',
+            { scope: 'scope/subsequent-register-from-different-iframe' });
+      })
+    .then(function(new_registration) {
+        assert_not_equals(
+          registration, new_registration,
+          'register should resolve to a different registration');
+        assert_equals(
+          registration.scope, new_registration.scope,
+          'registrations should have the same scope');
+
+        assert_equals(
+          registration.installing, null,
+          'installing worker should be null');
+        assert_equals(
+          new_registration.installing, null,
+          'installing worker should be null');
+        assert_equals(
+          registration.waiting, null,
+          'waiting worker should be null')
+        assert_equals(
+          new_registration.waiting, null,
+          'waiting worker should be null')
+
+        assert_not_equals(
+          registration.active, new_registration.active,
+          'registration should have a different active worker');
+        assert_equals(
+          registration.active.scriptURL,
+          new_registration.active.scriptURL,
+          'active workers should have the same script URL');
+        assert_equals(
+          registration.active.state,
+          new_registration.active.state,
+          'active workers should be in the same state');
+
+        frame.remove();
+        return registration.unregister();
+      })
+    .then(function() { t.done(); })
+    .catch(unreached_rejection(t));
+}, 'Subsequent registrations from a different iframe resolve to the ' +
+       'different registration object but they refer to the same ' +
+       'registration and workers');
+
+async_test(function(t) {
+  var scope = 'resources/scope/concurrent-register';
+
+  service_worker_unregister(t, scope)
+    .then(function() {
+        var promises = [];
+        for (var i = 0; i < 10; ++i) {
+          promises.push(navigator.serviceWorker.register(worker_url,
+                                                         { scope: scope }));
+        }
+        return Promise.all(promises);
+      })
+    .then(function(registrations) {
+        registrations.forEach(function(registration) {
+            assert_equals(registration, registrations[0],
+                          'register should resolve to the same registration');
+          });
+        return registrations[0].unregister();
+      })
+    .then(function() { t.done(); })
+    .catch(unreached_rejection(t));
+}, 'Concurrent registrations resolve to the same registration object');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/multiple-update.https.html b/test/fixtures/wpt/service-workers/service-worker/multiple-update.https.html
new file mode 100644
index 000000000000..6a83f73a054f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multiple-update.https.html
@@ -0,0 +1,94 @@
+<!DOCTYPE html>
+<!-- In Bug 1217367, we will try to merge update events for same registration
+     if possible. This testcase is used to make sure the optimization algorithm
+     doesn't go wrong. -->
+<title>Service Worker: Trigger multiple updates</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var script = 'resources/update-nocookie-worker.py';
+    var scope = 'resources/scope/update';
+    var expected_url = normalizeURL(script);
+    var registration;
+
+    return service_worker_unregister_and_register(t, expected_url, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          // Test single update works before triggering multiple update events
+          return Promise.all([registration.update(),
+                              wait_for_update(t, registration)]);
+        })
+      .then(function() {
+          assert_equals(registration.installing.scriptURL, expected_url,
+                        'new installing should be set after update resolves.');
+          assert_equals(registration.waiting, null,
+                        'waiting should still be null after update resolves.');
+          assert_equals(registration.active.scriptURL, expected_url,
+                        'active should still exist after update found.');
+          return wait_for_state(t, registration.installing, 'installed');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'installing should be null after installing.');
+          if (registration.waiting) {
+            assert_equals(registration.waiting.scriptURL, expected_url,
+                          'waiting should be set after installing.');
+            assert_equals(registration.active.scriptURL, expected_url,
+                          'active should still exist after installing.');
+            return wait_for_state(t, registration.waiting, 'activated');
+          }
+        })
+      .then(function() {
+          // Test triggering multiple update events at the same time.
+          var promiseList = [];
+          const burstUpdateCount = 10;
+          for (var i = 0; i < burstUpdateCount; i++) {
+            promiseList.push(registration.update());
+          }
+          promiseList.push(wait_for_update(t, registration));
+          return Promise.all(promiseList);
+        })
+      .then(function() {
+          assert_equals(registration.installing.scriptURL, expected_url,
+                        'new installing should be set after update resolves.');
+          assert_equals(registration.waiting, null,
+                        'waiting should still be null after update resolves.');
+          assert_equals(registration.active.scriptURL, expected_url,
+                        'active should still exist after update found.');
+          return wait_for_state(t, registration.installing, 'installed');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'installing should be null after installing.');
+          if (registration.waiting) {
+            assert_equals(registration.waiting.scriptURL, expected_url,
+                          'waiting should be set after installing.');
+            assert_equals(registration.active.scriptURL, expected_url,
+                          'active should still exist after installing.');
+            return wait_for_state(t, registration.waiting, 'activated');
+          }
+        })
+      .then(function() {
+          // Test update still works after handling update event burst.
+          return Promise.all([registration.update(),
+                              wait_for_update(t, registration)]);
+        })
+      .then(function() {
+          assert_equals(registration.installing.scriptURL, expected_url,
+                        'new installing should be set after update resolves.');
+          assert_equals(registration.waiting, null,
+                        'waiting should be null after activated.');
+          assert_equals(registration.active.scriptURL, expected_url,
+                        'active should still exist after update found.');
+        });
+  }, 'Trigger multiple updates.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigate-window.https.html b/test/fixtures/wpt/service-workers/service-worker/navigate-window.https.html
new file mode 100644
index 000000000000..46d32a48a0ad
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigate-window.https.html
@@ -0,0 +1,151 @@
+<!DOCTYPE html>
+<title>Service Worker: Navigate a Window</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var host_info = get_host_info();
+var BASE_URL = host_info['HTTPS_ORIGIN'] + base_path();
+
+function wait_for_message(msg) {
+  return new Promise(function(resolve, reject) {
+    window.addEventListener('message', function onMsg(evt) {
+      if (evt.data.type === msg) {
+        resolve();
+      }
+    });
+  });
+}
+
+function with_window(url) {
+  var win = window.open(url);
+  return wait_for_message('LOADED').then(_ => win);
+}
+
+function navigate_window(win, url) {
+  win.location = url;
+  return wait_for_message('LOADED').then(_ => win);
+}
+
+function reload_window(win) {
+  win.location.reload();
+  return wait_for_message('LOADED').then(_ => win);
+}
+
+function go_back(win) {
+  win.history.back();
+  return wait_for_message('PAGESHOW').then(_ => win);
+}
+
+function go_forward(win) {
+  win.history.forward();
+  return wait_for_message('PAGESHOW').then(_ => win);
+}
+
+function get_clients(win, sw, opts) {
+  return new Promise((resolve, reject) => {
+    win.navigator.serviceWorker.addEventListener('message', function onMsg(evt) {
+      win.navigator.serviceWorker.removeEventListener('message', onMsg);
+      if (evt.data.type === 'success') {
+        resolve(evt.data.detail);
+      } else {
+        reject(evt.data.detail);
+      }
+    });
+    sw.postMessage({ type: 'GET_CLIENTS', opts: (opts || {}) });
+  });
+}
+
+function compare_urls(a, b) {
+  return a.url < b.url ? -1 : b.url < a.url ? 1 : 0;
+}
+
+function validate_window(win, url, opts) {
+  return win.navigator.serviceWorker.getRegistration(url)
+    .then(reg => {
+        // In order to compare service worker instances we need to
+        // make sure the DOM object is owned by the same global; the
+        // opened window in this case.
+        assert_equals(win.navigator.serviceWorker.controller, reg.active,
+                      'window should be controlled by service worker');
+        return get_clients(win, reg.active, opts);
+      })
+    .then(resultList => {
+        // We should always see our controlled window.
+        var expected = [
+          { url: url, frameType: 'auxiliary' }
+        ];
+        // If we are including uncontrolled windows, then we might see the
+        // test window itself and the test harness.
+        if (opts.includeUncontrolled) {
+          expected.push({ url: BASE_URL + 'navigate-window.https.html',
+                          frameType: 'auxiliary' });
+          expected.push({
+            url: host_info['HTTPS_ORIGIN'] + '/testharness_runner.html',
+            frameType: 'top-level' });
+        }
+
+        assert_equals(resultList.length, expected.length,
+                      'expected number of clients');
+
+        expected.sort(compare_urls);
+        resultList.sort(compare_urls);
+
+        for (var i = 0; i < resultList.length; ++i) {
+          assert_equals(resultList[i].url, expected[i].url,
+                        'client should have expected url');
+          assert_equals(resultList[i].frameType, expected[i].frameType,
+                        'client should have expected frame type');
+        }
+        return win;
+      })
+}
+
+promise_test(function(t) {
+    var worker = BASE_URL + 'resources/navigate-window-worker.js';
+    var scope = BASE_URL + 'resources/loaded.html?navigate-window-controlled';
+    var url1 = scope + '&q=1';
+    var url2 = scope + '&q=2';
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(reg => wait_for_state(t, reg.installing, 'activated') )
+      .then(___ => with_window(url1))
+      .then(win => validate_window(win, url1, { includeUncontrolled: false }))
+      .then(win => navigate_window(win, url2))
+      .then(win => validate_window(win, url2, { includeUncontrolled: false }))
+      .then(win => go_back(win))
+      .then(win => validate_window(win, url1, { includeUncontrolled: false }))
+      .then(win => go_forward(win))
+      .then(win => validate_window(win, url2, { includeUncontrolled: false }))
+      .then(win => reload_window(win))
+      .then(win => validate_window(win, url2, { includeUncontrolled: false }))
+      .then(win => win.close())
+      .catch(unreached_rejection(t))
+      .then(___ => service_worker_unregister(t, scope))
+  }, 'Clients.matchAll() should not show an old window as controlled after ' +
+     'it navigates.');
+
+promise_test(function(t) {
+    var worker = BASE_URL + 'resources/navigate-window-worker.js';
+    var scope = BASE_URL + 'resources/loaded.html?navigate-window-uncontrolled';
+    var url1 = scope + '&q=1';
+    var url2 = scope + '&q=2';
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(reg => wait_for_state(t, reg.installing, 'activated') )
+      .then(___ => with_window(url1))
+      .then(win => validate_window(win, url1, { includeUncontrolled: true }))
+      .then(win => navigate_window(win, url2))
+      .then(win => validate_window(win, url2, { includeUncontrolled: true }))
+      .then(win => go_back(win))
+      .then(win => validate_window(win, url1, { includeUncontrolled: true }))
+      .then(win => go_forward(win))
+      .then(win => validate_window(win, url2, { includeUncontrolled: true }))
+      .then(win => reload_window(win))
+      .then(win => validate_window(win, url2, { includeUncontrolled: true }))
+      .then(win => win.close())
+      .catch(unreached_rejection(t))
+      .then(___ => service_worker_unregister(t, scope))
+  }, 'Clients.matchAll() should not show an old window after it navigates.');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-headers.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-headers.https.html
new file mode 100644
index 000000000000..a4b52035e221
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-headers.https.html
@@ -0,0 +1,819 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>Service Worker: Navigation Post Request Origin Header</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
+<body>
+<script>
+'use strict';
+
+const script = new URL('./resources/fetch-rewrite-worker.js', self.location);
+const base = './resources/navigation-headers-server.py';
+const scope = base + '?with-sw';
+let registration;
+
+async function post_and_get_headers(t, form_host, method, swaction,
+                                    redirect_hosts=[]) {
+  if (swaction === 'navpreload') {
+    assert_true('navigationPreload' in registration,
+                'navigation preload must be supported');
+  }
+  let target_string;
+  if (swaction === 'no-sw') {
+    target_string = base + '?no-sw';
+  } else if (swaction === 'fallback') {
+    target_string = `${scope}&ignore`;
+  } else {
+    target_string = `${scope}&${swaction}`;
+  }
+  let target = new URL(target_string, self.location);
+
+  for (let i = redirect_hosts.length - 1; i >= 0; --i) {
+    const redirect_url = new URL('./resources/redirect.py', self.location);
+    redirect_url.hostname = redirect_hosts[i];
+    redirect_url.search = `?Status=307&Redirect=${encodeURIComponent(target)}`;
+    target = redirect_url;
+  }
+
+  let popup_url_path;
+  if (method === 'GET') {
+    popup_url_path = './resources/location-setter.html';
+  } else if (method === 'POST') {
+    popup_url_path = './resources/form-poster.html';
+  }
+
+  const popup_url = new URL(popup_url_path, self.location);
+  popup_url.hostname = form_host;
+  popup_url.search = `?target=${encodeURIComponent(target.href)}`;
+
+  const message_promise = new Promise(resolve => {
+    self.addEventListener('message', evt => {
+      resolve(evt.data);
+    });
+  });
+
+  const frame = await with_iframe(popup_url);
+  t.add_cleanup(() => frame.remove());
+
+  return await message_promise;
+}
+
+const SAME_ORIGIN = new URL(self.location.origin);
+const SAME_SITE = new URL(get_host_info().HTTPS_REMOTE_ORIGIN);
+const CROSS_SITE = new URL(get_host_info().HTTPS_NOTSAMESITE_ORIGIN);
+
+promise_test(async t => {
+  registration = await service_worker_unregister_and_register(t, script, scope);
+  await wait_for_state(t, registration.installing, 'activated');
+  if (registration.navigationPreload)
+    await registration.navigationPreload.enable();
+}, 'Setup service worker');
+
+//
+// Origin and referer headers
+//
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'no-sw');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'GET Navigation, same-origin with no service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'no-sw');
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with no service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'passthrough');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'GET Navigation, same-origin with passthrough service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'passthrough');
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with passthrough service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'fallback');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'GET Navigation, same-origin with fallback service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'fallback');
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with fallback service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'navpreload');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'GET Navigation, same-origin with navpreload service worker sets correct ' +
+   'origin and referer headers.');
+
+// There is no POST test for navpreload since the feature only supports GET
+// requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'change-request');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'GET Navigation, same-origin with service worker that changes the ' +
+   'request sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'change-request');
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'POST Navigation, same-origin with service worker that changes the ' +
+   'request sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'no-sw');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, SAME_SITE.href, 'referer header');
+}, 'GET Navigation, same-site with no service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'POST',
+                                            'no-sw');
+  assert_equals(result.origin, SAME_SITE.origin, 'origin header');
+  assert_equals(result.referer, SAME_SITE.href, 'referer header');
+}, 'POST Navigation, same-site with no service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'passthrough');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, SAME_SITE.href, 'referer header');
+}, 'GET Navigation, same-site with passthrough service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'POST',
+                                            'passthrough');
+  assert_equals(result.origin, SAME_SITE.origin, 'origin header');
+  assert_equals(result.referer, SAME_SITE.href, 'referer header');
+}, 'POST Navigation, same-site with passthrough service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'fallback');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, SAME_SITE.href, 'referer header');
+}, 'GET Navigation, same-site with fallback service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'POST',
+                                            'fallback');
+  assert_equals(result.origin, SAME_SITE.origin, 'origin header');
+  assert_equals(result.referer, SAME_SITE.href, 'referer header');
+}, 'POST Navigation, same-site with fallback service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'navpreload');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, SAME_SITE.href, 'referer header');
+}, 'GET Navigation, same-site with navpreload service worker sets correct ' +
+   'origin and referer headers.');
+
+// There is no POST test for navpreload since the feature only supports GET
+// requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'change-request');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'GET Navigation, same-site with service worker that changes the ' +
+   'request sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'POST',
+                                            'change-request');
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'POST Navigation, same-site with service worker that changes the ' +
+   'request sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'no-sw');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, CROSS_SITE.href, 'referer header');
+}, 'GET Navigation, cross-site with no service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'POST',
+                                            'no-sw');
+  assert_equals(result.origin, CROSS_SITE.origin, 'origin header');
+  assert_equals(result.referer, CROSS_SITE.href, 'referer header');
+}, 'POST Navigation, cross-site with no service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'passthrough');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, CROSS_SITE.href, 'referer header');
+}, 'GET Navigation, cross-site with passthrough service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'POST',
+                                            'passthrough');
+  assert_equals(result.origin, CROSS_SITE.origin, 'origin header');
+  assert_equals(result.referer, CROSS_SITE.href, 'referer header');
+}, 'POST Navigation, cross-site with passthrough service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'fallback');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, CROSS_SITE.href, 'referer header');
+}, 'GET Navigation, cross-site with fallback service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'POST',
+                                            'fallback');
+  assert_equals(result.origin, CROSS_SITE.origin, 'origin header');
+  assert_equals(result.referer, CROSS_SITE.href, 'referer header');
+}, 'POST Navigation, cross-site with fallback service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'navpreload');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, CROSS_SITE.href, 'referer header');
+}, 'GET Navigation, cross-site with navpreload service worker sets correct ' +
+   'origin and referer headers.');
+
+// There is no POST test for navpreload since the feature only supports GET
+// requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'change-request');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'GET Navigation, cross-site with service worker that changes the ' +
+   'request sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'POST',
+                                            'change-request');
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'POST Navigation, cross-site with service worker that changes the ' +
+   'request sets correct origin and referer headers.');
+
+//
+// Origin and referer header tests using redirects
+//
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'no-sw', [SAME_SITE.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with same-site redirect and no service worker ' +
+   'sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'passthrough', [SAME_SITE.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with same-site redirect and passthrough service ' +
+   'worker sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'fallback', [SAME_SITE.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with same-site redirect and fallback service ' +
+   'worker sets correct origin and referer headers.');
+
+// There is no navpreload case because it does not work with POST requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'change-request', [SAME_SITE.hostname]);
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'POST Navigation, same-origin with same-site redirect and change-request service ' +
+   'worker sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'no-sw', [CROSS_SITE.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with cross-site redirect and no service worker ' +
+   'sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'passthrough', [CROSS_SITE.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with cross-site redirect and passthrough service ' +
+   'worker sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'fallback', [CROSS_SITE.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with cross-site redirect and fallback service ' +
+   'worker sets correct origin and referer headers.');
+
+// There is no navpreload case because it does not work with POST requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'change-request', [CROSS_SITE.hostname]);
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'POST Navigation, same-origin with cross-site redirect and change-request service ' +
+   'worker sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'no-sw', [CROSS_SITE.hostname,
+                                                      SAME_ORIGIN.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and no service worker sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'passthrough', [CROSS_SITE.hostname,
+                                                            SAME_ORIGIN.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and passthrough service worker sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'fallback', [CROSS_SITE.hostname,
+                                                         SAME_ORIGIN.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and fallback service worker sets correct origin and referer headers.');
+
+// There is no navpreload case because it does not work with POST requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'change-request', [CROSS_SITE.hostname,
+                                                               SAME_ORIGIN.hostname]);
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'POST Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and change-request service worker sets correct origin and referer headers.');
+
+//
+// Sec-Fetch-* Headers (separated since not all browsers implement them)
+//
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'no-sw');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with no service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'no-sw');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'POST Navigation, same-origin with no service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'passthrough');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with passthrough service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'passthrough');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'POST Navigation, same-origin with passthrough service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'fallback');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with fallback service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'fallback');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'POST Navigation, same-origin with fallback service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'navpreload');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with navpreload service worker sets correct ' +
+   'sec-fetch headers.');
+
+// There is no POST test for navpreload since the feature only supports GET
+// requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'change-request');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with service worker that changes the ' +
+   'request sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'change-request');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'POST Navigation, same-origin with service worker that changes the ' +
+   'request sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'no-sw');
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-site with no service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'POST',
+                                            'no-sw');
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'POST Navigation, same-site with no service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'passthrough');
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-site with passthrough service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'POST',
+                                            'passthrough');
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'POST Navigation, same-site with passthrough service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'fallback');
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-site with fallback service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'POST',
+                                            'fallback');
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'POST Navigation, same-site with fallback service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'navpreload');
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-site with navpreload service worker sets correct ' +
+   'sec-fetch headers.');
+
+// There is no POST test for navpreload since the feature only supports GET
+// requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'change-request');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-site with service worker that changes the ' +
+   'request sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'POST',
+                                            'change-request');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'POST Navigation, same-site with service worker that changes the ' +
+   'request sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'no-sw');
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, cross-site with no service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'POST',
+                                            'no-sw');
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'POST Navigation, cross-site with no service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'passthrough');
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, cross-site with passthrough service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'POST',
+                                            'passthrough');
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'POST Navigation, cross-site with passthrough service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'fallback');
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, cross-site with fallback service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'POST',
+                                            'fallback');
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'POST Navigation, cross-site with fallback service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'navpreload');
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, cross-site with navpreload service worker sets correct ' +
+   'sec-fetch headers.');
+
+// There is no POST test for navpreload since the feature only supports GET
+// requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'change-request');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, cross-site with service worker that changes the ' +
+   'request sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'POST',
+                                            'change-request');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'POST Navigation, cross-site with service worker that changes the ' +
+   'request sets correct sec-fetch headers.');
+
+//
+// Sec-Fetch-* header tests using redirects
+//
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'no-sw', [SAME_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with same-site redirect and no service worker ' +
+   'sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'passthrough', [SAME_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with same-site redirect and passthrough service ' +
+   'worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'fallback', [SAME_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with same-site redirect and fallback service ' +
+   'worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'navpreload', [SAME_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with same-site redirect and navpreload service ' +
+   'worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'change-request', [SAME_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with same-site redirect and change-request service ' +
+   'worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'no-sw', [CROSS_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect and no service worker ' +
+   'sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'passthrough', [CROSS_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect and passthrough service ' +
+   'worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'fallback', [CROSS_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect and fallback service ' +
+   'worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'navpreload', [CROSS_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect and navpreload service ' +
+   'worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'change-request', [CROSS_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect and change-request service ' +
+   'worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'no-sw', [CROSS_SITE.hostname,
+                                                      SAME_ORIGIN.hostname]);
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and no service worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'passthrough', [CROSS_SITE.hostname,
+                                                            SAME_ORIGIN.hostname]);
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and passthrough service worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'fallback', [CROSS_SITE.hostname,
+                                                         SAME_ORIGIN.hostname]);
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and fallback service worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'navpreload', [CROSS_SITE.hostname,
+                                                           SAME_ORIGIN.hostname]);
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and navpreload service worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'change-request', [CROSS_SITE.hostname,
+                                                               SAME_ORIGIN.hostname]);
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and change-request service worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  await registration.unregister();
+}, 'Cleanup service worker');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/WEB_FEATURES.yml b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/WEB_FEATURES.yml
new file mode 100644
index 000000000000..5bee18ab21d0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [service-workers]
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/broken-chunked-encoding.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/broken-chunked-encoding.https.html
new file mode 100644
index 000000000000..ec74282ac330
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/broken-chunked-encoding.https.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload with chunked encoding</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    var script = 'resources/broken-chunked-encoding-worker.js';
+    var scope = 'resources/broken-chunked-encoding-scope.asis';
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          add_completion_callback(_ => registration.unregister());
+          var worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(_ => with_iframe(scope))
+      .then(frame => {
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'PASS: preloadResponse resolved');
+        });
+  }, 'FetchEvent#preloadResponse resolves even if the body is sent with broken chunked encoding.');
+
+promise_test(t => {
+    var script = 'resources/broken-chunked-encoding-worker.js';
+    var scope = 'resources/chunked-encoding-scope.py?use_broken_body';
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          add_completion_callback(_ => registration.unregister());
+          var worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(_ => with_iframe(scope))
+      .then(frame => {
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'PASS: preloadResponse resolved');
+        });
+  }, 'FetchEvent#preloadResponse resolves even if the body is sent with broken chunked encoding with some delays');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/chunked-encoding.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/chunked-encoding.https.html
new file mode 100644
index 000000000000..830ce32cea5a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/chunked-encoding.https.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload with chunked encoding</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    var script = 'resources/chunked-encoding-worker.js';
+    var scope = 'resources/chunked-encoding-scope.py';
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          add_completion_callback(_ => registration.unregister());
+          var worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(_ => with_iframe(scope))
+      .then(frame => {
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            '0123456789');
+        });
+  }, 'Navigation Preload must work with chunked encoding.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/content-encoding.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/content-encoding.https.html
new file mode 100644
index 000000000000..d6135d95c880
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/content-encoding.https.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload with content encoding</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    var script = 'resources/content-encoding-worker.js';
+    var scope = 'resources/content-encoding-scope.py';
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          add_completion_callback(_ => registration.unregister());
+          var worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(_ => with_iframe(scope))
+      .then(frame => {
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'Hello World');
+        });
+  }, 'Navigation Preload must work with content encoding.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/empty-preload-response-body.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/empty-preload-response-body.https.html
new file mode 100644
index 000000000000..7e8aacdd36a5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/empty-preload-response-body.https.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload empty response body</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    var script = 'resources/empty-preload-response-body-worker.js';
+    var scope = 'resources/empty-preload-response-body-scope.html';
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          add_completion_callback(_ => registration.unregister());
+          var worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(_ => with_iframe(scope))
+      .then(frame => {
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            '[]');
+        });
+  }, 'Navigation Preload empty response body.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/get-state.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/get-state.https.html
new file mode 100644
index 000000000000..08e2f4976c59
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/get-state.https.html
@@ -0,0 +1,217 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>NavigationPreloadManager.getState</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script src="resources/helpers.js"></script>
+<body>
+<script>
+function post_and_wait_for_reply(worker, message) {
+  return new Promise(resolve => {
+      navigator.serviceWorker.onmessage = e => { resolve(e.data); };
+      worker.postMessage(message);
+    });
+}
+
+promise_test(t => {
+  const scope = '../resources/get-state';
+  const script = '../resources/empty-worker.js';
+  var np;
+
+  return service_worker_unregister_and_register(t, script, scope)
+    .then(r => {
+        np = r.navigationPreload;
+        add_completion_callback(() => r.unregister());
+        return wait_for_state(t, r.installing, 'activated');
+      })
+    .then(() => np.getState())
+    .then(state => {
+        expect_navigation_preload_state(state, false, 'true', 'default state');
+        return np.enable();
+      })
+    .then(result => {
+        assert_equals(result, undefined,
+                      'enable() should resolve to undefined');
+        return np.getState();
+      })
+    .then(state => {
+        expect_navigation_preload_state(state, true, 'true',
+                                        'state after enable()');
+        return np.disable();
+      })
+    .then(result => {
+        assert_equals(result, undefined,
+                      'disable() should resolve to undefined');
+        return np.getState();
+      })
+    .then(state => {
+        expect_navigation_preload_state(state, false, 'true',
+                                        'state after disable()');
+        return np.setHeaderValue('dreams that cannot be');
+      })
+    .then(result => {
+        assert_equals(result, undefined,
+                      'setHeaderValue() should resolve to undefined');
+        return np.getState();
+      })
+    .then(state => {
+        expect_navigation_preload_state(state, false, 'dreams that cannot be',
+                                        'state after setHeaderValue()');
+        return np.setHeaderValue('').then(() => np.getState());
+      })
+    .then(state => {
+        expect_navigation_preload_state(state, false, '',
+                                        'after setHeaderValue to empty string');
+        return np.setHeaderValue(null).then(() => np.getState());
+      })
+    .then(state => {
+        expect_navigation_preload_state(state, false, 'null',
+                                        'after setHeaderValue to null');
+        return promise_rejects_js(t,
+            TypeError,
+            np.setHeaderValue('what\uDC00\uD800this'),
+            'setHeaderValue() should throw if passed surrogates');
+      })
+    .then(() => {
+        return promise_rejects_js(t,
+            TypeError,
+            np.setHeaderValue('zer\0o'),
+            'setHeaderValue() should throw if passed \\0');
+      })
+    .then(() => {
+        return promise_rejects_js(t,
+            TypeError,
+            np.setHeaderValue('\rcarriage'),
+            'setHeaderValue() should throw if passed \\r');
+      })
+    .then(() => {
+        return promise_rejects_js(t,
+            TypeError,
+            np.setHeaderValue('newline\n'),
+            'setHeaderValue() should throw if passed \\n');
+      })
+    .then(() => {
+        return promise_rejects_js(t,
+            TypeError,
+            np.setHeaderValue(),
+            'setHeaderValue() should throw if passed undefined');
+      })
+    .then(() => np.enable().then(() => np.getState()))
+    .then(state => {
+        expect_navigation_preload_state(state, true, 'null',
+                                        'enable() should not change header');
+      });
+  }, 'getState');
+
+// This test sends commands to a worker to call enable()/disable()/getState().
+// It checks the results from the worker and verifies that they match the
+// navigation preload state accessible from the page.
+promise_test(t => {
+  const scope = 'resources/get-state-worker';
+  const script = 'resources/get-state-worker.js';
+  var worker;
+  var registration;
+
+  return service_worker_unregister_and_register(t, script, scope)
+    .then(r => {
+        registration = r;
+        add_completion_callback(() => registration.unregister());
+        worker = registration.installing;
+        return wait_for_state(t, worker, 'activated');
+      })
+    .then(() => {
+        // Call getState().
+        return post_and_wait_for_reply(worker, 'getState');
+      })
+    .then(data => {
+        return Promise.all([data, registration.navigationPreload.getState()]);
+      })
+    .then(states => {
+        expect_navigation_preload_state(states[0], false, 'true',
+                                        'default state (from worker)');
+        expect_navigation_preload_state(states[1], false, 'true',
+                                        'default state (from page)');
+        // Call enable() and then getState().
+        return post_and_wait_for_reply(worker, 'enable');
+      })
+    .then(data => {
+        assert_equals(data, undefined, 'enable() should resolve to undefined');
+        return Promise.all([
+            post_and_wait_for_reply(worker, 'getState'),
+            registration.navigationPreload.getState()
+          ]);
+      })
+    .then(states => {
+        expect_navigation_preload_state(states[0], true, 'true',
+                                        'state after enable() (from worker)');
+        expect_navigation_preload_state(states[1], true, 'true',
+                                        'state after enable() (from page)');
+        // Call disable() and then getState().
+        return post_and_wait_for_reply(worker, 'disable');
+      })
+    .then(data => {
+        assert_equals(data, undefined,
+                      '.disable() should resolve to undefined');
+        return Promise.all([
+            post_and_wait_for_reply(worker, 'getState'),
+            registration.navigationPreload.getState()
+          ]);
+      })
+    .then(states => {
+        expect_navigation_preload_state(states[0], false, 'true',
+                                        'state after disable() (from worker)');
+        expect_navigation_preload_state(states[1], false, 'true',
+                                        'state after disable() (from page)');
+        return post_and_wait_for_reply(worker, 'setHeaderValue');
+      })
+    .then(data => {
+        assert_equals(data, undefined,
+                      '.setHeaderValue() should resolve to undefined');
+        return Promise.all([
+            post_and_wait_for_reply(worker, 'getState'),
+            registration.navigationPreload.getState()]);
+      })
+    .then(states => {
+        expect_navigation_preload_state(
+            states[0], false, 'insightful',
+            'state after setHeaderValue() (from worker)');
+        expect_navigation_preload_state(
+            states[1], false, 'insightful',
+            'state after setHeaderValue() (from page)');
+      });
+  }, 'getState from a worker');
+
+// This tests navigation preload API when there is no active worker. It calls
+// the API from the main page and then from the worker itself.
+promise_test(t => {
+  const scope = 'resources/wait-for-activate-worker';
+  const script = 'resources/wait-for-activate-worker.js';
+  var registration;
+  var np;
+  return service_worker_unregister_and_register(t, script, scope)
+    .then(r => {
+        registration = r;
+        np = registration.navigationPreload;
+        add_completion_callback(() => registration.unregister());
+        return Promise.all([
+            promise_rejects_dom(
+                t, 'InvalidStateError', np.enable(),
+                'enable should reject if there is no active worker'),
+            promise_rejects_dom(
+                t, 'InvalidStateError', np.disable(),
+                'disable should reject if there is no active worker'),
+            promise_rejects_dom(
+                t, 'InvalidStateError', np.setHeaderValue('umm'),
+                'setHeaderValue should reject if there is no active worker')]);
+      })
+    .then(() => np.getState())
+    .then(state => {
+        expect_navigation_preload_state(state, false, 'true',
+                                        'state before activation');
+        return post_and_wait_for_reply(registration.installing, 'ping');
+      })
+    .then(result => assert_equals(result, 'PASS'));
+  }, 'no active worker');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/navigationPreload.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/navigationPreload.https.html
new file mode 100644
index 000000000000..392e5c14dc8c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/navigationPreload.https.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>ServiceWorker: navigator.serviceWorker.navigationPreload</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script src="resources/helpers.js"></script>
+<script>
+promise_test(async t => {
+  const SCRIPT = '../resources/empty-worker.js';
+  const SCOPE = '../resources/navigationpreload';
+  const registration =
+      await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+  const navigationPreload = registration.navigationPreload;
+  assert_true(navigationPreload instanceof NavigationPreloadManager,
+              'ServiceWorkerRegistration.navigationPreload');
+  await registration.unregister();
+}, "The navigationPreload attribute must return service worker " +
+    "registration's NavigationPreloadManager object.");
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/redirect.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/redirect.https.html
new file mode 100644
index 000000000000..5970f053e369
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/redirect.https.html
@@ -0,0 +1,93 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload redirect response</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+
+function check_opaqueredirect(response_info, scope) {
+  assert_equals(response_info.type, 'opaqueredirect');
+  assert_equals(response_info.url, '' + new URL(scope, location));
+  assert_equals(response_info.status, 0);
+  assert_equals(response_info.ok, false);
+  assert_equals(response_info.statusText, '');
+  assert_equals(response_info.headers.length, 0);
+}
+
+function redirect_response_test(t, scope, expected_body, expected_urls) {
+  var script = 'resources/redirect-worker.js';
+  var registration;
+  var message_resolvers = [];
+  function wait_for_message(count) {
+    var promises = [];
+    message_resolvers = [];
+    for (var i = 0; i < count; ++i) {
+      promises.push(new Promise(resolve => message_resolvers.push(resolve)));
+    }
+    return promises;
+  }
+  function on_message(e) {
+    var resolve = message_resolvers.shift();
+    if (resolve)
+      resolve(e.data);
+  }
+  return service_worker_unregister_and_register(t, script, scope)
+    .then(reg => {
+        registration = reg;
+        add_completion_callback(_ => registration.unregister());
+        var worker = registration.installing;
+        return wait_for_state(t, worker, 'activated');
+      })
+    .then(_ => with_iframe(scope + '&base'))
+    .then(frame => {
+        assert_equals(frame.contentDocument.body.textContent, 'OK');
+        frame.contentWindow.navigator.serviceWorker.onmessage = on_message;
+        return Promise.all(wait_for_message(expected_urls.length)
+                               .concat(with_iframe(scope)));
+      })
+    .then(results => {
+      var frame = results[expected_urls.length];
+      assert_equals(frame.contentDocument.body.textContent, expected_body);
+      for (var i = 0; i < expected_urls.length; ++i) {
+        check_opaqueredirect(results[i], expected_urls[i]);
+      }
+      frame.remove();
+      return registration.unregister();
+    });
+}
+
+promise_test(t => {
+    return redirect_response_test(
+        t,
+        'resources/redirect-scope.py?type=normal',
+        'redirected\n',
+        ['resources/redirect-scope.py?type=normal']);
+  }, 'Navigation Preload redirect response.');
+
+promise_test(t => {
+    return redirect_response_test(
+        t,
+        'resources/redirect-scope.py?type=no-location',
+        '',
+        ['resources/redirect-scope.py?type=no-location']);
+  }, 'Navigation Preload no-location redirect response.');
+
+promise_test(t => {
+    return redirect_response_test(
+        t,
+        'resources/redirect-scope.py?type=no-location-with-body',
+        'BODY',
+        ['resources/redirect-scope.py?type=no-location-with-body']);
+  }, 'Navigation Preload no-location redirect response with body.');
+
+promise_test(t => {
+    return redirect_response_test(
+        t,
+        'resources/redirect-scope.py?type=redirect-to-scope',
+        'redirected\n',
+        ['resources/redirect-scope.py?type=redirect-to-scope',
+         'resources/redirect-scope.py?type=redirect-to-scope2',
+         'resources/redirect-scope.py?type=redirect-to-scope3',]);
+  }, 'Navigation Preload redirect to the same scope.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/request-headers.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/request-headers.https.html
new file mode 100644
index 000000000000..09642010218a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/request-headers.https.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload request headers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    var script = 'resources/request-headers-worker.js';
+    var scope = 'resources/request-headers-scope.py';
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          add_completion_callback(_ => registration.unregister());
+          var worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(_ => with_iframe(scope))
+      .then(frame => {
+          var headers = JSON.parse(frame.contentDocument.body.textContent);
+          assert_true(
+            'SERVICE-WORKER-NAVIGATION-PRELOAD' in headers,
+            'The Navigation Preload request must specify a ' +
+            '"Service-Worker-Navigation-Preload" header.');
+          assert_array_equals(
+            headers['SERVICE-WORKER-NAVIGATION-PRELOAD'],
+            ['hello'],
+            'The Navigation Preload request must specify the correct value ' +
+            'for the "Service-Worker-Navigation-Preload" header.');
+          assert_true(
+            'UPGRADE-INSECURE-REQUESTS' in headers,
+            'The Navigation Preload request must specify an ' +
+            '"Upgrade-Insecure-Requests" header.');
+          assert_array_equals(
+            headers['UPGRADE-INSECURE-REQUESTS'],
+            ['1'],
+            'The Navigation Preload request must specify the correct value ' +
+            'for the "Upgrade-Insecure-Requests" header.');
+        });
+  }, 'Navigation Preload request headers.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resource-timing.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resource-timing.https.html
new file mode 100644
index 000000000000..468a1f51e857
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resource-timing.https.html
@@ -0,0 +1,92 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload Resource Timing</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+
+function check_timing_entry(entry, url, decodedBodySize, encodedBodySize) {
+  assert_equals(entry.name, url, 'The entry name of '+ url);
+
+  assert_equals(
+    entry.entryType, 'resource',
+    'The entryType of preload response timing entry must be "resource' +
+    '" :' + url);
+  assert_equals(
+    entry.initiatorType, 'navigation',
+    'The initiatorType of preload response timing entry must be ' +
+    '"navigation":' + url);
+
+  // If the server returns the redirect response, |decodedBodySize| is null and
+  // |entry.decodedBodySize| should be 0. Otherwise |entry.decodedBodySize| must
+  // same as |decodedBodySize|
+  assert_equals(
+    entry.decodedBodySize, Number(decodedBodySize),
+    'decodedBodySize must same as the decoded size in the server:' + url);
+
+  // If the server returns the redirect response, |encodedBodySize| is null and
+  // |entry.encodedBodySize| should be 0. Otherwise |entry.encodedBodySize| must
+  // same as |encodedBodySize|
+  assert_equals(
+    entry.encodedBodySize, Number(encodedBodySize),
+    'encodedBodySize must same as the encoded size in the server:' + url);
+
+  assert_greater_than(
+    entry.transferSize, entry.decodedBodySize,
+    'transferSize must greater then encodedBodySize.');
+
+  assert_greater_than(entry.startTime, 0, 'startTime of ' + url);
+  assert_greater_than_equal(entry.fetchStart, entry.startTime,
+                            'fetchStart >= startTime of ' + url);
+  assert_greater_than_equal(entry.domainLookupStart, entry.fetchStart,
+                            'domainLookupStart >= fetchStart of ' + url);
+  assert_greater_than_equal(entry.domainLookupEnd, entry.domainLookupStart,
+                            'domainLookupEnd >= domainLookupStart of ' + url);
+  assert_greater_than_equal(entry.connectStart, entry.domainLookupEnd,
+                            'connectStart >= domainLookupEnd of ' + url);
+  assert_greater_than_equal(entry.connectEnd, entry.connectStart,
+                            'connectEnd >= connectStart of ' + url);
+  assert_greater_than_equal(entry.requestStart, entry.connectEnd,
+                            'requestStart >= connectEnd of ' + url);
+  assert_greater_than_equal(entry.responseStart, entry.requestStart,
+                            'domainLookupStart >= requestStart of ' + url);
+  assert_greater_than_equal(entry.responseEnd, entry.responseStart,
+                            'responseEnd >= responseStart of ' + url);
+  assert_greater_than(entry.duration, 0, 'duration of ' + url);
+}
+
+promise_test(t => {
+    var script = 'resources/resource-timing-worker.js';
+    var scope = 'resources/resource-timing-scope.py';
+    var registration;
+    var frames = [];
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(reg => {
+          registration = reg;
+          add_completion_callback(_ => registration.unregister());
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(_ => with_iframe(scope + '?type=normal'))
+      .then(frame => {
+          frames.push(frame);
+          return with_iframe(scope + '?type=redirect');
+        })
+      .then(frame => {
+          frames.push(frame);
+          frames.forEach(frame => {
+            var result = JSON.parse(frame.contentDocument.body.textContent);
+            assert_equals(
+              result.timingEntries.length, 1,
+              'performance.getEntriesByName() must returns one ' +
+              'PerformanceResourceTiming entry for the navigation preload.');
+            var entry = result.timingEntries[0];
+            check_timing_entry(entry, frame.src, result.decodedBodySize,
+                               result.encodedBodySize);
+            frame.remove();
+          });
+          return registration.unregister();
+        });
+  }, 'Navigation Preload Resource Timing.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/broken-chunked-encoding-scope.asis b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/broken-chunked-encoding-scope.asis
new file mode 100644
index 000000000000..2a719536fb89
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/broken-chunked-encoding-scope.asis
@@ -0,0 +1,6 @@
+HTTP/1.1 200 OK
+Content-type: text/html; charset=UTF-8
+Transfer-encoding: chunked
+
+hello
+world
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/broken-chunked-encoding-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/broken-chunked-encoding-worker.js
new file mode 100644
index 000000000000..7a453e4055f0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/broken-chunked-encoding-worker.js
@@ -0,0 +1,11 @@
+self.addEventListener('activate', event => {
+    event.waitUntil(
+        self.registration.navigationPreload.enable());
+  });
+
+self.addEventListener('fetch', event => {
+    event.respondWith(event.preloadResponse
+      .then(
+        _ => new Response('PASS: preloadResponse resolved'),
+        _ => new Response('FAIL: preloadResponse rejected')));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/chunked-encoding-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/chunked-encoding-worker.js
new file mode 100644
index 000000000000..f30e5ed274dd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/chunked-encoding-worker.js
@@ -0,0 +1,8 @@
+self.addEventListener('activate', event => {
+    event.waitUntil(
+        self.registration.navigationPreload.enable());
+  });
+
+self.addEventListener('fetch', event => {
+    event.respondWith(event.preloadResponse);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/content-encoding-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/content-encoding-worker.js
new file mode 100644
index 000000000000..f30e5ed274dd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/content-encoding-worker.js
@@ -0,0 +1,8 @@
+self.addEventListener('activate', event => {
+    event.waitUntil(
+        self.registration.navigationPreload.enable());
+  });
+
+self.addEventListener('fetch', event => {
+    event.respondWith(event.preloadResponse);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/empty-preload-response-body-scope.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/empty-preload-response-body-scope.html
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/empty-preload-response-body-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/empty-preload-response-body-worker.js
new file mode 100644
index 000000000000..48c14b7916f3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/empty-preload-response-body-worker.js
@@ -0,0 +1,15 @@
+self.addEventListener('activate', event => {
+    event.waitUntil(
+        self.registration.navigationPreload.enable());
+  });
+
+self.addEventListener('fetch', event => {
+    event.respondWith(
+      event.preloadResponse
+        .then(res => res.text())
+        .then(text => {
+            return new Response(
+                '<body>[' + text + ']</body>',
+                {headers: [['content-type', 'text/html']]});
+          }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/get-state-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/get-state-worker.js
new file mode 100644
index 000000000000..a14ffb4faaad
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/get-state-worker.js
@@ -0,0 +1,21 @@
+// This worker listens for commands from the page and messages back
+// the result.
+
+function handle(message) {
+  const np = self.registration.navigationPreload;
+  switch (message) {
+    case 'getState':
+      return np.getState();
+    case 'enable':
+      return np.enable();
+    case 'disable':
+      return np.disable();
+    case 'setHeaderValue':
+      return np.setHeaderValue('insightful');
+  }
+  return Promise.reject('bad message');
+}
+
+self.addEventListener('message', e => {
+    e.waitUntil(handle(e.data).then(result => e.source.postMessage(result)));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/helpers.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/helpers.js
new file mode 100644
index 000000000000..86f0c0916ec9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/helpers.js
@@ -0,0 +1,5 @@
+function expect_navigation_preload_state(state, enabled, header, desc) {
+  assert_equals(Object.keys(state).length, 2, desc + ': # of keys');
+  assert_equals(state.enabled, enabled, desc + ': enabled');
+  assert_equals(state.headerValue, header, desc + ': header');
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/navigation-preload-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/navigation-preload-worker.js
new file mode 100644
index 000000000000..6e1ab232907f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/navigation-preload-worker.js
@@ -0,0 +1,3 @@
+self.addEventListener('fetch', event => {
+  event.respondWith(event.preloadResponse);
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/redirect-redirected.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/redirect-redirected.html
new file mode 100644
index 000000000000..f9bfce5e8953
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/redirect-redirected.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<body>redirected</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/redirect-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/redirect-worker.js
new file mode 100644
index 000000000000..1b55f2ef0d98
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/redirect-worker.js
@@ -0,0 +1,35 @@
+self.addEventListener('activate', event => {
+    event.waitUntil(
+        self.registration.navigationPreload.enable());
+  });
+
+function get_response_info(r) {
+  var info = {
+    type: r.type,
+    url: r.url,
+    status: r.status,
+    ok: r.ok,
+    statusText: r.statusText,
+    headers: []
+  };
+  r.headers.forEach((value, name) => { info.headers.push([value, name]); });
+  return info;
+}
+
+function post_to_page(data) {
+  return self.clients.matchAll()
+    .then(clients => clients.forEach(client => client.postMessage(data)));
+}
+
+self.addEventListener('fetch', event => {
+    event.respondWith(
+      event.preloadResponse
+        .then(
+          res => {
+            if (res.url.includes("base")) {
+              return res;
+            }
+            return post_to_page(get_response_info(res)).then(_ => res);
+          },
+          err => new Response(err.toString())));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/request-headers-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/request-headers-worker.js
new file mode 100644
index 000000000000..1006cf27913a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/request-headers-worker.js
@@ -0,0 +1,10 @@
+self.addEventListener('activate', event => {
+    event.waitUntil(
+        Promise.all[
+            self.registration.navigationPreload.enable(),
+            self.registration.navigationPreload.setHeaderValue('hello')]);
+  });
+
+self.addEventListener('fetch', event => {
+    event.respondWith(event.preloadResponse);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/resource-timing-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/resource-timing-worker.js
new file mode 100644
index 000000000000..fac0d8de2a73
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/resource-timing-worker.js
@@ -0,0 +1,37 @@
+async function wait_for_performance_entries(url) {
+  let entries = performance.getEntriesByName(url);
+  if (entries.length > 0) {
+    return entries;
+  }
+  return new Promise((resolve) => {
+    new PerformanceObserver((list) => {
+      const entries = list.getEntriesByName(url);
+      if (entries.length > 0) {
+        resolve(entries);
+      }
+    }).observe({ entryTypes: ['resource'] });
+  });
+}
+
+self.addEventListener('activate', event => {
+    event.waitUntil(self.registration.navigationPreload.enable());
+  });
+
+self.addEventListener('fetch', event => {
+    let headers;
+    event.respondWith(
+      event.preloadResponse
+          .then(response => {
+            headers = response.headers;
+            return response.text()
+          })
+          .then(_ => wait_for_performance_entries(event.request.url))
+          .then(entries =>
+            new Response(
+              JSON.stringify({
+                decodedBodySize: headers.get('X-Decoded-Body-Size'),
+                encodedBodySize: headers.get('X-Encoded-Body-Size'),
+                timingEntries: entries
+              }),
+              {headers: {'Content-Type': 'text/html'}})));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-iframe.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-iframe.html
new file mode 100644
index 000000000000..a28b61261e82
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-iframe.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<body>samesite</body>
+<script>
+onmessage = (e) => {
+  if (e.data === "GetBody") {
+    parent.postMessage("samesite", '*');
+  }
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-sw-helper.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-sw-helper.html
new file mode 100644
index 000000000000..51fdc9ec74bd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-sw-helper.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload Same Site SW registrator</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../../resources/test-helpers.sub.js"></script>
+<script>
+
+/**
+ *  This is a helper file to register/unregister service worker in a same-site
+ *  iframe.
+ **/
+
+async function messageToParent(msg) {
+  parent.postMessage(msg, '*');
+}
+
+onmessage = async (e) => {
+  // t is a , but the helper function needs a test object.
+  let t = {
+    step_func: (func) => func,
+  };
+  if (e.data === "Register") {
+    let reg = await service_worker_unregister_and_register(t, "samesite-worker.js", ".");
+    let worker = reg.installing;
+    await wait_for_state(t, worker, 'activated');
+    await messageToParent("SW Registered");
+  } else if (e.data == "Unregister") {
+    await service_worker_unregister(t, ".");
+    await messageToParent("SW Unregistered");
+  }
+}
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-worker.js
new file mode 100644
index 000000000000..f30e5ed274dd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-worker.js
@@ -0,0 +1,8 @@
+self.addEventListener('activate', event => {
+    event.waitUntil(
+        self.registration.navigationPreload.enable());
+  });
+
+self.addEventListener('fetch', event => {
+    event.respondWith(event.preloadResponse);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/wait-for-activate-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/wait-for-activate-worker.js
new file mode 100644
index 000000000000..87791d2e487d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/wait-for-activate-worker.js
@@ -0,0 +1,40 @@
+// This worker remains in the installing phase so that the
+// navigation preload API can be tested when there is no
+// active worker.
+importScripts('/resources/testharness.js');
+importScripts('helpers.js');
+
+function expect_rejection(promise) {
+  return promise.then(
+      () => { return Promise.reject('unexpected fulfillment'); },
+      err => { assert_equals('InvalidStateError', err.name); });
+}
+
+function test_before_activation() {
+  const np = self.registration.navigationPreload;
+  return expect_rejection(np.enable())
+      .then(() => expect_rejection(np.disable()))
+      .then(() => expect_rejection(np.setHeaderValue('hi')))
+      .then(() => np.getState())
+      .then(state => expect_navigation_preload_state(
+          state, false, 'true', 'state should be the default'))
+      .then(() => 'PASS')
+      .catch(err => 'FAIL: ' + err);
+}
+
+var resolve_done_promise;
+var done_promise = new Promise(resolve => { resolve_done_promise = resolve; });
+
+// Run the test once the page messages this worker.
+self.addEventListener('message', e => {
+    e.waitUntil(test_before_activation()
+        .then(result => {
+            e.source.postMessage(result);
+            resolve_done_promise();
+          }));
+  });
+
+// Don't become the active worker until the test is done.
+self.addEventListener('install', e => {
+    e.waitUntil(done_promise);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/samesite-cookies.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/samesite-cookies.https.html
new file mode 100644
index 000000000000..a860d9545662
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/samesite-cookies.https.html
@@ -0,0 +1,61 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<meta name="timeout" content="long">
+<title>Navigation Preload: SameSite cookies</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<body>
+<script>
+const scope = 'resources/cookie.py';
+const script = 'resources/navigation-preload-worker.js';
+
+async function drop_cookie(t, same_site, cookie) {
+    const frame = await with_iframe(scope + '?same-site=' + same_site + '&cookie-name=' + cookie + '&drop=1');
+    t.add_cleanup(() => frame.remove());
+}
+
+async function same_site_cookies_test(t, same_site, cookie) {
+  // Remove the cookie before the first visit.
+  await drop_cookie(t, same_site, cookie);
+
+  {
+    const frame = await with_iframe(scope + '?same-site=' + same_site + '&cookie-name=' + cookie + '&drop=0');
+    t.add_cleanup(() => frame.remove());
+    // The body will be 0 because this is the first visit.
+    assert_equals(frame.contentDocument.body.textContent, '0', 'first visit');
+  }
+
+  {
+    const frame = await with_iframe(scope + '?same-site=' + same_site + '&cookie-name=' + cookie + '&drop=0');
+    t.add_cleanup(() => frame.remove());
+    // The body will be 1 because this is the second visit.
+    assert_equals(frame.contentDocument.body.textContent, '1', 'second visit');
+  }
+
+  // Remove the cookie after the test.
+  t.add_cleanup(() => drop_cookie(t, same_site, cookie));
+}
+
+promise_test(async t => {
+  const registration =
+    await service_worker_unregister_and_register(t, script, scope);
+  promise_test(t => registration.unregister(), 'Unregister a service worker.');
+
+  await wait_for_state(t, registration.installing, 'activated');
+  await registration.navigationPreload.enable();
+}, 'Set up a service worker for navigation preload tests.');
+
+promise_test(async t => {
+  await same_site_cookies_test(t, 'None', 'cookie-key-none');
+}, 'Navigation Preload for same site cookies (None).');
+
+promise_test(async t => {
+  await same_site_cookies_test(t, 'Strict', 'cookie-key-strict');
+}, 'Navigation Preload for same site cookies (Strict).');
+
+promise_test(async t => {
+  await same_site_cookies_test(t, 'Lax', 'cookie-key-lax');
+}, 'Navigation Preload for same site cookies (Lax).');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/samesite-iframe.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/samesite-iframe.https.html
new file mode 100644
index 000000000000..633da9926a8c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/samesite-iframe.https.html
@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload for same site iframe</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<body></body>
+<script>
+
+const SAME_SITE = get_host_info().HTTPS_REMOTE_ORIGIN;
+const RESOURCES_DIR = "/service-workers/service-worker/navigation-preload/resources/";
+
+/**
+ * This test is used for testing the NavigationPreload works in a same site iframe.
+ * The test scenario is
+ * 1. Create a same site iframe to register service worker and wait for it be activated
+ * 2. Create a same site iframe which be intercepted by the service worker.
+ * 3. Once the iframe is loaded, service worker should set the page through the preload response.
+ *    And checking if the iframe's body content is expected.
+ * 4. Unregister the service worker.
+ * 5. remove created iframes.
+ */
+
+promise_test(async (t) => {
+    let resolver;
+    let checkValue = false;
+    window.onmessage = (e) => {
+      if (checkValue) {
+        assert_equals(e.data, "samesite");
+        checkValue = false;
+      }
+      resolver();
+    };
+
+    let helperIframe = document.createElement("iframe");
+    helperIframe.src = SAME_SITE + RESOURCES_DIR + "samesite-sw-helper.html";
+    document.body.appendChild(helperIframe);
+
+    await new Promise(resolve => {
+      resolver = resolve;
+      helperIframe.onload = async () => {
+        helperIframe.contentWindow.postMessage("Register", '*');
+     }
+    });
+
+    let sameSiteIframe = document.createElement("iframe");
+    sameSiteIframe.src = SAME_SITE + RESOURCES_DIR + "samesite-iframe.html";
+    document.body.appendChild(sameSiteIframe);
+    await new Promise(resolve => {
+      resolver = resolve;
+      sameSiteIframe.onload = async() => {
+        checkValue = true;
+        sameSiteIframe.contentWindow.postMessage("GetBody", '*')
+      }
+    });
+
+    await new Promise(resolve => {
+      resolver = resolve;
+      helperIframe.contentWindow.postMessage("Unregister", '*')
+    });
+
+    helperIframe.remove();
+    sameSiteIframe.remove();
+  });
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-body.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-body.https.html
new file mode 100644
index 000000000000..0441c610b179
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-body.https.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<title>Service Worker: Navigation redirection must clear body</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<meta charset="utf-8">
+<body>
+<form id="test-form" method="POST" style="display: none;">
+  <input type="submit" id="submit-button" />
+</form>
+<script>
+promise_test(function(t) {
+    var scope = 'resources/navigation-redirect-body.py';
+    var script = 'resources/navigation-redirect-body-worker.js';
+    var registration;
+    var frame = document.createElement('frame');
+    var form = document.getElementById('test-form');
+    var submit_button = document.getElementById('submit-button');
+
+    frame.src = 'about:blank';
+    frame.name = 'target_frame';
+    frame.id = 'frame';
+    document.body.appendChild(frame);
+    t.add_cleanup(function() { document.body.removeChild(frame); });
+
+    form.action = scope;
+    form.target = 'target_frame';
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          var frame_load_promise = new Promise(function(resolve) {
+              frame.addEventListener('load', function() {
+                  resolve(frame.contentWindow.document.body.innerText);
+                }, false);
+            });
+          submit_button.click();
+          return frame_load_promise;
+        })
+      .then(function(text) {
+          var request_uri = decodeURIComponent(text);
+          assert_equals(
+              request_uri,
+              '/service-workers/service-worker/resources/navigation-redirect-body.py?redirect');
+          return registration.unregister();
+        });
+  }, 'Navigation redirection must clear body');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-resolution.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-resolution.https.html
new file mode 100644
index 000000000000..59e1cafec348
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-resolution.https.html
@@ -0,0 +1,58 @@
+<!DOCTYPE html>
+<title>Service Worker: Navigation Redirect Resolution</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+function make_absolute(url) {
+  return new URL(url, location).toString();
+}
+
+const script = 'resources/fetch-rewrite-worker.js';
+
+function redirect_result_test(scope, expected_url, description) {
+  promise_test(async t => {
+    const registration = await service_worker_unregister_and_register(
+          t, script, scope);
+      t.add_cleanup(() => {
+        return service_worker_unregister(t, scope);
+      })
+      await wait_for_state(t, registration.installing, 'activated');
+
+      // The navigation to |scope| will be resolved by a fetch to |redirect_url|
+      // which returns a relative Location header. If it is resolved relative to
+      // |scope|, the result will be navigate-redirect-resolution/blank.html. If
+      // relative to |redirect_url|, it will be resources/blank.html. The latter
+      // is correct.
+      const iframe = await with_iframe(scope);
+      t.add_cleanup(() => { iframe.remove(); });
+      assert_equals(iframe.contentWindow.location.href,
+                    make_absolute(expected_url));
+  }, description);
+}
+
+// |redirect_url| serves a relative redirect to resources/blank.html.
+const redirect_url = 'resources/redirect.py?Redirect=blank.html';
+
+// |scope_base| does not exist but will be replaced with a fetch of
+// |redirect_url| by fetch-rewrite-worker.js.
+const scope_base = 'resources/subdir/navigation-redirect-resolution?' +
+    'redirect-mode=manual&url=' +
+    encodeURIComponent(make_absolute(redirect_url));
+
+// When the Service Worker forwards the result of |redirect_url| as an
+// opaqueredirect response, the redirect uses the response's URL list as the
+// base URL, not the request.
+redirect_result_test(scope_base, 'resources/blank.html',
+                     'test relative opaqueredirect');
+
+// The response's base URL should be preserved across CacheStorage and clone.
+redirect_result_test(scope_base + '&cache=1', 'resources/blank.html',
+                     'test relative opaqueredirect with CacheStorage');
+redirect_result_test(scope_base + '&clone=1', 'resources/blank.html',
+                     'test relative opaqueredirect with clone');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-to-http.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-to-http.https.html
new file mode 100644
index 000000000000..d4d2788c5891
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-to-http.https.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<title>Service Worker: Service Worker can receive HTTP opaqueredirect response.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<meta charset="utf-8">
+<body></body>
+<script>
+async_test(function(t) {
+    var frame_src = get_host_info()['HTTPS_ORIGIN'] + base_path() +
+      'resources/navigation-redirect-to-http-iframe.html';
+    function on_message(e) {
+      assert_equals(e.data.results, 'OK');
+      t.done();
+    }
+
+    window.addEventListener('message', t.step_func(on_message), false);
+
+    with_iframe(frame_src)
+      .then(function(frame) {
+           t.add_cleanup(function() { frame.remove(); });
+         });
+  }, 'Verify Service Worker can receive HTTP opaqueredirect response.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-redirect.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-redirect.https.html
new file mode 100644
index 000000000000..a87de5693163
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-redirect.https.html
@@ -0,0 +1,846 @@
+<!DOCTYPE html>
+<title>Service Worker: Navigation redirection</title>
+<meta name="timeout" content="long">
+<!-- default variant tests document.location and intercepted URLs -->
+<meta name="variant" content="?default">
+<!-- client variant tests the Clients API (resultingClientId and Client.url) -->
+<meta name="variant" content="?client">
+
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+const host_info = get_host_info();
+
+// This test registers three Service Workers at SCOPE1, SCOPE2 and
+// OTHER_ORIGIN_SCOPE. And checks the redirected page's URL and the requests
+// which are intercepted by Service Worker while loading redirect page.
+const BASE_URL = host_info['HTTPS_ORIGIN'] + base_path();
+const OTHER_BASE_URL = host_info['HTTPS_REMOTE_ORIGIN'] + base_path();
+
+const SCOPE1 = BASE_URL + 'resources/navigation-redirect-scope1.py?';
+const SCOPE2 = BASE_URL + 'resources/navigation-redirect-scope2.py?';
+const OUT_SCOPE = BASE_URL + 'resources/navigation-redirect-out-scope.py?';
+const SCRIPT = 'resources/redirect-worker.js';
+
+const OTHER_ORIGIN_IFRAME_URL =
+      OTHER_BASE_URL + 'resources/navigation-redirect-other-origin.html';
+const OTHER_ORIGIN_SCOPE =
+      OTHER_BASE_URL + 'resources/navigation-redirect-scope1.py?';
+const OTHER_ORIGIN_OUT_SCOPE =
+      OTHER_BASE_URL + 'resources/navigation-redirect-out-scope.py?';
+
+let registrations;
+let workers;
+let other_origin_frame;
+let message_resolvers = {};
+let next_message_id = 0;
+
+promise_test(async t  => {
+  // In this frame we register a service worker at OTHER_ORIGIN_SCOPE.
+  // And will use this frame to communicate with the worker.
+  other_origin_frame = await with_iframe(OTHER_ORIGIN_IFRAME_URL);
+
+  // Register same-origin service workers.
+  registrations = await Promise.all([
+      service_worker_unregister_and_register(t, SCRIPT, SCOPE1),
+      service_worker_unregister_and_register(t, SCRIPT, SCOPE2)]);
+
+  // Wait for all workers to activate.
+  workers = registrations.map(get_effective_worker);
+  return Promise.all([
+      wait_for_state(t, workers[0], 'activated'),
+      wait_for_state(t, workers[1], 'activated'),
+      // This promise will resolve when |wait_for_worker_promise|
+      // in OTHER_ORIGIN_IFRAME_URL resolves.
+      send_to_iframe(other_origin_frame, {command: 'wait_for_worker'})]);
+}, 'initialize global state');
+
+function get_effective_worker(registration) {
+  if (registration.active)
+    return registration.active;
+  if (registration.waiting)
+    return registration.waiting;
+  if (registration.installing)
+    return registration.installing;
+}
+
+async function check_all_intercepted_urls(expected_urls) {
+  const urls = [];
+  urls.push(await get_intercepted_urls(workers[0]));
+  urls.push(await get_intercepted_urls(workers[1]));
+  // Gets the request URLs which are intercepted by OTHER_ORIGIN_SCOPE's
+  // SW. This promise will resolve when get_request_infos() in
+  // OTHER_ORIGIN_IFRAME_URL resolves.
+  const request_infos = await send_to_iframe(other_origin_frame,
+                                             {command: 'get_request_infos'});
+  urls.push(request_infos.map(info => { return info.url; }));
+
+  assert_object_equals(urls, expected_urls, 'Intercepted URLs should match.');
+}
+
+// Checks |clients| returned from a worker. Only the client matching
+// |expected_final_client_tag| should be found. Returns true if a client was
+// found. Note that the final client is not necessarily found by this worker,
+// if the client is cross-origin.
+//
+// |clients| is an object like:
+// {x: {found: true, id: id1, url: url1}, b: {found: false}}
+function check_clients(clients,
+                       expected_id,
+                       expected_url,
+                       expected_final_client_tag,
+                       worker_name) {
+  let found = false;
+  Object.keys(clients).forEach(key => {
+    const info = clients[key];
+    if (info.found) {
+      assert_true(!!expected_final_client_tag,
+                  `${worker_name} client tag exists`);
+      assert_equals(key, expected_final_client_tag,
+                    `${worker_name} client tag matches`);
+      assert_equals(info.id, expected_id, `${worker_name} client id`);
+      assert_equals(info.url, expected_url, `${worker_name} client url`);
+      found = true;
+    }
+  });
+  return found;
+}
+
+function check_resulting_client_ids(infos, expected_infos, actual_ids, worker) {
+  assert_equals(infos.length, expected_infos.length,
+                `request length for ${worker}`);
+  for (var i = 0; i < infos.length; i++) {
+    const tag = expected_infos[i].resultingClientIdTag;
+    const url = expected_infos[i].url;
+    const actual_id = infos[i].resultingClientId;
+    const expected_id = actual_ids[tag];
+    assert_equals(typeof(actual_id), 'string',
+                  `resultingClientId for ${url} request to ${worker}`);
+    if (expected_id) {
+      assert_equals(actual_id, expected_id,
+                    `resultingClientId for ${url} request to ${worker}`);
+    } else {
+      actual_ids[tag] = actual_id;
+    }
+  }
+}
+
+// Creates an iframe and navigates to |url|, which is expected to start a chain
+// of redirects.
+// - |expected_last_url| is the expected window.location after the
+//   navigation.
+//
+// - |expected_request_infos| is the expected requests that the service workers
+//   were dispatched fetch events for. The format is:
+//   [
+//     [
+//       // Requests received by workers[0].
+//       {url: url1, resultingClientIdTag: 'a'},
+//       {url: url2, resultingClientIdTag: 'a'}
+//     ],
+//     [
+//       // Requests received by workers[1].
+//       {url: url3, resultingClientIdTag: 'a'}
+//     ],
+//     [
+//       // Requests received by the cross-origin worker.
+//       {url: url4, resultingClientIdTag: 'x'}
+//       {url: url5, resultingClientIdTag: 'x'}
+//     ]
+//   ]
+//   Here, |url| is |event.request.url| and |resultingClientIdTag| represents
+//   |event.resultingClientId|. Since the actual client ids are not known
+//   beforehand, the expectation isn't the literal expected value, but all equal
+//   tags must map to the same actual id.
+//
+// - |expected_final_client_tag| is the resultingClientIdTag that is
+//   expected to map to the created client's id. This is null if there
+//   is no such tag, which can happen when the final request was a cross-origin
+//   redirect to out-scope, so no worker received a fetch event whose
+//   resultingClientId is the id of the resulting client.
+//
+// In the example above:
+// - workers[0] receives two requests with the same resultingClientId.
+// - workers[1] receives one request also with that resultingClientId.
+// - The cross-origin worker receives two requests with the same
+//   resultingClientId which differs from the previous one.
+// - Assuming |expected_final_client_tag| is 'x', then the created
+//   client has the id seen by the cross-origin worker above.
+function redirect_test(url,
+                       expected_last_url,
+                       expected_request_infos,
+                       expected_final_client_tag,
+                       test_name) {
+  promise_test(async t => {
+    const frame = await with_iframe(url);
+    t.add_cleanup(() => { frame.remove(); });
+
+    // Switch on variant.
+    if (document.location.search == '?client') {
+      return client_variant_test(url, expected_last_url, expected_request_infos,
+                                 expected_final_client_tag, test_name);
+    }
+
+    return default_variant_test(url, expected_last_url, expected_request_infos,
+                                frame, test_name);
+  }, test_name);
+}
+
+// The default variant tests the request interception chain and
+// resulting document.location.
+async function default_variant_test(url,
+                                    expected_last_url,
+                                    expected_request_infos,
+                                    frame,
+                                    test_name) {
+  const expected_intercepted_urls = expected_request_infos.map(
+      requests_for_worker => {
+    return requests_for_worker.map(info => {
+      return info.url;
+    });
+  });
+  await check_all_intercepted_urls(expected_intercepted_urls);
+  const last_url = await send_to_iframe(frame, 'getLocation');
+  assert_equals(last_url, expected_last_url, 'Last URL should match.');
+}
+
+// The "client" variant tests the Clients API using resultingClientId.
+async function client_variant_test(url,
+                                   expected_last_url,
+                                   expected_request_infos,
+                                   expected_final_client_tag,
+                                   test_name) {
+  // Request infos is an array like:
+  // [
+  //   [{url: url1, resultingClientIdTag: tag1}],
+  //   [{url: url2, resultingClientIdTag: tag2}],
+  //   [{url: url3: resultingClientIdTag: tag3}]
+  // ]
+  const requestInfos = await get_all_request_infos();
+
+  // We check the actual infos against the expected ones, and learn the
+  // actual ids as we go.
+  const actual_ids = {};
+  check_resulting_client_ids(requestInfos[0],
+                             expected_request_infos[0],
+                             actual_ids,
+                             'worker0');
+  check_resulting_client_ids(requestInfos[1],
+                             expected_request_infos[1],
+                             actual_ids,
+                             'worker1');
+  check_resulting_client_ids(requestInfos[2],
+                             expected_request_infos[2],
+                             actual_ids,
+                             'crossOriginWorker');
+
+  // Now |actual_ids| maps tag to actual id:
+  // {x: id1, b: id2, c: id3}
+  // Ask each worker to try to resolve the actual ids to clients.
+  // Only |expected_final_client_tag| should resolve to a client.
+  const client_infos = await get_all_clients(actual_ids);
+
+  // Client infos is an object like:
+  // {
+  //   worker0: {x: {found: true, id: id1, url: url1}, b: {found: false}},
+  //   worker1: {x: {found: true, id: id1, url: url1}},
+  //   crossOriginWorker: {x: {found: false}}, {b: {found: false}}
+  // }
+  //
+  // Now check each client info. check_clients() verifies each info: only
+  // |expected_final_client_tag| should ever be found and the found client
+  // should have the expected url and id. A wrinkle is that not all workers
+  // will find the client, if they are cross-origin to the client. This
+  // means check_clients() trivially passes if no clients are found. So
+  // additionally check that at least one worker found the client (|found|),
+  // if that was expected (|expect_found|).
+  let found = false;
+  const expect_found = !!expected_final_client_tag;
+  const expected_id = actual_ids[expected_final_client_tag];
+  found = check_clients(client_infos.worker0,
+                        expected_id,
+                        expected_last_url,
+                        expected_final_client_tag,
+                        'worker0');
+  found = check_clients(client_infos.worker1,
+                        expected_id,
+                        expected_last_url,
+                        expected_final_client_tag,
+                        'worker1') || found;
+  found = check_clients(client_infos.crossOriginWorker,
+                        expected_id,
+                        expected_last_url,
+                        expected_final_client_tag,
+                        'crossOriginWorker') || found;
+  assert_equals(found, expect_found, 'client found');
+
+  if (!expect_found) {
+    // TODO(falken): Ask the other origin frame if it has a client of the
+    // expected URL.
+  }
+}
+
+window.addEventListener('message', on_message, false);
+
+function on_message(e) {
+  if (e.origin != host_info['HTTPS_REMOTE_ORIGIN'] &&
+      e.origin != host_info['HTTPS_ORIGIN'] ) {
+    console.error('invalid origin: ' + e.origin);
+    return;
+  }
+  var resolve = message_resolvers[e.data.id];
+  delete message_resolvers[e.data.id];
+  resolve(e.data.result);
+}
+
+function send_to_iframe(frame, message) {
+  var message_id = next_message_id++;
+  return new Promise(resolve => {
+    message_resolvers[message_id] = resolve;
+    frame.contentWindow.postMessage(
+        {id: message_id, message},
+        '*');
+  });
+}
+
+async function get_all_clients(actual_ids) {
+  const client_infos = {};
+  client_infos['worker0'] = await get_clients(workers[0], actual_ids);
+  client_infos['worker1'] = await get_clients(workers[1], actual_ids);
+  client_infos['crossOriginWorker'] =
+      await send_to_iframe(other_origin_frame,
+                           {command: 'get_clients', actual_ids});
+  return client_infos;
+}
+
+function get_clients(worker, actual_ids) {
+  return new Promise(resolve => {
+    var channel = new MessageChannel();
+    channel.port1.onmessage = (msg) => {
+      resolve(msg.data.clients);
+    };
+    worker.postMessage({command: 'getClients', actual_ids, port: channel.port2},
+                       [channel.port2]);
+  });
+}
+
+// Returns an array of the URLs that |worker| received fetch events for:
+//   [url1, url2]
+async function get_intercepted_urls(worker) {
+  const infos = await get_request_infos(worker);
+  return infos.map(info => { return info.url; });
+}
+
+// Returns the requests that |worker| received fetch events for. The return
+// value is an array of format:
+// [
+//   {url: url1, resultingClientId: id},
+//   {url: url2, resultingClientId: id}
+// ]
+function get_request_infos(worker) {
+  return new Promise(resolve => {
+    var channel = new MessageChannel();
+    channel.port1.onmessage = (msg) => {
+      resolve(msg.data.requestInfos);
+    };
+    worker.postMessage({command: 'getRequestInfos', port: channel.port2},
+                       [channel.port2]);
+  });
+}
+
+// Returns an array of the requests the workers received fetch events for:
+// [
+//   // Requests from workers[0].
+//   [
+//     {url: url1, resultingClientIdTag: tag1},
+//     {url: url2, resultingClientIdTag: tag1}
+//   ],
+//
+//   // Requests from workers[1].
+//   [{url: url3, resultingClientIdTag: tag2}],
+//
+//   // Requests from the cross-origin worker.
+//   []
+// ]
+async function get_all_request_infos()  {
+  const request_infos = [];
+  request_infos.push(await get_request_infos(workers[0]));
+  request_infos.push(await get_request_infos(workers[1]));
+  request_infos.push(await send_to_iframe(other_origin_frame,
+                                          {command: 'get_request_infos'}));
+  return request_infos;
+}
+
+let url;
+let url1;
+let url2;
+
+// Normal redirect (from out-scope to in-scope).
+url = SCOPE1;
+redirect_test(
+    OUT_SCOPE + 'url=' + encodeURIComponent(url),
+    url,
+    [[{url, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'Normal redirect to same-origin scope.');
+
+
+url = SCOPE1 + '#ref';
+redirect_test(
+    OUT_SCOPE + 'url=' + encodeURIComponent(SCOPE1) + '#ref',
+    url,
+    [[{url, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'Normal redirect to same-origin scope with a hash fragment.');
+
+url = SCOPE1 + '#ref2';
+redirect_test(
+    OUT_SCOPE + 'url=' + encodeURIComponent(url) + '#ref',
+    url,
+    [[{url, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'Normal redirect to same-origin scope with different hash fragments.');
+
+url = OTHER_ORIGIN_SCOPE;
+redirect_test(
+    OUT_SCOPE + 'url=' + encodeURIComponent(url),
+    url,
+    [[], [], [{url, resultingClientIdTag: 'x'}]],
+    'x',
+    'Normal redirect to other-origin scope.');
+
+// SW fallbacked redirect. SW doesn't handle the fetch request.
+url = SCOPE1 + 'url=' + encodeURIComponent(OUT_SCOPE);
+redirect_test(
+    url,
+    OUT_SCOPE,
+    [[{url, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'SW-fallbacked redirect to same-origin out-scope.');
+
+url1 = SCOPE1 + 'url=' + encodeURIComponent(SCOPE1);
+url2 = SCOPE1;
+redirect_test(
+    url1,
+    url2,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'x'},
+        {url: url2, resultingClientIdTag: 'x'}
+      ],
+      [],
+      []
+    ],
+    'x',
+    'SW-fallbacked redirect to same-origin same-scope.');
+
+url1 = SCOPE1 + 'url=' + encodeURIComponent(SCOPE1) + '#ref';
+url2 = SCOPE1 + '#ref';
+redirect_test(
+    url1,
+    url2,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'x'},
+        {url: url2, resultingClientIdTag: 'x'}
+      ],
+      [],
+      []
+    ],
+    'x',
+    'SW-fallbacked redirect to same-origin same-scope with a hash fragment.');
+
+url1 = SCOPE1 + 'url=' + encodeURIComponent(SCOPE1 + '#ref2') + '#ref';
+url2 = SCOPE1 + '#ref2';
+redirect_test(
+    url1,
+    url2,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'x'},
+        {url: url2, resultingClientIdTag: 'x'}
+      ],
+      [],
+      []
+    ],
+    'x',
+    'SW-fallbacked redirect to same-origin same-scope with different hash ' +
+    'fragments.');
+
+url1 = SCOPE1 + 'url=' + encodeURIComponent(SCOPE2);
+url2 = SCOPE2;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'x'}],
+      [{url: url2, resultingClientIdTag: 'x'}],
+      []
+    ],
+    'x',
+    'SW-fallbacked redirect to same-origin other-scope.');
+
+url1 = SCOPE1 + 'url=' + encodeURIComponent(OTHER_ORIGIN_OUT_SCOPE);
+url2 = OTHER_ORIGIN_OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'a'}], [], []],
+    null,
+    'SW-fallbacked redirect to other-origin out-scope.');
+
+url1 = SCOPE1 + 'url=' + encodeURIComponent(OTHER_ORIGIN_SCOPE);
+url2 = OTHER_ORIGIN_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'a'}],
+      [],
+      [{url: url2, resultingClientIdTag: 'x'}]
+    ],
+    'x',
+    'SW-fallbacked redirect to other-origin in-scope.');
+
+
+url3 = SCOPE1;
+url2 = OTHER_ORIGIN_SCOPE + 'url=' + encodeURIComponent(url3);
+url1 = SCOPE1 + 'url=' + encodeURIComponent(url2);
+redirect_test(
+    url1,
+    url3,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'a'},
+        {url: url3, resultingClientIdTag: 'x'}
+      ],
+      [],
+      [{url: url2, resultingClientIdTag: 'b'}]
+    ],
+    'x',
+    'SW-fallbacked redirect to other-origin and back to same-origin.');
+
+// SW generated redirect.
+// SW: event.respondWith(Response.redirect(params['url']));
+url1 = SCOPE1 + 'sw=gen&url=' + encodeURIComponent(OUT_SCOPE);
+url2 = OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'SW-generated redirect to same-origin out-scope.');
+
+url1 = SCOPE1 + 'sw=gen&url=' + encodeURIComponent(OUT_SCOPE) + '#ref';
+url2 = OUT_SCOPE + '#ref';
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'SW-generated redirect to same-origin out-scope with a hash fragment.');
+
+url1 = SCOPE1 + 'sw=gen&url=' + encodeURIComponent(OUT_SCOPE + '#ref2') + '#ref';
+url2 = OUT_SCOPE + '#ref2';
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'SW-generated redirect to same-origin out-scope with different hash ' +
+    'fragments.');
+
+url1 = SCOPE1 + 'sw=gen&url=' + encodeURIComponent(SCOPE1);
+url2 = SCOPE1;
+redirect_test(
+    url1,
+    url2,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'x'},
+        {url: url2, resultingClientIdTag: 'x'}
+      ],
+      [],
+      []
+    ],
+    'x',
+    'SW-generated redirect to same-origin same-scope.');
+
+url1 = SCOPE1 + 'sw=gen&url=' + encodeURIComponent(SCOPE2);
+url2 = SCOPE2;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'x'}],
+      [{url: url2, resultingClientIdTag: 'x'}],
+      []
+    ],
+    'x',
+    'SW-generated redirect to same-origin other-scope.');
+
+url1 = SCOPE1 + 'sw=gen&url=' + encodeURIComponent(OTHER_ORIGIN_OUT_SCOPE);
+url2 = OTHER_ORIGIN_OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'a'}], [], []],
+    null,
+    'SW-generated redirect to other-origin out-scope.');
+
+url1 = SCOPE1 + 'sw=gen&url=' + encodeURIComponent(OTHER_ORIGIN_SCOPE);
+url2 = OTHER_ORIGIN_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'a'}],
+      [],
+      [{url: url2, resultingClientIdTag: 'x'}]
+    ],
+    'x',
+    'SW-generated redirect to other-origin in-scope.');
+
+
+// SW fetched redirect.
+// SW: event.respondWith(fetch(event.request));
+url1 = SCOPE1 + 'sw=fetch&url=' + encodeURIComponent(OUT_SCOPE)
+url2 = OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'SW-fetched redirect to same-origin out-scope.');
+
+url1 = SCOPE1 + 'sw=fetch&url=' + encodeURIComponent(SCOPE1);
+url2 = SCOPE1;
+redirect_test(
+    url1,
+    url2,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'x'},
+        {url: url2, resultingClientIdTag: 'x'}
+      ],
+      [],
+      []
+    ],
+    'x',
+    'SW-fetched redirect to same-origin same-scope.');
+
+url1 = SCOPE1 + 'sw=fetch&url=' + encodeURIComponent(SCOPE2);
+url2 = SCOPE2;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'x'}],
+      [{url: url2, resultingClientIdTag: 'x'}],
+      []
+    ],
+    'x',
+    'SW-fetched redirect to same-origin other-scope.');
+
+url1 = SCOPE1 + 'sw=fetch&url=' + encodeURIComponent(OTHER_ORIGIN_OUT_SCOPE);
+url2 = OTHER_ORIGIN_OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'a'}], [], []],
+    null,
+    'SW-fetched redirect to other-origin out-scope.');
+
+url1 = SCOPE1 + 'sw=fetch&url=' + encodeURIComponent(OTHER_ORIGIN_SCOPE);
+url2 = OTHER_ORIGIN_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'a'}],
+      [],
+      [{url: url2, resultingClientIdTag: 'x'}]
+    ],
+    'x',
+    'SW-fetched redirect to other-origin in-scope.');
+
+
+// SW responds with a fetch from a different url.
+// SW: event.respondWith(fetch(params['url']));
+url2 = SCOPE1;
+url1 = SCOPE1 + 'sw=fetch-url&url=' + encodeURIComponent(url2);
+redirect_test(
+    url1,
+    url1,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'x'}
+      ],
+      [],
+      []
+    ],
+    'x',
+    'SW-fetched response from different URL, same-origin same-scope.');
+
+
+// Opaque redirect.
+// SW: event.respondWith(fetch(
+//         new Request(event.request.url, {redirect: 'manual'})));
+url1 = SCOPE1 + 'sw=manual&url=' + encodeURIComponent(OUT_SCOPE);
+url2 = OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'Redirect to same-origin out-scope with opaque redirect response.');
+
+url1 = SCOPE1 + 'sw=manual&url=' + encodeURIComponent(SCOPE1);
+url2 = SCOPE1;
+redirect_test(
+    url1,
+    url2,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'x'},
+        {url: url2, resultingClientIdTag: 'x'}
+      ],
+      [],
+      []
+    ],
+    'x',
+    'Redirect to same-origin same-scope with opaque redirect response.');
+
+url1 = SCOPE1 + 'sw=manual&url=' + encodeURIComponent(SCOPE2);
+url2 = SCOPE2;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'x'}],
+      [{url: url2, resultingClientIdTag: 'x'}],
+      []
+    ],
+    'x',
+    'Redirect to same-origin other-scope with opaque redirect response.');
+
+url1 = SCOPE1 + 'sw=manual&url=' + encodeURIComponent(OTHER_ORIGIN_OUT_SCOPE);
+url2 = OTHER_ORIGIN_OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'a'}], [], []],
+    null,
+    'Redirect to other-origin out-scope with opaque redirect response.');
+
+url1 = SCOPE1 + 'sw=manual&url=' + encodeURIComponent(OTHER_ORIGIN_SCOPE);
+url2 = OTHER_ORIGIN_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'a'}],
+      [],
+      [{url: url2, resultingClientIdTag: 'x'}]
+    ],
+    'x',
+    'Redirect to other-origin in-scope with opaque redirect response.');
+
+url= SCOPE1 + 'sw=manual&noLocationRedirect';
+redirect_test(
+    url, url, [[{url, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'No location redirect response.');
+
+
+// Opaque redirect passed through Cache.
+// SW responds with an opaque redirectresponse from the Cache API.
+url1 = SCOPE1 + 'sw=manualThroughCache&url=' + encodeURIComponent(OUT_SCOPE);
+url2 = OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'Redirect to same-origin out-scope with opaque redirect response which ' +
+    'is passed through Cache.');
+
+url1 = SCOPE1 + 'sw=manualThroughCache&url=' + encodeURIComponent(SCOPE1);
+url2 = SCOPE1;
+redirect_test(
+    url1,
+    url2,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'x'},
+        {url: url2, resultingClientIdTag: 'x'}
+      ],
+      [],
+      []
+    ],
+    'x',
+    'Redirect to same-origin same-scope with opaque redirect response which ' +
+    'is passed through Cache.');
+
+url1 = SCOPE1 + 'sw=manualThroughCache&url=' + encodeURIComponent(SCOPE2);
+url2 = SCOPE2;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'x'}],
+      [{url: url2, resultingClientIdTag: 'x'}],
+      []
+    ],
+    'x',
+    'Redirect to same-origin other-scope with opaque redirect response which ' +
+    'is passed through Cache.');
+
+url1 = SCOPE1 + 'sw=manualThroughCache&url=' +
+       encodeURIComponent(OTHER_ORIGIN_OUT_SCOPE);
+url2 = OTHER_ORIGIN_OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'a'}], [], []],
+    null,
+    'Redirect to other-origin out-scope with opaque redirect response which ' +
+    'is passed through Cache.');
+
+url1 = SCOPE1 + 'sw=manualThroughCache&url=' +
+       encodeURIComponent(OTHER_ORIGIN_SCOPE);
+url2 = OTHER_ORIGIN_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'a'}],
+      [],
+      [{url: url2, resultingClientIdTag: 'x'}],
+    ],
+    'x',
+    'Redirect to other-origin in-scope with opaque redirect response which ' +
+    'is passed through Cache.');
+
+url = SCOPE1 + 'sw=manualThroughCache&noLocationRedirect';
+redirect_test(
+    url,
+    url,
+    [[{url, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'No location redirect response via Cache.');
+
+// Clean up the test environment. This promise_test() needs to be the last one.
+promise_test(async t => {
+  registrations.forEach(async registration => {
+    if (registration)
+      await registration.unregister();
+  });
+  await send_to_iframe(other_origin_frame, {command: 'unregister'});
+  other_origin_frame.remove();
+}, 'clean up global state');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-sets-cookie.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-sets-cookie.https.html
new file mode 100644
index 000000000000..7f6c756f5572
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-sets-cookie.https.html
@@ -0,0 +1,133 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>Service Worker: Navigation setting cookies</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
+<script src="/cookies/resources/cookie-helper.sub.js"></script>
+<body>
+<script>
+'use strict';
+
+const scopepath = '/cookies/resources/setSameSite.py?with-sw';
+
+async function unregister_service_worker(origin) {
+  let target_url = origin +
+      '/service-workers/service-worker/resources/unregister-rewrite-worker.html' +
+      '?scopepath=' + encodeURIComponent(scopepath);
+  const w = window.open(target_url);
+  try {
+    await wait_for_message('SW-UNREGISTERED');
+  } finally {
+    w.close();
+  }
+}
+
+async function register_service_worker(origin) {
+  let target_url = origin +
+      '/service-workers/service-worker/resources/register-rewrite-worker.html' +
+      '?scopepath=' + encodeURIComponent(scopepath);
+  const w = window.open(target_url);
+  try {
+    await wait_for_message('SW-REGISTERED');
+  } finally {
+    w.close();
+  }
+}
+
+async function clear_cookies(origin) {
+  let target_url = origin + '/cookies/samesite/resources/puppet.html';
+  const w = window.open(target_url);
+  try {
+    await wait_for_message('READY');
+    w.postMessage({ type: 'drop' }, '*');
+    await wait_for_message('drop-complete');
+  } finally {
+    w.close();
+  }
+}
+
+// The following tests are adapted from /cookies/samesite/setcookie-navigation.https.html
+
+// Asserts that cookies are present or not present (according to `expectation`)
+// in the cookie string `cookies` with the correct names and value.
+function assert_cookies_present(cookies, value, expected_cookie_names, expectation) {
+  for (name of expected_cookie_names) {
+    let re = new RegExp("(?:^|; )" + name + "=" + value + "(?:$|;)");
+    let assertion = expectation ? assert_true : assert_false;
+    assertion(re.test(cookies), "`" + name + "=" + value + "` in cookies");
+  }
+}
+
+// Navigate from ORIGIN to |origin_to|, expecting the navigation to set SameSite
+// cookies on |origin_to|.
+function navigate_test(method, origin_to, query, title) {
+  promise_test(async function(t) {
+    // The cookies don't need to be cleared on each run because |value| is
+    // a new random value on each run, so on each run we are overwriting and
+    // checking for a cookie with a different random value.
+    let value = query + "&" + Math.random();
+    let url_from = SECURE_ORIGIN + "/cookies/samesite/resources/navigate.html"
+    let url_to = origin_to + "/cookies/resources/setSameSite.py?" + value;
+    var w = window.open(url_from);
+    await wait_for_message('READY', SECURE_ORIGIN);
+    assert_equals(SECURE_ORIGIN, window.origin);
+    assert_equals(SECURE_ORIGIN, w.origin);
+    let command = (method === "POST") ? "post-form" : "navigate";
+    w.postMessage({ type: command, url: url_to }, "*");
+    let message = await wait_for_message('COOKIES_SET', origin_to);
+    let samesite_cookie_names = ['samesite_strict', 'samesite_lax', 'samesite_none', 'samesite_unspecified'];
+    assert_cookies_present(message.data.cookies, value, samesite_cookie_names, true);
+    w.close();
+  }, title);
+}
+
+promise_test(async t => {
+  await register_service_worker(SECURE_ORIGIN);
+  await register_service_worker(SECURE_CROSS_SITE_ORIGIN);
+}, 'Setup service workers');
+
+navigate_test("GET", SECURE_ORIGIN, "with-sw&ignore",
+              "Same-site top-level navigation with fallback service worker should be able to set SameSite=* cookies.");
+navigate_test("GET", SECURE_CROSS_SITE_ORIGIN, "with-sw&ignore",
+              "Cross-site top-level navigation with fallback service worker should be able to set SameSite=* cookies.");
+navigate_test("POST", SECURE_ORIGIN, "with-sw&ignore",
+              "Same-site top-level POST with fallback service worker should be able to set SameSite=* cookies.");
+navigate_test("POST", SECURE_CROSS_SITE_ORIGIN, "with-sw&ignore",
+              "Cross-site top-level with fallback service worker POST should be able to set SameSite=* cookies.");
+
+navigate_test("GET", SECURE_ORIGIN, "with-sw",
+              "Same-site top-level navigation with passthrough service worker should be able to set SameSite=* cookies.");
+navigate_test("GET", SECURE_CROSS_SITE_ORIGIN, "with-sw",
+              "Cross-site top-level navigation with passthrough service worker should be able to set SameSite=* cookies.");
+navigate_test("POST", SECURE_ORIGIN, "with-sw",
+              "Same-site top-level POST with passthrough service worker should be able to set SameSite=* cookies.");
+navigate_test("POST", SECURE_CROSS_SITE_ORIGIN, "with-sw",
+              "Cross-site top-level with passthrough service worker POST should be able to set SameSite=* cookies.");
+
+navigate_test("GET", SECURE_ORIGIN, "with-sw&navpreload",
+              "Same-site top-level navigation with navpreload service worker should be able to set SameSite=* cookies.");
+navigate_test("GET", SECURE_CROSS_SITE_ORIGIN, "with-sw&navpreload",
+              "Cross-site top-level navigation with navpreload service worker should be able to set SameSite=* cookies.");
+// navpreload not supported with POST method
+
+navigate_test("GET", SECURE_ORIGIN, "with-sw&change-request",
+              "Same-site top-level navigation with change-request service worker should be able to set SameSite=* cookies.");
+navigate_test("GET", SECURE_CROSS_SITE_ORIGIN, "with-sw&change-request",
+              "Cross-site top-level navigation with change-request service worker should be able to set SameSite=* cookies.");
+navigate_test("POST", SECURE_ORIGIN, "with-sw&change-request",
+              "Same-site top-level POST with change-request service worker should be able to set SameSite=* cookies.");
+navigate_test("POST", SECURE_CROSS_SITE_ORIGIN, "with-sw&change-request",
+              "Cross-site top-level with change-request service worker POST should be able to set SameSite=* cookies.");
+
+promise_test(async t => {
+  await unregister_service_worker(SECURE_ORIGIN);
+  await unregister_service_worker(SECURE_CROSS_SITE_ORIGIN);
+  await clear_cookies(SECURE_ORIGIN);
+  await clear_cookies(SECURE_CROSS_SITE_ORIGIN);
+}, 'Cleanup service workers');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-timing-extended.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-timing-extended.https.html
new file mode 100644
index 000000000000..acb02c6fe1f5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-timing-extended.https.html
@@ -0,0 +1,55 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+
+<script>
+const timingEventOrder = [
+    'startTime',
+    'workerStart',
+    'fetchStart',
+    'requestStart',
+    'responseStart',
+    'responseEnd',
+];
+
+function navigate_in_frame(frame, url) {
+    frame.contentWindow.location = url;
+    return new Promise((resolve) => {
+        frame.addEventListener('load', () => {
+            const timing = frame.contentWindow.performance.getEntriesByType('navigation')[0];
+            const {timeOrigin} = frame.contentWindow.performance;
+            resolve({
+                workerStart: timing.workerStart + timeOrigin,
+                fetchStart: timing.fetchStart + timeOrigin
+            })
+        });
+    });
+}
+
+const worker_url = 'resources/navigation-timing-worker-extended.js';
+
+promise_test(async (t) => {
+    const scope = 'resources/timings/dummy.html';
+    const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+    t.add_cleanup(() => registration.unregister());
+    await wait_for_state(t, registration.installing, 'activating');
+    const frame = await with_iframe('resources/empty.html');
+    t.add_cleanup(() => frame.remove());
+
+    const [timingFromEntry, timingFromWorker] = await Promise.all([
+        navigate_in_frame(frame, scope),
+        new Promise(resolve => {
+            window.addEventListener('message', m => {
+                resolve(m.data)
+            })
+        })])
+
+    assert_greater_than(timingFromWorker.activateWorkerEnd, timingFromEntry.workerStart,
+        'workerStart marking should not wait for worker activation to finish');
+    assert_greater_than(timingFromEntry.fetchStart, timingFromWorker.activateWorkerEnd,
+        'fetchStart should be marked once the worker is activated');
+    assert_greater_than(timingFromWorker.handleFetchEvent, timingFromEntry.fetchStart,
+        'fetchStart should be marked before the Fetch event handler is called');
+}, 'Service worker controlled navigation timing');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-timing-sizes.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-timing-sizes.https.html
new file mode 100644
index 000000000000..e726a31f1706
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-timing-sizes.https.html
@@ -0,0 +1,113 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker Navigation Timing</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+
+<body>
+  <script>
+
+    promise_test(async t => {
+      var script = 'resources/pass-through-worker.js';
+      var scope = 'resources/blank.html';
+
+      const registration = await service_worker_unregister_and_register(t, script, scope);
+      t.add_cleanup(() => registration.unregister());
+      await wait_for_state(t, registration.installing, 'activated');
+
+      const iframe = await with_iframe(scope);
+
+      // Sanity, to check that we actually loaded the document.
+      assert_equals(iframe.contentWindow.document.title, "Empty doc");
+      t.add_cleanup(() => iframe.remove());
+      const navigationEntry = iframe.contentWindow.performance.getEntriesByType("navigation")[0];
+
+      const main_page_resource_timing = performance.getEntriesByType("resource").filter(
+        e => e.name.includes('blank'))[0];
+
+      assert_greater_than(navigationEntry.encodedBodySize, 0,
+        'Navigation timing should have encodedBodySize larger than 0.');
+
+      assert_equals(navigationEntry.decodedBodySize, navigationEntry.encodedBodySize,
+        'Navigation timing\'s decodedBodySize and encodedBodySize should be equal.');
+
+      assert_greater_than(main_page_resource_timing.encodedBodySize, 0,
+        'Corresponding resource timing emitted on parent page should have decodedBodySize larger than 0.');
+
+      assert_equals(main_page_resource_timing.encodedBodySize, main_page_resource_timing.decodedBodySize,
+        'Corresponding resource timing emitted on parent page should have equal\
+        decodedBodySize and encodedBodySize.');
+
+    }, 'Body sizes in a regular pass-through');
+
+    promise_test(async t => {
+      var script = 'resources/pass-through-worker.js';
+      var scope = 'resources/simple.txt';
+
+      const registration = await service_worker_unregister_and_register(t, script, scope);
+      t.add_cleanup(() => registration.unregister());
+      await wait_for_state(t, registration.installing, 'activated');
+
+      const iframe = await with_iframe(scope);
+
+      // Sanity, to check that we actually loaded the text file.
+      assert_equals(iframe.contentWindow.document.body.textContent, "a simple text file\n");
+      t.add_cleanup(() => iframe.remove());
+      const navigationEntry = iframe.contentWindow.performance.getEntriesByType("navigation")[0];
+
+      const main_page_resource_timing = performance.getEntriesByType("resource").filter(
+        e => e.name.includes('blank'))[0];
+
+      assert_greater_than(navigationEntry.encodedBodySize, 0,
+        'Navigation timing should have encodedBodySize larger than 0.');
+
+      assert_equals(navigationEntry.decodedBodySize, navigationEntry.encodedBodySize,
+        'Navigation timing\'s decodedBodySize and encodedBodySize should be equal.');
+
+      assert_greater_than(main_page_resource_timing.encodedBodySize, 0,
+        'Corresponding resource timing emitted on parent page should have decodedBodySize larger than 0.');
+
+      assert_equals(main_page_resource_timing.encodedBodySize, main_page_resource_timing.decodedBodySize,
+        'Corresponding resource timing emitted on parent page should have equal\
+        decodedBodySize and encodedBodySize.');
+
+    }, 'Body sizes in a pass-through with non html content');
+
+    promise_test(async t => {
+      var script = 'resources/pass-through-worker.js';
+      var scope = 'resources/blank.html';
+
+      const registration = await service_worker_unregister_and_register(t, script, scope);
+      t.add_cleanup(() => registration.unregister());
+      await wait_for_state(t, registration.installing, 'activated');
+
+      const iframe = await with_iframe(scope + "?pipe=gzip");
+      // Sanity, to check that we actually loaded the document.
+      assert_equals(iframe.contentWindow.document.title, "Empty doc");
+      t.add_cleanup(() => iframe.remove());
+
+      const navigationEntry = iframe.contentWindow.performance.getEntriesByType("navigation")[0];
+
+      const main_page_resource_timing = performance.getEntriesByType("resource").filter(
+        e => e.name.includes('blank'))[0];
+
+      assert_greater_than(navigationEntry.decodedBodySize, 0,
+        'Navigation timing should have decodedBodySize larger than 0.');
+
+      // The response body that comes from a service worker respondWith promise
+      // should have identical encoded and decoded body sizes, regardless of what
+      // the service worker itself saw, according to the spec.
+      assert_equals(navigationEntry.encodedBodySize, navigationEntry.decodedBodySize,
+        'Navigation timing should have equal decodedBodySize and encodedBodySize.');
+
+      assert_greater_than(main_page_resource_timing.decodedBodySize, 0,
+        'Corresponding resource timing emitted on parent page should have decodedBodySize larger than 0.');
+
+      assert_equals(main_page_resource_timing.encodedBodySize, navigationEntry.decodedBodySize,
+        'Corresponding resource timing emitted on parent page should have equal decodedBodySize and \
+        encodedBodySize.');
+
+    }, 'Body sizes in a regular pass-through with gzip');
+  </script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-timing.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-timing.https.html
new file mode 100644
index 000000000000..75cab40458c6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-timing.https.html
@@ -0,0 +1,77 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+
+<script>
+const timingEventOrder = [
+    'startTime',
+    'workerStart',
+    'fetchStart',
+    'requestStart',
+    'responseStart',
+    'responseEnd',
+];
+
+function verify(timing) {
+    for (let i = 0; i < timingEventOrder.length - 1; i++) {
+        assert_true(timing[timingEventOrder[i]] <= timing[timingEventOrder[i + 1]],
+                `Expected ${timingEventOrder[i]} <= ${timingEventOrder[i + 1]}`);
+    }
+}
+
+function navigate_in_frame(frame, url) {
+    frame.contentWindow.location = url;
+    return new Promise((resolve) => {
+        frame.addEventListener('load', () => {
+            const timing = frame.contentWindow.performance.getEntriesByType('navigation')[0];
+            resolve(timing);
+        });
+    });
+}
+
+const worker_url = 'resources/navigation-timing-worker.js';
+
+promise_test(async (t) => {
+    const scope = 'resources/empty.html';
+    const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+    t.add_cleanup(() => registration.unregister());
+    await wait_for_state(t, registration.installing, 'activated');
+    const frame = await with_iframe(scope);
+    t.add_cleanup(() => frame.remove());
+
+    const timing = await navigate_in_frame(frame, scope);
+    assert_greater_than(timing.workerStart, 0);
+    verify(timing);
+}, 'Service worker controlled navigation timing');
+
+promise_test(async (t) => {
+    const scope = 'resources/empty.html?network-fallback';
+    const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+    t.add_cleanup(() => registration.unregister());
+    await wait_for_state(t, registration.installing, 'activated');
+    const frame = await with_iframe(scope);
+    t.add_cleanup(() => frame.remove());
+
+    const timing = await navigate_in_frame(frame, scope);
+    assert_greater_than(timing.workerStart, 0);
+    verify(timing);
+}, 'Service worker controlled navigation timing network fallback');
+
+promise_test(async (t) => {
+    const scope = 'resources/redirect.py?Redirect=empty.html';
+    const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+    t.add_cleanup(() => registration.unregister());
+    await wait_for_state(t, registration.installing, 'activated');
+    const frame = await with_iframe(scope);
+    t.add_cleanup(() => frame.remove());
+
+    const timing = await navigate_in_frame(frame, scope);
+    verify(timing);
+    // Additional checks for redirected navigation.
+    assert_true(timing.redirectStart <= timing.redirectEnd,
+        'Expected redirectStart <= redirectEnd');
+    assert_true(timing.redirectEnd <= timing.fetchStart,
+        'Expected redirectEnd <= fetchStart');
+}, 'Service worker controlled navigation timing redirect');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/nested-blob-url-workers.https.html b/test/fixtures/wpt/service-workers/service-worker/nested-blob-url-workers.https.html
new file mode 100644
index 000000000000..7269cbb701fa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/nested-blob-url-workers.https.html
@@ -0,0 +1,42 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Service Worker: nested blob URL worker clients</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+const SCRIPT = 'resources/simple-intercept-worker.js';
+const SCOPE = 'resources/';
+const RESOURCE = 'resources/simple.txt';
+
+promise_test((t) => {
+  return runTest(t, 'resources/nested-blob-url-workers.html');
+}, 'Nested blob URL workers should be intercepted by a service worker.');
+
+promise_test((t) => {
+  return runTest(t, 'resources/nested-worker-created-from-blob-url-worker.html');
+}, 'Nested worker created from a blob URL worker should be intercepted by a service worker.');
+
+promise_test((t) => {
+  return runTest(t, 'resources/nested-blob-url-worker-created-from-worker.html');
+}, 'Nested blob URL worker created from a worker should be intercepted by a service worker.');
+
+async function runTest(t, iframe_url) {
+  const reg = await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+  t.add_cleanup(_ => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  const frame = await with_iframe(iframe_url);
+  t.add_cleanup(_ => frame.remove());
+  assert_not_equals(frame.contentWindow.navigator.serviceWorker.controller,
+                    null, 'frame should be controlled');
+
+  const response_text = await frame.contentWindow.fetch_in_worker(RESOURCE);
+  assert_equals(response_text, 'intercepted by service worker',
+                'fetch() should be intercepted.');
+}
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/next-hop-protocol.https.html b/test/fixtures/wpt/service-workers/service-worker/next-hop-protocol.https.html
new file mode 100644
index 000000000000..0805db9e24db
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/next-hop-protocol.https.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: Verify nextHopProtocol is set correctly</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+async function getNextHopProtocol(frame, url) {
+  let final_url = new URL(url, self.location).href;
+  await frame.contentWindow.fetch(final_url).then(r => r.text());
+  let entryList = frame.contentWindow.performance.getEntriesByName(final_url);
+  let entry = entryList[entryList.length - 1];
+  return entry.nextHopProtocol;
+}
+
+async function runTest(t, base_url, expected_protocol) {
+  const scope = 'resources/empty.html?next-hop-protocol';
+  const script = 'resources/fetch-rewrite-worker.js';
+  let frame;
+
+  const registration =
+      await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(async _ => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+  frame = await with_iframe(scope);
+  t.add_cleanup(_ => frame.remove());
+
+  assert_equals(await getNextHopProtocol(frame, `${base_url}?generate-png`),
+                '', 'nextHopProtocol is not set on synthetic response');
+  assert_equals(await getNextHopProtocol(frame, `${base_url}?ignore`),
+                expected_protocol, 'nextHopProtocol is set on fallback');
+  assert_equals(await getNextHopProtocol(frame, `${base_url}`),
+                '', 'nextHopProtocol is not set on pass-through');
+  assert_equals(await getNextHopProtocol(frame, `${base_url}?cache`),
+                '', 'nextHopProtocol is not set on cached response');
+}
+
+promise_test(async (t) => {
+  return runTest(t, 'resources/empty.js', 'http/1.1');
+}, 'nextHopProtocol reports H1 correctly when routed via a service worker.');
+
+// This may be expected to fail if the WPT infrastructure does not fully
+// support H2 protocol testing yet.
+promise_test(async (t) => {
+  return runTest(t, 'resources/empty.h2.js', 'h2');
+}, 'nextHopProtocol reports H2 correctly when routed via a service worker.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/no-dynamic-import-in-module.any.js b/test/fixtures/wpt/service-workers/service-worker/no-dynamic-import-in-module.any.js
new file mode 100644
index 000000000000..f7c2ef37b8b9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/no-dynamic-import-in-module.any.js
@@ -0,0 +1,7 @@
+// META: global=serviceworker-module
+
+// This is imported to ensure import('./basic-module-2.js') fails even if
+// it has been previously statically imported.
+import './resources/basic-module-2.js';
+
+import './resources/no-dynamic-import.js';
diff --git a/test/fixtures/wpt/service-workers/service-worker/no-dynamic-import.any.js b/test/fixtures/wpt/service-workers/service-worker/no-dynamic-import.any.js
new file mode 100644
index 000000000000..25b370b7094b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/no-dynamic-import.any.js
@@ -0,0 +1,3 @@
+// META: global=serviceworker
+
+importScripts('resources/no-dynamic-import.js');
diff --git a/test/fixtures/wpt/service-workers/service-worker/onactivate-script-error.https.html b/test/fixtures/wpt/service-workers/service-worker/onactivate-script-error.https.html
new file mode 100644
index 000000000000..f5e80bb9a456
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/onactivate-script-error.https.html
@@ -0,0 +1,74 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function wait_for_install(worker) {
+  return new Promise(function(resolve, reject) {
+      worker.addEventListener('statechange', function(event) {
+          if (worker.state == 'installed')
+            resolve();
+          else if (worker.state == 'redundant')
+            reject();
+        });
+    });
+}
+
+function wait_for_activate(worker) {
+  return new Promise(function(resolve, reject) {
+      worker.addEventListener('statechange', function(event) {
+          if (worker.state == 'activated')
+            resolve();
+          else if (worker.state == 'redundant')
+            reject();
+        });
+    });
+}
+
+function make_test(name, script) {
+  promise_test(function(t) {
+      var scope = script;
+      var registration;
+      return service_worker_unregister_and_register(t, script, scope)
+        .then(function(r) {
+            registration = r;
+
+            t.add_cleanup(function() {
+                return r.unregister();
+              });
+
+            return wait_for_install(registration.installing);
+          })
+        .then(function() {
+            // Activate should succeed regardless of script errors.
+            return wait_for_activate(registration.waiting);
+          });
+    }, name);
+}
+
+[
+  {
+    name: 'activate handler throws an error',
+    script: 'resources/onactivate-throw-error-worker.js',
+  },
+  {
+    name: 'activate handler throws an error, error handler does not cancel',
+    script: 'resources/onactivate-throw-error-with-empty-onerror-worker.js',
+  },
+  {
+    name: 'activate handler dispatches an event that throws an error',
+    script: 'resources/onactivate-throw-error-from-nested-event-worker.js',
+  },
+  {
+    name: 'activate handler throws an error that is cancelled',
+    script: 'resources/onactivate-throw-error-then-cancel-worker.js',
+  },
+  {
+    name: 'activate handler throws an error and prevents default',
+    script: 'resources/onactivate-throw-error-then-prevent-default-worker.js',
+  }
+].forEach(function(test_case) {
+    make_test(test_case.name, test_case.script);
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/oninstall-script-error.https.html b/test/fixtures/wpt/service-workers/service-worker/oninstall-script-error.https.html
new file mode 100644
index 000000000000..fe7f6e901206
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/oninstall-script-error.https.html
@@ -0,0 +1,72 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function wait_for_install_event(worker) {
+  return new Promise(function(resolve) {
+      worker.addEventListener('statechange', function(event) {
+          if (worker.state == 'installed')
+            resolve(true);
+          else if (worker.state == 'redundant')
+            resolve(false);
+        });
+    });
+}
+
+function make_test(name, script, expect_install) {
+  promise_test(function(t) {
+      var scope = script;
+      return service_worker_unregister_and_register(t, script, scope)
+        .then(function(registration) {
+            return wait_for_install_event(registration.installing);
+          })
+        .then(function(did_install) {
+            assert_equals(did_install, expect_install,
+                          'The worker was installed');
+          })
+    }, name);
+}
+
+[
+  {
+    name: 'install handler throws an error',
+    script: 'resources/oninstall-throw-error-worker.js',
+    expect_install: true
+  },
+  {
+    name: 'install handler throws an error, error handler does not cancel',
+    script: 'resources/oninstall-throw-error-with-empty-onerror-worker.js',
+    expect_install: true
+  },
+  {
+    name: 'install handler dispatches an event that throws an error',
+    script: 'resources/oninstall-throw-error-from-nested-event-worker.js',
+    expect_install: true
+  },
+  {
+    name: 'install handler throws an error in the waitUntil',
+    script: 'resources/oninstall-waituntil-throw-error-worker.js',
+    expect_install: false
+  },
+
+  // The following two cases test what happens when the ServiceWorkerGlobalScope
+  // 'error' event handler cancels the resulting error event.  Since the
+  // original 'install' event handler through, the installation should still
+  // be stopped in this case.  See:
+  // https://github.com/slightlyoff/ServiceWorker/issues/778
+  {
+    name: 'install handler throws an error that is cancelled',
+    script: 'resources/oninstall-throw-error-then-cancel-worker.js',
+    expect_install: true
+  },
+  {
+    name: 'install handler throws an error and prevents default',
+    script: 'resources/oninstall-throw-error-then-prevent-default-worker.js',
+    expect_install: true
+  }
+].forEach(function(test_case) {
+    make_test(test_case.name, test_case.script, test_case.expect_install);
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/opaque-response-preloaded.https.html b/test/fixtures/wpt/service-workers/service-worker/opaque-response-preloaded.https.html
new file mode 100644
index 000000000000..417aa4ebec83
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/opaque-response-preloaded.https.html
@@ -0,0 +1,50 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Opaque responses should not be reused for XHRs</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const WORKER =
+  'resources/opaque-response-preloaded-worker.js';
+
+var done;
+
+// These test that the browser does not inappropriately use a cached opaque
+// response for a request that is not no-cors. The test opens a controlled
+// iframe that uses link rel=preload to issue a same-origin no-cors request.
+// The service worker responds to the request with an opaque response. Then the
+// iframe does an XHR (not no-cors) to that URL again. The request should fail.
+promise_test(t => {
+    const SCOPE =
+      'resources/opaque-response-being-preloaded-xhr.html';
+    const promise = new Promise(resolve => done = resolve);
+
+    return service_worker_unregister_and_register(t, WORKER, SCOPE)
+      .then(reg => {
+           add_completion_callback(() => reg.unregister());
+           return wait_for_state(t, reg.installing, 'activated');
+         })
+      .then(() => with_iframe(SCOPE))
+      .then(frame => t.add_cleanup(() => frame.remove() ))
+      .then(() => promise)
+      .then(result => assert_equals(result, 'PASS'));
+  }, 'Opaque responses should not be reused for XHRs, loading case');
+
+promise_test(t => {
+    const SCOPE =
+      'resources/opaque-response-preloaded-xhr.html';
+    const promise = new Promise(resolve => done = resolve);
+
+    return service_worker_unregister_and_register(t, WORKER, SCOPE)
+      .then(reg => {
+           add_completion_callback(() => reg.unregister());
+           return wait_for_state(t, reg.installing, 'activated');
+         })
+      .then(() => with_iframe(SCOPE))
+      .then(frame => t.add_cleanup(() => frame.remove() ))
+      .then(() => promise)
+      .then(result => assert_equals(result, 'PASS'));
+  }, 'Opaque responses should not be reused for XHRs, done case');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/opaque-script.https.html b/test/fixtures/wpt/service-workers/service-worker/opaque-script.https.html
new file mode 100644
index 000000000000..7d2121855dfa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/opaque-script.https.html
@@ -0,0 +1,71 @@
+<!doctype html>
+<title>Cache Storage: verify scripts loaded from cache_storage are marked opaque</title>
+<link rel="help" href="https://w3c.github.io/ServiceWorker/#cache-interface">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script>
+'use strict';
+
+const SW_URL = 'resources/opaque-script-sw.js';
+const BASE_SCOPE = './resources/opaque-script-frame.html';
+const SAME_ORIGIN_BASE = new URL('./resources/', self.location.href).href;
+const CROSS_ORIGIN_BASE = new URL('./resources/',
+    get_host_info().HTTPS_REMOTE_ORIGIN + base_path()).href;
+
+function wait_for_error() {
+  return new Promise(resolve => {
+    self.addEventListener('message', function messageHandler(evt) {
+      if (evt.data.type !== 'ErrorEvent')
+        return;
+      self.removeEventListener('message', messageHandler);
+      resolve(evt.data.msg);
+    });
+  });
+}
+
+// Load an iframe that dynamically adds a script tag that is
+// same/cross origin and large/small.  It then calls a function
+// defined in that loaded script that throws an unhandled error.
+// The resulting message exposed in the global onerror handler
+// is reported back from this function.  Opaque cross origin
+// scripts should not expose the details of the uncaught exception.
+async function get_error_message(t, mode, size) {
+  const script_base = mode === 'same-origin' ? SAME_ORIGIN_BASE
+                                             : CROSS_ORIGIN_BASE;
+  const script = script_base + `opaque-script-${size}.js`;
+  const scope = BASE_SCOPE + `?script=${script}`;
+  const reg = await service_worker_unregister_and_register(t, SW_URL, scope);
+  t.add_cleanup(_ => reg.unregister());
+  assert_true(!!reg.installing);
+  await wait_for_state(t, reg.installing, 'activated');
+  const error_promise = wait_for_error();
+  const f = await with_iframe(scope);
+  t.add_cleanup(_ => f.remove());
+  const error = await error_promise;
+  return error;
+}
+
+promise_test(async t => {
+  const error = await get_error_message(t, 'same-origin', 'small');
+  assert_true(error.includes('Intentional error'));
+}, 'Verify small same-origin cache_storage scripts are not opaque.');
+
+promise_test(async t => {
+  const error = await get_error_message(t, 'same-origin', 'large');
+  assert_true(error.includes('Intentional error'));
+}, 'Verify large same-origin cache_storage scripts are not opaque.');
+
+promise_test(async t => {
+  const error = await get_error_message(t, 'cross-origin', 'small');
+  assert_false(error.includes('Intentional error'));
+}, 'Verify small cross-origin cache_storage scripts are opaque.');
+
+promise_test(async t => {
+  const error = await get_error_message(t, 'cross-origin', 'large');
+  assert_false(error.includes('Intentional error'));
+}, 'Verify large cross-origin cache_storage scripts are opaque.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/partitioned-claim.tentative.https.html b/test/fixtures/wpt/service-workers/service-worker/partitioned-claim.tentative.https.html
new file mode 100644
index 000000000000..1f42c528e0b3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/partitioned-claim.tentative.https.html
@@ -0,0 +1,74 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<title>Service Worker: Partitioned Service Workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/partitioned-utils.js"></script>
+
+<body>
+This test creates a iframe in a first-party context and then registers a
+service worker (such that the iframe client is unclaimed).
+A third-party iframe is then created which has its SW call clients.claim()
+and then the test checks that the 1p iframe was not claimed int he process.
+Finally the test has its SW call clients.claim() and confirms the 1p iframe is
+claimed.
+
+<script>
+promise_test(async t => {
+  const script = './resources/partitioned-storage-sw.js';
+  const scope = './resources/partitioned-';
+
+  // Add a 1p iframe.
+  const wait_frame_url = new URL(
+    './resources/partitioned-service-worker-iframe-claim.html?1p-mode',
+    self.location);
+
+  const frame = await with_iframe(wait_frame_url, false);
+  t.add_cleanup(async () => {
+    frame.remove();
+  });
+
+  // Add service worker to this 1P context.
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Register the message listener.
+  self.addEventListener('message', messageEventHandler);
+
+  // Now we need to create a third-party iframe whose SW will claim it and then
+  // the iframe will postMessage that its serviceWorker.controller state has
+  // changed.
+  const third_party_iframe_url = new URL(
+    './resources/partitioned-service-worker-iframe-claim.html?3p-mode',
+    get_host_info().HTTPS_ORIGIN + self.location.pathname);
+
+  // Create the 3p window (which will in turn create the iframe with the SW)
+  // and await on its data.
+  const frame_3p_data = await loadAndReturnSwData(t, third_party_iframe_url,
+    'window');
+  assert_equals(frame_3p_data.status, "success",
+     "3p iframe was successfully claimed");
+
+  // Confirm that the 1p iframe wasn't claimed at the same time.
+  const controller_1p_iframe = makeMessagePromise();
+  frame.contentWindow.postMessage({type: "get-controller"});
+  const controller_1p_iframe_data = await controller_1p_iframe;
+  assert_equals(controller_1p_iframe_data.controller, null,
+     "Test iframe client isn't claimed yet.");
+
+
+  // Tell the SW to claim.
+  const claimed_1p_iframe = makeMessagePromise();
+  reg.active.postMessage({type: "claim"});
+  const claimed_1p_iframe_data = await claimed_1p_iframe;
+
+  assert_equals(claimed_1p_iframe_data.status, "success",
+     "iframe client was successfully claimed.");
+
+}, "ServiceWorker's clients.claim() is partitioned");
+</script>
+
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/partitioned-cookies.tentative.https.html b/test/fixtures/wpt/service-workers/service-worker/partitioned-cookies.tentative.https.html
new file mode 100644
index 000000000000..7a8bd3f5cf85
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/partitioned-cookies.tentative.https.html
@@ -0,0 +1,100 @@
+<!DOCTYPE html>
+<head>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>Service Worker: Partitioned Cookies</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/partitioned-cookies-test-helpers.js"></script>
+</head>
+
+<!--
+  This test exercises partitioned service workers' interaction with partitioned
+  cookies. Partitioned service workers should only be able to interact with
+  partitioned cookies whose partition key matches the worker's partition.
+-->
+
+<body>
+<script>
+
+promise_test(async t => {
+  const script = './resources/partitioned-cookies-sw.js'
+  const scope = './resources/partitioned-cookies-'
+  const absolute_scope = new URL(scope, window.location).href;
+
+  // Set a Partitioned cookie.
+  document.cookie =
+      '__Host-partitioned=123; Secure; Path=/; SameSite=None; Partitioned;';
+  assert_true(document.cookie.includes('__Host-partitioned=123'));
+
+  // Set an unpartitioned cookie.
+  document.cookie = 'unpartitioned=456; Secure; Path=/; SameSite=None;';
+  assert_true(document.cookie.includes('unpartitioned=456'));
+
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  await wait_for_state(t, reg.installing, 'activated');
+  t.add_cleanup(() => reg.unregister());
+
+  const next_message = worker_message_generator();
+
+  const retrieved_registrations =
+        await navigator.serviceWorker.getRegistrations();
+  // It's possible that other tests have left behind other service workers.
+  // This steps filters those other SWs out.
+  const filtered_registrations =
+    retrieved_registrations.filter(reg => reg.scope == absolute_scope);
+
+  // First test that the worker script started correctly and message passing
+  // is enabed.
+  filtered_registrations[0].active.postMessage({type: 'test_message'});
+  const msg1 = await next_message();
+  assert_true(msg1.ok, 'Message passing');
+
+  // Test that the partitioned cookie is available to this worker via HTTP.
+  filtered_registrations[0].active.postMessage({type: 'echo_cookies_http'});
+  const msg2 = await next_message();
+  assert_true(msg2.ok, 'Get cookies');
+  assert_true(
+      msg2.cookies.includes('__Host-partitioned'),
+      'Can access partitioned cookie via HTTP');
+  assert_true(
+      msg2.cookies.includes('unpartitioned'),
+      'Can access unpartitioned cookie via HTTP');
+
+  // Test that the partitioned cookie is available to this worker via
+  // CookieStore API.
+  filtered_registrations[0].active.postMessage({type: 'echo_cookies_js'});
+  const msg3 = await next_message();
+  assert_true(msg3.ok, 'Get cookies');
+  assert_true(
+      msg3.cookies.includes('__Host-partitioned'),
+      'Can access partitioned cookie via JS');
+  assert_true(
+      msg3.cookies.includes('unpartitioned'),
+      'Can access unpartitioned cookie via JS');
+
+  // Test that the partitioned cookie is not available to this worker in HTTP
+  // requests from importScripts.
+  filtered_registrations[0].active.postMessage({type: 'echo_cookies_import'});
+  const msg4 = await next_message();
+  assert_true(msg4.ok, 'Get cookies');
+  assert_true(
+      msg4.cookies.includes('__Host-partitioned'),
+      'Can access partitioned cookie via importScripts');
+  assert_true(
+      msg4.cookies.includes('unpartitioned'),
+      'Can access unpartitioned cookie via importScripts');
+
+  const popup = window.open(
+      new URL(
+          `./resources/partitioned-cookies-3p-window.html?origin=${
+              encodeURIComponent(self.location.origin)}`,
+          get_host_info().HTTPS_NOTSAMESITE_ORIGIN + self.location.pathname));
+  await fetch_tests_from_window(popup);
+});
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/partitioned-getRegistrations.tentative.https.html b/test/fixtures/wpt/service-workers/service-worker/partitioned-getRegistrations.tentative.https.html
new file mode 100644
index 000000000000..7c4d4f1e028b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/partitioned-getRegistrations.tentative.https.html
@@ -0,0 +1,99 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<title>Service Worker: Partitioned Service Workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/partitioned-utils.js"></script>
+
+<body>
+This test loads a SW in a first-party context and gets the SW's (randomly)
+generated ID. It does the same thing for the SW but in a third-party context
+and then confirms that the IDs are different.
+
+<script>
+promise_test(async t => {
+  const script = './resources/partitioned-storage-sw.js'
+  const scope = './resources/partitioned-'
+  const absoluteScope = new URL(scope, window.location).href;
+
+  // Add service worker to this 1P context.
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Register the message listener.
+  self.addEventListener('message', messageEventHandler);
+
+  // Open an iframe that will create a promise within the SW.
+  // The query param is there to track which request the service worker is
+  // handling.
+  //
+  // This promise is necessary to prevent the service worker from being
+  // shutdown during the test which would cause a new ID to be generated
+  // and thus invalidate the test.
+  const wait_frame_url = new URL(
+    './resources/partitioned-waitUntilResolved.fakehtml?From1pFrame',
+    self.location);
+
+  // We don't really need the data the SW sent us from this request
+  // but we can use the ID to confirm the SW wasn't shut down during the
+  // test.
+  const wait_frame_1p_data = await loadAndReturnSwData(t, wait_frame_url,
+                                                       'iframe');
+
+  // Now we need to create a third-party iframe that will send us its SW's
+  // ID.
+  const third_party_iframe_url = new URL(
+    './resources/partitioned-service-worker-third-party-iframe-getRegistrations.html',
+    get_host_info().HTTPS_ORIGIN + self.location.pathname);
+
+  // Create the 3p window (which will in turn create the iframe with the SW)
+  // and await on its data.
+  const frame_3p_ID = await loadAndReturnSwData(t, third_party_iframe_url,
+    'window');
+
+  // Now get this frame's SW's ID.
+  const frame_1p_ID_promise = makeMessagePromise();
+
+  const retrieved_registrations =
+        await navigator.serviceWorker.getRegistrations();
+  // It's possible that other tests have left behind other service workers.
+  // This steps filters those other SWs out.
+  const filtered_registrations =
+    retrieved_registrations.filter(reg => reg.scope == absoluteScope);
+
+  // Register a listener on the service worker container and then forward to
+  // the self event listener so we can reuse the existing message promise
+  // function.
+  navigator.serviceWorker.addEventListener('message', evt => {
+    self.postMessage(evt.data, '*');
+  });
+
+  filtered_registrations[0].active.postMessage({type: "get-id"});
+
+  const  frame_1p_ID = await frame_1p_ID_promise;
+
+  // First check that the SW didn't shutdown during the run of the test.
+  // (Note: We're not using assert_equals because random values make it
+  // difficult to use a test expectations file.)
+  assert_true(wait_frame_1p_data.ID === frame_1p_ID.ID,
+    "1p SW didn't shutdown");
+  // Now check that the 1p and 3p IDs differ.
+  assert_false(frame_1p_ID.ID === frame_3p_ID.ID,
+    "1p SW ID matches 3p SW ID");
+
+  // Finally, for clean up, resolve the SW's promise so it stops waiting.
+  const resolve_frame_url = new URL(
+    './resources/partitioned-resolve.fakehtml?From1pFrame', self.location);
+
+  // We don't care about the data.
+  await loadAndReturnSwData(t, resolve_frame_url, 'iframe');
+
+}, "ServiceWorker's getRegistrations() is partitioned");
+
+
+</script>
+
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/partitioned-matchAll.tentative.https.html b/test/fixtures/wpt/service-workers/service-worker/partitioned-matchAll.tentative.https.html
new file mode 100644
index 000000000000..46beec819c8e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/partitioned-matchAll.tentative.https.html
@@ -0,0 +1,65 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<title>Service Worker: Partitioned Service Workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/partitioned-utils.js"></script>
+
+<body>
+This test loads a SW in a first-party context and gets has the SW send
+its list of clients from client.matchAll(). It does the same thing for the
+SW in a third-party context as well and confirms that each SW see's the correct
+clients and that they don't see eachother's clients.
+
+<script>
+promise_test(async t => {
+
+  const script = './resources/partitioned-storage-sw.js'
+  const scope = './resources/partitioned-'
+
+  // Add service worker to this 1P context.
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Register the message listener.
+  self.addEventListener('message', messageEventHandler);
+
+  // Create a third-party iframe that will send us its SW's clients.
+  const third_party_iframe_url = new URL(
+    './resources/partitioned-service-worker-third-party-iframe-matchAll.html',
+    get_host_info().HTTPS_ORIGIN + self.location.pathname);
+
+  const {urls_list: frame_3p_urls_list} = await loadAndReturnSwData(t,
+    third_party_iframe_url, 'window');
+
+  // Register a listener on the service worker container and then forward to
+  // the self event listener so we can reuse the existing message promise
+  // function.
+  navigator.serviceWorker.addEventListener('message', evt => {
+    self.postMessage(evt.data, '*');
+  });
+
+  const frame_1p_data_promise = makeMessagePromise();
+
+  reg.active.postMessage({type: "get-match-all"});
+
+  const {urls_list: frame_1p_urls_list} = await frame_1p_data_promise;
+
+  // If partitioning is working, the 1p and 3p SWs should only see a single
+  // client.
+  assert_equals(frame_3p_urls_list.length, 1);
+  assert_equals(frame_1p_urls_list.length, 1);
+  // Confirm that the expected URL was seen by each.
+  assert_equals(frame_3p_urls_list[0], third_party_iframe_url.toString(),
+    "3p SW has the correct client url.");
+  assert_equals(frame_1p_urls_list[0], window.location.href,
+    "1P SW has the correct client url.");
+}, "ServiceWorker's matchAll() is partitioned");
+
+
+</script>
+
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/partitioned.tentative.https.html b/test/fixtures/wpt/service-workers/service-worker/partitioned.tentative.https.html
new file mode 100644
index 000000000000..17a375f9c732
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/partitioned.tentative.https.html
@@ -0,0 +1,188 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<title>Service Worker: Partitioned Service Workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/partitioned-utils.js"></script>
+
+<body>
+  <!-- Debugging text for both test cases -->
+  The 3p iframe's postMessage:
+  <p id="iframe_response">No message received</p>
+
+  The nested iframe's postMessage:
+  <p id="nested_iframe_response">No message received</p>
+
+<script>
+promise_test(async t => {
+  const script = './resources/partitioned-storage-sw.js'
+  const scope = './resources/partitioned-'
+
+  // Add service worker to this 1P context. wait_for_state() and
+  // service_worker_unregister_and_register() are helper functions
+  // for creating test ServiceWorkers defined in:
+  // service-workers/service-worker/resources/test-helpers.sub.js
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Registers the message listener with messageEventHandler(), defined in:
+  // service-workers/service-worker/resources/partitioned-utils.js
+  self.addEventListener('message', messageEventHandler);
+
+  // Open an iframe that will create a promise within the SW.
+  // Defined in service-workers/service-worker/resources/partitioned-storage-sw.js:
+  // `waitUntilResolved.fakehtml`: URL scope that creates the promise.
+  // `?From1pFrame`: query param that tracks which request the service worker is
+  // handling.
+  const wait_frame_url = new URL(
+    './resources/partitioned-waitUntilResolved.fakehtml?From1pFrame',
+    self.location);
+
+  // Loads a child iframe with wait_frame_url as the content and returns
+  // a promise for the data messaged from the loaded iframe.
+  // loadAndReturnSwData() defined in:
+  // service-workers/service-worker/resources/partitioned-utils.js:
+  const wait_frame_1p_data = await loadAndReturnSwData(t, wait_frame_url,
+                                                       'iframe');
+  assert_equals(wait_frame_1p_data.source, 'From1pFrame',
+    'The data for the 1p frame came from the wrong source');
+
+  // Now create a 3p iframe that will try to resolve the SW in a 3p context.
+  const third_party_iframe_url = new URL(
+    './resources/partitioned-service-worker-third-party-iframe.html',
+    get_host_info().HTTPS_ORIGIN + self.location.pathname);
+
+  // loadAndReturnSwData() creates a HTTPS_NOTSAMESITE_ORIGIN or 3p `window`
+  // element which embeds an iframe with the ServiceWorker and returns
+  // a promise of the data messaged from that frame.
+  const frame_3p_data = await loadAndReturnSwData(t, third_party_iframe_url, 'window');
+  assert_equals(frame_3p_data.source, 'From3pFrame',
+    'The data for the 3p frame came from the wrong source');
+
+  // Print some debug info to the main frame.
+  document.getElementById("iframe_response").innerHTML =
+      "3p iframe's has_pending: " + frame_3p_data.has_pending + " source: " +
+      frame_3p_data.source + ". ";
+
+  // Now do the same for the 1p iframe.
+  // Defined in service-workers/service-worker/resources/partitioned-storage-sw.js:
+  // `resolve.fakehtml`: URL scope that resolves the promise.
+  const resolve_frame_url = new URL(
+    './resources/partitioned-resolve.fakehtml?From1pFrame', self.location);
+
+  const frame_1p_data = await loadAndReturnSwData(t, resolve_frame_url,
+                                                  'iframe');
+  assert_equals(frame_1p_data.source, 'From1pFrame',
+    'The data for the 1p frame came from the wrong source');
+  // Both the 1p frames should have been serviced by the same service worker ID.
+  // If this isn't the case then that means the SW could have been deactivated
+  // which invalidates the test.
+  assert_equals(frame_1p_data.ID, wait_frame_1p_data.ID,
+    'The 1p frames were serviced by different service workers.');
+
+  document.getElementById("iframe_response").innerHTML +=
+    "1p iframe's has_pending: " + frame_1p_data.has_pending + " source: " +
+    frame_1p_data.source;
+
+  // If partitioning is working correctly then only the 1p iframe should see
+  // (and resolve) its SW's promise. Additionally the two frames should see
+  // different IDs.
+  assert_true(frame_1p_data.has_pending,
+      'The 1p iframe saw a pending promise in the service worker.');
+  assert_false(frame_3p_data.has_pending,
+    'The 3p iframe saw a pending promise in the service worker.');
+  assert_not_equals(frame_1p_data.ID, frame_3p_data.ID,
+    'The frames were serviced by the same service worker thread.');
+}, 'Services workers under different top-level sites are partitioned.');
+
+// Optional Test: Checking for partitioned ServiceWorkers in an A->B->A
+// (nested-iframes with cross-site ancestor) scenario.
+promise_test(async t => {
+  const script = './resources/partitioned-storage-sw.js'
+  const scope = './resources/partitioned-'
+
+  // Add service worker to this 1P context. wait_for_state() and
+  // service_worker_unregister_and_register() are helper functions
+  // for creating test ServiceWorkers defined in:
+  // service-workers/service-worker/resources/test-helpers.sub.js
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Registers the message listener with messageEventHandler(), defined in:
+  // service-workers/service-worker/resources/partitioned-utils.js
+  self.addEventListener('message', messageEventHandler);
+
+  // Open an iframe that will create a promise within the SW.
+  // Defined in service-workers/service-worker/resources/partitioned-storage-sw.js:
+  // `waitUntilResolved.fakehtml`: URL scope that creates the promise.
+  // `?From1pFrame`: query param that tracks which request the service worker is
+  // handling.
+  const wait_frame_url = new URL(
+    './resources/partitioned-waitUntilResolved.fakehtml?From1pFrame',
+    self.location);
+
+  // Load a child iframe with wait_frame_url as the content.
+  // loadAndReturnSwData() defined in:
+  // service-workers/service-worker/resources/partitioned-utils.js:
+  const wait_frame_1p_data = await loadAndReturnSwData(t, wait_frame_url,
+                                                       'iframe');
+  assert_equals(wait_frame_1p_data.source, 'From1pFrame',
+    'The data for the 1p frame came from the wrong source');
+
+  // Now create a set of nested iframes in the configuration A1->B->A2
+  // where B is cross-site and A2 is same-site to this top-level
+  // site (A1). The innermost iframe of the nested iframes (A2) will
+  // create an additional iframe to finally resolve the ServiceWorker.
+  const nested_iframe_url = new URL(
+    './resources/partitioned-service-worker-nested-iframe-parent.html',
+    get_host_info().HTTPS_NOTSAMESITE_ORIGIN + self.location.pathname);
+
+  // Create the nested iframes (which will in turn create the iframe
+  // with the ServiceWorker) and await on receiving its data.
+  const nested_iframe_data = await loadAndReturnSwData(t, nested_iframe_url, 'iframe');
+  assert_equals(nested_iframe_data.source, 'FromNestedFrame',
+    'The data for the nested iframe frame came from the wrong source');
+
+  // Print some debug info to the main frame.
+  document.getElementById("nested_iframe_response").innerHTML =
+      "Nested iframe's has_pending: " + nested_iframe_data.has_pending + " source: " +
+      nested_iframe_data.source + ". ";
+
+  // Now do the same for the 1p iframe.
+  // Defined in service-workers/service-worker/resources/partitioned-storage-sw.js:
+  // `resolve.fakehtml`: URL scope that resolves the promise.
+  const resolve_frame_url = new URL(
+    './resources/partitioned-resolve.fakehtml?From1pFrame', self.location);
+
+  const frame_1p_data = await loadAndReturnSwData(t, resolve_frame_url,
+                                                  'iframe');
+  assert_equals(frame_1p_data.source, 'From1pFrame',
+    'The data for the 1p frame came from the wrong source');
+  // Both the 1p frames should have been serviced by the same service worker ID.
+  // If this isn't the case then that means the SW could have been deactivated
+  // which invalidates the test.
+  assert_equals(frame_1p_data.ID, wait_frame_1p_data.ID,
+    'The 1p frames were serviced by different service workers.');
+
+  document.getElementById("nested_iframe_response").innerHTML +=
+    "1p iframe's has_pending: " + frame_1p_data.has_pending + " source: " +
+    frame_1p_data.source;
+
+  // If partitioning is working correctly then only the 1p iframe should see
+  // (and resolve) its SW's promise. Additionally, the innermost iframe of
+  // the nested iframes (A2 in the configuration A1->B->A2) should have a
+  // different service worker ID than the 1p (A1) frame.
+  assert_true(frame_1p_data.has_pending,
+      'The 1p iframe saw a pending promise in the service worker.');
+  assert_false(nested_iframe_data.has_pending,
+    'The 3p iframe saw a pending promise in the service worker.');
+  assert_not_equals(frame_1p_data.ID, nested_iframe_data.ID,
+    'The frames were serviced by the same service worker thread.');
+}, 'Services workers with cross-site ancestors are partitioned.');
+
+</script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/performance-timeline.https.html b/test/fixtures/wpt/service-workers/service-worker/performance-timeline.https.html
new file mode 100644
index 000000000000..e56e6fe416ff
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/performance-timeline.https.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+service_worker_test(
+    'resources/performance-timeline-worker.js',
+    'Test Performance Timeline API in Service Worker');
+
+// The purpose of this test is to verify that service worker overhead
+// is included in the Performance API's timing information.
+promise_test(t => {
+  let script = 'resources/empty-but-slow-worker.js';
+  let scope = 'resources/sample.txt?slow-sw-timing';
+  let url = new URL(scope, window.location).href;
+  let slowURL = url + '&slow';
+  let frame;
+  return service_worker_unregister_and_register(t, script, scope)
+    .then(reg => {
+        t.add_cleanup(() => service_worker_unregister(t, scope));
+
+        return wait_for_state(t, reg.installing, 'activated');
+      })
+    .then(_ => with_iframe(scope))
+    .then(f => {
+      frame = f;
+      return frame.contentWindow.fetch(url).then(r => r && r.text());
+    })
+    .then(_ => {
+      return frame.contentWindow.fetch(slowURL).then(r => r && r.text());
+    })
+    .then(_ => {
+      function elapsed(u) {
+        let entry = frame.contentWindow.performance.getEntriesByName(u);
+        return entry[0] ? entry[0].duration : undefined;
+      }
+      let urlTime = elapsed(url);
+      let slowURLTime = elapsed(slowURL);
+      // Verify the request slowed by the service worker is indeed measured
+      // to be slower.  Note, we compare to smaller delay instead of the exact
+      // delay amount to avoid making the test racy under automation.
+      assert_greater_than(slowURLTime, urlTime + 1000,
+                  'Slow service worker request should measure increased delay.');
+      frame.remove();
+    })
+}, 'empty service worker fetch event included in performance timings');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/postMessage-client-worker.js b/test/fixtures/wpt/service-workers/service-worker/postMessage-client-worker.js
new file mode 100644
index 000000000000..64d944d2b546
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/postMessage-client-worker.js
@@ -0,0 +1,23 @@
+async function doTest(e)
+{
+    if (e.resultingClientId) {
+        const promise = new Promise(async resolve => {
+            let counter = 0;
+            const client = await self.clients.get(e.resultingClientId);
+            if (client)
+                client.postMessage(counter++);
+            if (e.request.url.includes("repeatMessage")) {
+                setInterval(() => {
+                    if (client)
+                        client.postMessage(counter++);
+                }, 100);
+            }
+            setTimeout(() => {
+                resolve(fetch(e.request));
+            }, 1000);
+        });
+        e.respondWith(promise);
+    }
+}
+
+self.addEventListener("fetch", e => e.waitUntil(doTest(e)));
diff --git a/test/fixtures/wpt/service-workers/service-worker/postmessage-blob-url.https.html b/test/fixtures/wpt/service-workers/service-worker/postmessage-blob-url.https.html
new file mode 100644
index 000000000000..16fddd57b835
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/postmessage-blob-url.https.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<title>Service Worker: postMessage Blob URL</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    let script = 'resources/postmessage-blob-url.js';
+    let scope = 'resources/blank.html';
+    let registration;
+    let blobText = 'Blob text';
+    let blob;
+    let blobUrl;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(r => {
+          add_completion_callback(() => r.unregister());
+          registration = r;
+          let worker = registration.installing;
+          blob = new Blob([blobText]);
+          blobUrl = URL.createObjectURL(blob);
+          return new Promise(resolve => {
+            navigator.serviceWorker.onmessage = e => { resolve(e.data); }
+            worker.postMessage(blobUrl);
+          });
+        })
+      .then(response => {
+          assert_equals(response, 'Worker reply:' + blobText);
+          URL.revokeObjectURL(blobUrl);
+          return registration.unregister();
+        });
+  }, 'postMessage Blob URL to a ServiceWorker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/postmessage-from-waiting-serviceworker.https.html b/test/fixtures/wpt/service-workers/service-worker/postmessage-from-waiting-serviceworker.https.html
new file mode 100644
index 000000000000..117def9eb2a6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/postmessage-from-waiting-serviceworker.https.html
@@ -0,0 +1,50 @@
+<!DOCTYPE html>
+<title>Service Worker: postMessage from waiting serviceworker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+function echo(worker, data) {
+  return new Promise(resolve => {
+    navigator.serviceWorker.addEventListener('message', function onMsg(evt) {
+      navigator.serviceWorker.removeEventListener('message', onMsg);
+      resolve(evt);
+    });
+    worker.postMessage(data);
+  });
+}
+
+promise_test(t => {
+  let script = 'resources/echo-message-to-source-worker.js';
+  let scope = 'resources/client-postmessage-from-wait-serviceworker';
+  let registration;
+  let frame;
+  return service_worker_unregister_and_register(t, script, scope)
+    .then(swr => {
+      t.add_cleanup(() => service_worker_unregister(t, scope));
+
+      registration = swr;
+      return wait_for_state(t, registration.installing, 'activated');
+    }).then(_ => {
+      return with_iframe(scope);
+    }).then(f => {
+      frame = f;
+      return navigator.serviceWorker.register(script + '?update', { scope: scope })
+    }).then(swr => {
+      assert_equals(swr, registration, 'should be same registration');
+      return wait_for_state(t, registration.installing, 'installed');
+    }).then(_ => {
+      return echo(registration.waiting, 'waiting');
+    }).then(evt => {
+      assert_equals(evt.source, registration.waiting,
+                    'message event source should be correct');
+      return echo(registration.active, 'active');
+    }).then(evt => {
+      assert_equals(evt.source, registration.active,
+                    'message event source should be correct');
+      frame.remove();
+    });
+}, 'Client.postMessage() from waiting serviceworker.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/postmessage-msgport-to-client.https.html b/test/fixtures/wpt/service-workers/service-worker/postmessage-msgport-to-client.https.html
new file mode 100644
index 000000000000..29c056080c79
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/postmessage-msgport-to-client.https.html
@@ -0,0 +1,43 @@
+<!DOCTYPE html>
+<title>Service Worker: postMessage via MessagePort to Client</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    var script = 'resources/postmessage-msgport-to-client-worker.js';
+    var scope = 'resources/blank.html';
+    var port;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          add_completion_callback(() => registration.unregister());
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(() => with_iframe(scope))
+      .then(frame => {
+          t.add_cleanup(() => frame.remove());
+          return new Promise(resolve => {
+              var w = frame.contentWindow;
+              w.navigator.serviceWorker.onmessage = resolve;
+              w.navigator.serviceWorker.controller.postMessage('ping');
+            });
+        })
+      .then(e => {
+          port = e.ports[0];
+          port.postMessage({value: 1});
+          port.postMessage({value: 2});
+          port.postMessage({done: true});
+          return new Promise(resolve => { port.onmessage = resolve; });
+        })
+      .then(e => {
+          assert_equals(e.data.ack, 'Acking value: 1');
+          return new Promise(resolve => { port.onmessage = resolve; });
+        })
+      .then(e => {
+          assert_equals(e.data.ack, 'Acking value: 2');
+          return new Promise(resolve => { port.onmessage = resolve; });
+        })
+      .then(e => { assert_true(e.data.done, 'done'); });
+  }, 'postMessage MessagePorts from ServiceWorker to Client');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/postmessage-to-client-message-queue.https.html b/test/fixtures/wpt/service-workers/service-worker/postmessage-to-client-message-queue.https.html
new file mode 100644
index 000000000000..83e5f4540d14
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/postmessage-to-client-message-queue.https.html
@@ -0,0 +1,212 @@
+<!DOCTYPE html>
+<title>Service Worker: postMessage to Client (message queue)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// This function creates a message listener that captures all messages
+// sent to this window and matches them with corresponding requests.
+// This frees test code from having to use clunky constructs just to
+// avoid race conditions, since the relative order of message and
+// request arrival doesn't matter.
+function create_message_listener(t) {
+    const listener = {
+        messages: new Set(),
+        requests: new Set(),
+        waitFor: function(predicate) {
+            for (const event of this.messages) {
+                // If a message satisfying the predicate has already
+                // arrived, it gets matched to this request.
+                if (predicate(event)) {
+                    this.messages.delete(event);
+                    return Promise.resolve(event);
+                }
+            }
+
+            // If no match was found, the request is stored and a
+            // promise is returned.
+            const request = { predicate };
+            const promise = new Promise(resolve => request.resolve = resolve);
+            this.requests.add(request);
+            return promise;
+        }
+    };
+    window.onmessage = t.step_func(event => {
+        for (const request of listener.requests) {
+            // If the new message matches a stored request's
+            // predicate, the request's promise is resolved with this
+            // message.
+            if (request.predicate(event)) {
+                listener.requests.delete(request);
+                request.resolve(event);
+                return;
+            }
+        };
+
+        // No outstanding request for this message, store it in case
+        // it's requested later.
+        listener.messages.add(event);
+    });
+    return listener;
+}
+
+async function service_worker_register_and_activate(t, script, scope) {
+    const registration = await service_worker_unregister_and_register(t, script, scope);
+    t.add_cleanup(() => registration.unregister());
+    const worker = registration.installing;
+    await wait_for_state(t, worker, 'activated');
+    return worker;
+}
+
+// Add an iframe (parent) whose document contains a nested iframe
+// (child), then set the child's src attribute to child_url and return
+// its Window (without waiting for it to finish loading).
+async function with_nested_iframes(t, child_url) {
+    const parent = await with_iframe('resources/nested-iframe-parent.html?role=parent');
+    t.add_cleanup(() => parent.remove());
+    const child = parent.contentWindow.document.getElementById('child');
+    child.setAttribute('src', child_url);
+    return child.contentWindow;
+}
+
+// Returns a predicate matching a fetch message with the specified
+// key.
+function fetch_message(key) {
+    return event => event.data.type === 'fetch' && event.data.key === key;
+}
+
+// Returns a predicate matching a ping message with the specified
+// payload.
+function ping_message(data) {
+    return event => event.data.type === 'ping' && event.data.data === data;
+}
+
+// A client message queue test is a testharness.js test with some
+// additional setup:
+// 1. A listener (see create_message_listener)
+// 2. An active service worker
+// 3. Two nested iframes
+// 4. A state transition function that controls the order of events
+//    during the test
+function client_message_queue_test(url, test_function, description) {
+    promise_test(async t => {
+        t.listener = create_message_listener(t);
+
+        const script = 'resources/stalling-service-worker.js';
+        const scope = 'resources/';
+        t.service_worker = await service_worker_register_and_activate(t, script, scope);
+
+        // We create two nested iframes such that both are controlled by
+        // the newly installed service worker.
+        const child_url = url + '?role=child';
+        t.frame = await with_nested_iframes(t, child_url);
+
+        t.state_transition = async function(from, to, scripts) {
+            // A state transition begins with the child's parser
+            // fetching a script due to a <script> tag. The request
+            // arrives at the service worker, which notifies the
+            // parent, which in turn notifies the test. Note that the
+            // event loop keeps spinning while the parser is waiting.
+            const request = await this.listener.waitFor(fetch_message(to));
+
+            // The test instructs the service worker to send two ping
+            // messages through the Client interface: first to the
+            // child, then to the parent.
+            this.service_worker.postMessage(from);
+
+            // When the parent receives the ping message, it forwards
+            // it to the test. Assuming that messages to both child
+            // and parent are mapped to the same task queue (this is
+            // not [yet] required by the spec), receiving this message
+            // guarantees that the child has already dispatched its
+            // message if it was allowed to do so.
+            await this.listener.waitFor(ping_message(from));
+
+            // Finally, reply to the service worker's fetch
+            // notification with the script it should use as the fetch
+            // request's response. This is a defensive mechanism that
+            // ensures the child's parser really is blocked until the
+            // test is ready to continue.
+            request.ports[0].postMessage([`state = '${to}';`].concat(scripts));
+        };
+
+        await test_function(t);
+    }, description);
+}
+
+function client_message_queue_enable_test(
+    install_script,
+    start_script,
+    earliest_dispatch,
+    description)
+{
+    function assert_state_less_than_equal(state1, state2, explanation) {
+        const states = ['init', 'install', 'start', 'finish', 'loaded'];
+        const index1 = states.indexOf(state1);
+        const index2 = states.indexOf(state2);
+        if (index1 > index2)
+          assert_unreached(explanation);
+    }
+
+    client_message_queue_test('enable-client-message-queue.html', async t => {
+        // While parsing the child's document, the child transitions
+        // from the 'init' state all the way to the 'finish' state.
+        // Once parsing is finished it would enter the final 'loaded'
+        // state. All but the last transition require assitance from
+        // the test.
+        await t.state_transition('init', 'install', [install_script]);
+        await t.state_transition('install', 'start', [start_script]);
+        await t.state_transition('start', 'finish', []);
+
+        // Wait for all messages to get dispatched on the child's
+        // ServiceWorkerContainer and then verify that each message
+        // was dispatched after |earliest_dispatch|.
+        const report = await t.frame.report;
+        ['init', 'install', 'start'].forEach(state => {
+            const explanation = `Message sent in state '${state}' was dispatched in '${report[state]}', should be dispatched no earlier than '${earliest_dispatch}'`;
+            assert_state_less_than_equal(earliest_dispatch,
+                                         report[state],
+                                         explanation);
+        });
+    }, description);
+}
+
+const empty_script = ``;
+
+const add_event_listener =
+    `navigator.serviceWorker.addEventListener('message', handle_message);`;
+
+const set_onmessage = `navigator.serviceWorker.onmessage = handle_message;`;
+
+const start_messages = `navigator.serviceWorker.startMessages();`;
+
+client_message_queue_enable_test(add_event_listener, empty_script, 'loaded',
+    'Messages from ServiceWorker to Client only received after DOMContentLoaded event.');
+
+client_message_queue_enable_test(add_event_listener, start_messages, 'start',
+    'Messages from ServiceWorker to Client only received after calling startMessages().');
+
+client_message_queue_enable_test(set_onmessage, empty_script, 'install',
+    'Messages from ServiceWorker to Client only received after setting onmessage.');
+
+const resolve_manual_promise = `resolve_manual_promise();`
+
+async function test_microtasks_when_client_message_queue_enabled(t, scripts) {
+    await t.state_transition('init', 'start', scripts.concat([resolve_manual_promise]));
+    let result = await t.frame.result;
+    assert_equals(result[0], 'microtask', 'The microtask was executed first.');
+    assert_equals(result[1], 'message', 'The message was dispatched.');
+}
+
+client_message_queue_test('message-vs-microtask.html', t => {
+    return test_microtasks_when_client_message_queue_enabled(t, [
+        add_event_listener,
+        start_messages,
+    ]);
+}, 'Microtasks run before dispatching messages after calling startMessages().');
+
+client_message_queue_test('message-vs-microtask.html', t => {
+    return test_microtasks_when_client_message_queue_enabled(t, [set_onmessage]);
+}, 'Microtasks run before dispatching messages after setting onmessage.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/postmessage-to-client.https.html b/test/fixtures/wpt/service-workers/service-worker/postmessage-to-client.https.html
new file mode 100644
index 000000000000..f834a4bffe20
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/postmessage-to-client.https.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<title>Service Worker: postMessage to Client</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(async t => {
+  const script = 'resources/postmessage-to-client-worker.js';
+  const scope = 'resources/blank.html';
+
+  const registration =
+      await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+  const w = frame.contentWindow;
+
+  w.navigator.serviceWorker.controller.postMessage('ping');
+  let e = await new Promise(r => w.navigator.serviceWorker.onmessage = r);
+
+  assert_equals(e.constructor, w.MessageEvent,
+                'message events should use MessageEvent interface.');
+  assert_equals(e.type, 'message', 'type should be "message".');
+  assert_false(e.bubbles, 'message events should not bubble.');
+  assert_false(e.cancelable, 'message events should not be cancelable.');
+  assert_equals(e.origin, location.origin,
+                'origin of message should be origin of Service Worker.');
+  assert_equals(e.lastEventId, '',
+                'lastEventId should be an empty string.');
+  assert_equals(e.source.constructor, w.ServiceWorker,
+                'source should use ServiceWorker interface.');
+  assert_equals(e.source, w.navigator.serviceWorker.controller,
+                'source should be the service worker that sent the message.');
+  assert_equals(e.ports.length, 0, 'ports should be an empty array.');
+  assert_equals(e.data, 'Sending message via clients');
+
+  e = await new Promise(r => w.navigator.serviceWorker.onmessage = r);
+  assert_equals(e.data, 'quit');
+}, 'postMessage from ServiceWorker to Client.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/postmessage.https.html b/test/fixtures/wpt/service-workers/service-worker/postmessage.https.html
new file mode 100644
index 000000000000..7abb3022f91a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/postmessage.https.html
@@ -0,0 +1,202 @@
+<!DOCTYPE html>
+<title>Service Worker: postMessage</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    var script = 'resources/postmessage-worker.js';
+    var scope = 'resources/blank.html';
+    var registration;
+    var worker;
+    var port;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(r => {
+          t.add_cleanup(() => r.unregister());
+          registration = r;
+          worker = registration.installing;
+
+          var messageChannel = new MessageChannel();
+          port = messageChannel.port1;
+          return new Promise(resolve => {
+              port.onmessage = resolve;
+              worker.postMessage({port: messageChannel.port2},
+                                 [messageChannel.port2]);
+              worker.postMessage({value: 1});
+              worker.postMessage({value: 2});
+              worker.postMessage({done: true});
+            });
+        })
+      .then(e => {
+          assert_equals(e.data, 'Acking value: 1');
+          return new Promise(resolve => { port.onmessage = resolve; });
+        })
+      .then(e => {
+          assert_equals(e.data, 'Acking value: 2');
+          return new Promise(resolve => { port.onmessage = resolve; });
+        })
+      .then(e => {
+          assert_equals(e.data, 'quit');
+          return registration.unregister(scope);
+        });
+  }, 'postMessage to a ServiceWorker (and back via MessagePort)');
+
+promise_test(t => {
+    var script = 'resources/postmessage-transferables-worker.js';
+    var scope = 'resources/blank.html';
+    var sw = navigator.serviceWorker;
+
+    var message = 'Hello, world!';
+    var text_encoder = new TextEncoder;
+    var text_decoder = new TextDecoder;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(r => {
+          t.add_cleanup(() => r.unregister());
+
+          var ab = text_encoder.encode(message);
+          assert_equals(ab.byteLength, message.length);
+          r.installing.postMessage(ab, [ab.buffer]);
+          assert_equals(text_decoder.decode(ab), '');
+          assert_equals(ab.byteLength, 0);
+
+          return new Promise(resolve => { sw.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify the integrity of the transferred array buffer.
+          assert_equals(e.data.content, message);
+          assert_equals(e.data.byteLength, message.length);
+          return new Promise(resolve => { sw.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify the integrity of the array buffer sent back from
+          // ServiceWorker via Client.postMessage.
+          assert_equals(text_decoder.decode(e.data), message);
+          assert_equals(e.data.byteLength, message.length);
+          return new Promise(resolve => { sw.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify that the array buffer on ServiceWorker is neutered.
+          assert_equals(e.data.content, '');
+          assert_equals(e.data.byteLength, 0);
+        });
+  }, 'postMessage a transferable ArrayBuffer between ServiceWorker and Client');
+
+promise_test(t => {
+    var script = 'resources/postmessage-transferables-worker.js';
+    var scope = 'resources/blank.html';
+    var message = 'Hello, world!';
+    var text_encoder = new TextEncoder;
+    var text_decoder = new TextDecoder;
+    var port;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(r => {
+          t.add_cleanup(() => r.unregister());
+
+          var channel = new MessageChannel;
+          port = channel.port1;
+          r.installing.postMessage(undefined, [channel.port2]);
+
+          var ab = text_encoder.encode(message);
+          assert_equals(ab.byteLength, message.length);
+          port.postMessage(ab, [ab.buffer]);
+          assert_equals(text_decoder.decode(ab), '');
+          assert_equals(ab.byteLength, 0);
+
+          return new Promise(resolve => { port.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify the integrity of the transferred array buffer.
+          assert_equals(e.data.content, message);
+          assert_equals(e.data.byteLength, message.length);
+          return new Promise(resolve => { port.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify the integrity of the array buffer sent back from
+          // ServiceWorker via Client.postMessage.
+          assert_equals(text_decoder.decode(e.data), message);
+          assert_equals(e.data.byteLength, message.length);
+          return new Promise(resolve => { port.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify that the array buffer on ServiceWorker is neutered.
+          assert_equals(e.data.content, '');
+          assert_equals(e.data.byteLength, 0);
+        });
+  }, 'postMessage a transferable ArrayBuffer between ServiceWorker and Client' +
+     ' over MessagePort');
+
+  promise_test(t => {
+    var script = 'resources/postmessage-dictionary-transferables-worker.js';
+    var scope = 'resources/blank.html';
+    var sw = navigator.serviceWorker;
+
+    var message = 'Hello, world!';
+    var text_encoder = new TextEncoder;
+    var text_decoder = new TextDecoder;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(r => {
+          t.add_cleanup(() => r.unregister());
+
+          var ab = text_encoder.encode(message);
+          assert_equals(ab.byteLength, message.length);
+          r.installing.postMessage(ab, {transfer: [ab.buffer]});
+          assert_equals(text_decoder.decode(ab), '');
+          assert_equals(ab.byteLength, 0);
+
+          return new Promise(resolve => { sw.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify the integrity of the transferred array buffer.
+          assert_equals(e.data.content, message);
+          assert_equals(e.data.byteLength, message.length);
+          return new Promise(resolve => { sw.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify the integrity of the array buffer sent back from
+          // ServiceWorker via Client.postMessage.
+          assert_equals(text_decoder.decode(e.data), message);
+          assert_equals(e.data.byteLength, message.length);
+          return new Promise(resolve => { sw.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify that the array buffer on ServiceWorker is neutered.
+          assert_equals(e.data.content, '');
+          assert_equals(e.data.byteLength, 0);
+        });
+  }, 'postMessage with dictionary a transferable ArrayBuffer between ServiceWorker and Client');
+
+  promise_test(async t => {
+    const firstScript = 'resources/postmessage-echo-worker.js?one';
+    const secondScript = 'resources/postmessage-echo-worker.js?two';
+    const scope = 'resources/';
+
+    const registration = await service_worker_unregister_and_register(t, firstScript, scope);
+    t.add_cleanup(() => registration.unregister());
+    const firstWorker = registration.installing;
+
+    const messagePromise = new Promise(resolve => {
+      navigator.serviceWorker.addEventListener('message', (event) => {
+        resolve(event.data);
+      }, {once: true});
+    });
+
+    await wait_for_state(t, firstWorker, 'activated');
+    await navigator.serviceWorker.register(secondScript, {scope});
+    const secondWorker = registration.installing;
+    await wait_for_state(t, firstWorker, 'redundant');
+
+    // postMessage() to a redundant worker should be dropped silently.
+    // Historically, this threw an exception.
+    firstWorker.postMessage('firstWorker');
+
+    // To test somewhat that it was not received, send a message to another
+    // worker and check that we get a reply for that one.
+    secondWorker.postMessage('secondWorker');
+    const data = await messagePromise;
+    assert_equals(data, 'secondWorker');
+  }, 'postMessage to a redundant worker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ready.https.window.js b/test/fixtures/wpt/service-workers/service-worker/ready.https.window.js
new file mode 100644
index 000000000000..6c4e270682c2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ready.https.window.js
@@ -0,0 +1,223 @@
+// META: title=Service Worker: navigator.serviceWorker.ready
+// META: script=resources/test-helpers.sub.js
+
+test(() => {
+  assert_equals(
+    navigator.serviceWorker.ready,
+    navigator.serviceWorker.ready,
+    'repeated access to ready without intervening registrations should return the same Promise object'
+  );
+}, 'ready returns the same Promise object');
+
+promise_test(async t => {
+  const frame = await with_iframe('resources/blank.html?uncontrolled');
+  t.add_cleanup(() => frame.remove());
+
+  const promise = frame.contentWindow.navigator.serviceWorker.ready;
+
+  assert_equals(
+    Object.getPrototypeOf(promise),
+    frame.contentWindow.Promise.prototype,
+    'the Promise should be in the context of the related document'
+  );
+}, 'ready returns a Promise object in the context of the related document');
+
+promise_test(async t => {
+  const url = 'resources/empty-worker.js';
+  const scope = 'resources/blank.html?ready-controlled';
+  const expectedURL = normalizeURL(url);
+  const registration = await service_worker_unregister_and_register(t, url, scope);
+  t.add_cleanup(() => registration.unregister());
+
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+
+  const readyReg = await frame.contentWindow.navigator.serviceWorker.ready;
+
+  assert_equals(readyReg.installing, null, 'installing should be null');
+  assert_equals(readyReg.waiting, null, 'waiting should be null');
+  assert_equals(readyReg.active.scriptURL, expectedURL, 'active after ready should not be null');
+  assert_equals(
+    frame.contentWindow.navigator.serviceWorker.controller,
+    readyReg.active,
+    'the controller should be the active worker'
+  );
+  assert_in_array(
+    readyReg.active.state,
+    ['activating', 'activated'],
+    '.ready should be resolved when the registration has an active worker'
+  );
+}, 'ready on a controlled document');
+
+promise_test(async t => {
+  const url = 'resources/empty-worker.js';
+  const scope = 'resources/blank.html?ready-potential-controlled';
+  const expected_url = normalizeURL(url);
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+
+  const registration = await navigator.serviceWorker.register(url, { scope });
+  t.add_cleanup(() => registration.unregister());
+
+  const readyReg = await frame.contentWindow.navigator.serviceWorker.ready;
+
+  assert_equals(readyReg.installing, null, 'installing should be null');
+  assert_equals(readyReg.waiting, null, 'waiting should be null.')
+  assert_equals(readyReg.active.scriptURL, expected_url, 'active after ready should not be null');
+  assert_in_array(
+    readyReg.active.state,
+    ['activating', 'activated'],
+    '.ready should be resolved when the registration has an active worker'
+  );
+  assert_equals(
+    frame.contentWindow.navigator.serviceWorker.controller,
+    null,
+    'uncontrolled document should not have a controller'
+  );
+}, 'ready on a potential controlled document');
+
+promise_test(async t => {
+  const url = 'resources/empty-worker.js';
+  const scope = 'resources/blank.html?ready-installing';
+
+  await service_worker_unregister(t, scope);
+
+  const frame = await with_iframe(scope);
+  const promise = frame.contentWindow.navigator.serviceWorker.ready;
+  navigator.serviceWorker.register(url, { scope });
+  const registration = await promise;
+
+  t.add_cleanup(async () => {
+    await registration.unregister();
+    frame.remove();
+  });
+
+  assert_equals(registration.installing, null, 'installing should be null');
+  assert_equals(registration.waiting, null, 'waiting should be null');
+  assert_not_equals(registration.active, null, 'active after ready should not be null');
+  assert_in_array(
+    registration.active.state,
+    ['activating', 'activated'],
+    '.ready should be resolved when the registration has an active worker'
+  );
+}, 'ready on an iframe whose parent registers a new service worker');
+
+promise_test(async t => {
+  const scope = 'resources/register-iframe.html';
+  const frame = await with_iframe(scope);
+
+  const registration = await frame.contentWindow.navigator.serviceWorker.ready;
+
+  t.add_cleanup(async () => {
+    await registration.unregister();
+    frame.remove();
+  });
+
+  assert_equals(registration.installing, null, 'installing should be null');
+  assert_equals(registration.waiting, null, 'waiting should be null');
+  assert_not_equals(registration.active, null, 'active after ready should not be null');
+  assert_in_array(
+    registration.active.state,
+    ['activating', 'activated'],
+    '.ready should be resolved with "active worker"'
+  );
+ }, 'ready on an iframe that installs a new service worker');
+
+promise_test(async t => {
+  const url = 'resources/empty-worker.js';
+  const matchedScope = 'resources/blank.html?ready-after-match';
+  const longerMatchedScope = 'resources/blank.html?ready-after-match-longer';
+
+  await service_worker_unregister(t, matchedScope);
+  await service_worker_unregister(t, longerMatchedScope);
+
+  const frame = await with_iframe(longerMatchedScope);
+  const registration = await navigator.serviceWorker.register(url, { scope: matchedScope });
+
+  t.add_cleanup(async () => {
+    await registration.unregister();
+    frame.remove();
+  });
+
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const longerRegistration = await navigator.serviceWorker.register(url, { scope: longerMatchedScope });
+
+  t.add_cleanup(() => longerRegistration.unregister());
+
+  const readyReg = await frame.contentWindow.navigator.serviceWorker.ready;
+
+  assert_equals(
+    readyReg.scope,
+    normalizeURL(longerMatchedScope),
+    'longer matched registration should be returned'
+  );
+  assert_equals(
+    frame.contentWindow.navigator.serviceWorker.controller,
+    null,
+    'controller should be null'
+  );
+}, 'ready after a longer matched registration registered');
+
+promise_test(async t => {
+  const url = 'resources/empty-worker.js';
+  const matchedScope = 'resources/blank.html?ready-after-resolve';
+  const longerMatchedScope = 'resources/blank.html?ready-after-resolve-longer';
+  const registration = await service_worker_unregister_and_register(t, url, matchedScope);
+  t.add_cleanup(() => registration.unregister());
+
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const frame = await with_iframe(longerMatchedScope);
+  t.add_cleanup(() => frame.remove());
+
+  const readyReg1 = await frame.contentWindow.navigator.serviceWorker.ready;
+
+  assert_equals(
+    readyReg1.scope,
+    normalizeURL(matchedScope),
+    'matched registration should be returned'
+  );
+
+  const longerReg = await navigator.serviceWorker.register(url, { scope: longerMatchedScope });
+  t.add_cleanup(() => longerReg.unregister());
+
+  const readyReg2 = await frame.contentWindow.navigator.serviceWorker.ready;
+
+  assert_equals(
+    readyReg2.scope,
+    normalizeURL(matchedScope),
+    'ready should only be resolved once'
+  );
+}, 'access ready after it has been resolved');
+
+promise_test(async t => {
+  const url1 = 'resources/empty-worker.js';
+  const url2 = url1 + '?2';
+  const matchedScope = 'resources/blank.html?ready-after-unregister';
+  const reg1 = await service_worker_unregister_and_register(t, url1, matchedScope);
+  t.add_cleanup(() => reg1.unregister());
+
+  await wait_for_state(t, reg1.installing, 'activating');
+
+  const frame = await with_iframe(matchedScope);
+  t.add_cleanup(() => frame.remove());
+
+  await reg1.unregister();
+
+  // Ready promise should be pending, waiting for a new registration to arrive
+  const readyPromise = frame.contentWindow.navigator.serviceWorker.ready;
+
+  const reg2 = await navigator.serviceWorker.register(url2, { scope: matchedScope });
+  t.add_cleanup(() => reg2.unregister());
+
+  const readyReg = await readyPromise;
+
+  // Wait for registration update, since it comes from another global, the states are racy.
+  await wait_for_state(t, reg2.installing || reg2.waiting || reg2.active, 'activated');
+
+  assert_equals(readyReg.active.scriptURL, reg2.active.scriptURL, 'Resolves with the second registration');
+  assert_not_equals(reg1, reg2, 'Registrations should be different');
+}, 'resolve ready after unregistering');
diff --git a/test/fixtures/wpt/service-workers/service-worker/redirected-response.https.html b/test/fixtures/wpt/service-workers/service-worker/redirected-response.https.html
new file mode 100644
index 000000000000..71b35d0e1205
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/redirected-response.https.html
@@ -0,0 +1,471 @@
+<!DOCTYPE html>
+<title>Service Worker: Redirected response</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// Tests redirect behavior. It calls fetch_method(url, fetch_option) and tests
+// the resulting response against the expected values. It also adds the
+// response to |cache| and checks the cached response matches the expected
+// values.
+//
+// |options|: a dictionary of parameters for the test
+// |options.url|: the URL to fetch
+// |options.fetch_option|: the options passed to |fetch_method|
+// |options.fetch_method|: the method used to fetch. Useful for testing an
+//                         iframe's fetch() vs. this page's fetch().
+// |options.expected_type|: The value of response.type
+// |options.expected_redirected|: The value of response.redirected
+// |options.expected_intercepted_urls|: The list of intercepted request URLs.
+function redirected_test(options) {
+  return options.fetch_method.call(null, options.url, options.fetch_option).then(response => {
+        let cloned_response = response.clone();
+        assert_equals(
+            response.type, options.expected_type,
+            'The response type of response must match. URL: ' + options.url);
+        assert_equals(
+            cloned_response.type, options.expected_type,
+            'The response type of cloned response must match. URL: ' + options.url);
+        assert_equals(
+            response.redirected, options.expected_redirected,
+            'The redirected flag of response must match. URL: ' + options.url);
+        assert_equals(
+            cloned_response.redirected, options.expected_redirected,
+            'The redirected flag of cloned response must match. URL: ' + options.url);
+        if (options.expected_response_url) {
+            assert_equals(
+                cloned_response.url, options.expected_response_url,
+                'The URL does not meet expectation. URL: ' + options.url);
+        }
+        return cache.put(options.url, response);
+      })
+    .then(_ => cache.match(options.url))
+    .then(response => {
+        assert_equals(
+            response.type, options.expected_type,
+            'The response type of response in CacheStorage must match. ' +
+            'URL: ' + options.url);
+        assert_equals(
+            response.redirected, options.expected_redirected,
+            'The redirected flag of response in CacheStorage must match. ' +
+            'URL: ' + options.url);
+        return check_intercepted_urls(options.expected_intercepted_urls);
+      });
+}
+
+async function take_intercepted_urls() {
+  const message = new Promise((resolve) => {
+    let channel = new MessageChannel();
+    channel.port1.onmessage = msg => { resolve(msg.data.requestInfos); };
+    worker.postMessage({command: 'getRequestInfos', port: channel.port2},
+                       [channel.port2]);
+  });
+  const request_infos = await message;
+  return request_infos.map(info => { return info.url; });
+}
+
+function check_intercepted_urls(expected_urls) {
+  return take_intercepted_urls().then((urls) => {
+      assert_object_equals(urls, expected_urls, 'Intercepted URLs matching.');
+    });
+}
+
+function setup_and_clean() {
+  // To prevent interference from previous tests, take the intercepted URLs from
+  // the service worker.
+  return setup.then(() => take_intercepted_urls());
+}
+
+
+let host_info = get_host_info();
+const REDIRECT_URL = host_info['HTTPS_ORIGIN'] + base_path() +
+                     'resources/redirect.py?Redirect=';
+const TARGET_URL = host_info['HTTPS_ORIGIN'] + base_path() +
+                   'resources/simple.txt?';
+const REDIRECT_TO_TARGET_URL = REDIRECT_URL + encodeURIComponent(TARGET_URL);
+let frame;
+let cache;
+let setup;
+let worker;
+
+promise_test(t => {
+    const SCOPE = 'resources/blank.html?redirected-response';
+    const SCRIPT = 'resources/redirect-worker.js';
+    const CACHE_NAME = 'service-workers/service-worker/redirected-response';
+    setup = service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(registration => {
+          promise_test(
+              () => registration.unregister(),
+              'restore global state (service worker registration)');
+          worker = registration.installing;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(_ => self.caches.open(CACHE_NAME))
+      .then(c => {
+          cache = c;
+          promise_test(
+            () => self.caches.delete(CACHE_NAME),
+            'restore global state (caches)');
+          return with_iframe(SCOPE);
+        })
+      .then(f => {
+          frame = f;
+          add_completion_callback(() => f.remove());
+          return check_intercepted_urls(
+              [host_info['HTTPS_ORIGIN'] + base_path() + SCOPE]);
+        });
+      return setup;
+  }, 'initialize global state (service worker registration and caches)');
+
+// ===============================================================
+// Tests for requests that are out-of-scope of the service worker.
+// ===============================================================
+promise_test(t => setup_and_clean()
+  .then(() => redirected_test({url: TARGET_URL,
+                               fetch_option: {},
+                               fetch_method: self.fetch,
+                               expected_type: 'basic',
+                               expected_redirected: false,
+                               expected_intercepted_urls: []})),
+  'mode: "follow", non-intercepted request, no server redirect');
+
+promise_test(t => setup_and_clean()
+  .then(() => redirected_test({url: REDIRECT_TO_TARGET_URL,
+                               fetch_option: {},
+                               fetch_method: self.fetch,
+                               expected_type: 'basic',
+                               expected_redirected: true,
+                               expected_intercepted_urls: []})),
+  'mode: "follow", non-intercepted request');
+
+promise_test(t => setup_and_clean()
+  .then(() => redirected_test({url: REDIRECT_TO_TARGET_URL + '&manual',
+                               fetch_option: {redirect: 'manual'},
+                               fetch_method: self.fetch,
+                               expected_type: 'opaqueredirect',
+                               expected_redirected: false,
+                               expected_intercepted_urls: []})),
+  'mode: "manual", non-intercepted request');
+
+promise_test(t => setup_and_clean()
+    .then(() => promise_rejects_js(
+                   t, TypeError,
+                   self.fetch(REDIRECT_TO_TARGET_URL + '&error',
+                              {redirect:'error'}),
+                   'The redirect response from the server should be treated as' +
+                   ' an error when the redirect flag of request was \'error\'.'))
+    .then(() => check_intercepted_urls([])),
+  'mode: "error", non-intercepted request');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = TARGET_URL + '&sw=fetch';
+      return redirected_test({url: url,
+                              fetch_option: {},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'basic',
+                              expected_redirected: false,
+                              expected_intercepted_urls: [url]})
+    }),
+  'mode: "follow", no mode change, no server redirect');
+
+// =======================================================
+// Tests for requests that are in-scope of the service worker. The service
+// worker returns a redirected response.
+// =======================================================
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = REDIRECT_TO_TARGET_URL +
+                  '&original-redirect-mode=follow&sw=fetch';
+      return redirected_test({url: url,
+                              fetch_option: {redirect: 'follow'},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'basic',
+                              expected_redirected: true,
+                              expected_intercepted_urls: [url]})
+    }),
+  'mode: "follow", no mode change');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = REDIRECT_TO_TARGET_URL +
+                  '&original-redirect-mode=error&sw=follow';
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(url, {redirect: 'error'}),
+          'The redirected response from the service worker should be ' +
+          'treated as an error when the redirect flag of request was ' +
+          '\'error\'.')
+        .then(() => check_intercepted_urls([url]));
+    }),
+  'mode: "error", mode change: "follow"');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = REDIRECT_TO_TARGET_URL +
+                  '&original-redirect-mode=manual&sw=follow';
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(url, {redirect: 'manual'}),
+          'The redirected response from the service worker should be ' +
+          'treated as an error when the redirect flag of request was ' +
+          '\'manual\'.')
+        .then(() => check_intercepted_urls([url]));
+    }),
+  'mode: "manual", mode change: "follow"');
+
+// =======================================================
+// Tests for requests that are in-scope of the service worker. The service
+// worker returns an opaqueredirect response.
+// =======================================================
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = REDIRECT_TO_TARGET_URL +
+                  '&original-redirect-mode=follow&sw=manual';
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(url, {redirect: 'follow'}),
+          'The opaqueredirect response from the service worker should ' +
+          'be treated as an error when the redirect flag of request was' +
+          ' \'follow\'.')
+        .then(() => check_intercepted_urls([url]));
+    }),
+  'mode: "follow", mode change: "manual"');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = REDIRECT_TO_TARGET_URL +
+                  '&original-redirect-mode=error&sw=manual';
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(url, {redirect: 'error'}),
+          'The opaqueredirect response from the service worker should ' +
+          'be treated as an error when the redirect flag of request was' +
+          ' \'error\'.')
+        .then(() => check_intercepted_urls([url]));
+    }),
+  'mode: "error", mode change: "manual"');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = REDIRECT_TO_TARGET_URL +
+                  '&original-redirect-mode=manual&sw=manual';
+      return redirected_test({url: url,
+                              fetch_option: {redirect: 'manual'},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'opaqueredirect',
+                              expected_redirected: false,
+                              expected_intercepted_urls: [url]});
+    }),
+  'mode: "manual", no mode change');
+
+// =======================================================
+// Tests for requests that are in-scope of the service worker. The service
+// worker returns a generated redirect response.
+// =======================================================
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=' + encodeURIComponent(TARGET_URL) +
+                  '&original-redirect-mode=follow&sw=gen';
+      return redirected_test({url: url,
+                              fetch_option: {redirect: 'follow'},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'basic',
+                              expected_redirected: true,
+                              expected_intercepted_urls: [url, TARGET_URL]})
+    }),
+  'mode: "follow", generated redirect response');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=' + encodeURIComponent(TARGET_URL) +
+                  '&original-redirect-mode=error&sw=gen';
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(url, {redirect: 'error'}),
+          'The generated redirect response from the service worker should ' +
+          'be treated as an error when the redirect flag of request was' +
+          ' \'error\'.')
+        .then(() => check_intercepted_urls([url]));
+    }),
+  'mode: "error", generated redirect response');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=' + encodeURIComponent(TARGET_URL) +
+                  '&original-redirect-mode=manual&sw=gen';
+      return redirected_test({url: url,
+                              fetch_option: {redirect: 'manual'},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'opaqueredirect',
+                              expected_redirected: false,
+                              expected_intercepted_urls: [url]})
+    }),
+  'mode: "manual", generated redirect response');
+
+// =======================================================
+// Tests for requests that are in-scope of the service worker. The service
+// worker returns a generated redirect response manually with the Response
+// constructor.
+// =======================================================
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=' + encodeURIComponent(TARGET_URL) +
+                  '&original-redirect-mode=follow&sw=gen-manual';
+      return redirected_test({url: url,
+                              fetch_option: {redirect: 'follow'},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'basic',
+                              expected_redirected: true,
+                              expected_intercepted_urls: [url, TARGET_URL]})
+    }),
+  'mode: "follow", manually-generated redirect response');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=' + encodeURIComponent(TARGET_URL) +
+                  '&original-redirect-mode=error&sw=gen-manual';
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(url, {redirect: 'error'}),
+          'The generated redirect response from the service worker should ' +
+          'be treated as an error when the redirect flag of request was' +
+          ' \'error\'.')
+        .then(() => check_intercepted_urls([url]));
+    }),
+  'mode: "error", manually-generated redirect response');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=' + encodeURIComponent(TARGET_URL) +
+                  '&original-redirect-mode=manual&sw=gen-manual';
+      return redirected_test({url: url,
+                              fetch_option: {redirect: 'manual'},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'opaqueredirect',
+                              expected_redirected: false,
+                              expected_intercepted_urls: [url]})
+    }),
+  'mode: "manual", manually-generated redirect response');
+
+// =======================================================
+// Tests for requests that are in-scope of the service worker. The service
+// worker returns a generated redirect response with a relative location header.
+// Generated responses do not have URLs, so this should fail to resolve.
+// =======================================================
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=blank.html' +
+                  '&original-redirect-mode=follow&sw=gen-manual';
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(url, {redirect: 'follow'}),
+          'Following the generated redirect response from the service worker '+
+          'should result fail.')
+        .then(() => check_intercepted_urls([url]));
+    }),
+  'mode: "follow", generated relative redirect response');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=blank.html' +
+                  '&original-redirect-mode=error&sw=gen-manual';
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(url, {redirect: 'error'}),
+          'The generated redirect response from the service worker should ' +
+          'be treated as an error when the redirect flag of request was' +
+          ' \'error\'.')
+        .then(() => check_intercepted_urls([url]));
+    }),
+  'mode: "error", generated relative redirect response');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=blank.html' +
+                  '&original-redirect-mode=manual&sw=gen-manual';
+      return redirected_test({url: url,
+                              fetch_option: {redirect: 'manual'},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'opaqueredirect',
+                              expected_redirected: false,
+                              expected_intercepted_urls: [url]})
+    }),
+  'mode: "manual", generated relative redirect response');
+
+// =======================================================
+// Tests for requests that are in-scope of the service worker. The service
+// worker returns a generated redirect response. And the fetch follows the
+// redirection multiple times.
+// =======================================================
+promise_test(t => setup_and_clean()
+    .then(() => {
+      // The Fetch spec says: "If request’s redirect count is twenty, return a
+      // network error." https://fetch.spec.whatwg.org/#http-redirect-fetch
+      // So fetch can follow the redirect response 20 times.
+      let urls = [TARGET_URL];
+      for (let i = 0; i < 20; ++i) {
+        urls.unshift(host_info['HTTPS_ORIGIN'] + '/sample?sw=gen&url=' +
+                    encodeURIComponent(urls[0]));
+
+      }
+      return redirected_test({url: urls[0],
+                              fetch_option: {redirect: 'follow'},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'basic',
+                              expected_redirected: true,
+                              expected_intercepted_urls: urls})
+    }),
+  'Fetch should follow the redirect response 20 times');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      let urls = [TARGET_URL];
+      // The Fetch spec says: "If request’s redirect count is twenty, return a
+      // network error." https://fetch.spec.whatwg.org/#http-redirect-fetch
+      // So fetch can't follow the redirect response 21 times.
+      for (let i = 0; i < 21; ++i) {
+        urls.unshift(host_info['HTTPS_ORIGIN'] + '/sample?sw=gen&url=' +
+                    encodeURIComponent(urls[0]));
+
+      }
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(urls[0], {redirect: 'follow'}),
+          'Fetch should not follow the redirect response 21 times.')
+        .then(() => {
+          urls.pop();
+          return check_intercepted_urls(urls)
+        });
+    }),
+  'Fetch should not follow the redirect response 21 times.');
+
+// =======================================================
+// A test for verifying the url of a service-worker-redirected request is
+// propagated to the outer response.
+// =======================================================
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() + 'sample?url=' +
+                  encodeURIComponent(TARGET_URL) +'&sw=fetch-url';
+      return redirected_test({url: url,
+                              fetch_option: {},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'basic',
+                              expected_redirected: false,
+                              expected_intercepted_urls: [url],
+                              expected_response_url: TARGET_URL});
+    }),
+  'The URL for the service worker redirected request should be propagated to ' +
+  'response.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/referer.https.html b/test/fixtures/wpt/service-workers/service-worker/referer.https.html
new file mode 100644
index 000000000000..0957e4c53301
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/referer.https.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<title>Service Worker: check referer of fetch()</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+promise_test(function(t) {
+    var SCOPE = 'resources/referer-iframe.html';
+    var SCRIPT = 'resources/fetch-rewrite-worker.js';
+    var host_info = get_host_info();
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, SCOPE);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(function(frame) {
+          var channel = new MessageChannel();
+          t.add_cleanup(function() {
+              frame.remove();
+            });
+
+          var onMsg = new Promise(function(resolve) {
+              channel.port1.onmessage = resolve;
+            });
+
+          frame.contentWindow.postMessage({},
+                                          host_info['HTTPS_ORIGIN'],
+                                          [channel.port2]);
+          return onMsg;
+        })
+      .then(function(e) {
+          assert_equals(e.data.results, 'finish');
+        });
+  }, 'Verify the referer');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/referrer-policy-header.https.html b/test/fixtures/wpt/service-workers/service-worker/referrer-policy-header.https.html
new file mode 100644
index 000000000000..784343e6d8f1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/referrer-policy-header.https.html
@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<title>Service Worker: check referer of fetch() with Referrer Policy</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+const SCOPE = 'resources/referrer-policy-iframe.html';
+const SCRIPT = 'resources/fetch-rewrite-worker-referrer-policy.js';
+
+promise_test(async t => {
+    const registration =
+        await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+    await wait_for_state(t, registration.installing, 'activated');
+    t.add_cleanup(() => registration.unregister(),
+                 'Remove registration as a cleanup');
+
+    const full_scope_url = new URL(SCOPE, location.href);
+    const redirect_to = `${full_scope_url.href}?ignore=true`;
+    const frame = await with_iframe(
+        `${SCOPE}?pipe=status(302)|header(Location,${redirect_to})|` +
+        'header(Referrer-Policy,origin)');
+    assert_equals(frame.contentDocument.referrer,
+                  full_scope_url.origin + '/');
+    t.add_cleanup(() => frame.remove());
+}, 'Referrer for a main resource redirected with referrer-policy (origin) ' +
+   'should only have origin.');
+
+promise_test(async t => {
+    const registration =
+        await service_worker_unregister_and_register(t, SCRIPT, SCOPE, `{type: 'module'}`);
+    await wait_for_state(t, registration.installing, 'activated');
+    t.add_cleanup(() => registration.unregister(),
+                 'Remove registration as a cleanup');
+
+    const full_scope_url = new URL(SCOPE, location.href);
+    const redirect_to = `${full_scope_url.href}?ignore=true`;
+    const frame = await with_iframe(
+        `${SCOPE}?pipe=status(302)|header(Location,${redirect_to})|` +
+        'header(Referrer-Policy,origin)');
+    assert_equals(frame.contentDocument.referrer,
+                  full_scope_url.origin + '/');
+    t.add_cleanup(() => frame.remove());
+}, 'Referrer for a main resource redirected with a module script with referrer-policy (origin) ' +
+   'should only have origin.');
+
+promise_test(async t => {
+    const registration =
+        await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+    await wait_for_state(t, registration.installing, 'activated');
+    t.add_cleanup(() => registration.unregister(),
+                 'Remove registration as a cleanup');
+
+    const host_info = get_host_info();
+    const frame = await with_iframe(SCOPE);
+    const channel = new MessageChannel();
+    t.add_cleanup(() => frame.remove());
+    const e = await new Promise(resolve => {
+        channel.port1.onmessage = resolve;
+        frame.contentWindow.postMessage(
+            {}, host_info['HTTPS_ORIGIN'], [channel.port2]);
+    });
+    assert_equals(e.data.results, 'finish');
+}, 'Referrer for fetch requests initiated from a service worker with ' +
+   'referrer-policy (origin) should only have origin.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/referrer-toplevel-script-fetch.https.html b/test/fixtures/wpt/service-workers/service-worker/referrer-toplevel-script-fetch.https.html
new file mode 100644
index 000000000000..65c60a11db20
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/referrer-toplevel-script-fetch.https.html
@@ -0,0 +1,64 @@
+<!DOCTYPE html>
+<title>Service Worker: check referrer of top-level script fetch</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+
+async function get_toplevel_script_headers(worker) {
+  worker.postMessage("getHeaders");
+  return new Promise((resolve) => {
+    navigator.serviceWorker.onmessage = (event) => {
+      resolve(event.data);
+    };
+  });
+}
+
+promise_test(async (t) => {
+  const script = "resources/test-request-headers-worker.py";
+  const scope = "resources/blank.html";
+  const host_info = get_host_info();
+
+  const registration = await service_worker_unregister_and_register(
+    t, script, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+  await wait_for_state(t, registration.installing, "activated");
+
+  const expected_referrer = host_info["HTTPS_ORIGIN"] + location.pathname;
+
+  // Check referrer for register().
+  const register_headers = await get_toplevel_script_headers(registration.active);
+  assert_equals(register_headers["referer"], expected_referrer, "referrer of register()");
+
+  // Check referrer for update().
+  await registration.update();
+  await wait_for_state(t, registration.installing, "installed");
+  const update_headers = await get_toplevel_script_headers(registration.waiting);
+  assert_equals(update_headers["referer"], expected_referrer, "referrer of update()");
+}, "Referrer of the top-level script fetch should be the document URL");
+
+promise_test(async (t) => {
+  const script = "resources/test-request-headers-worker.py";
+  const scope = "resources/blank.html";
+  const host_info = get_host_info();
+
+  const registration = await service_worker_unregister_and_register(
+    t, script, scope, {type: 'module'});
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+  await wait_for_state(t, registration.installing, "activated");
+
+  const expected_referrer = host_info["HTTPS_ORIGIN"] + location.pathname;
+
+  // Check referrer for register().
+  const register_headers = await get_toplevel_script_headers(registration.active);
+  assert_equals(register_headers["referer"], expected_referrer, "referrer of register()");
+
+  // Check referrer for update().
+  await registration.update();
+  await wait_for_state(t, registration.installing, "installed");
+  const update_headers = await get_toplevel_script_headers(registration.waiting);
+  assert_equals(update_headers["referer"], expected_referrer, "referrer of update()");
+}, "Referrer of the module script fetch should be the document URL");
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/register-closed-window.https.html b/test/fixtures/wpt/service-workers/service-worker/register-closed-window.https.html
new file mode 100644
index 000000000000..9c1b639bb757
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/register-closed-window.https.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<title>Service Worker: Register() on Closed Window</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+var host_info = get_host_info();
+var frameURL = host_info['HTTPS_ORIGIN'] + base_path() +
+               'resources/register-closed-window-iframe.html';
+
+async_test(function(t) {
+  var frame;
+  with_iframe(frameURL).then(function(f) {
+    frame = f;
+    return new Promise(function(resolve) {
+      window.addEventListener('message', function messageHandler(evt) {
+        window.removeEventListener('message', messageHandler);
+        resolve(evt.data);
+      });
+      frame.contentWindow.postMessage('START', '*');
+    });
+  }).then(function(result) {
+    assert_equals(result, 'OK', 'frame should complete without crashing');
+    frame.remove();
+    t.done();
+  }).catch(unreached_rejection(t));
+}, 'Call register() on ServiceWorkerContainer owned by closed window.');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/register-default-scope.https.html b/test/fixtures/wpt/service-workers/service-worker/register-default-scope.https.html
new file mode 100644
index 000000000000..1d86548eb5ee
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/register-default-scope.https.html
@@ -0,0 +1,69 @@
+<!DOCTYPE html>
+<title>register() and scope</title>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(function(t) {
+    var script = 'resources/empty-worker.js';
+    var script_url = new URL(script, location.href);
+    var expected_scope = new URL('./', script_url).href;
+    return service_worker_unregister(t, expected_scope)
+      .then(function() {
+        return navigator.serviceWorker.register('resources/empty-worker.js');
+      }).then(function(registration) {
+        assert_equals(registration.scope, expected_scope,
+                      'The default scope should be URL("./", script_url)');
+        return registration.unregister();
+      }).then(function() {
+        t.done();
+      });
+  }, 'default scope');
+
+promise_test(function(t) {
+    // This script must be different than the 'default scope' test, or else
+    // the scopes will collide.
+    var script = 'resources/empty.js';
+    var script_url = new URL(script, location.href);
+    var expected_scope = new URL('./', script_url).href;
+    return service_worker_unregister(t, expected_scope)
+      .then(function() {
+        return navigator.serviceWorker.register('resources/empty.js',
+                                                { scope: undefined });
+      }).then(function(registration) {
+        assert_equals(registration.scope, expected_scope,
+                      'The default scope should be URL("./", script_url)');
+        return registration.unregister();
+      }).then(function() {
+        t.done();
+      });
+  }, 'undefined scope');
+
+promise_test(function(t) {
+    var script = 'resources/simple-fetch-worker.js';
+    var script_url = new URL(script, location.href);
+    var expected_scope = new URL('./', script_url).href;
+    return service_worker_unregister(t, expected_scope)
+      .then(function() {
+        return navigator.serviceWorker.register('resources/empty.js',
+                                                { scope: null });
+      })
+      .then(
+        function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, registration.scope);
+            });
+
+          assert_unreached('register should fail');
+        },
+        function(error) {
+          assert_equals(error.name, 'SecurityError',
+                        'passing a null scope should be interpreted as ' +
+                        'scope="null" which violates the path restriction');
+          t.done();
+        });
+  }, 'null scope');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/register-same-scope-different-script-url.https.html b/test/fixtures/wpt/service-workers/service-worker/register-same-scope-different-script-url.https.html
new file mode 100644
index 000000000000..6eb00f3071a2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/register-same-scope-different-script-url.https.html
@@ -0,0 +1,233 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var script1 = normalizeURL('resources/empty-worker.js');
+var script2 = normalizeURL('resources/empty-worker.js?new');
+
+async_test(function(t) {
+    var scope = 'resources/scope/register-new-script-concurrently';
+    var register_promise1;
+    var register_promise2;
+
+    service_worker_unregister(t, scope)
+      .then(function() {
+          register_promise1 = navigator.serviceWorker.register(script1,
+                                                               {scope: scope});
+          register_promise2 = navigator.serviceWorker.register(script2,
+                                                               {scope: scope});
+          return register_promise1;
+        })
+      .then(function(registration) {
+          assert_equals(registration.installing.scriptURL, script1,
+                        'on first register, first script should be installing');
+          assert_equals(registration.waiting, null,
+                        'on first register, waiting should be null');
+          assert_equals(registration.active, null,
+                        'on first register, active should be null');
+          return register_promise2;
+        })
+      .then(function(registration) {
+          assert_equals(
+              registration.installing.scriptURL, script2,
+              'on second register, second script should be installing');
+          // Spec allows racing: the first register may have finished
+          // or the second one could have terminated the installing worker.
+          assert_true(registration.waiting == null ||
+                      registration.waiting.scriptURL == script1,
+                      'on second register, .waiting should be null or the ' +
+                      'first script');
+          assert_true(registration.active == null ||
+                      (registration.waiting == null &&
+                       registration.active.scriptURL == script1),
+                      'on second register, .active should be null or the ' +
+                      'first script');
+          return registration.unregister();
+        })
+      .then(function() {
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Register different scripts concurrently');
+
+async_test(function(t) {
+    var scope = 'resources/scope/register-then-register-new-script';
+    var registration;
+
+    service_worker_unregister_and_register(t, script1, scope)
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'on activated, installing should be null');
+          assert_equals(registration.waiting, null,
+                        'on activated, waiting should be null');
+          assert_equals(registration.active.scriptURL, script1,
+                        'on activated, the first script should be active');
+          return navigator.serviceWorker.register(script2, {scope:scope});
+        })
+      .then(function(r) {
+          registration = r;
+          assert_equals(registration.installing.scriptURL, script2,
+                        'on second register, the second script should be ' +
+                        'installing');
+          assert_equals(registration.waiting, null,
+                        'on second register, waiting should be null');
+          assert_equals(registration.active.scriptURL, script1,
+                        'on second register, the first script should be ' +
+                        'active');
+          return wait_for_state(t, registration.installing, 'installed');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'on installed, installing should be null');
+          assert_equals(registration.waiting.scriptURL, script2,
+                        'on installed, the second script should be waiting');
+          assert_equals(registration.active.scriptURL, script1,
+                        'on installed, the first script should be active');
+          return registration.unregister();
+        })
+      .then(function() {
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Register then register new script URL');
+
+async_test(function(t) {
+    var scope = 'resources/scope/register-then-register-new-script-404';
+    var registration;
+
+    service_worker_unregister_and_register(t, script1, scope)
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'on activated, installing should be null');
+          assert_equals(registration.waiting, null,
+                        'on activated, waiting should be null');
+          assert_equals(registration.active.scriptURL, script1,
+                        'on activated, the first script should be active');
+          return navigator.serviceWorker.register('this-will-404.js',
+                                                  {scope:scope});
+        })
+      .then(
+        function() { assert_unreached('register should reject'); },
+        function(error) {
+          assert_equals(registration.installing, null,
+                        'on rejected, installing should be null');
+          assert_equals(registration.waiting, null,
+                        'on rejected, waiting should be null');
+          assert_equals(registration.active.scriptURL, script1,
+                        'on rejected, the first script should be active');
+          return registration.unregister();
+        })
+      .then(function() {
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Register then register new script URL that 404s');
+
+async_test(function(t) {
+    var scope = 'resources/scope/register-then-register-new-script-reject-install';
+    var reject_script = normalizeURL('resources/reject-install-worker.js');
+    var registration;
+
+    service_worker_unregister_and_register(t, script1, scope)
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'on activated, installing should be null');
+          assert_equals(registration.waiting, null,
+                        'on activated, waiting should be null');
+          assert_equals(registration.active.scriptURL, script1,
+                        'on activated, the first script should be active');
+          return navigator.serviceWorker.register(reject_script, {scope:scope});
+        })
+      .then(function(r) {
+          registration = r;
+          assert_equals(registration.installing.scriptURL, reject_script,
+                        'on update, the second script should be installing');
+          assert_equals(registration.waiting, null,
+                        'on update, waiting should be null');
+          assert_equals(registration.active.scriptURL, script1,
+                        'on update, the first script should be active');
+          return wait_for_state(t, registration.installing, 'redundant');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'on redundant, installing should be null');
+          assert_equals(registration.waiting, null,
+                        'on redundant, waiting should be null');
+          assert_equals(registration.active.scriptURL, script1,
+                        'on redundant, the first script should be active');
+          return registration.unregister();
+        })
+      .then(function() {
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Register then register new script that does not install');
+
+async_test(function(t) {
+    var scope = 'resources/scope/register-new-script-controller';
+    var iframe;
+    var registration;
+
+    service_worker_unregister_and_register(t, script1, scope)
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          iframe = frame;
+          return navigator.serviceWorker.register(script2, { scope: scope })
+        })
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, registration.installing, 'installed');
+        })
+      .then(function() {
+          var sw_container = iframe.contentWindow.navigator.serviceWorker;
+          assert_equals(sw_container.controller.scriptURL, script1,
+                        'the old version should control the old doc');
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          var sw_container = frame.contentWindow.navigator.serviceWorker;
+          assert_equals(sw_container.controller.scriptURL, script1,
+                        'the old version should control a new doc');
+          var onactivated_promise = wait_for_state(t,
+                                                   registration.waiting,
+                                                   'activated');
+          frame.remove();
+          iframe.remove();
+          return onactivated_promise;
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          var sw_container = frame.contentWindow.navigator.serviceWorker;
+          assert_equals(sw_container.controller.scriptURL, script2,
+                        'the new version should control a new doc');
+          frame.remove();
+          return registration.unregister();
+        })
+      .then(function() {
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Register same-scope new script url effect on controller');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/register-wait-forever-in-install-worker.https.html b/test/fixtures/wpt/service-workers/service-worker/register-wait-forever-in-install-worker.https.html
new file mode 100644
index 000000000000..0920b5cb223d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/register-wait-forever-in-install-worker.https.html
@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<title>Service Worker: Register wait-forever-in-install-worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(function(t) {
+    var bad_script = 'resources/wait-forever-in-install-worker.js';
+    var good_script = 'resources/empty-worker.js';
+    var scope = 'resources/wait-forever-in-install-worker';
+    var other_scope = 'resources/wait-forever-in-install-worker-other';
+    var registration;
+    var registerPromise;
+
+    return navigator.serviceWorker.register(bad_script, {scope: scope})
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          assert_equals(registration.installing.scriptURL,
+                        normalizeURL(bad_script));
+
+          // This register job should not start until the first
+          // register for the same scope completes.
+          registerPromise =
+            navigator.serviceWorker.register(good_script, {scope: scope});
+
+          // In order to test that the above register does not complete
+          // we will perform a register() on a different scope.  The
+          // assumption here is that the previous register call would
+          // have completed in the same timeframe if it was able to do
+          // so.
+          return navigator.serviceWorker.register(good_script,
+                                                  {scope: other_scope});
+        })
+      .then(function(swr) {
+          return swr.unregister();
+        })
+      .then(function() {
+          assert_equals(registration.installing.scriptURL,
+                        normalizeURL(bad_script));
+          registration.installing.postMessage('STOP_WAITING');
+          return registerPromise;
+        })
+      .then(function(swr) {
+          assert_equals(registration.installing.scriptURL,
+                        normalizeURL(good_script));
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+  }, 'register worker that calls waitUntil with a promise that never ' +
+     'resolves in oninstall');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-basic.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-basic.https.html
new file mode 100644
index 000000000000..759b4244a269
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-basic.https.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration (basic)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const script = 'resources/registration-worker.js';
+
+promise_test(async (t) => {
+  const scope = 'resources/registration/normal';
+  const registration = await navigator.serviceWorker.register(script, {scope});
+  t.add_cleanup(() => registration.unregister());
+  assert_true(
+    registration instanceof ServiceWorkerRegistration,
+    'Successfully registered.');
+}, 'Registering normal scope');
+
+promise_test(async (t) => {
+  const scope = 'resources/registration/scope-with-fragment#ref';
+  const registration = await navigator.serviceWorker.register(script, {scope});
+  t.add_cleanup(() => registration.unregister());
+  assert_true(
+    registration instanceof ServiceWorkerRegistration,
+    'Successfully registered.');
+  assert_equals(
+    registration.scope,
+    normalizeURL('resources/registration/scope-with-fragment'),
+    'A fragment should be removed from scope');
+}, 'Registering scope with fragment');
+
+promise_test(async (t) => {
+  const scope = 'resources/';
+  const registration = await navigator.serviceWorker.register(script, {scope})
+  t.add_cleanup(() => registration.unregister());
+  assert_true(
+    registration instanceof ServiceWorkerRegistration,
+    'Successfully registered.');
+}, 'Registering same scope as the script directory');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-end-to-end.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-end-to-end.https.html
new file mode 100644
index 000000000000..1af4582d3874
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-end-to-end.https.html
@@ -0,0 +1,88 @@
+<!DOCTYPE html>
+<title>Service Worker: registration end-to-end</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var t = async_test('Registration: end-to-end');
+t.step(function() {
+
+    var scope = 'resources/in-scope/';
+    var serviceWorkerStates = [];
+    var lastServiceWorkerState = '';
+    var receivedMessageFromPort = '';
+
+    assert_true(navigator.serviceWorker instanceof ServiceWorkerContainer);
+    assert_equals(typeof navigator.serviceWorker.register, 'function');
+    assert_equals(typeof navigator.serviceWorker.getRegistration, 'function');
+
+    service_worker_unregister_and_register(
+        t, 'resources/end-to-end-worker.js', scope)
+      .then(onRegister)
+      .catch(unreached_rejection(t));
+
+    function sendMessagePort(worker, from) {
+        var messageChannel = new MessageChannel();
+        worker.postMessage({from:from, port:messageChannel.port2}, [messageChannel.port2]);
+        return messageChannel.port1;
+    }
+
+    function onRegister(registration) {
+        var sw = registration.installing;
+        serviceWorkerStates.push(sw.state);
+        lastServiceWorkerState = sw.state;
+
+        var sawMessage = new Promise(t.step_func(function(resolve) {
+            sendMessagePort(sw, 'registering doc').onmessage = t.step_func(function (e) {
+                receivedMessageFromPort = e.data;
+                resolve();
+            });
+        }));
+
+        var sawActive = new Promise(t.step_func(function(resolve) {
+            sw.onstatechange = t.step_func(function() {
+                serviceWorkerStates.push(sw.state);
+
+                switch (sw.state) {
+                case 'installed':
+                    assert_equals(lastServiceWorkerState, 'installing');
+                    break;
+                case 'activating':
+                    assert_equals(lastServiceWorkerState, 'installed');
+                    break;
+                case 'activated':
+                    assert_equals(lastServiceWorkerState, 'activating');
+                    break;
+                default:
+                    // We won't see 'redundant' because onstatechange is
+                    // overwritten before calling unregister.
+                    assert_unreached('Unexpected state: ' + sw.state);
+                }
+
+                lastServiceWorkerState = sw.state;
+                if (sw.state === 'activated')
+                    resolve();
+            });
+        }));
+
+        Promise.all([sawMessage, sawActive]).then(t.step_func(function() {
+            assert_array_equals(serviceWorkerStates,
+                                ['installing', 'installed', 'activating', 'activated'],
+                                'Service worker should pass through all states');
+
+            assert_equals(receivedMessageFromPort, 'Ack for: registering doc');
+
+            var sawRedundant = new Promise(t.step_func(function(resolve) {
+                sw.onstatechange = t.step_func(function() {
+                    assert_equals(sw.state, 'redundant');
+                    resolve();
+                });
+            }));
+            registration.unregister();
+            sawRedundant.then(t.step_func(function() {
+                t.done();
+            }));
+        }));
+    }
+});
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-events.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-events.https.html
new file mode 100644
index 000000000000..5bcfd66846bc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-events.https.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<title>Service Worker: registration events</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var scope = 'resources/in-scope/';
+    return service_worker_unregister_and_register(
+        t, 'resources/events-worker.js', scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+          });
+
+          return onRegister(registration.installing);
+        });
+
+    function sendMessagePort(worker, from) {
+        var messageChannel = new MessageChannel();
+        worker.postMessage({from:from, port:messageChannel.port2}, [messageChannel.port2]);
+        return messageChannel.port1;
+    }
+
+    function onRegister(sw) {
+        return new Promise(function(resolve) {
+            sw.onstatechange = function() {
+                if (sw.state === 'activated')
+                    resolve();
+            };
+        }).then(function() {
+            return new Promise(function(resolve) {
+                sendMessagePort(sw, 'registering doc').onmessage = resolve;
+            });
+        }).then(function(e) {
+                assert_array_equals(e.data.events,
+                                    ['install', 'activate'],
+                                   'Worker should see install then activate events');
+        });
+    }
+}, 'Registration: events');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-iframe.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-iframe.https.html
new file mode 100644
index 000000000000..ae39ddfea3e5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-iframe.https.html
@@ -0,0 +1,116 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: Registration for iframe</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+// Set script url and scope url relative to the iframe's document's url. Assert
+// the implementation parses the urls against the iframe's document's url.
+async_test(function(t) {
+  const url = 'resources/blank.html';
+  const iframe_scope = 'registration-with-valid-scope';
+  const scope = normalizeURL('resources/' + iframe_scope);
+  const iframe_script = 'empty-worker.js';
+  const script = normalizeURL('resources/' + iframe_script);
+  var frame;
+  var registration;
+
+  service_worker_unregister(t, scope)
+    .then(function() { return with_iframe(url); })
+    .then(function(f) {
+        frame = f;
+        return frame.contentWindow.navigator.serviceWorker.register(
+            iframe_script,
+            { scope: iframe_scope });
+      })
+    .then(function(r) {
+        registration = r;
+        return wait_for_state(t, r.installing, 'activated');
+      })
+    .then(function() {
+        assert_equals(registration.scope, scope,
+                      'registration\'s scope must be parsed against the ' +
+                      '"relevant global object"');
+        assert_equals(registration.active.scriptURL, script,
+                      'worker\'s scriptURL must be parsed against the ' +
+                      '"relevant global object"');
+        return registration.unregister();
+      })
+    .then(function() {
+        frame.remove();
+        t.done();
+      })
+    .catch(unreached_rejection(t));
+  }, 'register method should use the "relevant global object" to parse its ' +
+     'scriptURL and scope - normal case');
+
+// Set script url and scope url relative to the parent frame's document's url.
+// Assert the implementation throws a TypeError exception.
+async_test(function(t) {
+  const url = 'resources/blank.html';
+  const iframe_scope = 'resources/registration-with-scope-to-non-existing-url';
+  const scope = normalizeURL('resources/' + iframe_scope);
+  const script = 'resources/empty-worker.js';
+  var frame;
+  var registration;
+
+  service_worker_unregister(t, scope)
+    .then(function() { return with_iframe(url); })
+    .then(function(f) {
+        frame = f;
+        return frame.contentWindow.navigator.serviceWorker.register(
+            script,
+            { scope: iframe_scope });
+      })
+    .then(
+      function() {
+        assert_unreached('register() should reject');
+      },
+      function(e) {
+        assert_equals(e.name, 'TypeError',
+                      'register method with scriptURL and scope parsed to ' +
+                      'nonexistent location should reject with TypeError');
+        frame.remove();
+        t.done();
+      })
+    .catch(unreached_rejection(t));
+  }, 'register method should use the "relevant global object" to parse its ' +
+     'scriptURL and scope - error case');
+
+// Set the scope url to a non-subdirectory of the script url. Assert the
+// implementation throws a SecurityError exception.
+async_test(function(t) {
+  const url = 'resources/blank.html';
+  const scope = 'registration-with-disallowed-scope';
+  const iframe_scope = '../' + scope;
+  const script = 'empty-worker.js';
+  var frame;
+  var registration;
+
+  service_worker_unregister(t, scope)
+    .then(function() { return with_iframe(url); })
+    .then(function(f) {
+        frame = f;
+        return frame.contentWindow.navigator.serviceWorker.register(
+            script,
+            { scope: iframe_scope });
+      })
+    .then(
+      function() {
+        assert_unreached('register() should reject');
+      },
+      function(e) {
+        assert_equals(e.name, 'SecurityError',
+                      'The scope set to a non-subdirectory of the scriptURL ' +
+                      'should reject with SecurityError');
+        frame.remove();
+        t.done();
+      })
+    .catch(unreached_rejection(t));
+  }, 'A scope url should start with the given script url');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-mime-types.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-mime-types.https.html
new file mode 100644
index 000000000000..3a21aac5c75c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-mime-types.https.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration (MIME types)</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/registration-tests-mime-types.js"></script>
+<script>
+registration_tests_mime_types((script, options) => navigator.serviceWorker.register(script, options));
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-schedule-job.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-schedule-job.https.html
new file mode 100644
index 000000000000..25d758ee8f0e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-schedule-job.https.html
@@ -0,0 +1,107 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<meta name=timeout content=long>
+<title>Service Worker: Schedule Job algorithm</title>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// Tests for https://w3c.github.io/ServiceWorker/#schedule-job-algorithm
+// Non-equivalent register jobs should not be coalesced.
+const scope = 'resources/';
+const script1 = 'resources/empty.js';
+const script2 = 'resources/empty.js?change';
+
+async function cleanup() {
+  const registration = await navigator.serviceWorker.getRegistration(scope);
+  if (registration)
+    await registration.unregister();
+}
+
+function absolute_url(url) {
+  return new URL(url, self.location).toString();
+}
+
+// Test that a change to `script` starts a new register job.
+promise_test(async t => {
+  await cleanup();
+  t.add_cleanup(cleanup);
+
+  // Make a registration.
+  const registration = await
+      navigator.serviceWorker.register(script1, {scope});
+
+  // Schedule two more register jobs.
+  navigator.serviceWorker.register(script1, {scope});
+  await navigator.serviceWorker.register(script2, {scope});
+
+  // The jobs should not have been coalesced.
+  const worker = get_newest_worker(registration);
+  assert_equals(worker.scriptURL, absolute_url(script2));
+}, 'different scriptURL');
+
+// Test that a change to `updateViaCache` starts a new register job.
+promise_test(async t => {
+  await cleanup();
+  t.add_cleanup(cleanup);
+
+  // Check defaults.
+  const registration = await
+      navigator.serviceWorker.register(script1, {scope});
+  assert_equals(registration.updateViaCache, 'imports');
+
+  // Schedule two more register jobs.
+  navigator.serviceWorker.register(script1, {scope});
+  await navigator.serviceWorker.register(script1, {scope,
+      updateViaCache: 'none'});
+
+  // The jobs should not have been coalesced.
+  assert_equals(registration.updateViaCache, 'none');
+}, 'different updateViaCache');
+
+// Test that a change to `type` starts a new register job.
+promise_test(async t => {
+  await cleanup();
+  t.add_cleanup(cleanup);
+
+  const scriptForTypeCheck = 'resources/type-check-worker.js';
+  // Check defaults.
+  const registration = await
+      navigator.serviceWorker.register(scriptForTypeCheck, {scope});
+
+  let worker_type = await new Promise((resolve) => {
+    navigator.serviceWorker.onmessage = (event) => {
+      resolve(event.data);
+    };
+    // The jobs should not have been coalesced. get_newest_worker() helps the
+    // test fail with stable output on browers that incorrectly coalesce
+    // register jobs, since then sometimes registration is not a new worker as
+    // expected.
+    const worker = get_newest_worker(registration);
+    // The argument of postMessage doesn't matter for this case.
+    worker.postMessage('');
+  });
+
+  assert_equals(worker_type, 'classic');
+
+  // Schedule two more register jobs.
+  navigator.serviceWorker.register(scriptForTypeCheck, {scope});
+  await navigator.serviceWorker.register(scriptForTypeCheck, {scope, type: 'module'});
+
+  worker_type = await new Promise((resolve) => {
+    navigator.serviceWorker.onmessage = (event) => {
+      resolve(event.data);
+    };
+    // The jobs should not have been coalesced. get_newest_worker() helps the
+    // test fail with stable output on browers that incorrectly coalesce
+    // register jobs, since then sometimes registration is not a new worker as
+    // expected.
+    const worker = get_newest_worker(registration);
+    // The argument of postMessage doesn't matter for this case.
+    worker.postMessage('');
+  });
+
+  assert_equals(worker_type, 'module');
+}, 'different type');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-scope-module-static-import.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-scope-module-static-import.https.html
new file mode 100644
index 000000000000..5c75295aed1c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-scope-module-static-import.https.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<title>Service Worker: Static imports from module top-level scripts shouldn't be affected by the service worker script path restriction</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// https://w3c.github.io/ServiceWorker/#path-restriction
+// is applied to top-level scripts in
+// https://w3c.github.io/ServiceWorker/#update-algorithm
+// but not to submodules imported from top-level scripts.
+async function runTest(t, script, scope) {
+  const script_url = new URL(script, location.href);
+  await service_worker_unregister(t, scope);
+  const registration = await
+      navigator.serviceWorker.register(script, {type: 'module'});
+  t.add_cleanup(_ => registration.unregister());
+  const msg = await new Promise(resolve => {
+    registration.installing.postMessage('ping');
+    navigator.serviceWorker.onmessage = resolve;
+  });
+  assert_equals(msg.data, 'pong');
+}
+
+promise_test(async t => {
+    await runTest(t,
+        'resources/scope2/imported-module-script.js',
+        'resources/scope2/');
+  }, 'imported-module-script.js works when used as top-level');
+
+promise_test(async t => {
+    await runTest(t,
+        'resources/scope1/module-worker-importing-scope2.js',
+        'resources/scope1/');
+  }, 'static imports to outside path restriction should be allowed');
+
+promise_test(async t => {
+    await runTest(t,
+       'resources/scope1/module-worker-importing-redirect-to-scope2.js',
+       'resources/scope1/');
+  }, 'static imports redirecting to outside path restriction should be allowed');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-scope.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-scope.https.html
new file mode 100644
index 000000000000..141875f5847c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-scope.https.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration (scope)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/registration-tests-scope.js"></script>
+<script>
+registration_tests_scope((script, options) => navigator.serviceWorker.register(script, options));
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-script-module.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-script-module.https.html
new file mode 100644
index 000000000000..9e39a1f75b27
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-script-module.https.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration (module script)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/registration-tests-script.js"></script>
+<script>
+registration_tests_script(
+    (script, options) => navigator.serviceWorker.register(
+        script,
+        Object.assign({type: 'module'}, options)),
+    'module');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-script-url.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-script-url.https.html
new file mode 100644
index 000000000000..bda61adb0027
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-script-url.https.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration (scriptURL)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/registration-tests-script-url.js"></script>
+<script>
+registration_tests_script_url((script, options) => navigator.serviceWorker.register(script, options));
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-script.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-script.https.html
new file mode 100644
index 000000000000..f1e51fd265e2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-script.https.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration (script)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/registration-tests-script.js"></script>
+<script>
+registration_tests_script(
+    (script, options) => navigator.serviceWorker.register(script, options),
+    'classic'
+);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-security-error.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-security-error.https.html
new file mode 100644
index 000000000000..860c2d22ea93
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-security-error.https.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration (SecurityError)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/registration-tests-security-error.js"></script>
+<script>
+registration_tests_security_error((script, options) => navigator.serviceWorker.register(script, options));
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-service-worker-attributes.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-service-worker-attributes.https.html
new file mode 100644
index 000000000000..f7b52d5ddced
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-service-worker-attributes.https.html
@@ -0,0 +1,72 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+promise_test(function(t) {
+    var scope = 'resources/scope/installing-waiting-active-after-registration';
+    var worker_url = 'resources/empty-worker.js';
+    var expected_url = normalizeURL(worker_url);
+    var newest_worker;
+    var registration;
+
+    return service_worker_unregister_and_register(t, worker_url, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return r.unregister();
+            });
+          registration = r;
+          newest_worker = registration.installing;
+          assert_equals(registration.installing.scriptURL, expected_url,
+                        'installing before updatefound');
+          assert_equals(registration.waiting, null,
+                        'waiting before updatefound');
+          assert_equals(registration.active, null,
+                        'active before updatefound');
+          return wait_for_update(t, registration);
+        })
+      .then(function() {
+          assert_equals(registration.installing, newest_worker,
+                        'installing after updatefound');
+          assert_equals(registration.waiting, null,
+                        'waiting after updatefound');
+          assert_equals(registration.active, null,
+                        'active after updatefound');
+          return wait_for_state(t, registration.installing, 'installed');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'installing after installed');
+          assert_equals(registration.waiting, newest_worker,
+                        'waiting after installed');
+          assert_equals(registration.active, null,
+                        'active after installed');
+          return wait_for_state(t, registration.waiting, 'activated');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'installing after activated');
+          assert_equals(registration.waiting, null,
+                        'waiting after activated');
+          assert_equals(registration.active, newest_worker,
+                        'active after activated');
+          return Promise.all([
+              wait_for_state(t, registration.active, 'redundant'),
+              registration.unregister()
+            ]);
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'installing after redundant');
+          assert_equals(registration.waiting, null,
+                        'waiting after redundant');
+          // According to spec, Clear Registration runs Update State which is
+          // immediately followed by setting active to null, which means by the
+          // time the event loop turns and the Promise for statechange is
+          // resolved, this will be gone.
+          assert_equals(registration.active, null,
+                        'active should be null after redundant');
+        });
+  }, 'installing/waiting/active after registration');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-updateviacache.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-updateviacache.https.html
new file mode 100644
index 000000000000..b2f6bbc6f849
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-updateviacache.https.html
@@ -0,0 +1,204 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration-updateViaCache</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+  const UPDATE_VIA_CACHE_VALUES = [undefined, 'imports', 'all', 'none'];
+  const SCRIPT_URL = 'resources/update-max-aged-worker.py';
+  const SCOPE = 'resources/blank.html';
+
+  async function cleanup() {
+    const reg = await navigator.serviceWorker.getRegistration(SCOPE);
+    if (!reg) return;
+    if (reg.scope == new URL(SCOPE, location).href) {
+      return reg.unregister();
+    };
+  }
+
+  function getScriptTimes(sw, testName) {
+    return new Promise(resolve => {
+      navigator.serviceWorker.addEventListener('message', function listener(event) {
+        if (event.data.test !== testName) return;
+        navigator.serviceWorker.removeEventListener('message', listener);
+        resolve({
+          mainTime: event.data.mainTime,
+          importTime: event.data.importTime
+        });
+      });
+
+      sw.postMessage('');
+    });
+  }
+
+  // Test creating registrations & triggering an update.
+  for (const updateViaCache of UPDATE_VIA_CACHE_VALUES) {
+    const testName = `register-with-updateViaCache-${updateViaCache}`;
+
+    promise_test(async t => {
+      await cleanup();
+
+      const opts = {scope: SCOPE};
+
+      if (updateViaCache) opts.updateViaCache = updateViaCache;
+
+      const reg = await navigator.serviceWorker.register(
+        `${SCRIPT_URL}?test=${testName}`,
+        opts
+      );
+
+      assert_equals(reg.updateViaCache, updateViaCache || 'imports', "reg.updateViaCache");
+
+      const sw = reg.installing || reg.waiting || reg.active;
+      await wait_for_state(t, sw, 'activated');
+      const values = await getScriptTimes(sw, testName);
+      await reg.update();
+
+      if (updateViaCache == 'all') {
+        assert_equals(reg.installing, null, "No new service worker");
+      }
+      else {
+        const newWorker = reg.installing;
+        assert_true(!!newWorker, "New worker installing");
+        const newValues = await getScriptTimes(newWorker, testName);
+
+        if (!updateViaCache || updateViaCache == 'imports') {
+          assert_not_equals(values.mainTime, newValues.mainTime, "Main script should have updated");
+          assert_equals(values.importTime, newValues.importTime, "Imported script should be the same");
+        }
+        else if (updateViaCache == 'none') {
+          assert_not_equals(values.mainTime, newValues.mainTime, "Main script should have updated");
+          assert_not_equals(values.importTime, newValues.importTime, "Imported script should have updated");
+        }
+        else {
+          // We should have handled all of the possible values for updateViaCache.
+          // If this runs, something's gone very wrong.
+          throw Error(`Unexpected updateViaCache value: ${updateViaCache}`);
+        }
+      }
+
+      await cleanup();
+    }, testName);
+  }
+
+  // Test changing the updateViaCache value of an existing registration.
+  for (const updateViaCache1 of UPDATE_VIA_CACHE_VALUES) {
+    for (const updateViaCache2 of UPDATE_VIA_CACHE_VALUES) {
+      const testName = `register-with-updateViaCache-${updateViaCache1}-then-${updateViaCache2}`;
+
+      promise_test(async t => {
+        await cleanup();
+
+        const fullScriptUrl = `${SCRIPT_URL}?test=${testName}`;
+        let opts = {scope: SCOPE};
+        if (updateViaCache1) opts.updateViaCache = updateViaCache1;
+
+        const reg = await navigator.serviceWorker.register(fullScriptUrl, opts);
+
+        const sw = reg.installing;
+        await wait_for_state(t, sw, 'activated');
+        const values = await getScriptTimes(sw, testName);
+
+        const frame = await with_iframe(SCOPE);
+        const reg_in_frame = await frame.contentWindow.navigator.serviceWorker.getRegistration(normalizeURL(SCOPE));
+        assert_equals(reg_in_frame.updateViaCache, updateViaCache1 || 'imports', "reg_in_frame.updateViaCache");
+
+        opts = {scope: SCOPE};
+        if (updateViaCache2) opts.updateViaCache = updateViaCache2;
+
+        await navigator.serviceWorker.register(fullScriptUrl, opts);
+
+        const expected_updateViaCache = updateViaCache2 || 'imports';
+
+        assert_equals(reg.updateViaCache, expected_updateViaCache, "reg.updateViaCache updated");
+        // If the update happens via the cache, the scripts will come back byte-identical.
+        // We bypass the byte-identical check if the script URL has changed, but not if
+        // only the updateViaCache value has changed.
+        if (updateViaCache2 == 'all') {
+          assert_equals(reg.installing, null, "No new service worker");
+        }
+        // If there's no change to the updateViaCache value, register should be a no-op.
+        // The default value should behave as 'imports'.
+        else if ((updateViaCache1 || 'imports') == (updateViaCache2 || 'imports')) {
+          assert_equals(reg.installing, null, "No new service worker");
+        }
+        else {
+          const newWorker = reg.installing;
+          assert_true(!!newWorker, "New worker installing");
+          const newValues = await getScriptTimes(newWorker, testName);
+
+          if (!updateViaCache2 || updateViaCache2 == 'imports') {
+            assert_not_equals(values.mainTime, newValues.mainTime, "Main script should have updated");
+            assert_equals(values.importTime, newValues.importTime, "Imported script should be the same");
+          }
+          else if (updateViaCache2 == 'none') {
+            assert_not_equals(values.mainTime, newValues.mainTime, "Main script should have updated");
+            assert_not_equals(values.importTime, newValues.importTime, "Imported script should have updated");
+          }
+          else {
+            // We should have handled all of the possible values for updateViaCache2.
+            // If this runs, something's gone very wrong.
+            throw Error(`Unexpected updateViaCache value: ${updateViaCache}`);
+          }
+        }
+
+        // Wait for all registration related tasks on |frame| to complete.
+        await wait_for_activation_on_sample_scope(t, frame.contentWindow);
+        // The updateViaCache change should have been propagated to all
+        // corresponding JS registration objects.
+        assert_equals(reg_in_frame.updateViaCache, expected_updateViaCache, "reg_in_frame.updateViaCache updated");
+        frame.remove();
+
+        await cleanup();
+      }, testName);
+    }
+  }
+
+  // Test accessing updateViaCache of an unregistered registration.
+  for (const updateViaCache of UPDATE_VIA_CACHE_VALUES) {
+    const testName = `access-updateViaCache-after-unregister-${updateViaCache}`;
+
+    promise_test(async t => {
+      await cleanup();
+
+      const opts = {scope: SCOPE};
+
+      if (updateViaCache) opts.updateViaCache = updateViaCache;
+
+      const reg = await navigator.serviceWorker.register(
+        `${SCRIPT_URL}?test=${testName}`,
+        opts
+      );
+
+      const expected_updateViaCache = updateViaCache || 'imports';
+      assert_equals(reg.updateViaCache, expected_updateViaCache, "reg.updateViaCache");
+
+      await reg.unregister();
+
+      // Keep the original value.
+      assert_equals(reg.updateViaCache, expected_updateViaCache, "reg.updateViaCache");
+
+      await cleanup();
+    }, testName);
+  }
+
+  promise_test(async t => {
+    await cleanup();
+    t.add_cleanup(cleanup);
+
+    const registration = await navigator.serviceWorker.register(
+        'resources/empty.js',
+        {scope: SCOPE});
+    assert_equals(registration.updateViaCache, 'imports',
+                  'before update attempt');
+
+    const fail = navigator.serviceWorker.register(
+        'resources/malformed-worker.py?parse-error',
+        {scope: SCOPE, updateViaCache: 'none'});
+    await promise_rejects_js(t, TypeError, fail);
+    assert_equals(registration.updateViaCache, 'imports',
+                  'after update attempt');
+  }, 'updateViaCache is not updated if register() rejects');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/rejections.https.html b/test/fixtures/wpt/service-workers/service-worker/rejections.https.html
new file mode 100644
index 000000000000..8002ad9a81b9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/rejections.https.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<title>Service Worker: Rejection Types</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+(function() {
+    var t = async_test('Rejections are DOMExceptions');
+    t.step(function() {
+
+        navigator.serviceWorker.register('http://example.com').then(
+            t.step_func(function() { assert_unreached('Registration should fail'); }),
+            t.step_func(function(reason) {
+                assert_true(reason instanceof DOMException);
+                assert_true(reason instanceof Error);
+                t.done();
+            }));
+    });
+}());
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/request-end-to-end.https.html b/test/fixtures/wpt/service-workers/service-worker/request-end-to-end.https.html
new file mode 100644
index 000000000000..82475eabc4ab
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/request-end-to-end.https.html
@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+<title>Service Worker: FetchEvent.request passed to onfetch</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+promise_test(t => {
+    var url = 'resources/request-end-to-end-worker.js';
+    var scope = 'resources/blank.html';
+    return service_worker_unregister_and_register(t, url, scope)
+      .then(r => {
+          add_completion_callback(() => { r.unregister(); });
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(() => { return with_iframe(scope); })
+      .then(frame => {
+          add_completion_callback(() => { frame.remove(); });
+
+          var result = JSON.parse(frame.contentDocument.body.textContent);
+          assert_equals(result.url, frame.src, 'request.url');
+          assert_equals(result.method, 'GET', 'request.method');
+          assert_equals(result.referrer, location.href, 'request.referrer');
+          assert_equals(result.mode, 'navigate', 'request.mode');
+          assert_equals(result.request_construct_error, '',
+                        'Constructing a Request with a Request whose mode ' +
+                        'is navigate and non-empty RequestInit must not throw a ' +
+                        'TypeError.')
+          assert_equals(result.credentials, 'include', 'request.credentials');
+          assert_equals(result.redirect, 'manual', 'request.redirect');
+          assert_equals(result.append_header_error, 'TypeError',
+                        'Appending a new header to the request must throw a ' +
+                        'TypeError.')
+
+          // `assert_equals()` is not used here to create a stable failure
+          // baseline, because the User-Agent header would be version-dependent
+          // if set.
+          assert_true(result.headers['user-agent'] === undefined,
+                      'Default User-Agent header should not be passed to ' +
+                      'onfetch event.')
+        });
+  }, 'Test FetchEvent.request passed to onfetch');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resource-timing-bodySize.https.html b/test/fixtures/wpt/service-workers/service-worker/resource-timing-bodySize.https.html
new file mode 100644
index 000000000000..5c2b1eba8c81
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resource-timing-bodySize.https.html
@@ -0,0 +1,55 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<meta name="timeout" content="long">
+<script src="/common/utils.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const {REMOTE_ORIGIN} = get_host_info();
+
+/*
+  This test does the following:
+  - Loads a service worker
+  - Loads an iframe in the service worker's scope
+  - The service worker tries to fetch a resource which is either:
+    - constructed inside the service worker
+    - fetched from a different URL ny the service worker
+    - Streamed from a differend URL by the service worker
+    - Passes through
+  - By default the RT entry should have encoded/decoded body size. except for
+    the case where the response is an opaque pass-through.
+*/
+function test_scenario({tao, mode, name}) {
+    promise_test(async (t) => {
+        const uid = token();
+        const worker_url = `resources/fetch-response.js?uid=${uid}`;
+        const scope = `resources/fetch-response.html?uid=${uid}`;
+        const iframe = document.createElement('iframe');
+        const path = name === "passthrough" ? `element-timing/resources/TAOImage.py?origin=*&tao=${
+            tao === "pass" ? "wildcard" : "none"})}` : name;
+
+        iframe.src = `${scope}&path=${encodeURIComponent(
+            `${mode === "same-origin" ? "" : REMOTE_ORIGIN}/${path}`)}&mode=${mode}`;
+        const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+        t.add_cleanup(() => registration.unregister());
+        t.add_cleanup(() => iframe.remove());
+        await wait_for_state(t, registration.installing, 'activated');
+        const waitForMessage = new Promise(resolve =>
+          window.addEventListener('message', ({data}) => resolve(data)));
+        document.body.appendChild(iframe);
+        const {buffer, entry} = await waitForMessage;
+        const expectPass = name !== "passthrough" || mode !== "no-cors";
+        assert_equals(buffer.byteLength, expectPass ? entry.decodedBodySize : 0);
+        assert_equals(buffer.byteLength, expectPass ? entry.encodedBodySize : 0);
+    }, `Response body size: ${name}, ${mode}, TAO ${tao}`);
+}
+for (const mode of ["cors", "no-cors", "same-origin"]) {
+  for (const tao of ["pass", "fail"])
+    for (const name of ['constructed', 'forward', 'stream', 'passthrough']) {
+      test_scenario({tao, mode, name});
+    }
+}
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resource-timing-cross-origin.https.html b/test/fixtures/wpt/service-workers/service-worker/resource-timing-cross-origin.https.html
new file mode 100644
index 000000000000..9184a5933a8a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resource-timing-cross-origin.https.html
@@ -0,0 +1,47 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<meta charset="utf-8" />
+<title>This test validates Resource Timing for cross origin content fetched by Service Worker from an originally same-origin URL.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+</head>
+
+<body>
+<script>
+function test_sw_resource_timing({ mode }) {
+    promise_test(async t => {
+      const worker_url = `resources/worker-fetching-cross-origin.js?mode=${mode}`;
+      const scope = 'resources/iframe-with-image.html';
+      const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+      await wait_for_state(t, registration.installing, 'activated');
+      const frame = await with_iframe(scope);
+      const frame_performance = frame.contentWindow.performance;
+      // Check that there is one entry for which the timing allow check algorithm failed.
+      const entries = frame_performance.getEntriesByType('resource');
+      assert_equals(entries.length, 1);
+      const entry = entries[0];
+      assert_equals(entry.redirectStart, 0, 'redirectStart should be 0 in cross-origin request.');
+      assert_equals(entry.redirectEnd, 0, 'redirectEnd should be 0 in cross-origin request.');
+
+      assert_equals(entry.domainLookupStart, entry.fetchStart, 'domainLookupStart and fetchStart should be the same in cross-origin request.');
+      assert_equals(entry.domainLookupEnd, entry.fetchStart, 'domainLookupEnd and fetchStart should be the same in cross-origin request.');
+      assert_equals(entry.connectStart, entry.fetchStart, 'connectStart and fetchStart should be the same in cross-origin request.');
+      assert_equals(entry.connectEnd, entry.fetchStart, 'connectEnd and fetchStart should be the same in cross-origin request.');
+      assert_equals(entry.responseStart, entry.fetchStart, 'responseStart and fetchStart should be the same in cross-origin request.');
+      assert_equals(entry.secureConnectionStart, entry.fetchStart, 'secureConnectionStart and fetchStart should be the same in cross-origin request.');
+      assert_equals(entry.transferSize, 300, 'transferSize should be 300 in cross-origin request.');
+      frame.remove();
+      await registration.unregister();
+  }, `Test that timing allow check fails when service worker changes origin from same to cross origin (${mode}).`);
+}
+
+test_sw_resource_timing({ mode: "cors" });
+test_sw_resource_timing({ mode: "no-cors" });
+
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resource-timing-fetch-variants.https.html b/test/fixtures/wpt/service-workers/service-worker/resource-timing-fetch-variants.https.html
new file mode 100644
index 000000000000..8d4f0be01a8a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resource-timing-fetch-variants.https.html
@@ -0,0 +1,121 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<title>Test various interactions between fetch, service-workers and resource timing</title>
+<meta charset="utf-8" />
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<link rel="help" href="https://w3c.github.io/resource-timing/" >
+<!--
+    This test checks that the different properties in a PerformanceResourceTimingEntry
+    measure what they are supposed to measure according to spec.
+
+    It is achieved by generating programmatic delays and redirects inside a service worker,
+    and checking how the different metrics respond to the delays and redirects.
+
+    The deltas are not measured precisely, but rather relatively to the delay.
+    The delay needs to be long enough so that it's clear that what's measured is the test's
+    programmatic delay and not arbitrary system delays.
+-->
+</head>
+
+<body>
+<script>
+
+const delay = 200;
+const absolutePath = `${base_path()}/simple.txt`
+function toSequence({before, after, entry}) {
+    /*
+        The order of keys is the same as in this chart:
+        https://w3c.github.io/resource-timing/#attribute-descriptions
+    */
+    const keys = [
+        'startTime',
+        'redirectStart',
+        'redirectEnd',
+        'workerStart',
+        'fetchStart',
+        'connectStart',
+        'requestStart',
+        'responseStart',
+        'responseEnd'
+    ];
+
+    let cursor = before;
+    const step = value => {
+        // A zero/null value, reflect that in the sequence
+        if (!value)
+            return value;
+
+        // Value is the same as before
+        if (value === cursor)
+            return "same";
+
+        // Oops, value is in the wrong place
+        if (value < cursor)
+            return "back";
+
+        // Delta is greater than programmatic delay, this is where the delay is measured.
+        if ((value - cursor) >= delay)
+            return "delay";
+
+        // Some small delta, probably measuring an actual networking stack delay
+        return "tick";
+    }
+
+    const res = keys.map(key => {
+        const value = step(entry[key]);
+        if (entry[key])
+            cursor = entry[key];
+        return [key, value];
+    });
+
+    return Object.fromEntries([...res, ['after', step(after)]]);
+}
+async function testVariant(t, variant) {
+    const worker_url = 'resources/fetch-variants-worker.js';
+    const url = encodeURIComponent(`simple.txt?delay=${delay}&variant=${variant}`);
+    const scope = `resources/iframe-with-fetch-variants.html?url=${url}`;
+    const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+    t.add_cleanup(() => registration.unregister());
+    await wait_for_state(t, registration.installing, 'activated');
+    const frame = await with_iframe(scope);
+    t.add_cleanup(() => frame.remove());
+    const result = await new Promise(resolve => window.addEventListener('message', message => {
+        resolve(message.data);
+    }))
+
+    return toSequence(result);
+}
+
+promise_test(async t => {
+    const result = await testVariant(t, 'redirect');
+    assert_equals(result.redirectStart, 0);
+}, 'Redirects done from within a service-worker should not be exposed to client ResourceTiming');
+
+promise_test(async t => {
+    const result = await testVariant(t, 'forward');
+    assert_equals(result.connectStart, 'same');
+}, 'Connection info from within a service-worker should not be exposed to client ResourceTiming');
+
+promise_test(async t => {
+    const result = await testVariant(t, 'forward');
+    assert_not_equals(result.requestStart, 'back');
+}, 'requestStart should never be before fetchStart');
+
+promise_test(async t => {
+    const result = await testVariant(t, 'delay-after-fetch');
+    const whereIsDelayMeasured = Object.entries(result).find(r => r[1] === 'delay')[0];
+    assert_equals(whereIsDelayMeasured, 'responseStart');
+}, 'Delay from within service-worker (after internal fetching) should be accessible through `responseStart`');
+
+promise_test(async t => {
+    const result = await testVariant(t, 'delay-before-fetch');
+    const whereIsDelayMeasured = Object.entries(result).find(r => r[1] === 'delay')[0];
+    assert_equals(whereIsDelayMeasured, 'responseStart');
+}, 'Delay from within service-worker (before internal fetching) should be measured before responseStart in the client ResourceTiming entry');
+</script>
+
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resource-timing.sub.https.html b/test/fixtures/wpt/service-workers/service-worker/resource-timing.sub.https.html
new file mode 100644
index 000000000000..e8328f3597ba
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resource-timing.sub.https.html
@@ -0,0 +1,150 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function resourceUrl(path) {
+  return "https://{{host}}:{{ports[https][0]}}" + base_path() + path;
+}
+
+function crossOriginUrl(path) {
+  return "https://{{hosts[alt][]}}:{{ports[https][0]}}" + base_path() + path;
+}
+
+// Verify existance of a PerformanceEntry and the order between the timings.
+//
+// |options| has these properties:
+// performance: Performance interface to verify existance of the entry.
+// resource: the path to the resource.
+// mode: 'cross-origin' to load the resource from third-party origin.
+// description: the description passed to each assertion.
+// should_no_performance_entry: no entry is expected to be recorded when it's
+//                              true.
+function verify(options) {
+  const url = options.mode === 'cross-origin' ? crossOriginUrl(options.resource)
+    : resourceUrl(options.resource);
+  const entryList = options.performance.getEntriesByName(url, 'resource');
+  if (options.should_no_performance_entry) {
+    // The performance timeline may not have an entry for a resource
+    // which failed to load.
+    assert_equals(entryList.length, 0, options.description);
+    return;
+  }
+
+  assert_equals(entryList.length, 1, options.description);
+  const entry = entryList[0];
+  assert_equals(entry.entryType, 'resource', options.description);
+
+  // workerStart is recorded between startTime and fetchStart.
+  assert_greater_than(entry.workerStart, 0, options.description);
+  assert_greater_than_equal(entry.workerStart, entry.startTime, options.description);
+  assert_less_than_equal(entry.workerStart, entry.fetchStart, options.description);
+
+  if (options.mode === 'cross-origin') {
+    assert_equals(entry.responseStart, 0, options.description);
+    assert_greater_than_equal(entry.responseEnd, entry.fetchStart, options.description);
+  } else {
+    assert_greater_than_equal(entry.responseStart, entry.fetchStart, options.description);
+    assert_greater_than_equal(entry.responseEnd, entry.responseStart, options.description);
+  }
+
+  // responseEnd follows fetchStart.
+  assert_greater_than(entry.responseEnd, entry.fetchStart, options.description);
+  // duration always has some value.
+  assert_greater_than(entry.duration, 0, options.description);
+
+  if (options.resource.indexOf('redirect.py') != -1) {
+    assert_less_than_equal(entry.workerStart, entry.redirectStart,
+      options.description);
+  } else {
+    assert_equals(entry.redirectStart, 0, options.description);
+  }
+}
+
+promise_test(async (t) => {
+  const worker_url = 'resources/resource-timing-worker.js';
+  const scope = 'resources/resource-timing-iframe.sub.html';
+
+  const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+  t.add_cleanup(() => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+
+  const performance = frame.contentWindow.performance;
+  verify({
+    performance: performance,
+    resource: 'resources/sample.js',
+    mode: 'same-origin',
+    description: 'Generated response',
+  });
+  verify({
+    performance: performance,
+    resource: 'resources/empty.js',
+    mode: 'same-origin',
+    description: 'Network fallback',
+  });
+  verify({
+    performance: performance,
+    resource: 'resources/redirect.py?Redirect=empty.js',
+    mode: 'same-origin',
+    description: 'Redirect',
+  });
+  verify({
+    performance: performance,
+    resource: 'resources/square.png',
+    mode: 'same-origin',
+    description: 'Network fallback image',
+  });
+  // Test that worker start is available on cross-origin no-cors
+  // subresources.
+  verify({
+    performance: performance,
+    resource: 'resources/square.png',
+    mode: 'cross-origin',
+    description: 'Network fallback cross-origin image',
+  });
+
+  // Tests for resouces which failed to load.
+  verify({
+    performance: performance,
+    resource: 'resources/missing.jpg',
+    mode: 'same-origin',
+    description: 'Network fallback load failure',
+  });
+  verify({
+    performance: performance,
+    resource: 'resources/missing.asis',  // ORB-compatible 404 response.
+    mode: 'cross-origin',
+    description: 'Network fallback cross-origin load failure (404 response)',
+  });
+  // Tests for respondWith(fetch()).
+  verify({
+    performance: performance,
+    resource: 'resources/missing.jpg?SWRespondsWithFetch',
+    mode: 'same-origin',
+    description: 'Resource in iframe, nonexistent but responded with fetch to another.',
+  });
+  verify({
+    performance: performance,
+    resource: 'resources/sample.txt?SWFetched',
+    mode: 'same-origin',
+    description: 'Resource fetched as response from missing.jpg?SWRespondsWithFetch.',
+    should_no_performance_entry: true,
+  });
+  // Test for a normal resource that is unaffected by the Service Worker.
+  verify({
+    performance: performance,
+    resource: 'resources/empty-worker.js',
+    mode: 'same-origin',
+    description: 'Resource untouched by the Service Worker.',
+  });
+}, 'Controlled resource loads');
+
+test(() => {
+  const url = resourceUrl('resources/test-helpers.sub.js');
+  const entry = window.performance.getEntriesByName(url, 'resource')[0];
+  assert_equals(entry.workerStart, 0, 'Non-controlled');
+}, 'Non-controlled resource loads');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-blank-dynamic-nested-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-blank-dynamic-nested-frame.html
new file mode 100644
index 000000000000..1e0c6209bfc0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-blank-dynamic-nested-frame.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<html>
+<body>
+<script>
+function nestedLoaded() {
+  parent.postMessage({ type: 'NESTED_LOADED' }, '*');
+}
+
+// dynamically add an about:blank iframe
+var f = document.createElement('iframe');
+f.onload = nestedLoaded;
+document.body.appendChild(f);
+
+// Helper routine to make it slightly easier for our parent to find
+// the nested frame.
+function nested() {
+  return f.contentWindow;
+}
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-blank-nested-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-blank-nested-frame.html
new file mode 100644
index 000000000000..16f7e7c60ffa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-blank-nested-frame.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<html>
+<body>
+<script>
+function nestedLoaded() {
+  parent.postMessage({ type: 'NESTED_LOADED' }, '*');
+}
+
+// Helper routine to make it slightly easier for our parent to find
+// the nested frame.
+function nested() {
+  return document.getElementById('nested').contentWindow;
+}
+
+// NOTE: Make sure not to touch the iframe directly here.  We want to
+//       test the case where the initial about:blank document is not
+//       directly accessed before load.
+</script>
+<iframe id="nested" onload="nestedLoaded()"></iframe>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-srcdoc-nested-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-srcdoc-nested-frame.html
new file mode 100644
index 000000000000..0122a00aa432
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-srcdoc-nested-frame.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<html>
+<body>
+<script>
+function nestedLoaded() {
+  parent.postMessage({ type: 'NESTED_LOADED' }, '*');
+}
+</script>
+<iframe id="nested" srcdoc="<div></div>" onload="nestedLoaded()"></iframe>
+<script>
+// Helper routine to make it slightly easier for our parent to find
+// the nested frame.
+function nested() {
+  return document.getElementById('nested').contentWindow;
+}
+
+// NOTE: Make sure not to touch the iframe directly here.  We want to
+//       test the case where the initial about:blank document is not
+//       directly accessed before load.
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-uncontrolled-nested-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-uncontrolled-nested-frame.html
new file mode 100644
index 000000000000..89509159a410
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-uncontrolled-nested-frame.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<html>
+<body>
+<script>
+function nestedLoaded() {
+  parent.postMessage({ type: 'NESTED_LOADED' }, '*');
+}
+</script>
+<iframe src="empty.html?nested=true" id="nested" onload="nestedLoaded()"></iframe>
+<script>
+// Helper routine to make it slightly easier for our parent to find
+// the nested frame.
+function nested() {
+  return document.getElementById('nested').contentWindow;
+}
+
+// NOTE: Make sure not to touch the iframe directly here.  We want to
+//       test the case where the initial about:blank document is not
+//       directly accessed before load.
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-worker.js
new file mode 100644
index 000000000000..f43598e41c1a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-worker.js
@@ -0,0 +1,95 @@
+// Helper routine to find a client that matches a particular URL.  Note, we
+// require that Client to be controlled to avoid false matches with other
+// about:blank windows the browser might have.  The initial about:blank should
+// inherit the controller from its parent.
+async function getClientByURL(url) {
+  let list = await clients.matchAll();
+  return list.find(client => client.url === url);
+}
+
+// Helper routine to perform a ping-pong with the given target client.  We
+// expect the Client to respond with its location URL.
+async function pingPong(target) {
+  function waitForPong() {
+    return new Promise(resolve => {
+      self.addEventListener('message', function onMessage(evt) {
+        if (evt.data.type === 'PONG') {
+          resolve(evt.data.location);
+        }
+      });
+    });
+  }
+
+  target.postMessage({ type: 'PING' })
+  return await waitForPong(target);
+}
+
+addEventListener('fetch', async evt => {
+  let url = new URL(evt.request.url);
+  if (!url.searchParams.get('nested')) {
+    return;
+  }
+
+  evt.respondWith(async function() {
+    // Find the initial about:blank document.
+    const client = await getClientByURL('about:blank');
+    if (!client) {
+      return new Response('failure: could not find about:blank client');
+    }
+
+    // If the nested frame is configured to support a ping-pong, then
+    // ping it now to verify its message listener exists.  We also
+    // verify the Client's idea of its own location URL while we are doing
+    // this.
+    if (url.searchParams.get('ping')) {
+      const loc = await pingPong(client);
+      if (loc !== 'about:blank') {
+        return new Response(`failure: got location {$loc}, expected about:blank`);
+      }
+    }
+
+    // Finally, allow the nested frame to complete loading.  We place the
+    // Client ID we found for the initial about:blank in the body.
+    return new Response(client.id);
+  }());
+});
+
+addEventListener('message', evt => {
+  if (evt.data.type !== 'GET_CLIENT_ID') {
+    return;
+  }
+
+  evt.waitUntil(async function() {
+    let url = new URL(evt.data.url);
+
+    // Find the given Client by its URL.
+    let client = await getClientByURL(evt.data.url);
+    if (!client) {
+      evt.source.postMessage({
+        type: 'GET_CLIENT_ID',
+        result: `failure: could not find ${evt.data.url} client`
+      });
+      return;
+    }
+
+    // If the Client supports a ping-pong, then do it now to verify
+    // the message listener exists and its location matches the
+    // Client object.
+    if (url.searchParams.get('ping')) {
+      let loc = await pingPong(client);
+      if (loc !== evt.data.url) {
+        evt.source.postMessage({
+          type: 'GET_CLIENT_ID',
+          result: `failure: got location ${loc}, expected ${evt.data.url}`
+        });
+        return;
+      }
+    }
+
+    // Finally, send the client ID back.
+    evt.source.postMessage({
+      type: 'GET_CLIENT_ID',
+      result: client.id
+    });
+  }());
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/add-routes.js b/test/fixtures/wpt/service-workers/service-worker/resources/add-routes.js
new file mode 100644
index 000000000000..796acd19c12f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/add-routes.js
@@ -0,0 +1,37 @@
+let globalAddRoutes;
+let addRoutesError = {};
+
+self.addEventListener('install', event => {
+  globalAddRoutes = event.addRoutes.bind(event);
+  globalAddRoutes([
+    {
+      condition: { urlPattern: '/', runningStatus: 'not-running' },
+      source: 'network',
+    },
+  ])
+    .then(() => {
+      addRoutesError.install = null;
+  })
+    .catch(error => {
+      addRoutesError.install = error;
+    });
+});
+
+self.addEventListener('activate', event => {
+  globalAddRoutes([
+    {
+      condition: { urlPattern: '/', runningStatus: 'not-running' },
+      source: 'network',
+    },
+  ])
+    .then(() => {
+      addRoutesError.activate = null;
+    })
+    .catch(error => {
+      addRoutesError.activate = error;
+    });
+});
+
+self.addEventListener('message', event => {
+  event.ports[0].postMessage(addRoutesError);
+});
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/ancestorOrigins.html b/test/fixtures/wpt/service-workers/service-worker/resources/ancestorOrigins.html
new file mode 100644
index 000000000000..f69b8de78256
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/ancestorOrigins.html
@@ -0,0 +1,41 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>WindowClient ancestorOrigins helper</title>
+<script>
+(async function() {
+  const registration =
+    await navigator.serviceWorker.register("ancestorOrigins.js", { scope: './' });
+
+  const worker =
+    registration.installing || registration.waiting || registration.active;
+
+  if (!worker) {
+    throw new Error("No service worker on registration");
+  }
+
+  if (worker.state !== "activated") {
+    await new Promise(resolve => {
+      worker.addEventListener("statechange", () => {
+        if (worker.state === "activated") {
+          resolve();
+        }
+      });
+    });
+  }
+
+  async function gimmeAncestorOrigins() {
+    worker.postMessage("gimme!");
+    const msgEvt = await new Promise(resolve => {
+      navigator.serviceWorker.addEventListener("message", resolve, { once: true });
+    });
+    return msgEvt.data;
+  }
+
+  const { ancestorOrigins, sameObject } = await gimmeAncestorOrigins();
+  const locationAO = Array.from(location.ancestorOrigins ?? []);
+
+  await registration.unregister();
+
+  parent.postMessage({ id: window.name, swAO: ancestorOrigins, sameObject, locationAO }, '*');
+})();
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/ancestorOrigins.js b/test/fixtures/wpt/service-workers/service-worker/resources/ancestorOrigins.js
new file mode 100644
index 000000000000..7e4bf018fc4e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/ancestorOrigins.js
@@ -0,0 +1,6 @@
+self.onmessage = (evt) => {
+  evt.source.postMessage({
+    ancestorOrigins: evt.source.ancestorOrigins,
+    sameObject: evt.source.ancestorOrigins === evt.source.ancestorOrigins
+  });
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/basic-module-2.js b/test/fixtures/wpt/service-workers/service-worker/resources/basic-module-2.js
new file mode 100644
index 000000000000..189b1c87fee7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/basic-module-2.js
@@ -0,0 +1 @@
+export default 'hello again!';
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/basic-module.js b/test/fixtures/wpt/service-workers/service-worker/resources/basic-module.js
new file mode 100644
index 000000000000..789a89bc6308
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/basic-module.js
@@ -0,0 +1 @@
+export default 'hello!';
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/blank.html b/test/fixtures/wpt/service-workers/service-worker/resources/blank.html
new file mode 100644
index 000000000000..a3c3a4689a62
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/blank.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<title>Empty doc</title>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-blob-url-worker-fetch-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/claim-blob-url-worker-fetch-iframe.html
new file mode 100644
index 000000000000..12ae1a87258f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-blob-url-worker-fetch-iframe.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<script>
+const baseLocation = window.location;
+const workerScript =
+  `self.onmessage = async (e) => {
+    const url = new URL(e.data, '${baseLocation}').href;
+    const response = await fetch(url);
+    const text = await response.text();
+    self.postMessage(text);
+  };`;
+const blob = new Blob([workerScript], { type: 'text/javascript' });
+const blobUrl = URL.createObjectURL(blob);
+const worker = new Worker(blobUrl);
+
+function fetch_in_worker(url) {
+  return new Promise((resolve) => {
+    worker.onmessage = (e) => resolve(e.data);
+    worker.postMessage(url);
+  });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-nested-worker-fetch-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/claim-nested-worker-fetch-iframe.html
new file mode 100644
index 000000000000..2fa15db61d9c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-nested-worker-fetch-iframe.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<script>
+// An iframe that starts a nested worker. Our parent frame (the test page) calls
+// fetch_in_worker() to ask the nested worker to perform a fetch to see whether
+// it's controlled by a service worker.
+var worker = new Worker('./claim-nested-worker-fetch-parent-worker.js');
+
+function fetch_in_worker(url) {
+  return new Promise((resolve) => {
+    worker.onmessage = (event) => {
+      resolve(event.data);
+    };
+    worker.postMessage(url);
+  });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-nested-worker-fetch-parent-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/claim-nested-worker-fetch-parent-worker.js
new file mode 100644
index 000000000000..f5ff7c234b42
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-nested-worker-fetch-parent-worker.js
@@ -0,0 +1,12 @@
+try {
+  var worker = new Worker('./claim-worker-fetch-worker.js');
+
+  self.onmessage = (event) => {
+    worker.postMessage(event.data);
+  }
+  worker.onmessage = (event) => {
+    self.postMessage(event.data);
+  };
+} catch (e) {
+  self.postMessage("Fail: " + e.data);
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-shared-worker-fetch-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/claim-shared-worker-fetch-iframe.html
new file mode 100644
index 000000000000..ad865b848f8e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-shared-worker-fetch-iframe.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<script>
+var worker = new SharedWorker('./claim-shared-worker-fetch-worker.js');
+
+function fetch_in_shared_worker(url) {
+  return new Promise((resolve) => {
+    worker.port.onmessage = (event) => {
+      resolve(event.data);
+    };
+    worker.port.postMessage(url);
+  });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-shared-worker-fetch-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/claim-shared-worker-fetch-worker.js
new file mode 100644
index 000000000000..ddc8bea7af47
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-shared-worker-fetch-worker.js
@@ -0,0 +1,8 @@
+self.onconnect = (event) => {
+  var port = event.ports[0];
+  event.ports[0].onmessage = (evt) => {
+    fetch(evt.data)
+      .then(response => response.text())
+      .then(text => port.postMessage(text));
+  };
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-with-redirect-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/claim-with-redirect-iframe.html
new file mode 100644
index 000000000000..4150d7e68574
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-with-redirect-iframe.html
@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<body>
+<script>
+var host_info = get_host_info();
+
+function send_result(result) {
+  window.parent.postMessage({message: result},
+                            host_info['HTTPS_ORIGIN']);
+}
+
+function executeTask(params) {
+  // Execute task for each parameter
+  if (params.has('register')) {
+    var worker_url = decodeURIComponent(params.get('register'));
+    var scope = decodeURIComponent(params.get('scope'));
+    navigator.serviceWorker.register(worker_url, {scope: scope})
+      .then(r => send_result('registered'));
+  } else if (params.has('redirected')) {
+    send_result('redirected');
+  } else if (params.has('update')) {
+    var scope = decodeURIComponent(params.get('update'));
+    navigator.serviceWorker.getRegistration(scope)
+      .then(r => r.update())
+      .then(() => send_result('updated'));
+  } else if (params.has('unregister')) {
+    var scope = decodeURIComponent(params.get('unregister'));
+    navigator.serviceWorker.getRegistration(scope)
+      .then(r => r.unregister())
+      .then(succeeded => {
+          if (succeeded) {
+            send_result('unregistered');
+          } else {
+            send_result('failure: unregister');
+          }
+        });
+  } else {
+    send_result('unknown parameter: ' + params.toString());
+  }
+}
+
+var params = new URLSearchParams(location.search.slice(1));
+executeTask(params);
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker-fetch-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker-fetch-iframe.html
new file mode 100644
index 000000000000..92c5d15def0f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker-fetch-iframe.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<script>
+var worker = new Worker('./claim-worker-fetch-worker.js');
+
+function fetch_in_worker(url) {
+  return new Promise((resolve) => {
+    worker.onmessage = (event) => {
+      resolve(event.data);
+    };
+    worker.postMessage(url);
+  });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker-fetch-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker-fetch-worker.js
new file mode 100644
index 000000000000..7080181c85cb
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker-fetch-worker.js
@@ -0,0 +1,5 @@
+self.onmessage = (event) => {
+  fetch(event.data)
+    .then(response => response.text())
+    .then(text => self.postMessage(text));
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker.js
new file mode 100644
index 000000000000..18004079475e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker.js
@@ -0,0 +1,19 @@
+self.addEventListener('message', function(event) {
+    self.clients.claim()
+      .then(function(result) {
+          if (result !== undefined) {
+              event.data.port.postMessage(
+                  'FAIL: claim() should be resolved with undefined');
+              return;
+          }
+          event.data.port.postMessage('PASS');
+        })
+      .catch(function(error) {
+          event.data.port.postMessage('FAIL: exception: ' + error.name);
+        });
+  });
+
+self.addEventListener('fetch', function(event) {
+    if (!/404/.test(event.request.url))
+      event.respondWith(new Response('Intercepted!'));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/classic-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/classic-worker.js
new file mode 100644
index 000000000000..36a32b1a1f84
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/classic-worker.js
@@ -0,0 +1 @@
+importScripts('./imported-classic-script.js');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/client-id-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/client-id-worker.js
new file mode 100644
index 000000000000..ec71b3458b72
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/client-id-worker.js
@@ -0,0 +1,27 @@
+self.onmessage = function(e) {
+  var port = e.data.port;
+  var message = [];
+
+  var promise = Promise.resolve()
+    .then(function() {
+        // 1st matchAll()
+        return self.clients.matchAll().then(function(clients) {
+            clients.forEach(function(client) {
+                message.push(client.id);
+              });
+          });
+      })
+    .then(function() {
+        // 2nd matchAll()
+        return self.clients.matchAll().then(function(clients) {
+            clients.forEach(function(client) {
+                message.push(client.id);
+              });
+          });
+      })
+    .then(function() {
+        // Send an array containing ids of clients from 1st and 2nd matchAll()
+        port.postMessage(message);
+      });
+  e.waitUntil(promise);
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/client-navigate-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/client-navigate-frame.html
new file mode 100644
index 000000000000..7e186f8ee798
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/client-navigate-frame.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<script>
+  fetch("clientId")
+    .then(function(response) {
+      return response.text();
+    })
+    .then(function(text) {
+      parent.postMessage({id: text}, "*");
+    });
+</script>
+<body style="background-color: red;"></body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/client-navigate-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/client-navigate-worker.js
new file mode 100644
index 000000000000..6101d5d8f92c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/client-navigate-worker.js
@@ -0,0 +1,92 @@
+importScripts("worker-testharness.js");
+importScripts("test-helpers.sub.js");
+importScripts("/common/get-host-info.sub.js")
+importScripts("testharness-helpers.js")
+
+setup({ explicit_done: true });
+
+self.onfetch = function(e) {
+  if (e.request.url.indexOf("client-navigate-frame.html") >= 0) {
+    return;
+  }
+  e.respondWith(new Response(e.clientId));
+};
+
+function pass(test, url) {
+  return { result: test,
+           url: url };
+}
+
+function fail(test, reason) {
+  return { result: "FAILED " + test + " " + reason }
+}
+
+self.onmessage = function(e) {
+  var port = e.data.port;
+  var test = e.data.test;
+  var clientId = e.data.clientId;
+  var clientUrl = "";
+  if (test === "test_client_navigate_success") {
+    promise_test(function(t) {
+      this.add_cleanup(() => port.postMessage(pass(test, clientUrl)));
+      return self.clients.get(clientId)
+                 .then(client => client.navigate("client-navigated-frame.html"))
+                 .then(client => {
+                   clientUrl = client.url;
+                   assert_true(client instanceof WindowClient);
+                 })
+                 .catch(unreached_rejection(t));
+    }, "Return value should be instance of WindowClient");
+    done();
+  } else if (test === "test_client_navigate_cross_origin") {
+    promise_test(function(t) {
+      this.add_cleanup(() => port.postMessage(pass(test, clientUrl)));
+      var path = new URL('client-navigated-frame.html', self.location.href).pathname;
+      var url = get_host_info()['HTTPS_REMOTE_ORIGIN'] + path;
+      return self.clients.get(clientId)
+                 .then(client => client.navigate(url))
+                 .then(client => {
+                   clientUrl = (client && client.url) || "";
+                   assert_equals(client, null,
+                                 'cross-origin navigate resolves with null');
+                 })
+                 .catch(unreached_rejection(t));
+    }, "Navigating to different origin should resolve with null");
+    done();
+  } else if (test === "test_client_navigate_about_blank") {
+    promise_test(function(t) {
+      this.add_cleanup(function() { port.postMessage(pass(test, "")); });
+      return self.clients.get(clientId)
+                 .then(client => promise_rejects_js(t, TypeError, client.navigate("about:blank")))
+                 .catch(unreached_rejection(t));
+    }, "Navigating to about:blank should reject with TypeError");
+    done();
+  } else if (test === "test_client_navigate_mixed_content") {
+    promise_test(function(t) {
+      this.add_cleanup(function() { port.postMessage(pass(test, "")); });
+      var path = new URL('client-navigated-frame.html', self.location.href).pathname;
+      // Insecure URL should fail since the frame is owned by a secure parent
+      // and navigating to http:// would create a mixed-content violation.
+      var url = get_host_info()['HTTP_REMOTE_ORIGIN'] + path;
+      return self.clients.get(clientId)
+                 .then(client => promise_rejects_js(t, TypeError, client.navigate(url)))
+                 .catch(unreached_rejection(t));
+    }, "Navigating to mixed-content iframe should reject with TypeError");
+    done();
+  } else if (test === "test_client_navigate_redirect") {
+    var host_info = get_host_info();
+    var url = new URL(host_info['HTTPS_REMOTE_ORIGIN']).toString() +
+              new URL("client-navigated-frame.html", location).pathname.substring(1);
+    promise_test(function(t) {
+      this.add_cleanup(() => port.postMessage(pass(test, clientUrl)));
+      return self.clients.get(clientId)
+                 .then(client => client.navigate("redirect.py?Redirect=" + url))
+                 .then(client => {
+                   clientUrl = (client && client.url) || ""
+                   assert_equals(client, null);
+                 })
+                 .catch(unreached_rejection(t));
+    }, "Redirecting to another origin should resolve with null");
+    done();
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/client-navigated-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/client-navigated-frame.html
new file mode 100644
index 000000000000..307f7f9ac6ea
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/client-navigated-frame.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<body style="background-color: green;"></body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/client-url-creation-url-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/client-url-creation-url-iframe.html
new file mode 100644
index 000000000000..db2b9e5bbd91
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/client-url-creation-url-iframe.html
@@ -0,0 +1,85 @@
+<!DOCTYPE html>
+<title>Service Worker: Client.url is Window creation URL iframe resource</title>
+<script>
+// This is the iframe resource for the Client.url Window creation URL test.
+// It supports the test page telling it to navigate in various ways, and then
+// the iframe will post back that its done.
+
+// Turn the next time an event is raised into a promise.
+function wait_for_next_event(event_target, event_name) {
+  return new Promise(resolve => {
+    const event_handler = event => {
+      event_target.removeEventListener(event_name, event_handler);
+      resolve(event);
+    };
+    event_target.addEventListener(event_name, event_handler);
+  });
+}
+
+// Perform the navigation step sent to the iframe by the test page.
+async function perform_navigation(navigation_kind) {
+  // This is true if the navigation results in a new document instance.
+  // For example, history.pushState() doesn't create a new document, but
+  // navigating to a URL with a different query does. We need to keep
+  // track of this so we can post a message back to the test page when the
+  // navigation completes without loading a new document.
+  let cross_document_navigation = false;
+
+  const query_params = new URLSearchParams(location.search.substring(1));
+  const step = parseInt(query_params.get('step'), 10);
+
+  const next_url = `?step=${step + 1}`;
+
+  if (navigation_kind === 'pushstate') {
+    history.pushState({}, '', next_url);
+  } else if (navigation_kind === 'replacestate') {
+    history.replaceState({}, '', next_url);
+  } else if (navigation_kind === 'back-within-same-document') {
+    history.back();
+  } else if (navigation_kind === 'fragment') {
+    location.href = '#fragment';
+    await wait_for_next_event(window, 'hashchange');
+  } else if (navigation_kind === 'back-cross-document') {
+    // Note there are two back navigation_kinds. Both call history.back(),
+    // but 'back-cross-document' is for when we go back to a different
+    // document instance and the new document will postMessage the parent
+    // that the navigation is done, and and 'back-within-same-document' is for
+    // when we go back but remain in the same document and so need to
+    // postMessage the parent that the navigation is done from this document.
+    history.back();
+    cross_document_navigation = true;
+  } else if (navigation_kind === 'query') {
+    location.href = next_url;
+    cross_document_navigation = true;
+  } else if (navigation_kind === 'reload') {
+    location.reload();
+    cross_document_navigation = true;
+  } else {
+    throw new Error('Unknown navigation kind: ' + navigation_kind);
+  }
+  return cross_document_navigation;
+}
+
+window.addEventListener('message', async message_event => {
+  try {
+    const navigation_kind = message_event.data;
+
+    // If its a cross document navigation, then we need to send the done
+    // message back to the test page when the navigation has started the
+    // new document.
+    const cross_document_navigation = await perform_navigation(navigation_kind);
+    if (!cross_document_navigation ) {
+      window.parent.postMessage('done');
+    }
+  } catch (error) {
+    window.parent.postMessage('error: ' + error.message);
+  }
+});
+
+// Navigation steps either result in a new document instance or not. The
+// iframe needs to post a message back to the test page when the navigation
+// completes regardless. If the navigation does create a new document, then
+// the following postMessage informs the test page that the cross document
+// navigation has completed.
+window.parent.postMessage('done');
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/client-url-creation-url-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/client-url-creation-url-sw.js
new file mode 100644
index 000000000000..013d9be4caeb
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/client-url-creation-url-sw.js
@@ -0,0 +1,24 @@
+// This is a service worker script used by the client-url-creation-url test.
+// It exists only to look up the client URL of the test iframe and send it back
+// to the test page.
+addEventListener('message', message_event => {
+  const port = message_event.data.port;
+
+  const async_work = async () => {
+    try {
+      const clients = await self.clients.matchAll();
+
+      // In our test there should be exactly one client that is our test
+      // navigation iframe.
+      if (clients.length == 1) {
+        const client = clients[0];
+        port.postMessage(client.url);
+      } else {
+        port.postMessage(`error: expected 1 client, not ${clients.length}`);
+      }
+    } catch (error) {
+      port.postMessage(`error: ${error.message}`);
+    }
+  };
+  message_event.waitUntil(async_work());
+});
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/client-url-of-blob-url-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/client-url-of-blob-url-worker.html
new file mode 100644
index 000000000000..00f6acede8eb
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/client-url-of-blob-url-worker.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<script>
+
+// Return a URL of a client when it's successful.
+function createAndFetchFromBlobWorker() {
+  const fetchURL = new URL('get-worker-client-url.txt', window.location).href;
+  const workerScript =
+    `self.onmessage = async (e) => {
+      const response = await fetch(e.data.url);
+      const text = await response.text();
+      self.postMessage({"result": text, "expected": self.location.href});
+    };`;
+  const blob = new Blob([workerScript], { type: 'text/javascript' });
+  const blobUrl = URL.createObjectURL(blob);
+
+  const worker = new Worker(blobUrl);
+  return new Promise((resolve, reject) => {
+    worker.onmessage = e => resolve(e.data);
+    worker.onerror = e => reject(e.message);
+    worker.postMessage({"url": fetchURL});
+  });
+}
+
+</script>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/client-url-of-blob-url-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/client-url-of-blob-url-worker.js
new file mode 100644
index 000000000000..fd754f8250da
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/client-url-of-blob-url-worker.js
@@ -0,0 +1,10 @@
+addEventListener('fetch', e => {
+  if (e.request.url.includes('get-worker-client-url')) {
+    e.respondWith((async () => {
+      const clients = await self.clients.matchAll({type: 'worker'});
+      if (clients.length != 1)
+        return new Response('one worker client should exist');
+      return new Response(clients[0].url);
+    })());
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-frame-freeze.html b/test/fixtures/wpt/service-workers/service-worker/resources/clients-frame-freeze.html
new file mode 100644
index 000000000000..7468a660e908
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-frame-freeze.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script>
+  document.addEventListener('freeze', () => {
+      opener.postMessage('frozen', "*");
+  });
+
+  window.onmessage = (e) => {
+    if (e.data == 'freeze') {
+      test_driver.freeze();
+    }
+  };
+  opener.postMessage('loaded', '*');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-frame-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-frame-worker.js
new file mode 100644
index 000000000000..0a1461b40e08
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-frame-worker.js
@@ -0,0 +1,11 @@
+onmessage = function(e) {
+  if (e.data.cmd == 'GetClientId') {
+    fetch('clientId')
+        .then(function(response) {
+          return response.text();
+        })
+        .then(function(text) {
+          e.data.port.postMessage({clientId: text});
+        });
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-frame.html
new file mode 100644
index 000000000000..4324e6d4054f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-frame.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<script>
+fetch('clientId')
+  .then(function(response) {
+      return response.text();
+    })
+  .then(function(text) {
+      parent.postMessage({clientId: text}, '*');
+    });
+
+onmessage = function(e) {
+  if (e.data == 'StartWorker') {
+    var w = new Worker('clients-get-client-types-frame-worker.js');
+    w.postMessage({cmd:'GetClientId', port:e.ports[0]}, [e.ports[0]]);
+  }
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-shared-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-shared-worker.js
new file mode 100644
index 000000000000..fadef970374b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-shared-worker.js
@@ -0,0 +1,10 @@
+onconnect = function(e) {
+  var port = e.ports[0];
+  fetch('clientId')
+    .then(function(response) {
+        return response.text();
+      })
+    .then(function(text) {
+        port.postMessage({clientId: text});
+      });
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-worker.js
new file mode 100644
index 000000000000..0a1461b40e08
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-worker.js
@@ -0,0 +1,11 @@
+onmessage = function(e) {
+  if (e.data.cmd == 'GetClientId') {
+    fetch('clientId')
+        .then(function(response) {
+          return response.text();
+        })
+        .then(function(text) {
+          e.data.port.postMessage({clientId: text});
+        });
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-cross-origin-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-cross-origin-frame.html
new file mode 100644
index 000000000000..e16bb1116dc8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-cross-origin-frame.html
@@ -0,0 +1,50 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js"></script>
+<script>
+var host_info = get_host_info();
+var scope = 'blank.html?clients-get';
+var script = 'clients-get-worker.js';
+
+var registration;
+var worker;
+var wait_for_worker_promise = navigator.serviceWorker.getRegistration(scope)
+  .then(function(reg) {
+      if (reg)
+        return reg.unregister();
+    })
+  .then(function() {
+      return navigator.serviceWorker.register(script, {scope: scope});
+    })
+  .then(function(reg) {
+      registration = reg;
+      worker = reg.installing;
+      return new Promise(function(resolve) {
+          worker.addEventListener('statechange', function() {
+              if (worker.state == 'activated')
+                resolve();
+            });
+        });
+    });
+
+window.addEventListener('message', function(e) {
+  var cross_origin_client_ids = [];
+  cross_origin_client_ids.push(e.data.clientId);
+  wait_for_worker_promise
+    .then(function() {
+        return with_iframe(scope);
+      })
+    .then(function(iframe) {
+        add_completion_callback(function() { iframe.remove(); });
+        navigator.serviceWorker.onmessage = function(e) {
+          registration.unregister();
+          window.parent.postMessage(
+            { type: 'clientId', value: e.data }, host_info['HTTPS_ORIGIN']
+          );
+        };
+        registration.active.postMessage({clientIds: cross_origin_client_ids});
+      });
+});
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-frame.html
new file mode 100644
index 000000000000..27143d4b99b0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-frame.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<script>
+
+  fetch("clientId")
+    .then(function(response) {
+        return response.text();
+      })
+    .then(function(text) {
+        parent.postMessage({clientId: text}, "*");
+      });
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-other-origin.html b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-other-origin.html
new file mode 100644
index 000000000000..6342fe04f404
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-other-origin.html
@@ -0,0 +1,64 @@
+<!DOCTYPE html>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js"></script>
+<script>
+var host_info = get_host_info();
+var SCOPE = 'blank.html?clients-get';
+var SCRIPT = 'clients-get-worker.js';
+
+var registration;
+var worker;
+var wait_for_worker_promise = navigator.serviceWorker.getRegistration(SCOPE)
+  .then(function(reg) {
+      if (reg)
+        return reg.unregister();
+    })
+  .then(function() {
+      return navigator.serviceWorker.register(SCRIPT, {scope: SCOPE});
+    })
+  .then(function(reg) {
+      registration = reg;
+      worker = reg.installing;
+      return new Promise(function(resolve) {
+          worker.addEventListener('statechange', function() {
+              if (worker.state == 'activated')
+                resolve();
+            });
+        });
+    });
+
+function send_result(result) {
+  window.parent.postMessage(
+      {result: result},
+      host_info['HTTPS_ORIGIN']);
+}
+
+window.addEventListener("message", on_message, false);
+
+function on_message(e) {
+  if (e.origin != host_info['HTTPS_ORIGIN']) {
+    console.error('invalid origin: ' + e.origin);
+    return;
+  }
+  if (e.data.message == 'get_client_id') {
+    var otherOriginClientId = e.data.clientId;
+    wait_for_worker_promise
+      .then(function() {
+          return with_iframe(SCOPE);
+        })
+      .then(function(iframe) {
+          var channel = new MessageChannel();
+          channel.port1.onmessage = function(e) {
+            navigator.serviceWorker.getRegistration(SCOPE)
+              .then(function(reg) {
+                  reg.unregister();
+                  send_result(e.data);
+                });
+          };
+          iframe.contentWindow.navigator.serviceWorker.controller.postMessage(
+              {port:channel.port2, clientId: otherOriginClientId,
+               message: 'get_other_client_id'}, [channel.port2]);
+        })
+  }
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-resultingClientId-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-resultingClientId-worker.js
new file mode 100644
index 000000000000..5a46ff9cf440
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-resultingClientId-worker.js
@@ -0,0 +1,60 @@
+let savedPort = null;
+let savedResultingClientId = null;
+
+async function getTestingPage() {
+  const clientList = await self.clients.matchAll({ type: 'window', includeUncontrolled: true });
+  for (let c of clientList) {
+    if (c.url.endsWith('clients-get.https.html')) {
+      c.focus();
+      return c;
+    }
+  }
+  return null;
+}
+
+async function destroyResultingClient(testingPage) {
+  const destroyedPromise = new Promise(resolve => {
+    self.addEventListener('message', e => {
+      if (e.data.msg == 'resultingClientDestroyed') {
+        resolve();
+      }
+    }, {once: true});
+  });
+  testingPage.postMessage({ msg: 'destroyResultingClient' });
+  return destroyedPromise;
+}
+
+self.addEventListener('fetch', async (e) => {
+  let { resultingClientId } = e;
+  savedResultingClientId = resultingClientId;
+
+  if (e.request.url.endsWith('simple.html?fail')) {
+    e.waitUntil((async () => {
+      const testingPage = await getTestingPage();
+      await destroyResultingClient(testingPage);
+      testingPage.postMessage({ msg: 'resultingClientDestroyedAck',
+                                resultingDestroyedClientId: savedResultingClientId });
+    })());
+    return;
+  }
+
+  e.respondWith(fetch(e.request));
+});
+
+self.addEventListener('message', (e) => {
+  let { msg, resultingClientId } = e.data;
+  e.waitUntil((async () => {
+    if (msg == 'getIsResultingClientUndefined') {
+      const client = await self.clients.get(resultingClientId);
+      let isUndefined = typeof client == 'undefined';
+      e.source.postMessage({ msg: 'getIsResultingClientUndefined',
+        isResultingClientUndefined: isUndefined });
+      return;
+    }
+    if (msg == 'getResultingClientId') {
+      e.source.postMessage({ msg: 'getResultingClientId',
+                             resultingClientId: savedResultingClientId });
+      return;
+    }
+  })());
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-worker.js
new file mode 100644
index 000000000000..8effa56c98c9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-worker.js
@@ -0,0 +1,41 @@
+// This worker is designed to expose information about clients that is only available from Service Worker contexts.
+//
+// In the case of the `onfetch` handler, it provides the `clientId` property of
+// the `event` object. In the case of the `onmessage` handler, it provides the
+// Client instance attributes of the requested clients.
+self.onfetch = function(e) {
+  if (/\/clientId$/.test(e.request.url)) {
+    e.respondWith(new Response(e.clientId));
+    return;
+  }
+};
+
+self.onmessage = function(e) {
+  var client_ids = e.data.clientIds;
+  var message = [];
+
+  e.waitUntil(Promise.all(
+      client_ids.map(function(client_id) {
+          return self.clients.get(client_id);
+        }))
+      .then(function(clients) {
+          // No matching client for a given id or a matched client is off-origin
+          // from the service worker.
+          if (clients.length == 1 && clients[0] == undefined) {
+            e.source.postMessage(clients[0]);
+          } else {
+            clients.forEach(function(client) {
+                if (client instanceof Client) {
+                  message.push([client.visibilityState,
+                                client.focused,
+                                client.url,
+                                client.type,
+                                client.frameType]);
+                } else {
+                  message.push(client);
+                }
+              });
+            e.source.postMessage(message);
+          }
+        }));
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-blob-url-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-blob-url-worker.html
new file mode 100644
index 000000000000..ee89a0d8b3ee
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-blob-url-worker.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<script>
+const workerScript = `
+  self.onmessage = (e) => {
+    self.postMessage("Worker is ready.");
+  };
+`;
+const blob = new Blob([workerScript], { type: 'text/javascript' });
+const blobUrl = URL.createObjectURL(blob);
+const worker = new Worker(blobUrl);
+
+function waitForWorker() {
+  return new Promise(resolve => {
+    worker.onmessage = resolve;
+    worker.postMessage("Ping to worker.");
+  });
+}
+</script>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-dedicated-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-dedicated-worker.js
new file mode 100644
index 000000000000..5a3f04d33aaa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-dedicated-worker.js
@@ -0,0 +1,3 @@
+onmessage = function(e) {
+  postMessage(e.data);
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-iframe.html
new file mode 100644
index 000000000000..7607b035de31
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-iframe.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<title>Empty doc</title>
+<!--
+  Change the page URL using the History API to ensure that ServiceWorkerClient
+  uses the creation URL.
+-->
+<body onload="history.pushState({}, 'title', 'url-modified-via-pushstate.html')">
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-shared-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-shared-worker.js
new file mode 100644
index 000000000000..1ae72fb89445
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-shared-worker.js
@@ -0,0 +1,4 @@
+onconnect = function(e) {
+  var port = e.ports[0];
+  port.postMessage('started');
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-on-evaluation-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-on-evaluation-worker.js
new file mode 100644
index 000000000000..f1559aca39b6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-on-evaluation-worker.js
@@ -0,0 +1,11 @@
+importScripts('test-helpers.sub.js');
+
+var page_url = normalizeURL('../clients-matchall-on-evaluation.https.html');
+
+self.clients.matchAll({includeUncontrolled: true})
+  .then(function(clients) {
+      clients.forEach(function(client) {
+          if (client.url == page_url)
+            client.postMessage('matched');
+        });
+    });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-worker.js
new file mode 100644
index 000000000000..13e111a2f914
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-worker.js
@@ -0,0 +1,40 @@
+self.onmessage = function(e) {
+  var port = e.data.port;
+  var options = e.data.options;
+
+  e.waitUntil(self.clients.matchAll(options)
+    .then(function(clients) {
+        var message = [];
+        clients.forEach(function(client) {
+            var frame_type = client.frameType;
+            if (client.url.indexOf('clients-matchall-include-uncontrolled.https.html') > -1 &&
+                client.frameType == 'auxiliary') {
+              // The test tab might be opened using window.open() by the test framework.
+              // In that case, just pretend it's top-level!
+              frame_type = 'top-level';
+            }
+            if (e.data.includeLifecycleState) {
+              message.push({visibilityState: client.visibilityState,
+                            focused: client.focused,
+                            url: client.url,
+                            lifecycleState: client.lifecycleState,
+                            type: client.type,
+                            frameType: frame_type});
+            } else {
+              message.push([client.visibilityState,
+                            client.focused,
+                            client.url,
+                            client.type,
+                            frame_type]);
+            }
+          });
+        // Sort by url
+        if (!e.data.disableSort) {
+          message.sort(function(a, b) { return a[2] > b[2] ? 1 : -1; });
+        }
+        port.postMessage(message);
+      })
+    .catch(e => {
+        port.postMessage('clients.matchAll() rejected: ' + e);
+      }));
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/controlled-frame-postMessage.html b/test/fixtures/wpt/service-workers/service-worker/resources/controlled-frame-postMessage.html
new file mode 100644
index 000000000000..c4428e88a3da
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/controlled-frame-postMessage.html
@@ -0,0 +1,39 @@
+<html>
+<body>
+<script>
+var messageData;
+function registerMessage()
+{
+    navigator.serviceWorker.onmessage = (e) => {
+        if (window.messageData === undefined)
+            window.messageData = e.data;
+    }
+}
+
+function listenToMessages()
+{
+    messageData = [];
+    setTimeout(() => {
+        navigator.serviceWorker.addEventListener("message", (e) => {
+            messageData.push(e.data);
+        }, { once:true });
+    }, 500);
+    setTimeout(() => {
+        navigator.serviceWorker.onmessage = (e) => {
+            messageData.push(e.data);
+        };
+    }, 1000);
+}
+
+if (window.location.search === "?repeatMessages") {
+    setTimeout(() => {
+        registerMessage();
+    }, 500);
+} else if (window.location.search.includes("listener")) {
+    listenToMessages();
+} else {
+    registerMessage();
+}
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/controlled-worker-late-postMessage.js b/test/fixtures/wpt/service-workers/service-worker/resources/controlled-worker-late-postMessage.js
new file mode 100644
index 000000000000..41d2db43b1fe
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/controlled-worker-late-postMessage.js
@@ -0,0 +1,6 @@
+setTimeout(() => {
+    navigator.serviceWorker.onmessage = e => self.postMessage(e.data);
+}, 500);
+setTimeout(() => {
+    self.postMessage("No message received");
+}, 5000);
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/controlled-worker-postMessage.js b/test/fixtures/wpt/service-workers/service-worker/resources/controlled-worker-postMessage.js
new file mode 100644
index 000000000000..628dc65db11c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/controlled-worker-postMessage.js
@@ -0,0 +1,4 @@
+navigator.serviceWorker.onmessage = e => self.postMessage(e.data);
+setTimeout(() => {
+    self.postMessage("No message received");
+}, 5000);
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/cors-approved.txt b/test/fixtures/wpt/service-workers/service-worker/resources/cors-approved.txt
new file mode 100644
index 000000000000..1cd89bb14d60
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/cors-approved.txt
@@ -0,0 +1 @@
+plaintext
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/cors-approved.txt.headers b/test/fixtures/wpt/service-workers/service-worker/resources/cors-approved.txt.headers
new file mode 100644
index 000000000000..f7985fd9bd52
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/cors-approved.txt.headers
@@ -0,0 +1,3 @@
+Content-Type: text/plain
+Access-Control-Allow-Origin: *
+
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/cors-denied.txt b/test/fixtures/wpt/service-workers/service-worker/resources/cors-denied.txt
new file mode 100644
index 000000000000..ff333bd97da4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/cors-denied.txt
@@ -0,0 +1,2 @@
+this file is served without Access-Control-Allow-Origin headers so it should not
+be readable from cross-origin.
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/create-blob-url-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/create-blob-url-worker.js
new file mode 100644
index 000000000000..57e4882c24f7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/create-blob-url-worker.js
@@ -0,0 +1,22 @@
+const childWorkerScript = `
+  self.onmessage = async (e) => {
+    const response = await fetch(e.data);
+    const text = await response.text();
+    self.postMessage(text);
+  };
+`;
+const blob = new Blob([childWorkerScript], { type: 'text/javascript' });
+const blobUrl = URL.createObjectURL(blob);
+const childWorker = new Worker(blobUrl);
+
+// When a message comes from the parent frame, sends a resource url to the child
+// worker.
+self.onmessage = (e) => {
+  childWorker.postMessage(e.data);
+};
+
+// When a message comes from the child worker, sends a content of fetch() to the
+// parent frame.
+childWorker.onmessage = (e) => {
+  self.postMessage(e.data);
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/create-out-of-scope-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/create-out-of-scope-worker.html
new file mode 100644
index 000000000000..b51c45175094
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/create-out-of-scope-worker.html
@@ -0,0 +1,19 @@
+<!doctype html>
+<script>
+const workerUrl = '../out-of-scope/sample-synthesized-worker.js?dedicated';
+const worker = new Worker(workerUrl);
+const workerPromise = new Promise(resolve => {
+  worker.onmessage = e => {
+    // `e.data` is 'worker loading intercepted by service worker' when a worker
+    // is intercepted by a service worker.
+    resolve(e.data);
+  }
+  worker.onerror = _ => {
+    resolve('worker loading was not intercepted by service worker');
+  }
+});
+
+function getWorkerPromise() {
+  return workerPromise;
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/css-sw-same-origin-substitution-iframe.sub.html b/test/fixtures/wpt/service-workers/service-worker/resources/css-sw-same-origin-substitution-iframe.sub.html
new file mode 100644
index 000000000000..67e86e1ce6c3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/css-sw-same-origin-substitution-iframe.sub.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe: cross-origin CSS request, service worker substitutes a same-origin response</title>
+<!-- Cross-origin stylesheet request. The controlling service worker intercepts
+     it and responds with a fetch() of a same-origin stylesheet, so the content
+     is same-origin and cssRules must be readable. -->
+<link rel="stylesheet" type="text/css"
+      href="{{location[scheme]}}://{{hosts[alt][]}}:{{location[port]}}/service-workers/service-worker/resources/css-sw-substitute-marker.css">
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/css-sw-same-origin-substitution-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/css-sw-same-origin-substitution-worker.js
new file mode 100644
index 000000000000..eab5c9ff268b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/css-sw-same-origin-substitution-worker.js
@@ -0,0 +1,14 @@
+importScripts('test-helpers.sub.js');
+
+const BASE_PATH = base_path();
+
+self.addEventListener('fetch', event => {
+  const url = new URL(event.request.url);
+  // The iframe requests this cross-origin stylesheet; substitute a same-origin
+  // response (a real same-origin fetch => a cross-origin -> same-origin internal
+  // redirect on the page's channel).
+  if (url.pathname.endsWith('/css-sw-substitute-marker.css')) {
+    event.respondWith(fetch(
+        BASE_PATH + 'fetch-request-css-cross-origin-mime-check-same.css'));
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/direct.css b/test/fixtures/wpt/service-workers/service-worker/resources/direct.css
new file mode 100644
index 000000000000..c812213f5307
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/direct.css
@@ -0,0 +1,3 @@
+body {
+  width: 100%;
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/direct.html b/test/fixtures/wpt/service-workers/service-worker/resources/direct.html
new file mode 100644
index 000000000000..e98d70207afa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/direct.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<title>Direct</title>
+<body>
+  Here's a direct html from network.
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/direct.js b/test/fixtures/wpt/service-workers/service-worker/resources/direct.js
new file mode 100644
index 000000000000..ed6f0e5f980a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/direct.js
@@ -0,0 +1 @@
+window.router_condition_request_destination_script = true;
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/direct.txt b/test/fixtures/wpt/service-workers/service-worker/resources/direct.txt
new file mode 100644
index 000000000000..f3d9861c137b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/direct.txt
@@ -0,0 +1 @@
+Network
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/echo-message-to-source-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/echo-message-to-source-worker.js
new file mode 100644
index 000000000000..bbbd35fb4f60
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/echo-message-to-source-worker.js
@@ -0,0 +1,3 @@
+addEventListener('message', evt => {
+  evt.source.postMessage(evt.data);
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/embed-and-object-are-not-intercepted-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/embed-and-object-are-not-intercepted-worker.js
new file mode 100644
index 000000000000..ffcdb7512888
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/embed-and-object-are-not-intercepted-worker.js
@@ -0,0 +1,14 @@
+// This worker intercepts a request for EMBED/OBJECT and responds with a
+// response that indicates that interception occurred. The tests expect
+// that interception does not occur.
+self.addEventListener('fetch', e => {
+    if (e.request.url.indexOf('embedded-content-from-server.html') != -1) {
+      e.respondWith(fetch('embedded-content-from-service-worker.html'));
+      return;
+    }
+
+    if (e.request.url.indexOf('green.png') != -1) {
+      e.respondWith(Promise.reject('network error to show interception occurred'));
+      return;
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/embed-image-is-not-intercepted-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/embed-image-is-not-intercepted-iframe.html
new file mode 100644
index 000000000000..7b8b257203a2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/embed-image-is-not-intercepted-iframe.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe for embed-and-object-are-not-intercepted test</title>
+<body>
+<embed type="image/png" src="/images/green.png"></embed>
+<script>
+// Our parent (the root frame of the test) will examine this to get the result.
+var test_promise = new Promise(resolve => {
+    if (!navigator.serviceWorker.controller)
+      resolve('FAIL: this iframe is not controlled');
+
+    const elem = document.querySelector('embed');
+    elem.addEventListener('load', e => {
+        resolve('request was not intercepted');
+      });
+    elem.addEventListener('error', e => {
+        resolve('FAIL: request was intercepted');
+      });
+  });
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/embed-is-not-intercepted-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/embed-is-not-intercepted-iframe.html
new file mode 100644
index 000000000000..39149915cc57
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/embed-is-not-intercepted-iframe.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe for embed-and-object-are-not-intercepted test</title>
+<body>
+<script>
+// The EMBED element will call this with the result about whether the EMBED
+// request was intercepted by the service worker.
+var report_result;
+
+// Our parent (the root frame of the test) will examine this to get the result.
+var test_promise = new Promise(resolve => {
+    report_result = resolve;
+  });
+</script>
+
+<embed src="embedded-content-from-server.html"></embed>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/embed-navigation-is-not-intercepted-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/embed-navigation-is-not-intercepted-iframe.html
new file mode 100644
index 000000000000..5e86f67735f7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/embed-navigation-is-not-intercepted-iframe.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe for embed-and-object-are-not-intercepted test</title>
+<body>
+<script>
+// The EMBED element will call this with the result about whether the EMBED
+// request was intercepted by the service worker.
+var report_result;
+
+// Our parent (the root frame of the test) will examine this to get the result.
+var test_promise = new Promise(resolve => {
+    report_result = resolve;
+  });
+
+let el = document.createElement('embed');
+el.src = "/common/blank.html";
+el.addEventListener('load', _ => {
+  window[0].location = "/service-workers/service-worker/resources/embedded-content-from-server.html";
+}, { once: true });
+document.body.appendChild(el);
+</script>
+
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/embedded-content-from-server.html b/test/fixtures/wpt/service-workers/service-worker/resources/embedded-content-from-server.html
new file mode 100644
index 000000000000..ff50a9c75269
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/embedded-content-from-server.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>embed for embed-and-object-are-not-intercepted test</title>
+<script>
+window.parent.report_result('request for embedded content was not intercepted');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/embedded-content-from-service-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/embedded-content-from-service-worker.html
new file mode 100644
index 000000000000..2e2b9236082d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/embedded-content-from-service-worker.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>embed for embed-and-object-are-not-intercepted test</title>
+<script>
+window.parent.report_result('request for embedded content was intercepted by service worker');
+</script>
+
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/empty-but-slow-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/empty-but-slow-worker.js
new file mode 100644
index 000000000000..92abac7a384d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/empty-but-slow-worker.js
@@ -0,0 +1,8 @@
+addEventListener('fetch', evt => {
+  if (evt.request.url.endsWith('slow')) {
+    // Performance.now() might be a bit better here, but Date.now() has
+    // better compat in workers right now.
+    let start = Date.now();
+    while(Date.now() - start < 2000);
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/empty-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/empty-worker.js
new file mode 100644
index 000000000000..49ceb2648a93
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/empty-worker.js
@@ -0,0 +1 @@
+// Do nothing.
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/empty.h2.js b/test/fixtures/wpt/service-workers/service-worker/resources/empty.h2.js
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/empty.html b/test/fixtures/wpt/service-workers/service-worker/resources/empty.html
new file mode 100644
index 000000000000..6feb11946b80
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/empty.html
@@ -0,0 +1,6 @@
+<!doctype html>
+<html>
+<body>
+hello world
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/empty.js b/test/fixtures/wpt/service-workers/service-worker/resources/empty.js
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/enable-client-message-queue.html b/test/fixtures/wpt/service-workers/service-worker/resources/enable-client-message-queue.html
new file mode 100644
index 000000000000..512bd14bc67d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/enable-client-message-queue.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<script>
+  // The state variable is used by handle_message to record the time
+  // at which a message was handled. It's updated by the scripts
+  // loaded by the <script> tags at the bottom of the file as well as
+  // by the event listener added here.
+  var state = 'init';
+  addEventListener('DOMContentLoaded', () => state = 'loaded');
+
+  // We expect to get three ping messages from the service worker.
+  const expected = ['init', 'install', 'start'];
+  let promises = {};
+  let resolvers = {};
+  expected.forEach(name => {
+    promises[name] = new Promise(resolve => resolvers[name] = resolve);
+  });
+
+  // Once all messages have been dispatched, the state in which each
+  // of them was dispatched is recorded in the draft. At that point
+  // the draft becomes the final report.
+  var draft = {};
+  var report = Promise.all(Object.values(promises)).then(() => window.draft);
+
+  // This message handler is installed by the 'install' script.
+  function handle_message(event) {
+    const data = event.data.data;
+    draft[data] = state;
+    resolvers[data]();
+  }
+</script>
+
+<!--
+  The controlling service worker will delay the response to these
+  fetch requests until the test instructs it how to reply. Note that
+  the event loop keeps spinning while the parser is blocked.
+-->
+<script src="empty.js?key=install"></script>
+<script src="empty.js?key=start"></script>
+<script src="empty.js?key=finish"></script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/end-to-end-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/end-to-end-worker.js
new file mode 100644
index 000000000000..d45a50556a93
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/end-to-end-worker.js
@@ -0,0 +1,7 @@
+onmessage = function(e) {
+  var message = e.data;
+  if (typeof message === 'object' && 'port' in message) {
+    var response = 'Ack for: ' + message.from;
+    message.port.postMessage(response);
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/events-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/events-worker.js
new file mode 100644
index 000000000000..80a2188677ba
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/events-worker.js
@@ -0,0 +1,12 @@
+var eventsSeen = [];
+
+function handler(event) { eventsSeen.push(event.type); }
+
+['activate', 'install'].forEach(function(type) {
+    self.addEventListener(type, handler);
+  });
+
+onmessage = function(e) {
+  var message = e.data;
+  message.port.postMessage({events: eventsSeen});
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/extendable-event-async-waituntil.js b/test/fixtures/wpt/service-workers/service-worker/resources/extendable-event-async-waituntil.js
new file mode 100644
index 000000000000..8a975b0d2e9b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/extendable-event-async-waituntil.js
@@ -0,0 +1,210 @@
+// This worker calls waitUntil() and respondWith() asynchronously and
+// reports back to the test whether they threw.
+//
+// These test cases are confusing. Bear in mind that the event is active
+// (calling waitUntil() is allowed) if:
+// * The pending promise count is not 0, or
+// * The event dispatch flag is set.
+
+// Controlled by 'init'/'done' messages.
+var resolveLockPromise;
+var port;
+
+self.addEventListener('message', function(event) {
+    var waitPromise;
+    var resolveTestPromise;
+
+    switch (event.data.step) {
+      case 'init':
+        event.waitUntil(new Promise((res) => { resolveLockPromise = res; }));
+        port = event.data.port;
+        break;
+      case 'done':
+        resolveLockPromise();
+        break;
+
+      // Throws because waitUntil() is called in a task after event dispatch
+      // finishes.
+      case 'no-current-extension-different-task':
+        async_task_waituntil(event).then(reportResultExpecting('InvalidStateError'));
+        break;
+
+      // OK because waitUntil() is called in a microtask that runs after the
+      // event handler runs, while the event dispatch flag is still set.
+      case 'no-current-extension-different-microtask':
+        async_microtask_waituntil(event).then(reportResultExpecting('OK'));
+        break;
+
+      // OK because the second waitUntil() is called while the first waitUntil()
+      // promise is still pending.
+      case 'current-extension-different-task':
+        event.waitUntil(new Promise((res) => { resolveTestPromise = res; }));
+        async_task_waituntil(event).then(reportResultExpecting('OK')).then(resolveTestPromise);
+        break;
+
+      // OK because all promises involved resolve "immediately", so the second
+      // waitUntil() is called during the microtask checkpoint at the end of
+      // event dispatching, when the event dispatch flag is still set.
+      case 'during-event-dispatch-current-extension-expired-same-microtask-turn':
+        waitPromise = Promise.resolve();
+        event.waitUntil(waitPromise);
+        waitPromise.then(() => { return sync_waituntil(event); })
+          .then(reportResultExpecting('OK'))
+        break;
+
+      // OK for the same reason as above.
+      case 'during-event-dispatch-current-extension-expired-same-microtask-turn-extra':
+        waitPromise = Promise.resolve();
+        event.waitUntil(waitPromise);
+        waitPromise.then(() => { return async_microtask_waituntil(event); })
+          .then(reportResultExpecting('OK'))
+        break;
+
+
+      // OK because the pending promise count is decremented in a microtask
+      // queued upon fulfillment of the first waitUntil() promise, so the second
+      // waitUntil() is called while the pending promise count is still
+      // positive.
+      case 'after-event-dispatch-current-extension-expired-same-microtask-turn':
+        waitPromise = makeNewTaskPromise();
+        event.waitUntil(waitPromise);
+        waitPromise.then(() => { return sync_waituntil(event); })
+          .then(reportResultExpecting('OK'))
+        break;
+
+      // Throws because the second waitUntil() is called after the pending
+      // promise count was decremented to 0.
+      case 'after-event-dispatch-current-extension-expired-same-microtask-turn-extra':
+        waitPromise = makeNewTaskPromise();
+        event.waitUntil(waitPromise);
+        waitPromise.then(() => { return async_microtask_waituntil(event); })
+          .then(reportResultExpecting('InvalidStateError'))
+        break;
+
+      // Throws because the second waitUntil() is called in a new task, after
+      // first waitUntil() promise settled and the event dispatch flag is unset.
+      case 'current-extension-expired-different-task':
+        event.waitUntil(Promise.resolve());
+        async_task_waituntil(event).then(reportResultExpecting('InvalidStateError'));
+        break;
+
+      case 'script-extendable-event':
+        self.dispatchEvent(new ExtendableEvent('nontrustedevent'));
+        break;
+    }
+
+    event.source.postMessage('ACK');
+  });
+
+self.addEventListener('fetch', function(event) {
+  const path = new URL(event.request.url).pathname;
+  const step = path.substring(path.lastIndexOf('/') + 1);
+  let response;
+  switch (step) {
+    // OK because waitUntil() is called while the respondWith() promise is still
+    // unsettled, so the pending promise count is positive.
+    case 'pending-respondwith-async-waituntil':
+      var resolveFetch;
+      response = new Promise((res) => { resolveFetch = res; });
+      event.respondWith(response);
+      async_task_waituntil(event)
+        .then(reportResultExpecting('OK'))
+        .then(() => { resolveFetch(new Response('OK')); });
+      break;
+
+    // OK because all promises involved resolve "immediately", so waitUntil() is
+    // called during the microtask checkpoint at the end of event dispatching,
+    // when the event dispatch flag is still set.
+    case 'during-event-dispatch-respondwith-microtask-sync-waituntil':
+      response = Promise.resolve(new Response('RESP'));
+      event.respondWith(response);
+      response.then(() => { return sync_waituntil(event); })
+        .then(reportResultExpecting('OK'));
+      break;
+
+    // OK because all promises involved resolve "immediately", so waitUntil() is
+    // called during the microtask checkpoint at the end of event dispatching,
+    // when the event dispatch flag is still set.
+    case 'during-event-dispatch-respondwith-microtask-async-waituntil':
+      response = Promise.resolve(new Response('RESP'));
+      event.respondWith(response);
+      response.then(() => { return async_microtask_waituntil(event); })
+        .then(reportResultExpecting('OK'));
+      break;
+
+    // OK because the pending promise count is decremented in a microtask queued
+    // upon fulfillment of the respondWith() promise, so waitUntil() is called
+    // while the pending promise count is still positive.
+    case 'after-event-dispatch-respondwith-microtask-sync-waituntil':
+      response = makeNewTaskPromise().then(() => {return new Response('RESP');});
+      event.respondWith(response);
+      response.then(() => { return sync_waituntil(event); })
+        .then(reportResultExpecting('OK'));
+      break;
+
+
+    // Throws because waitUntil() is called after the pending promise count was
+    // decremented to 0.
+    case 'after-event-dispatch-respondwith-microtask-async-waituntil':
+      response = makeNewTaskPromise().then(() => {return new Response('RESP');});
+      event.respondWith(response);
+      response.then(() => { return async_microtask_waituntil(event); })
+        .then(reportResultExpecting('InvalidStateError'))
+      break;
+  }
+});
+
+self.addEventListener('nontrustedevent', function(event) {
+    sync_waituntil(event).then(reportResultExpecting('InvalidStateError'));
+  });
+
+function reportResultExpecting(expectedResult) {
+  return function (result) {
+    port.postMessage({result : result, expected: expectedResult});
+    return result;
+  };
+}
+
+function sync_waituntil(event) {
+  return new Promise((res, rej) => {
+    try {
+      event.waitUntil(Promise.resolve());
+      res('OK');
+    } catch (error) {
+      res(error.name);
+    }
+  });
+}
+
+function async_microtask_waituntil(event) {
+  return new Promise((res, rej) => {
+    Promise.resolve().then(() => {
+      try {
+        event.waitUntil(Promise.resolve());
+        res('OK');
+      } catch (error) {
+        res(error.name);
+      }
+    });
+  });
+}
+
+function async_task_waituntil(event) {
+  return new Promise((res, rej) => {
+    setTimeout(() => {
+      try {
+        event.waitUntil(Promise.resolve());
+        res('OK');
+      } catch (error) {
+        res(error.name);
+      }
+    }, 0);
+  });
+}
+
+// Returns a promise that settles in a separate task.
+function makeNewTaskPromise() {
+  return new Promise(resolve => {
+    setTimeout(resolve, 0);
+  });
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/extendable-event-waituntil.js b/test/fixtures/wpt/service-workers/service-worker/resources/extendable-event-waituntil.js
new file mode 100644
index 000000000000..20a9eb023f62
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/extendable-event-waituntil.js
@@ -0,0 +1,87 @@
+var pendingPorts = [];
+var portResolves = [];
+
+onmessage = function(e) {
+  var message = e.data;
+  if ('port' in message) {
+    var resolve = self.portResolves.shift();
+    if (resolve)
+      resolve(message.port);
+    else
+      self.pendingPorts.push(message.port);
+  }
+};
+
+function fulfillPromise() {
+  return new Promise(function(resolve) {
+      // Make sure the oninstall/onactivate callback returns first.
+      Promise.resolve().then(function() {
+          var port = self.pendingPorts.shift();
+          if (port)
+            resolve(port);
+          else
+            self.portResolves.push(resolve);
+        });
+    }).then(function(port) {
+        port.postMessage('SYNC');
+        return new Promise(function(resolve) {
+            port.onmessage = function(e) {
+              if (e.data == 'ACK')
+                resolve();
+            };
+          });
+      });
+}
+
+function rejectPromise() {
+  return new Promise(function(resolve, reject) {
+      // Make sure the oninstall/onactivate callback returns first.
+      Promise.resolve().then(reject);
+    });
+}
+
+function stripScopeName(url) {
+  return url.split('/').slice(-1)[0];
+}
+
+oninstall = function(e) {
+  switch (stripScopeName(self.location.href)) {
+    case 'install-fulfilled':
+      e.waitUntil(fulfillPromise());
+      break;
+    case 'install-rejected':
+      e.waitUntil(rejectPromise());
+      break;
+    case 'install-multiple-fulfilled':
+      e.waitUntil(fulfillPromise());
+      e.waitUntil(fulfillPromise());
+      break;
+    case 'install-reject-precedence':
+      // Three "extend lifetime promises" are needed to verify that the user
+      // agent waits for all promises to settle even in the event of rejection.
+      // The first promise is fulfilled on demand by the client, the second is
+      // immediately scheduled for rejection, and the third is fulfilled on
+      // demand by the client (but only after the first promise has been
+      // fulfilled).
+      //
+      // User agents which simply expose `Promise.all` semantics in this case
+      // (by entering the "redundant state" following the rejection of the
+      // second promise but prior to the fulfillment of the third) can be
+      // identified from the client context.
+      e.waitUntil(fulfillPromise());
+      e.waitUntil(rejectPromise());
+      e.waitUntil(fulfillPromise());
+      break;
+  }
+};
+
+onactivate = function(e) {
+  switch (stripScopeName(self.location.href)) {
+    case 'activate-fulfilled':
+      e.waitUntil(fulfillPromise());
+      break;
+    case 'activate-rejected':
+      e.waitUntil(rejectPromise());
+      break;
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fail-on-fetch-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fail-on-fetch-worker.js
new file mode 100644
index 000000000000..517f289fbc8e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fail-on-fetch-worker.js
@@ -0,0 +1,5 @@
+importScripts('worker-testharness.js');
+
+this.addEventListener('fetch', function(event) {
+    event.respondWith(new Response('ERROR'));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-access-control-login.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-access-control-login.html
new file mode 100644
index 000000000000..ee296807ed14
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-access-control-login.html
@@ -0,0 +1,16 @@
+<script>
+// Set authentication info
+window.addEventListener("message", function(evt) {
+    var port = evt.ports[0];
+    document.cookie = 'cookie=' + evt.data.cookie;
+    var xhr = new XMLHttpRequest();
+    xhr.addEventListener('load', function() {
+        port.postMessage({msg: 'LOGIN FINISHED'});
+      }, false);
+    xhr.open('GET',
+             './fetch-access-control.py?Auth',
+             true,
+             evt.data.username, evt.data.password);
+    xhr.send();
+  }, false);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-double-write-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-double-write-worker.js
new file mode 100644
index 000000000000..17723dcdda2f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-double-write-worker.js
@@ -0,0 +1,7 @@
+self.addEventListener('fetch', (event) => {
+  url = new URL(event.request.url);
+  if (url.search == '?PNGIMAGE') {
+    localUrl = new URL(url.pathname + url.search, self.location);
+    event.respondWith(fetch(localUrl));
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-iframe.html
new file mode 100644
index 000000000000..75d766c193a8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-iframe.html
@@ -0,0 +1,70 @@
+<html>
+<title>iframe for fetch canvas tainting test</title>
+<script>
+const NOT_TAINTED = 'NOT_TAINTED';
+const TAINTED = 'TAINTED';
+const LOAD_ERROR = 'LOAD_ERROR';
+
+// Creates an image/video element with src=|url| and an optional |cross_origin|
+// attibute. Tries to read from the image/video using a canvas element. Returns
+// NOT_TAINTED if it could be read, TAINTED if it could not be read, and
+// LOAD_ERROR if loading the image/video failed.
+function create_test_case_promise(url, cross_origin) {
+  return new Promise(resolve => {
+      if (url.indexOf('PNGIMAGE') != -1) {
+        const img = document.createElement('img');
+        if (cross_origin != '') {
+          img.crossOrigin = cross_origin;
+        }
+        img.onload = function() {
+          try {
+            const canvas = document.createElement('canvas');
+            canvas.width = 100;
+            canvas.height = 100;
+            const context = canvas.getContext('2d');
+            context.drawImage(img, 0, 0);
+            context.getImageData(0, 0, 100, 100);
+            resolve(NOT_TAINTED);
+          } catch (e) {
+            resolve(TAINTED);
+          }
+        };
+        img.onerror = function() {
+          resolve(LOAD_ERROR);
+        }
+        img.src = url;
+        return;
+      }
+
+      if (url.indexOf('VIDEO') != -1) {
+        const video = document.createElement('video');
+        video.autoplay = true;
+        video.muted = true;
+        if (cross_origin != '') {
+          video.crossOrigin = cross_origin;
+        }
+        video.onplay = function() {
+          try {
+            const canvas = document.createElement('canvas');
+            canvas.width = 100;
+            canvas.height = 100;
+            const context = canvas.getContext('2d');
+            context.drawImage(video, 0, 0);
+            context.getImageData(0, 0, 100, 100);
+            resolve(NOT_TAINTED);
+          } catch (e) {
+            resolve(TAINTED);
+          }
+        };
+        video.onerror = function() {
+          resolve(LOAD_ERROR);
+        }
+        video.src = url;
+        return;
+      }
+
+      resolve('unknown resource type');
+  });
+}
+</script>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-tests.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-tests.js
new file mode 100644
index 000000000000..2aada3669eff
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-tests.js
@@ -0,0 +1,241 @@
+// This is the main driver of the canvas tainting tests.
+const NOT_TAINTED = 'NOT_TAINTED';
+const TAINTED = 'TAINTED';
+const LOAD_ERROR = 'LOAD_ERROR';
+
+let frame;
+
+// Creates a single promise_test.
+function canvas_taint_test(url, cross_origin, expected_result) {
+  promise_test(t => {
+      return frame.contentWindow.create_test_case_promise(url, cross_origin)
+        .then(result => {
+          assert_equals(result, expected_result);
+        });
+    }, 'url "' + url + '" with crossOrigin "' + cross_origin + '" should be ' +
+           expected_result);
+}
+
+
+// Runs all the tests. The given |params| has these properties:
+// * |resource_path|: the relative path to the (image/video) resource to test.
+// * |cache|: when true, the service worker bounces responses into
+//   Cache Storage and back out before responding with them.
+function do_canvas_tainting_tests(params) {
+  const host_info = get_host_info();
+  let resource_path = params.resource_path;
+  if (params.cache)
+    resource_path += "&cache=true";
+  const resource_url = host_info['HTTPS_ORIGIN'] + resource_path;
+  const remote_resource_url = host_info['HTTPS_REMOTE_ORIGIN'] + resource_path;
+
+  // Set up the service worker and the frame.
+  promise_test(function(t) {
+      const SCOPE = 'resources/fetch-canvas-tainting-iframe.html';
+      const SCRIPT = 'resources/fetch-rewrite-worker.js';
+      const host_info = get_host_info();
+
+      // login_https() is needed because some test cases use credentials.
+      return login_https(t)
+        .then(function() {
+            return service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+          })
+        .then(function(registration) {
+            promise_test(() => {
+                if (frame)
+                  frame.remove();
+                return registration.unregister();
+              }, 'restore global state');
+
+            return wait_for_state(t, registration.installing, 'activated');
+          })
+        .then(function() { return with_iframe(SCOPE); })
+        .then(f => {
+            frame = f;
+          });
+    }, 'initialize global state');
+
+  // Reject tests. Add '&reject' so the service worker responds with a rejected promise.
+  // A load error is expected.
+  canvas_taint_test(resource_url + '&reject', '', LOAD_ERROR);
+  canvas_taint_test(resource_url + '&reject', 'anonymous', LOAD_ERROR);
+  canvas_taint_test(resource_url + '&reject', 'use-credentials', LOAD_ERROR);
+
+  // Fallback tests. Add '&ignore' so the service worker does not respond to the fetch
+  // request, and we fall back to network.
+  canvas_taint_test(resource_url + '&ignore', '', NOT_TAINTED);
+  canvas_taint_test(remote_resource_url + '&ignore', '', TAINTED);
+  canvas_taint_test(remote_resource_url + '&ignore', 'anonymous', LOAD_ERROR);
+  canvas_taint_test(
+      remote_resource_url + '&ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+          '&ignore',
+      'anonymous',
+      NOT_TAINTED);
+  canvas_taint_test(remote_resource_url + '&ignore', 'use-credentials', LOAD_ERROR);
+  canvas_taint_test(
+      remote_resource_url + '&ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+          '&ignore',
+      'use-credentials',
+      LOAD_ERROR);
+  canvas_taint_test(
+      remote_resource_url + '&ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+          '&ACACredentials=true&ignore',
+      'use-credentials',
+      NOT_TAINTED);
+
+  // Credential tests (with fallback). Add '&Auth' so the server requires authentication.
+  // Furthermore, add '&ignore' so the service worker falls back to network.
+  canvas_taint_test(resource_url + '&Auth&ignore', '', NOT_TAINTED);
+  canvas_taint_test(remote_resource_url + '&Auth&ignore', '', TAINTED);
+  canvas_taint_test(
+      remote_resource_url + '&Auth&ignore', 'anonymous', LOAD_ERROR);
+  canvas_taint_test(
+      remote_resource_url + '&Auth&ignore',
+      'use-credentials',
+      LOAD_ERROR);
+  canvas_taint_test(
+      remote_resource_url + '&Auth&ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+      '&ignore',
+      'use-credentials',
+      LOAD_ERROR);
+  canvas_taint_test(
+      remote_resource_url + '&Auth&ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+      '&ACACredentials=true&ignore',
+      'use-credentials',
+      NOT_TAINTED);
+
+  // In the following tests, the service worker provides a response.
+  // Add '&url' so the service worker responds with fetch(url).
+  // Add '&mode' to configure the fetch request options.
+
+  // Basic response tests. Set &url to the original url.
+  canvas_taint_test(
+      resource_url + '&mode=same-origin&url=' + encodeURIComponent(resource_url),
+      '',
+      NOT_TAINTED);
+  canvas_taint_test(
+      resource_url + '&mode=same-origin&url=' + encodeURIComponent(resource_url),
+      'anonymous',
+      NOT_TAINTED);
+  canvas_taint_test(
+      resource_url + '&mode=same-origin&url=' + encodeURIComponent(resource_url),
+      'use-credentials',
+      NOT_TAINTED);
+  canvas_taint_test(
+      remote_resource_url + '&mode=same-origin&url=' +
+          encodeURIComponent(resource_url),
+      '',
+      NOT_TAINTED);
+  canvas_taint_test(
+      remote_resource_url + '&mode=same-origin&url=' +
+          encodeURIComponent(resource_url),
+      'anonymous',
+      NOT_TAINTED);
+  canvas_taint_test(
+      remote_resource_url + '&mode=same-origin&url=' +
+          encodeURIComponent(resource_url),
+      'use-credentials',
+      NOT_TAINTED);
+
+  // Opaque response tests. Set &url to the cross-origin URL, and &mode to
+  // 'no-cors' so we expect an opaque response.
+  canvas_taint_test(
+      resource_url +
+          '&mode=no-cors&url=' + encodeURIComponent(remote_resource_url),
+      '',
+      TAINTED);
+  canvas_taint_test(
+      resource_url +
+          '&mode=no-cors&url=' + encodeURIComponent(remote_resource_url),
+      'anonymous',
+      LOAD_ERROR);
+  canvas_taint_test(
+      resource_url +
+          '&mode=no-cors&url=' + encodeURIComponent(remote_resource_url),
+      'use-credentials',
+      LOAD_ERROR);
+  canvas_taint_test(
+      remote_resource_url +
+          '&mode=no-cors&url=' + encodeURIComponent(remote_resource_url),
+      '',
+      TAINTED);
+  canvas_taint_test(
+      remote_resource_url +
+          '&mode=no-cors&url=' + encodeURIComponent(remote_resource_url),
+      'anonymous',
+      LOAD_ERROR);
+  canvas_taint_test(
+      remote_resource_url +
+          '&mode=no-cors&url=' + encodeURIComponent(remote_resource_url),
+      'use-credentials',
+      LOAD_ERROR);
+
+  // CORS response tests. Set &url to the cross-origin URL, and &mode
+  // to 'cors' to attempt a CORS request.
+  canvas_taint_test(
+      resource_url + '&mode=cors&url=' +
+          encodeURIComponent(remote_resource_url +
+                             '&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      '',
+      LOAD_ERROR); // We expect LOAD_ERROR since the server doesn't respond
+                   // with an Access-Control-Allow-Credentials header.
+  canvas_taint_test(
+      resource_url + '&mode=cors&credentials=same-origin&url=' +
+          encodeURIComponent(remote_resource_url +
+                             '&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      '',
+      NOT_TAINTED);
+  canvas_taint_test(
+      resource_url + '&mode=cors&url=' +
+          encodeURIComponent(remote_resource_url +
+                             '&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      'anonymous',
+      NOT_TAINTED);
+  canvas_taint_test(
+      resource_url + '&mode=cors&url=' +
+          encodeURIComponent(remote_resource_url +
+                             '&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      'use-credentials',
+      LOAD_ERROR); // We expect LOAD_ERROR since the server doesn't respond
+                   // with an Access-Control-Allow-Credentials header.
+  canvas_taint_test(
+      resource_url + '&mode=cors&url=' +
+          encodeURIComponent(
+              remote_resource_url +
+              '&ACACredentials=true&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      'use-credentials',
+      NOT_TAINTED);
+  canvas_taint_test(
+      remote_resource_url + '&mode=cors&url=' +
+          encodeURIComponent(remote_resource_url +
+                             '&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      '',
+      LOAD_ERROR); // We expect LOAD_ERROR since the server doesn't respond
+                   // with an Access-Control-Allow-Credentials header.
+  canvas_taint_test(
+      remote_resource_url + '&mode=cors&credentials=same-origin&url=' +
+          encodeURIComponent(remote_resource_url +
+                             '&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      '',
+      NOT_TAINTED);
+  canvas_taint_test(
+      remote_resource_url + '&mode=cors&url=' +
+          encodeURIComponent(remote_resource_url +
+                             '&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      'anonymous',
+      NOT_TAINTED);
+  canvas_taint_test(
+      remote_resource_url + '&mode=cors&url=' +
+          encodeURIComponent(remote_resource_url +
+                             '&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      'use-credentials',
+      LOAD_ERROR); // We expect LOAD_ERROR since the server doesn't respond
+                   // with an Access-Control-Allow-Credentials header.
+  canvas_taint_test(
+      remote_resource_url + '&mode=cors&url=' +
+          encodeURIComponent(
+              remote_resource_url +
+              '&ACACredentials=true&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      'use-credentials',
+      NOT_TAINTED);
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-cors-exposed-header-names-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-cors-exposed-header-names-worker.js
new file mode 100644
index 000000000000..145952a22cf0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-cors-exposed-header-names-worker.js
@@ -0,0 +1,3 @@
+self.addEventListener('fetch', (e) => {
+    e.respondWith(fetch(e.request));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-cors-xhr-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-cors-xhr-iframe.html
new file mode 100644
index 000000000000..d88c5103d35b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-cors-xhr-iframe.html
@@ -0,0 +1,170 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js?pipe=sub"></script>
+<script>
+var path = base_path() + 'fetch-access-control.py';
+var host_info = get_host_info();
+var SUCCESS = 'SUCCESS';
+var FAIL = 'FAIL';
+
+function create_test_case_promise(url, with_credentials) {
+  return new Promise(function(resolve) {
+      var xhr = new XMLHttpRequest();
+      xhr.onload = function() {
+        if (xhr.status == 200) {
+          resolve(SUCCESS);
+        } else {
+          resolve("STATUS" + xhr.status);
+        }
+      }
+      xhr.onerror = function() {
+        resolve(FAIL);
+      }
+      xhr.responseType = 'text';
+      xhr.withCredentials = with_credentials;
+      xhr.open('GET', url, true);
+      xhr.send();
+    });
+}
+
+window.addEventListener('message', async (evt) => {
+    var port = evt.ports[0];
+    var url = host_info['HTTPS_ORIGIN'] + path;
+    var remote_url = host_info['HTTPS_REMOTE_ORIGIN'] + path;
+    var TEST_CASES = [
+      // Reject tests
+      [url + '?reject', false, FAIL],
+      [url + '?reject', true, FAIL],
+      [remote_url + '?reject', false, FAIL],
+      [remote_url + '?reject', true, FAIL],
+      // Event handler exception tests
+      [url + '?throw', false, SUCCESS],
+      [url + '?throw', true, SUCCESS],
+      [remote_url + '?throw', false, FAIL],
+      [remote_url + '?throw', true, FAIL],
+      // Reject(resolve-null) tests
+      [url + '?resolve-null', false, FAIL],
+      [url + '?resolve-null', true, FAIL],
+      [remote_url + '?resolve-null', false, FAIL],
+      [remote_url + '?resolve-null', true, FAIL],
+      // Fallback tests
+      [url + '?ignore', false, SUCCESS],
+      [url + '?ignore', true, SUCCESS],
+      [remote_url + '?ignore', false, FAIL, true],  // Executed in serial.
+      [remote_url + '?ignore', true, FAIL, true],  // Executed in serial.
+      [
+        remote_url + '?ACAOrigin=' + host_info['HTTPS_ORIGIN'] + '&ignore',
+        false, SUCCESS
+      ],
+      [
+        remote_url + '?ACAOrigin=' + host_info['HTTPS_ORIGIN'] + '&ignore',
+        true, FAIL, true  // Executed in serial.
+      ],
+      [
+        remote_url + '?ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+        '&ACACredentials=true&ignore',
+        true, SUCCESS
+      ],
+      // Credential test (fallback)
+      [url + '?Auth&ignore', false, SUCCESS],
+      [url + '?Auth&ignore', true, SUCCESS],
+      [remote_url + '?Auth&ignore', false, FAIL],
+      [remote_url + '?Auth&ignore', true, FAIL],
+      [
+        remote_url + '?Auth&ACAOrigin=' + host_info['HTTPS_ORIGIN'] + '&ignore',
+        false, 'STATUS401'
+      ],
+      [
+        remote_url + '?Auth&ACAOrigin=' + host_info['HTTPS_ORIGIN'] + '&ignore',
+        true, FAIL, true  // Executed in serial.
+      ],
+      [
+        remote_url + '?Auth&ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+        '&ACACredentials=true&ignore',
+        true, SUCCESS
+      ],
+      // Basic response
+      [
+        url + '?mode=same-origin&url=' + encodeURIComponent(url),
+        false, SUCCESS
+      ],
+      [
+        url + '?mode=same-origin&url=' + encodeURIComponent(url),
+        false, SUCCESS
+      ],
+      [
+        remote_url + '?mode=same-origin&url=' + encodeURIComponent(url),
+        false, SUCCESS
+      ],
+      [
+        remote_url + '?mode=same-origin&url=' + encodeURIComponent(url),
+        false, SUCCESS
+      ],
+      // Opaque response
+      [
+        url + '?mode=no-cors&url=' + encodeURIComponent(remote_url),
+        false, FAIL
+      ],
+      [
+        url + '?mode=no-cors&url=' + encodeURIComponent(remote_url),
+        false, FAIL
+      ],
+      [
+        remote_url + '?mode=no-cors&url=' + encodeURIComponent(remote_url),
+        false, FAIL
+      ],
+      [
+        remote_url + '?mode=no-cors&url=' + encodeURIComponent(remote_url),
+        false, FAIL
+      ],
+      // CORS response
+      [
+        url + '?mode=cors&url=' +
+        encodeURIComponent(remote_url + '?ACAOrigin=' +
+                           host_info['HTTPS_ORIGIN']),
+        false, SUCCESS
+      ],
+      [
+        url + '?mode=cors&url=' +
+        encodeURIComponent(remote_url + '?ACAOrigin=' +
+                           host_info['HTTPS_ORIGIN']),
+        true, FAIL
+      ],
+      [
+        url + '?mode=cors&url=' +
+        encodeURIComponent(remote_url + '?ACAOrigin=' +
+                           host_info['HTTPS_ORIGIN'] +
+                           '&ACACredentials=true'),
+        true, SUCCESS
+      ],
+      [
+        remote_url + '?mode=cors&url=' +
+        encodeURIComponent(remote_url + '?ACAOrigin=' +
+                           host_info['HTTPS_ORIGIN']),
+        false, SUCCESS
+      ],
+      [
+        remote_url +
+        '?mode=cors&url=' +
+        encodeURIComponent(remote_url + '?ACAOrigin=' +
+                           host_info['HTTPS_ORIGIN']),
+        true, FAIL
+      ],
+      [
+        remote_url +
+        '?mode=cors&url=' +
+        encodeURIComponent(remote_url + '?ACAOrigin=' +
+                           host_info['HTTPS_ORIGIN'] +
+                           '&ACACredentials=true'),
+        true, SUCCESS
+      ]
+    ];
+
+    let counter = 0;
+    for (let test of TEST_CASES) {
+      let result = await create_test_case_promise(test[0], test[1]);
+      let testName = 'test ' + (++counter) + ': ' + test[0] + ' with credentials ' + test[1] + ' must be ' + test[2];
+      port.postMessage({testName: testName, result: result === test[2]});
+    }
+    port.postMessage('done');
+  }, false);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-csp-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-csp-iframe.html
new file mode 100644
index 000000000000..33bf0416d585
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-csp-iframe.html
@@ -0,0 +1,16 @@
+<script>
+var meta = document.createElement('meta');
+meta.setAttribute('http-equiv', 'Content-Security-Policy');
+meta.setAttribute('content', decodeURIComponent(location.search.substring(1)));
+document.head.appendChild(meta);
+
+function load_image(url) {
+  return new Promise(function(resolve, reject) {
+      var img = document.createElement('img');
+      document.body.appendChild(img);
+      img.onload = resolve;
+      img.onerror = reject;
+      img.src = url;
+    });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-csp-iframe.html.sub.headers b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-csp-iframe.html.sub.headers
new file mode 100644
index 000000000000..5a1c7b941aca
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-csp-iframe.html.sub.headers
@@ -0,0 +1 @@
+Content-Security-Policy: img-src https://{{host}}:{{ports[https][0]}}; connect-src 'unsafe-inline' 'self'
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-error-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-error-worker.js
new file mode 100644
index 000000000000..788252cf3b3b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-error-worker.js
@@ -0,0 +1,22 @@
+importScripts("/resources/testharness.js");
+
+function doTest(event)
+{
+    if (!event.request.url.includes("fetch-error-test"))
+        return;
+
+    let counter = 0;
+    const stream = new ReadableStream({ pull: controller => {
+        switch (++counter) {
+        case 1:
+            controller.enqueue(new Uint8Array([1]));
+            return;
+        default:
+            // We asynchronously error the stream so that there is ample time to resolve the fetch promise and call text() on the response.
+            step_timeout(() => controller.error("Sorry"), 50);
+        }
+    }});
+    event.respondWith(new Response(stream));
+}
+
+self.addEventListener("fetch", doTest);
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-add-async-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-add-async-worker.js
new file mode 100644
index 000000000000..a5a44a57c99c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-add-async-worker.js
@@ -0,0 +1,6 @@
+importScripts('/resources/testharness.js');
+
+promise_test(async () => {
+  await new Promise(handler => { step_timeout(handler, 0); });
+  self.addEventListener('fetch', () => {});
+}, 'fetch event added asynchronously does not throw');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-after-navigation-within-page-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-after-navigation-within-page-iframe.html
new file mode 100644
index 000000000000..bf8a6d5ce51f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-after-navigation-within-page-iframe.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<script>
+function fetch_url(url) {
+  return new Promise(function(resolve, reject) {
+      var request = new XMLHttpRequest();
+      request.addEventListener('load', function(event) {
+          if (request.status == 200)
+            resolve(request.response);
+          else
+            reject(new Error('fetch_url: ' + request.statusText + " : " + url));
+        });
+      request.addEventListener('error', function(event) {
+          reject(new Error('fetch_url encountered an error: ' + url));
+        });
+      request.addEventListener('abort', function(event) {
+          reject(new Error('fetch_url was aborted: ' + url));
+        });
+      request.open('GET', url);
+      request.send();
+    });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-async-respond-with-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-async-respond-with-worker.js
new file mode 100644
index 000000000000..dc3f1a1e9856
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-async-respond-with-worker.js
@@ -0,0 +1,66 @@
+// This worker attempts to call respondWith() asynchronously after the
+// fetch event handler finished. It reports back to the test whether
+// an exception was thrown.
+
+// These get reset at the start of a test case.
+let reportResult;
+
+// The test page sends a message to tell us that a new test case is starting.
+// We expect a fetch event after this.
+self.addEventListener('message', (event) => {
+  // Ensure tests run mutually exclusive.
+  if (reportResult) {
+    event.source.postMessage('testAlreadyRunning');
+    return;
+  }
+
+  const resultPromise = new Promise((resolve) => {
+    reportResult = resolve;
+    // Tell the client that everything is initialized and that it's safe to
+    // proceed with the test without relying on the order of events (which some
+    // browsers like Chrome may not guarantee).
+    event.source.postMessage('messageHandlerInitialized');
+  });
+
+  // Keep the worker alive until the test case finishes, and report
+  // back the result to the test page.
+  event.waitUntil(resultPromise.then(result => {
+    reportResult = null;
+    event.source.postMessage(result);
+  }));
+});
+
+// Calls respondWith() and reports back whether an exception occurred.
+function tryRespondWith(event) {
+  try {
+    event.respondWith(new Response());
+    reportResult({didThrow: false});
+  } catch (error) {
+    reportResult({didThrow: true, error: error.name});
+  }
+}
+
+function respondWithInTask(event) {
+  setTimeout(() => {
+    tryRespondWith(event);
+  }, 0);
+}
+
+function respondWithInMicrotask(event) {
+  Promise.resolve().then(() => {
+    tryRespondWith(event);
+  });
+}
+
+self.addEventListener('fetch', function(event) {
+  const path = new URL(event.request.url).pathname;
+  const test = path.substring(path.lastIndexOf('/') + 1);
+
+  // If this is a test case, try respondWith() and report back to the test page
+  // the result.
+  if (test == 'respondWith-in-task') {
+    respondWithInTask(event);
+  } else if (test == 'respondWith-in-microtask') {
+    respondWithInMicrotask(event);
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-download-helpers.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-download-helpers.js
new file mode 100644
index 000000000000..f9ad52daf81d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-download-helpers.js
@@ -0,0 +1,50 @@
+// Shared helpers for fetch-event-download-*.https.html tests.
+// crbug.com/40410035.
+
+function uniqueChannelId() {
+  return 'download-' + Math.random().toString(36).slice(2);
+}
+
+// Resolves with the first message posted to a BroadcastChannel of the given
+// id, or rejects via the test's timeout if none arrives.
+function nextChannelMessage(t, channelId) {
+  return new Promise((resolve) => {
+    const channel = new BroadcastChannel(channelId);
+    channel.addEventListener('message', (e) => {
+      channel.close();
+      resolve(e.data);
+    }, {once: true});
+    t.add_cleanup(() => channel.close());
+  });
+}
+
+// Resolves true if a message arrived within `timeoutMs`, false otherwise.
+function awaitChannelSilence(t, channelId, timeoutMs) {
+  return new Promise((resolve) => {
+    const channel = new BroadcastChannel(channelId);
+    let received = false;
+    channel.addEventListener('message', () => {
+      received = true;
+      channel.close();
+      resolve(true);
+    });
+    step_timeout(() => {
+      channel.close();
+      resolve(received);
+    }, timeoutMs);
+    t.add_cleanup(() => channel.close());
+  });
+}
+
+// Programmatically clicks an <a download> via testdriver so the click carries
+// transient activation; without it Chromium's download path may suppress the
+// fetch entirely.
+async function clickDownloadAnchor(t, href) {
+  const a = document.createElement('a');
+  a.href = href;
+  a.download = '';
+  a.textContent = 'download';
+  document.body.appendChild(a);
+  t.add_cleanup(() => a.remove());
+  await test_driver.click(a);
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-download-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-download-worker.js
new file mode 100644
index 000000000000..38d0f56dc302
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-download-worker.js
@@ -0,0 +1,39 @@
+// Service worker for fetch-event-download-*.https.html.
+//
+// Echoes the FetchEvent it sees for download requests onto a BroadcastChannel
+// named after the channel ID embedded in the request URL's `?channel=` query
+// parameter, then optionally provides a response based on the `?mode=` param.
+//
+// Mode values:
+//   "respond" (default) — call event.respondWith(new Response("from-sw", ...)).
+//   "fallback"          — observe the event but do not call respondWith,
+//                         letting the request fall back to the network.
+
+self.addEventListener('fetch', (event) => {
+  const url = new URL(event.request.url);
+  const channelId = url.searchParams.get('channel');
+  if (!channelId) {
+    return;
+  }
+  const mode = url.searchParams.get('mode') || 'respond';
+
+  const channel = new BroadcastChannel(channelId);
+  channel.postMessage({
+    type: 'fetch',
+    url: event.request.url,
+    destination: event.request.destination,
+    method: event.request.method,
+    mode: event.request.mode,
+    referrer: event.request.referrer,
+    clientId: event.clientId,
+    resultingClientId: event.resultingClientId,
+  });
+
+  if (mode === 'fallback') {
+    return;
+  }
+
+  event.respondWith(new Response('from-sw', {
+    headers: {'content-type': 'text/plain'},
+  }));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-handled-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-handled-worker.js
new file mode 100644
index 000000000000..53ee1493743d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-handled-worker.js
@@ -0,0 +1,37 @@
+// This worker reports back the final state of FetchEvent.handled (RESOLVED or
+// REJECTED) to the test.
+
+self.addEventListener('message', function(event) {
+  self.port = event.data.port;
+});
+
+self.addEventListener('fetch', function(event) {
+  try {
+    event.handled.then(() => {
+      self.port.postMessage('RESOLVED');
+    }, () => {
+      self.port.postMessage('REJECTED');
+    });
+  } catch (e) {
+    self.port.postMessage('FAILED');
+    return;
+  }
+
+  const search = new URL(event.request.url).search;
+  switch (search) {
+    case '?respondWith-not-called':
+      break;
+    case '?respondWith-not-called-and-event-canceled':
+      event.preventDefault();
+      break;
+    case '?respondWith-called-and-promise-resolved':
+      event.respondWith(Promise.resolve(new Response('body')));
+      break;
+    case '?respondWith-called-and-promise-resolved-to-invalid-response':
+      event.respondWith(Promise.resolve('invalid response'));
+      break;
+    case '?respondWith-called-and-promise-rejected':
+      event.respondWith(Promise.reject(new Error('respondWith rejected')));
+      break;
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-error-controllee-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-error-controllee-iframe.html
new file mode 100644
index 000000000000..f6c1919bbcf6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-error-controllee-iframe.html
@@ -0,0 +1,60 @@
+<!DOCTYPE html>
+<script>
+function fetch_url(url) {
+  return new Promise(function(resolve, reject) {
+      var request = new XMLHttpRequest();
+      request.addEventListener('load', function(event) {
+          resolve();
+        });
+      request.addEventListener('error', function(event) {
+          reject();
+        });
+      request.open('GET', url);
+      request.send();
+    });
+}
+
+function make_test(testcase) {
+  var name = testcase.name;
+  return fetch_url(window.location.href + '?' + name)
+    .then(
+      function() {
+          if (testcase.expect_load)
+            return Promise.resolve();
+          return Promise.reject(new Error(
+              name + ': expected network error but loaded'));
+        },
+      function() {
+          if (!testcase.expect_load)
+            return Promise.resolve();
+          return Promise.reject(new Error(
+              name + ': expected to load but got network error'));
+        });
+}
+
+function run_tests() {
+  var tests = [
+    { name: 'prevent-default-and-respond-with', expect_load: true },
+    { name: 'prevent-default', expect_load: false },
+    { name: 'reject', expect_load: false },
+    { name: 'unused-body', expect_load: true },
+    { name: 'used-body', expect_load: false },
+    { name: 'unused-fetched-body', expect_load: true },
+    { name: 'used-fetched-body', expect_load: false },
+    { name: 'throw-exception', expect_load: true },
+  ].map(make_test);
+
+  Promise.all(tests)
+    .then(function() {
+        window.parent.notify_test_done('PASS');
+      })
+    .catch(function(error) {
+        window.parent.notify_test_done('FAIL: ' + error.message);
+      });
+}
+
+if (!navigator.serviceWorker.controller)
+  window.parent.notify_test_done('FAIL: no controller');
+else
+  run_tests();
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-error-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-error-worker.js
new file mode 100644
index 000000000000..5bfe3a0bbd9c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-error-worker.js
@@ -0,0 +1,49 @@
+// Test that multiple fetch handlers do not confuse the implementation.
+self.addEventListener('fetch', function(event) {});
+
+self.addEventListener('fetch', function(event) {
+    var testcase = new URL(event.request.url).search;
+    switch (testcase) {
+    case '?reject':
+      event.respondWith(Promise.reject());
+      break;
+    case '?prevent-default':
+      event.preventDefault();
+      break;
+    case '?prevent-default-and-respond-with':
+      event.preventDefault();
+      break;
+    case '?unused-body':
+      event.respondWith(new Response('body'));
+      break;
+    case '?used-body':
+      var res = new Response('body');
+      res.text();
+      event.respondWith(res);
+      break;
+    case '?unused-fetched-body':
+      event.respondWith(fetch('other.html').then(function(res){
+          return res;
+        }));
+      break;
+    case '?used-fetched-body':
+      event.respondWith(fetch('other.html').then(function(res){
+          res.text();
+          return res;
+        }));
+      break;
+    case '?throw-exception':
+      throw('boom');
+      break;
+    }
+  });
+
+self.addEventListener('fetch', function(event) {});
+
+self.addEventListener('fetch', function(event) {
+    var testcase = new URL(event.request.url).search;
+    if (testcase == '?prevent-default-and-respond-with')
+      event.respondWith(new Response('responding!'));
+  });
+
+self.addEventListener('fetch', function(event) {});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-fallback-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-fallback-worker.js
new file mode 100644
index 000000000000..376bdbed05e1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-fallback-worker.js
@@ -0,0 +1,3 @@
+self.addEventListener('fetch', () => {
+  // Do nothing.
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-argument-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-argument-iframe.html
new file mode 100644
index 000000000000..0ebd1ca81537
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-argument-iframe.html
@@ -0,0 +1,55 @@
+<!DOCTYPE html>
+<script>
+function fetch_url(url) {
+  return new Promise(function(resolve, reject) {
+      var request = new XMLHttpRequest();
+      request.addEventListener('load', function(event) {
+          resolve();
+        });
+      request.addEventListener('error', function(event) {
+          reject();
+        });
+      request.open('GET', url);
+      request.send();
+    });
+}
+
+function make_test(testcase) {
+  var name = testcase.name;
+  return fetch_url(window.location.href + '?' + name)
+    .then(
+      function() {
+          if (testcase.expect_load)
+            return Promise.resolve();
+          return Promise.reject(new Error(
+              name + ': expected network error but loaded'));
+        },
+      function() {
+          if (!testcase.expect_load)
+            return Promise.resolve();
+          return Promise.reject(new Error(
+              name + ': expected to load but got network error'));
+        });
+}
+
+function run_tests() {
+  var tests = [
+    { name: 'response-object', expect_load: true },
+    { name: 'response-promise-object', expect_load: true },
+    { name: 'other-value', expect_load: false },
+  ].map(make_test);
+
+  Promise.all(tests)
+    .then(function() {
+        window.parent.notify_test_done('PASS');
+      })
+    .catch(function(error) {
+        window.parent.notify_test_done('FAIL: ' + error.message);
+      });
+}
+
+if (!navigator.serviceWorker.controller)
+  window.parent.notify_test_done('FAIL: no controller');
+else
+  run_tests();
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-argument-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-argument-worker.js
new file mode 100644
index 000000000000..712c4b73c9bc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-argument-worker.js
@@ -0,0 +1,14 @@
+self.addEventListener('fetch', function(event) {
+    var testcase = new URL(event.request.url).search;
+    switch (testcase) {
+    case '?response-object':
+      event.respondWith(new Response('body'));
+      break;
+    case '?response-promise-object':
+      event.respondWith(Promise.resolve(new Response('body')));
+      break;
+    case '?other-value':
+      event.respondWith(new Object());
+      break;
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-body-loaded-in-chunk-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-body-loaded-in-chunk-worker.js
new file mode 100644
index 000000000000..d3ba8a8df2e7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-body-loaded-in-chunk-worker.js
@@ -0,0 +1,7 @@
+'use strict';
+
+self.addEventListener('fetch', event => {
+    if (!event.request.url.match(/body-in-chunk$/))
+        return;
+    event.respondWith(fetch("../../../fetch/api/resources/trickle.py?count=4&delay=50"));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-custom-response-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-custom-response-worker.js
new file mode 100644
index 000000000000..ff24aed1282c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-custom-response-worker.js
@@ -0,0 +1,45 @@
+'use strict';
+
+addEventListener('fetch', event => {
+  const url = new URL(event.request.url);
+  const type = url.searchParams.get('type');
+
+  if (!type) return;
+
+  if (type === 'string') {
+    event.respondWith(new Response('PASS'));
+  }
+  else if (type === 'blob') {
+    event.respondWith(
+      new Response(new Blob(['PASS']))
+    );
+  }
+  else if (type === 'buffer-view') {
+    const encoder = new TextEncoder();
+    event.respondWith(
+      new Response(encoder.encode('PASS'))
+    );
+  }
+  else if (type === 'buffer') {
+    const encoder = new TextEncoder();
+    event.respondWith(
+      new Response(encoder.encode('PASS').buffer)
+    );
+  }
+  else if (type === 'form-data') {
+    const body = new FormData();
+    body.set('result', 'PASS');
+    event.respondWith(
+      new Response(body)
+    );
+  }
+  else if (type === 'search-params') {
+    const body = new URLSearchParams();
+    body.set('result', 'PASS');
+    event.respondWith(
+      new Response(body, {
+        headers: { 'Content-Type': 'text/plain' }
+      })
+    );
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-partial-stream-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-partial-stream-worker.js
new file mode 100644
index 000000000000..b7307f29f57f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-partial-stream-worker.js
@@ -0,0 +1,28 @@
+let waitUntilResolve;
+
+let bodyController;
+
+self.addEventListener('message', evt => {
+  if (evt.data === 'done') {
+    bodyController.close();
+    waitUntilResolve();
+  }
+});
+
+self.addEventListener('fetch', evt => {
+  if (!evt.request.url.includes('partial-stream.txt')) {
+    return;
+  }
+
+  evt.waitUntil(new Promise(resolve => waitUntilResolve = resolve));
+
+  let body = new ReadableStream({
+    start: controller => {
+      let encoder = new TextEncoder();
+      controller.enqueue(encoder.encode('partial-stream-content'));
+      bodyController = controller;
+    },
+  });
+
+  evt.respondWith(new Response(body));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-readable-stream-chunk-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-readable-stream-chunk-worker.js
new file mode 100644
index 000000000000..f954e3a18a5e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-readable-stream-chunk-worker.js
@@ -0,0 +1,40 @@
+'use strict';
+
+self.addEventListener('fetch', event => {
+    if (!event.request.url.match(/body-stream$/))
+        return;
+
+    var counter = 0;
+    const encoder = new TextEncoder();
+    const stream = new ReadableStream({ pull: controller => {
+        switch (++counter) {
+        case 1:
+            controller.enqueue(encoder.encode(''));
+            return;
+        case 2:
+            controller.enqueue(encoder.encode('chunk #1'));
+            return;
+        case 3:
+            controller.enqueue(encoder.encode(' '));
+            return;
+        case 4:
+            controller.enqueue(encoder.encode('chunk #2'));
+            return;
+        case 5:
+            controller.enqueue(encoder.encode(' '));
+            return;
+        case 6:
+            controller.enqueue(encoder.encode('chunk #3'));
+            return;
+        case 7:
+            controller.enqueue(encoder.encode(' '));
+            return;
+        case 8:
+            controller.enqueue(encoder.encode('chunk #4'));
+            return;
+        default:
+            controller.close();
+        }
+    }});
+    event.respondWith(new Response(stream));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-readable-stream-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-readable-stream-worker.js
new file mode 100644
index 000000000000..056351322c69
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-readable-stream-worker.js
@@ -0,0 +1,81 @@
+'use strict';
+importScripts("/resources/testharness.js");
+
+const map = new Map();
+
+self.addEventListener('fetch', event => {
+  const url = new URL(event.request.url);
+  if (!url.searchParams.has('stream')) return;
+
+  if (url.searchParams.has('observe-cancel')) {
+    const id = url.searchParams.get('id');
+    if (id === undefined) {
+      event.respondWith(new Error('error'));
+      return;
+    }
+    event.waitUntil(new Promise(resolve => {
+      map.set(id, {label: 'pending', resolve});
+    }));
+
+    const stream = new ReadableStream({
+      pull(c) {
+        if (url.searchParams.get('enqueue') === 'true') {
+          url.searchParams.delete('enqueue');
+          c.enqueue(new Uint8Array([65]));
+        }
+      },
+      cancel() {
+        map.get(id).label = 'cancelled';
+      }
+    });
+    event.respondWith(new Response(stream));
+    return;
+  }
+
+  if (url.searchParams.has('query-cancel')) {
+    const id = url.searchParams.get('id');
+    if (id === undefined) {
+      event.respondWith(new Error('error'));
+      return;
+    }
+    const entry = map.get(id);
+    if (entry === undefined) {
+      event.respondWith(new Error('not found'));
+      return;
+    }
+    map.delete(id);
+    entry.resolve();
+    event.respondWith(new Response(entry.label));
+    return;
+  }
+
+  if (url.searchParams.has('use-fetch-stream')) {
+    event.respondWith(async function() {
+      const response = await fetch('pass.txt');
+      return new Response(response.body);
+    }());
+    return;
+  }
+
+  const delayEnqueue = url.searchParams.has('delay');
+
+  const stream = new ReadableStream({
+    start(controller) {
+      const encoder = new TextEncoder();
+
+      const populate = () => {
+        controller.enqueue(encoder.encode('PASS'));
+        controller.close();
+      }
+
+      if (delayEnqueue) {
+        step_timeout(populate, 16);
+      }
+      else {
+        populate();
+      }
+    }
+  });
+
+  event.respondWith(new Response(stream));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-response-body-with-invalid-chunk-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-response-body-with-invalid-chunk-iframe.html
new file mode 100644
index 000000000000..d15454daa5be
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-response-body-with-invalid-chunk-iframe.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>respond-with-response-body-with-invalid-chunk</title>
+<body></body>
+<script>
+'use strict';
+
+parent.set_fetch_promise(fetch('body-stream-with-invalid-chunk').then(resp => {
+    const reader = resp.body.getReader();
+    const reader_promise = reader.read();
+    parent.set_reader_promise(reader_promise);
+    // Suppress our expected error.
+    return reader_promise.catch(() => {});
+  }));
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-response-body-with-invalid-chunk-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-response-body-with-invalid-chunk-worker.js
new file mode 100644
index 000000000000..0254e24f94a2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-response-body-with-invalid-chunk-worker.js
@@ -0,0 +1,12 @@
+'use strict';
+
+self.addEventListener('fetch', event => {
+    if (!event.request.url.match(/body-stream-with-invalid-chunk$/))
+      return;
+    const stream = new ReadableStream({start: controller => {
+        // The argument is intentionally a string, not a Uint8Array.
+        controller.enqueue('hello');
+      }});
+    const headers = { 'x-content-type-options': 'nosniff' };
+    event.respondWith(new Response(stream, { headers }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-stops-propagation-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-stops-propagation-worker.js
new file mode 100644
index 000000000000..18da049d69f4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-stops-propagation-worker.js
@@ -0,0 +1,15 @@
+var result = null;
+
+self.addEventListener('message', function(event) {
+    event.data.port.postMessage(result);
+  });
+
+self.addEventListener('fetch', function(event) {
+    if (!result)
+      result = 'PASS';
+    event.respondWith(new Response());
+  });
+
+self.addEventListener('fetch', function(event) {
+    result = 'FAIL: fetch event propagated';
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-test-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-test-worker.js
new file mode 100644
index 000000000000..813f79d1b07b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-test-worker.js
@@ -0,0 +1,224 @@
+function handleHeaders(event) {
+  const headers = Array.from(event.request.headers);
+  event.respondWith(new Response(JSON.stringify(headers)));
+}
+
+function handleString(event) {
+  event.respondWith(new Response('Test string'));
+}
+
+function handleBlob(event) {
+  event.respondWith(new Response(new Blob(['Test blob'])));
+}
+
+function handleReferrer(event) {
+  event.respondWith(new Response(new Blob(
+    ['Referrer: ' + event.request.referrer])));
+}
+
+function handleReferrerPolicy(event) {
+  event.respondWith(new Response(new Blob(
+    ['ReferrerPolicy: ' + event.request.referrerPolicy])));
+}
+
+function handleReferrerFull(event) {
+  event.respondWith(new Response(new Blob(
+    ['Referrer: ' + event.request.referrer + '\n' +
+     'ReferrerPolicy: ' + event.request.referrerPolicy])));
+}
+
+function handleClientId(event) {
+  var body;
+  if (event.clientId !== "") {
+    body = 'Client ID Found: ' + event.clientId;
+  } else {
+    body = 'Client ID Not Found';
+  }
+  event.respondWith(new Response(body));
+}
+
+function handleResultingClientId(event) {
+  var body;
+  if (event.resultingClientId !== "") {
+    body = 'Resulting Client ID Found: ' + event.resultingClientId;
+  } else {
+    body = 'Resulting Client ID Not Found';
+  }
+  event.respondWith(new Response(body));
+}
+
+function handleNullBody(event) {
+  event.respondWith(new Response());
+}
+
+function handleFetch(event) {
+  event.respondWith(fetch('other.html'));
+}
+
+function handleFormPost(event) {
+  event.respondWith(new Promise(function(resolve) {
+      event.request.text()
+        .then(function(result) {
+            resolve(new Response(event.request.method + ':' +
+                                 event.request.headers.get('Content-Type') + ':' +
+                                 result));
+          });
+    }));
+}
+
+function handleMultipleRespondWith(event) {
+  var logForMultipleRespondWith = '';
+  for (var i = 0; i < 3; ++i) {
+    logForMultipleRespondWith += '(' + i + ')';
+    try {
+      event.respondWith(new Promise(function(resolve) {
+        setTimeout(function() {
+          resolve(new Response(logForMultipleRespondWith));
+        }, 0);
+      }));
+    } catch (e) {
+      logForMultipleRespondWith += '[' + e.name + ']';
+    }
+  }
+}
+
+var lastResponseForUsedCheck = undefined;
+
+function handleUsedCheck(event) {
+  if (!lastResponseForUsedCheck) {
+    event.respondWith(fetch('other.html').then(function(response) {
+        lastResponseForUsedCheck = response;
+        return response;
+      }));
+  } else {
+    event.respondWith(new Response(
+        'bodyUsed: ' + lastResponseForUsedCheck.bodyUsed));
+  }
+}
+function handleFragmentCheck(event) {
+  var body;
+  if (event.request.url.indexOf('#') === -1) {
+    body = 'Fragment Not Found';
+  } else {
+    body = 'Fragment Found :' +
+           event.request.url.substring(event.request.url.indexOf('#'));
+  }
+  event.respondWith(new Response(body));
+}
+function handleCache(event) {
+  event.respondWith(new Response(event.request.cache));
+}
+function handleEventSource(event) {
+  if (event.request.mode === 'navigate') {
+    return;
+  }
+  var data = {
+    mode: event.request.mode,
+    cache: event.request.cache,
+    credentials: event.request.credentials
+  };
+  var body = 'data:' + JSON.stringify(data) + '\n\n';
+  event.respondWith(new Response(body, {
+      headers: { 'Content-Type': 'text/event-stream' }
+    }
+  ));
+}
+
+function handleIntegrity(event) {
+  event.respondWith(new Response(event.request.integrity));
+}
+
+function handleRequestBody(event) {
+  event.respondWith(event.request.text().then(text => {
+    return new Response(text);
+  }));
+}
+
+function handleKeepalive(event) {
+  event.respondWith(new Response(event.request.keepalive));
+}
+
+function handleIsReloadNavigation(event) {
+  const request = event.request;
+  const body =
+    `method = ${request.method}, ` +
+    `isReloadNavigation = ${request.isReloadNavigation}`;
+  event.respondWith(new Response(body));
+}
+
+function handleIsHistoryNavigation(event) {
+  const request = event.request;
+  const body =
+    `method = ${request.method}, ` +
+    `isHistoryNavigation = ${request.isHistoryNavigation}`;
+  event.respondWith(new Response(body));
+}
+
+function handleUseAndIgnore(event) {
+  const request = event.request;
+  request.text();
+  return;
+}
+
+function handleCloneAndIgnore(event) {
+  const request = event.request;
+  request.clone().text();
+  return;
+}
+
+var handle_status_count = 0;
+function handleStatus(event) {
+  handle_status_count++;
+  event.respondWith(async function() {
+    const res = await fetch(event.request);
+    const text = await res.text();
+    return new Response(`${text}. Request was sent ${handle_status_count} times.`,
+      {"status": new URL(event.request.url).searchParams.get("status")});
+  }());
+}
+
+self.addEventListener('fetch', function(event) {
+    var url = event.request.url;
+    var handlers = [
+      { pattern: '?headers', fn: handleHeaders },
+      { pattern: '?string', fn: handleString },
+      { pattern: '?blob', fn: handleBlob },
+      { pattern: '?referrerFull', fn: handleReferrerFull },
+      { pattern: '?referrerPolicy', fn: handleReferrerPolicy },
+      { pattern: '?referrer', fn: handleReferrer },
+      { pattern: '?clientId', fn: handleClientId },
+      { pattern: '?resultingClientId', fn: handleResultingClientId },
+      { pattern: '?ignore', fn: function() {} },
+      { pattern: '?null', fn: handleNullBody },
+      { pattern: '?fetch', fn: handleFetch },
+      { pattern: '?form-post', fn: handleFormPost },
+      { pattern: '?multiple-respond-with', fn: handleMultipleRespondWith },
+      { pattern: '?used-check', fn: handleUsedCheck },
+      { pattern: '?fragment-check', fn: handleFragmentCheck },
+      { pattern: '?cache', fn: handleCache },
+      { pattern: '?eventsource', fn: handleEventSource },
+      { pattern: '?integrity', fn: handleIntegrity },
+      { pattern: '?request-body', fn: handleRequestBody },
+      { pattern: '?keepalive', fn: handleKeepalive },
+      { pattern: '?isReloadNavigation', fn: handleIsReloadNavigation },
+      { pattern: '?isHistoryNavigation', fn: handleIsHistoryNavigation },
+      { pattern: '?use-and-ignore', fn: handleUseAndIgnore },
+      { pattern: '?clone-and-ignore', fn: handleCloneAndIgnore },
+      { pattern: '?status', fn: handleStatus },
+    ];
+
+    var handler = null;
+    for (var i = 0; i < handlers.length; ++i) {
+      if (url.indexOf(handlers[i].pattern) != -1) {
+        handler = handlers[i];
+        break;
+      }
+    }
+
+    if (handler) {
+      handler.fn(event);
+    } else {
+      event.respondWith(new Response(new Blob(
+        ['Service Worker got an unexpected request: ' + url])));
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-within-sw-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-within-sw-worker.js
new file mode 100644
index 000000000000..5903bab968dc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-within-sw-worker.js
@@ -0,0 +1,48 @@
+skipWaiting();
+
+addEventListener('fetch', event => {
+  const url = new URL(event.request.url);
+
+  if (url.origin != location.origin) return;
+
+  if (url.pathname.endsWith('/sample.txt')) {
+    event.respondWith(new Response('intercepted'));
+    return;
+  }
+
+  if (url.pathname.endsWith('/sample.txt-inner-fetch')) {
+    event.respondWith(fetch('sample.txt'));
+    return;
+  }
+
+  if (url.pathname.endsWith('/sample.txt-inner-cache')) {
+    event.respondWith(
+      caches.open('test-inner-cache').then(cache =>
+        cache.add('sample.txt').then(() => cache.match('sample.txt'))
+      )
+    );
+    return;
+  }
+
+  if (url.pathname.endsWith('/show-notification')) {
+    // Copy the currect search string onto the icon url
+    const iconURL = new URL('notification_icon.py', location);
+    iconURL.search = url.search;
+
+    event.respondWith(
+      registration.showNotification('test', {
+        icon: iconURL
+      }).then(() => registration.getNotifications()).then(notifications => {
+        for (const n of notifications) n.close();
+        return new Response('done');
+      })
+    );
+    return;
+  }
+
+  if (url.pathname.endsWith('/notification_icon.py')) {
+    new BroadcastChannel('icon-request').postMessage('yay');
+    event.respondWith(new Response('done'));
+    return;
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-header-visibility-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-header-visibility-iframe.html
new file mode 100644
index 000000000000..0d9ab6ff9045
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-header-visibility-iframe.html
@@ -0,0 +1,66 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js?pipe=sub"></script>
+<script>
+  var host_info = get_host_info();
+  var uri = document.location + '?check-ua-header';
+
+  var headers = new Headers();
+  headers.set('User-Agent', 'custom_ua');
+
+  // Check the custom UA case
+  fetch(uri, { headers: headers }).then(function(response) {
+    return response.text();
+  }).then(function(text) {
+    if (text == 'custom_ua') {
+      parent.postMessage('PASS', '*');
+    } else {
+      parent.postMessage('withUA FAIL - expected "custom_ua", got "' + text + '"', '*');
+    }
+  }).catch(function(err) {
+    parent.postMessage('withUA FAIL - unexpected error: ' + err, '*');
+  });
+
+  // Check the default UA case
+  fetch(uri, {}).then(function(response) {
+    return response.text();
+  }).then(function(text) {
+    if (text == 'NO_UA') {
+      parent.postMessage('PASS', '*');
+    } else {
+      parent.postMessage('noUA FAIL - expected "NO_UA", got "' + text + '"', '*');
+    }
+  }).catch(function(err) {
+    parent.postMessage('noUA FAIL - unexpected error: ' + err, '*');
+  });
+
+  var uri = document.location + '?check-accept-header';
+  var headers = new Headers();
+  headers.set('Accept', 'hmm');
+
+  // Check for custom accept header
+  fetch(uri, { headers: headers }).then(function(response) {
+    return response.text();
+  }).then(function(text) {
+    if (text === headers.get('Accept')) {
+      parent.postMessage('PASS', '*');
+    } else {
+      parent.postMessage('custom accept FAIL - expected ' + headers.get('Accept') +
+                         ' got "' + text + '"', '*');
+    }
+  }).catch(function(err) {
+    parent.postMessage('custom accept FAIL - unexpected error: ' + err, '*');
+  });
+
+  // Check for default accept header
+  fetch(uri).then(function(response) {
+    return response.text();
+  }).then(function(text) {
+    if (text === '*/*') {
+      parent.postMessage('PASS', '*');
+    } else {
+      parent.postMessage('accept FAIL - expected */* got "' + text + '"', '*');
+    }
+  }).catch(function(err) {
+    parent.postMessage('accept FAIL - unexpected error: ' + err, '*');
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe-inscope-to-inscope.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe-inscope-to-inscope.html
new file mode 100644
index 000000000000..64a634e9db7b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe-inscope-to-inscope.html
@@ -0,0 +1,71 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js?pipe=sub"></script>
+<script>
+var image_path = base_path() + 'fetch-access-control.py?PNGIMAGE';
+var host_info = get_host_info();
+var results = '';
+
+function test1() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    test2();
+  };
+  img.onerror = function() {
+    results += 'FAIL(1)';
+    test2();
+  };
+  img.src = './sample?url=' +
+            encodeURIComponent(host_info['HTTPS_ORIGIN'] + image_path);
+}
+
+function test2() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    test3();
+  };
+  img.onerror = function() {
+    results += 'FAIL(2)';
+    test3();
+  };
+  img.src = './sample?mode=no-cors&url=' +
+            encodeURIComponent(host_info['HTTPS_REMOTE_ORIGIN'] + image_path);
+}
+
+function test3() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    results += 'FAIL(3)';
+    test4();
+  };
+  img.onerror = function() {
+    test4();
+  };
+  img.src = './sample?mode=no-cors&url=' +
+            encodeURIComponent(host_info['HTTP_ORIGIN'] + image_path);
+}
+
+function test4() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    results += 'FAIL(4)';
+    finish();
+  };
+  img.onerror = function() {
+    finish();
+  };
+  img.src = './sample?mode=no-cors&url=' +
+            encodeURIComponent(host_info['HTTP_REMOTE_ORIGIN'] + image_path);
+}
+
+function finish() {
+  results += 'finish';
+  window.parent.postMessage({results: results}, host_info['HTTPS_ORIGIN']);
+}
+</script>
+
+<body onload='test1();'>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe-inscope-to-outscope.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe-inscope-to-outscope.html
new file mode 100644
index 000000000000..be0b5c8f561d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe-inscope-to-outscope.html
@@ -0,0 +1,80 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js?pipe=sub"></script>
+<script>
+var image_path = base_path() + 'fetch-access-control.py?PNGIMAGE';
+var host_info = get_host_info();
+var results = '';
+
+function test1() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    test2();
+  };
+  img.onerror = function() {
+    results += 'FAIL(1)';
+    test2();
+  };
+  img.src = host_info['HTTPS_ORIGIN'] + image_path;
+}
+
+function test2() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    test3();
+  };
+  img.onerror = function() {
+    results += 'FAIL(2)';
+    test3();
+  };
+  img.src = host_info['HTTPS_REMOTE_ORIGIN'] + image_path;
+}
+
+function test3() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    results += 'FAIL(3)';
+    test4();
+  };
+  img.onerror = function() {
+    test4();
+  };
+  img.src = host_info['HTTP_ORIGIN'] + image_path;
+}
+
+function test4() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    results += 'FAIL(4)';
+    test5();
+  };
+  img.onerror = function() {
+    test5();
+  };
+  img.src = host_info['HTTP_REMOTE_ORIGIN'] + image_path;
+}
+
+function test5() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    finish();
+  };
+  img.onerror = function() {
+    results += 'FAIL(5)';
+    finish();
+  };
+  img.src = './sample?generate-png';
+}
+
+function finish() {
+  results += 'finish';
+  window.parent.postMessage({results: results}, host_info['HTTPS_ORIGIN']);
+}
+</script>
+
+<body onload='test1();'>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe.html
new file mode 100644
index 000000000000..2831c381b5e4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe.html
@@ -0,0 +1,71 @@
+<!DOCTYPE html>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js?pipe=sub"></script>
+<script>
+var params = get_query_params(location.href);
+var SCOPE = 'fetch-mixed-content-iframe-inscope-to-' + params['target'] + '.html';
+var URL = 'fetch-rewrite-worker.js';
+var host_info = get_host_info();
+
+window.addEventListener('message', on_message, false);
+
+navigator.serviceWorker.getRegistration(SCOPE)
+  .then(function(registration) {
+      if (registration)
+        return registration.unregister();
+    })
+  .then(function() {
+      return navigator.serviceWorker.register(URL, {scope: SCOPE});
+    })
+  .then(function(registration) {
+      return new Promise(function(resolve) {
+          registration.addEventListener('updatefound', function() {
+              resolve(registration.installing);
+            });
+        });
+    })
+  .then(function(worker) {
+      worker.addEventListener('statechange', on_state_change);
+    })
+  .catch(function(reason) {
+      window.parent.postMessage({results: 'FAILURE: ' + reason.message},
+                                host_info['HTTPS_ORIGIN']);
+     });
+
+function on_state_change(event) {
+  if (event.target.state != 'activated')
+    return;
+  var frame = document.createElement('iframe');
+  frame.src = SCOPE;
+  document.body.appendChild(frame);
+}
+
+function on_message(e) {
+  navigator.serviceWorker.getRegistration(SCOPE)
+    .then(function(registration) {
+        if (registration)
+          return registration.unregister();
+      })
+    .then(function() {
+      window.parent.postMessage(e.data, host_info['HTTPS_ORIGIN']);
+    })
+    .catch(function(reason) {
+        window.parent.postMessage({results: 'FAILURE: ' + reason.message},
+                                  host_info['HTTPS_ORIGIN']);
+     });
+}
+
+function get_query_params(url) {
+  var search = (new URL(url)).search;
+  if (!search) {
+    return {};
+  }
+  var ret = {};
+  var params = search.substring(1).split('&');
+  params.forEach(function(param) {
+      var element = param.split('=');
+      ret[decodeURIComponent(element[0])] = decodeURIComponent(element[1]);
+    });
+  return ret;
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-iframe.html
new file mode 100644
index 000000000000..504e10435642
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-iframe.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<title>iframe for css base url test</title>
+</head>
+<body>
+<script>
+// Load a stylesheet. Create it dynamically so we can construct the href URL
+// dynamically.
+const link = document.createElement('link');
+link.rel = 'stylesheet';
+link.type = 'text/css';
+// Add "request-url-path" to the path to help distinguish the request URL from
+// the response URL. Add |document.location.search| (chosen by the test main
+// page) to tell the service worker how to respond to the request.
+link.href = 'request-url-path/fetch-request-css-base-url-style.css' +
+    document.location.search;
+document.head.appendChild(link);
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-style.css b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-style.css
new file mode 100644
index 000000000000..f14fcaae7275
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-style.css
@@ -0,0 +1 @@
+body { background-image: url("./sample.png");}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-worker.js
new file mode 100644
index 000000000000..f3d6a73bdde8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-worker.js
@@ -0,0 +1,45 @@
+let source;
+let resolveDone;
+let done = new Promise(resolve => resolveDone = resolve);
+
+// The page messages this worker to ask for the result. Keep the worker alive
+// via waitUntil() until the result is sent.
+self.addEventListener('message', event => {
+  source = event.data.port;
+  source.postMessage('pong');
+  event.waitUntil(done);
+});
+
+self.addEventListener('fetch', event => {
+  const url = new URL(event.request.url);
+
+  // For the CSS file, respond in a way that may change the response URL,
+  // depending on |url.search|.
+  const cssPath = 'request-url-path/fetch-request-css-base-url-style.css';
+  if (url.pathname.indexOf(cssPath) != -1) {
+    // Respond with a different URL, deleting "request-url-path/".
+    if (url.search == '?fetch') {
+      event.respondWith(fetch('fetch-request-css-base-url-style.css?fetch'));
+    }
+    // Respond with new Response().
+    else if (url.search == '?newResponse') {
+      const styleString = 'body { background-image: url("./sample.png");}';
+      const headers = {'content-type': 'text/css'};
+      event.respondWith(new Response(styleString, headers));
+    }
+  }
+
+  // The image request indicates what the base URL of the CSS was. Message the
+  // result back to the test page.
+  else if (url.pathname.indexOf('sample.png') != -1) {
+    // For some reason |source| is undefined here when running the test manually
+    // in Firefox. The test author experimented with both using Client
+    // (event.source) and MessagePort to try to get the test to pass, but
+    // failed.
+    source.postMessage({
+      url: event.request.url,
+      referrer: event.request.referrer
+    });
+    resolveDone();
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-cross.css b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-cross.css
new file mode 100644
index 000000000000..9a7545d07021
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-cross.css
@@ -0,0 +1 @@
+#crossOriginCss { color: blue; }
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-cross.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-cross.html
new file mode 100644
index 000000000000..3211f78084d7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-cross.html
@@ -0,0 +1 @@
+#crossOriginHtml { color: red; }
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-iframe.html
new file mode 100644
index 000000000000..9a4adedb84d4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-iframe.html
@@ -0,0 +1,17 @@
+<style type="text/css">
+#crossOriginCss { color: red; }
+#crossOriginHtml { color: blue; }
+#sameOriginCss { color: red; }
+#sameOriginHtml { color: red; }
+#synthetic { color: red; }
+</style>
+<link href="./cross-origin-css.css?mime=no" rel="stylesheet" type="text/css">
+<link href="./cross-origin-html.css?mime=no" rel="stylesheet" type="text/css">
+<link href="./fetch-request-css-cross-origin-mime-check-same.css" rel="stylesheet" type="text/css">
+<link href="./fetch-request-css-cross-origin-mime-check-same.html" rel="stylesheet" type="text/css">
+<link href="./synthetic.css?mime=no" rel="stylesheet" type="text/css">
+<h1 id=crossOriginCss>I should be blue</h1>
+<h1 id=crossOriginHtml>I should be blue</h1>
+<h1 id=sameOriginCss>I should be blue</h1>
+<h1 id=sameOriginHtml>I should be blue</h1>
+<h1 id=synthetic>I should be blue</h1>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-same.css b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-same.css
new file mode 100644
index 000000000000..55455bd5da58
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-same.css
@@ -0,0 +1 @@
+#sameOriginCss { color: blue; }
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-same.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-same.html
new file mode 100644
index 000000000000..6fad4b9ff048
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-same.html
@@ -0,0 +1 @@
+#sameOriginHtml { color: blue; }
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-read-contents.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-read-contents.html
new file mode 100644
index 000000000000..c902366b023a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-read-contents.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe: cross-origin CSS via service worker</title>
+
+<!-- Service worker responds with a cross-origin opaque response. -->
+<link href="cross-origin-css.css" rel="stylesheet" type="text/css">
+
+<!-- Service worker responds with a cross-origin CORS approved response. -->
+<link href="cross-origin-css.css?cors" rel="stylesheet" type="text/css">
+
+<!-- Service worker falls back to network. This is a same-origin response. -->
+<link href="fetch-request-css-cross-origin-mime-check-same.css" rel="stylesheet" type="text/css">
+
+<!-- Service worker responds with a new Response() synthetic response. -->
+<link href="synthetic.css" rel="stylesheet" type="text/css">
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-worker.js
new file mode 100644
index 000000000000..a71e91216c10
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-worker.js
@@ -0,0 +1,65 @@
+importScripts('/common/get-host-info.sub.js');
+importScripts('test-helpers.sub.js');
+
+const HOST_INFO = get_host_info();
+const REMOTE_ORIGIN = HOST_INFO.HTTPS_REMOTE_ORIGIN;
+const BASE_PATH = base_path();
+const CSS_FILE = 'fetch-request-css-cross-origin-mime-check-cross.css';
+const HTML_FILE = 'fetch-request-css-cross-origin-mime-check-cross.html';
+
+function add_pipe_header(url_str, header) {
+  if (url_str.indexOf('?pipe=') == -1) {
+    url_str += '?pipe=';
+  } else {
+    url_str += '|';
+  }
+  url_str += `header${header}`;
+  return url_str;
+}
+
+self.addEventListener('fetch', function(event) {
+    const url = new URL(event.request.url);
+
+    const use_mime =
+        (url.searchParams.get('mime') != 'no');
+    const mime_header = '(Content-Type, text/css)';
+
+    const use_cors =
+        (url.searchParams.has('cors'));
+    const cors_header = '(Access-Control-Allow-Origin, *)';
+
+    const file = url.pathname.substring(url.pathname.lastIndexOf('/') + 1);
+
+    // Respond with a cross-origin CSS resource, using CORS if desired.
+    if (file == 'cross-origin-css.css') {
+      let fetch_url =  REMOTE_ORIGIN + BASE_PATH + CSS_FILE;
+      if (use_mime)
+        fetch_url = add_pipe_header(fetch_url, mime_header);
+      if (use_cors)
+        fetch_url = add_pipe_header(fetch_url, cors_header);
+      const mode = use_cors ? 'cors' : 'no-cors';
+      event.respondWith(fetch(fetch_url, {'mode': mode}));
+      return;
+    }
+
+    // Respond with a cross-origin CSS resource with an HTML name. This is only
+    // used in the MIME sniffing test, so MIME is never added.
+    if (file == 'cross-origin-html.css') {
+      const fetch_url = REMOTE_ORIGIN + BASE_PATH + HTML_FILE;
+      event.respondWith(fetch(fetch_url, {mode: 'no-cors'}));
+      return;
+    }
+
+    // Respond with synthetic CSS.
+    if (file == 'synthetic.css') {
+      let headers = {};
+      if (use_mime) {
+        headers['Content-Type'] = 'text/css';
+      }
+
+      event.respondWith(new Response("#synthetic { color: blue; }", {headers}));
+      return;
+    }
+
+    // Otherwise, fallback to network.
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-fallback-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-fallback-iframe.html
new file mode 100644
index 000000000000..d117d0f55ef3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-fallback-iframe.html
@@ -0,0 +1,32 @@
+<script>
+function xhr(url) {
+  return new Promise(function(resolve, reject) {
+      var request = new XMLHttpRequest();
+      request.addEventListener(
+        'error',
+        function() { reject(new Error()); });
+      request.addEventListener(
+        'load',
+        function(event) { resolve(request.response); });
+      request.open('GET', url);
+      request.send();
+    });
+}
+
+function load_image(url, cross_origin) {
+  return new Promise(function(resolve, reject) {
+      var img = document.createElement('img');
+      document.body.appendChild(img);
+      img.onload = function() {
+        resolve();
+      };
+      img.onerror = function() {
+        reject(new Error());
+      };
+      if (cross_origin != '') {
+        img.crossOrigin = cross_origin;
+      }
+      img.src = url;
+    });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-fallback-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-fallback-worker.js
new file mode 100644
index 000000000000..3b028b24bde4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-fallback-worker.js
@@ -0,0 +1,13 @@
+var requests = [];
+
+self.addEventListener('message', function(event) {
+    event.data.port.postMessage({requests: requests});
+    requests = [];
+  });
+
+self.addEventListener('fetch', function(event) {
+    requests.push({
+        url: event.request.url,
+        mode: event.request.mode
+      });
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-html-imports-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-html-imports-iframe.html
new file mode 100644
index 000000000000..07a084257a8c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-html-imports-iframe.html
@@ -0,0 +1,13 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script type="text/javascript">
+  var hostInfo = get_host_info();
+  var makeLink = function(id, url) {
+      var link = document.createElement('link');
+      link.rel = 'import'
+      link.id = id;
+      link.href = url;
+      document.documentElement.appendChild(link);
+    };
+  makeLink('same', hostInfo.HTTPS_ORIGIN + '/sample-dir/same.html');
+  makeLink('other', hostInfo.HTTPS_REMOTE_ORIGIN + '/sample-dir/other.html');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-html-imports-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-html-imports-worker.js
new file mode 100644
index 000000000000..110727bd52cf
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-html-imports-worker.js
@@ -0,0 +1,30 @@
+importScripts('/common/get-host-info.sub.js');
+var host_info = get_host_info();
+
+self.addEventListener('fetch', function(event) {
+    var url = event.request.url;
+    if (url.indexOf('sample-dir') == -1) {
+      return;
+    }
+    var result = 'mode=' + event.request.mode +
+      ' credentials=' + event.request.credentials;
+    if (url == host_info.HTTPS_ORIGIN + '/sample-dir/same.html') {
+      event.respondWith(new Response(
+        result +
+        '<link id="same-same" rel="import" ' +
+        'href="' + host_info.HTTPS_ORIGIN + '/sample-dir/same-same.html">' +
+        '<link id="same-other" rel="import" ' +
+        ' href="' + host_info.HTTPS_REMOTE_ORIGIN +
+        '/sample-dir/same-other.html">'));
+    } else if (url == host_info.HTTPS_REMOTE_ORIGIN + '/sample-dir/other.html') {
+      event.respondWith(new Response(
+        result +
+        '<link id="other-same" rel="import" ' +
+        ' href="' + host_info.HTTPS_ORIGIN + '/sample-dir/other-same.html">' +
+        '<link id="other-other" rel="import" ' +
+        ' href="' + host_info.HTTPS_REMOTE_ORIGIN +
+        '/sample-dir/other-other.html">'));
+    } else {
+      event.respondWith(new Response(result));
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-no-freshness-headers-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-no-freshness-headers-iframe.html
new file mode 100644
index 000000000000..e6e9380ba622
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-no-freshness-headers-iframe.html
@@ -0,0 +1 @@
+<script src="./fetch-request-no-freshness-headers-script.py"></script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-no-freshness-headers-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-no-freshness-headers-worker.js
new file mode 100644
index 000000000000..2bd59d739225
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-no-freshness-headers-worker.js
@@ -0,0 +1,18 @@
+var requests = [];
+
+self.addEventListener('message', function(event) {
+    event.data.port.postMessage({requests: requests});
+  });
+
+self.addEventListener('fetch', function(event) {
+    var url = event.request.url;
+    var headers = [];
+    for (var header of event.request.headers) {
+      headers.push(header);
+    }
+    requests.push({
+        url: url,
+        headers: headers
+      });
+    event.respondWith(fetch(event.request));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-redirect-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-redirect-iframe.html
new file mode 100644
index 000000000000..ffd76bfc4990
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-redirect-iframe.html
@@ -0,0 +1,35 @@
+<script>
+function xhr(url) {
+  return new Promise(function(resolve, reject) {
+      var request = new XMLHttpRequest();
+      request.addEventListener(
+        'error',
+        function(event) { reject(event); });
+      request.addEventListener(
+        'load',
+        function(event) { resolve(request.response); });
+      request.open('GET', url);
+      request.send();
+    });
+}
+
+function load_image(url) {
+  return new Promise(function(resolve, reject) {
+      var img = document.createElement('img');
+      document.body.appendChild(img);
+      img.onload = resolve;
+      img.onerror = reject;
+      img.src = url;
+    });
+}
+
+function load_audio(url) {
+  return new Promise(function(resolve, reject) {
+      var audio = document.createElement('audio');
+      document.body.appendChild(audio);
+      audio.oncanplay = resolve;
+      audio.onerror = reject;
+      audio.src = url;
+    });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-resources-iframe.https.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-resources-iframe.https.html
new file mode 100644
index 000000000000..37fc491134d0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-resources-iframe.https.html
@@ -0,0 +1,126 @@
+<script src="test-helpers.sub.js?pipe=sub"></script>
+<body>
+<script type="importmap">
+{
+  "integrity": {
+    "./sample?test_module": "sha384-foobar",
+    "./sample?test_modulepreload": "sha384-foobar",
+    "./sample?test_moduleimport": "sha384-foobar",
+    "./sample?test_moduleimportdynamic": "sha384-foobar"
+  }
+}
+</script>
+<script>
+
+function load_image(url, cross_origin) {
+  const img = document.createElement('img');
+  if (cross_origin != '') {
+    img.crossOrigin = cross_origin;
+  }
+  img.src = url;
+}
+
+function load_script(url, cross_origin) {
+  const script = document.createElement('script');
+  script.src = url;
+  if (cross_origin != '') {
+    script.crossOrigin = cross_origin;
+  }
+  document.body.appendChild(script);
+}
+
+function load_css(url, cross_origin) {
+  const link = document.createElement('link');
+  link.rel = 'stylesheet'
+  link.href = url;
+  link.type = 'text/css';
+  if (cross_origin != '') {
+    link.crossOrigin = cross_origin;
+  }
+  document.body.appendChild(link);
+}
+
+function load_font(url) {
+  const fontFace = new FontFace('test', 'url(' + url + ')');
+  fontFace.load();
+}
+
+function load_css_image(url, type) {
+  const div = document.createElement('div');
+  document.body.appendChild(div);
+  div.style[type] = 'url(' + url + ')';
+}
+
+function load_css_image_set(url, type) {
+  const div = document.createElement('div');
+  document.body.appendChild(div);
+  div.style[type] = 'image-set(url(' + url + ') 1x)';
+  if (!div.style[type]) {
+    div.style[type] = '-webkit-image-set(url(' + url + ') 1x)';
+  }
+}
+
+function load_script_with_integrity(url, integrity, type) {
+  const script = document.createElement('script');
+  if (type) {
+    script.type = type;
+  }
+  script.src = url;
+  if (integrity) {
+    script.integrity = integrity;
+  }
+  document.body.appendChild(script);
+}
+
+function import_modulescript(url) {
+  const script = document.createElement('script');
+  script.type = "module";
+  script.innerHTML = `import "${url}";`;
+  document.body.appendChild(script);
+}
+
+function import_dynamic_modulescript(url) {
+  const script = document.createElement('script');
+  script.type = "module";
+  script.innerHTML = `import("${url}");`;
+  document.body.appendChild(script);
+}
+
+function load_modulepreload_with_integrity(url, integrity) {
+  const link = document.createElement('link');
+  link.href = url;
+  if (integrity) {
+    link.integrity = integrity;
+  }
+  link.rel = "modulepreload";
+  document.body.appendChild(link);
+}
+
+function load_css_with_integrity(url, integrity) {
+  const link = document.createElement('link');
+  link.rel = 'stylesheet'
+  link.href = url;
+  link.type = 'text/css';
+  link.integrity = integrity;
+  document.body.appendChild(link);
+}
+
+function load_audio(url, cross_origin) {
+  const audio = document.createElement('audio');
+  if (cross_origin != '') {
+    audio.crossOrigin = cross_origin;
+  }
+  audio.src = url;
+  document.body.appendChild(audio);
+}
+
+function load_video(url, cross_origin) {
+  const video = document.createElement('video');
+  if (cross_origin != '') {
+    video.crossOrigin = cross_origin;
+  }
+  video.src = url;
+  document.body.appendChild(video);
+}
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-resources-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-resources-worker.js
new file mode 100644
index 000000000000..983cccb8db78
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-resources-worker.js
@@ -0,0 +1,26 @@
+const requests = [];
+let port = undefined;
+
+self.onmessage = e => {
+  const message = e.data;
+  if ('port' in message) {
+    port = message.port;
+    port.postMessage({ready: true});
+  }
+};
+
+self.addEventListener('fetch', e => {
+  const url = e.request.url;
+  if (!url.includes('sample?test')) {
+    return;
+  }
+  port.postMessage({
+    url: url,
+    mode: e.request.mode,
+    redirect: e.request.redirect,
+    credentials: e.request.credentials,
+    integrity: e.request.integrity,
+    destination: e.request.destination
+  });
+  e.respondWith(Promise.reject());
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-iframe.https.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-iframe.https.html
new file mode 100644
index 000000000000..b3ddec1a701b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-iframe.https.html
@@ -0,0 +1,208 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+var host_info = get_host_info();
+
+function get_boundary(headers) {
+  var reg = new RegExp('multipart\/form-data; boundary=(.*)');
+  for (var i = 0; i < headers.length; ++i) {
+    if (headers[i][0] != 'content-type') {
+      continue;
+    }
+    var regResult = reg.exec(headers[i][1]);
+    if (!regResult) {
+      continue;
+    }
+    return regResult[1];
+  }
+  return '';
+}
+
+function xhr_send(url_base, method, data, with_credentials) {
+  return new Promise(function(resolve, reject) {
+      var xhr = new XMLHttpRequest();
+      xhr.onload = function() {
+        resolve(JSON.parse(xhr.response));
+      };
+      xhr.onerror = function() {
+        reject('XHR should succeed.');
+      };
+      xhr.responseType = 'text';
+      if (with_credentials) {
+        xhr.withCredentials = true;
+      }
+      xhr.open(method, url_base + '/sample?test', true);
+      xhr.send(data);
+    });
+}
+
+function get_sorted_header_name_list(headers) {
+  var header_names = [];
+  var idx, name;
+
+  for (idx = 0; idx < headers.length; ++idx) {
+    name = headers[idx][0];
+    // The `Accept-Language` header is optional; its presence should not
+    // influence test results.
+    //
+    // > 4. If request’s header list does not contain `Accept-Language`, user
+    // >    agents should append `Accept-Language`/an appropriate value to
+    // >    request's header list.
+    //
+    // https://fetch.spec.whatwg.org/#fetching
+    if (name === 'accept-language') {
+      continue;
+    }
+
+    header_names.push(name);
+  }
+  header_names.sort();
+  return header_names;
+}
+
+function get_header_test() {
+  return xhr_send(host_info['HTTPS_ORIGIN'], 'GET', '', false)
+    .then(function(response) {
+        assert_array_equals(
+          get_sorted_header_name_list(response.headers),
+          ["accept"],
+          'event.request has the expected headers for same-origin GET.');
+      });
+}
+
+function post_header_test() {
+  return xhr_send(host_info['HTTPS_ORIGIN'], 'POST', '', false)
+    .then(function(response) {
+        assert_array_equals(
+          get_sorted_header_name_list(response.headers),
+          ["accept", "content-type"],
+          'event.request has the expected headers for same-origin POST.');
+      });
+}
+
+function cross_origin_get_header_test() {
+  return xhr_send(host_info['HTTPS_REMOTE_ORIGIN'], 'GET', '', false)
+    .then(function(response) {
+        assert_array_equals(
+          get_sorted_header_name_list(response.headers),
+          ["accept"],
+          'event.request has the expected headers for cross-origin GET.');
+      });
+}
+
+function cross_origin_post_header_test() {
+  return xhr_send(host_info['HTTPS_REMOTE_ORIGIN'], 'POST', '', false)
+    .then(function(response) {
+        assert_array_equals(
+          get_sorted_header_name_list(response.headers),
+          ["accept", "content-type"],
+          'event.request has the expected headers for cross-origin POST.');
+      });
+}
+
+function string_test() {
+  return xhr_send(host_info['HTTPS_ORIGIN'], 'POST', 'test string', false)
+    .then(function(response) {
+        assert_equals(response.method, 'POST');
+        assert_equals(response.body, 'test string');
+      });
+}
+
+function blob_test() {
+  return xhr_send(host_info['HTTPS_ORIGIN'], 'POST', new Blob(['test blob']),
+                  false)
+    .then(function(response) {
+        assert_equals(response.method, 'POST');
+        assert_equals(response.body, 'test blob');
+      });
+}
+
+function custom_method_test() {
+  return xhr_send(host_info['HTTPS_ORIGIN'], 'XXX', 'test string xxx', false)
+    .then(function(response) {
+        assert_equals(response.method, 'XXX');
+        assert_equals(response.body, 'test string xxx');
+      });
+}
+
+function options_method_test() {
+  return xhr_send(host_info['HTTPS_ORIGIN'], 'OPTIONS', 'test string xxx', false)
+    .then(function(response) {
+        assert_equals(response.method, 'OPTIONS');
+        assert_equals(response.body, 'test string xxx');
+      });
+}
+
+function form_data_test() {
+    var formData = new FormData();
+    formData.append('sample string', '1234567890');
+    formData.append('sample blob', new Blob(['blob content']));
+    formData.append('sample file', new File(['file content'], 'file.dat'));
+    return xhr_send(host_info['HTTPS_ORIGIN'], 'POST', formData, false)
+    .then(function(response) {
+        assert_equals(response.method, 'POST');
+        var boundary = get_boundary(response.headers);
+        var expected_body =
+          '--' + boundary + '\r\n' +
+          'Content-Disposition: form-data; name="sample string"\r\n' +
+          '\r\n' +
+          '1234567890\r\n' +
+          '--' + boundary + '\r\n' +
+          'Content-Disposition: form-data; name="sample blob"; ' +
+          'filename="blob"\r\n' +
+          'Content-Type: application/octet-stream\r\n' +
+          '\r\n' +
+          'blob content\r\n' +
+          '--' + boundary + '\r\n' +
+          'Content-Disposition: form-data; name="sample file"; ' +
+          'filename="file.dat"\r\n' +
+          'Content-Type: application/octet-stream\r\n' +
+          '\r\n' +
+          'file content\r\n' +
+          '--' + boundary + '--\r\n';
+        assert_equals(response.body, expected_body, "form data response content is as expected");
+      });
+}
+
+function mode_credentials_test() {
+  return xhr_send(host_info['HTTPS_ORIGIN'], 'GET', '', false)
+    .then(function(response){
+        assert_equals(response.mode, 'cors');
+        assert_equals(response.credentials, 'same-origin');
+        return xhr_send(host_info['HTTPS_ORIGIN'], 'GET', '', true);
+      })
+    .then(function(response){
+        assert_equals(response.mode, 'cors');
+        assert_equals(response.credentials, 'include');
+        return xhr_send(host_info['HTTPS_REMOTE_ORIGIN'], 'GET', '', false);
+      })
+    .then(function(response){
+        assert_equals(response.mode, 'cors');
+        assert_equals(response.credentials, 'same-origin');
+        return xhr_send(host_info['HTTPS_REMOTE_ORIGIN'], 'GET', '', true);
+      })
+    .then(function(response){
+        assert_equals(response.mode, 'cors');
+        assert_equals(response.credentials, 'include');
+      });
+}
+
+function data_url_test() {
+  return new Promise(function(resolve, reject) {
+        var xhr = new XMLHttpRequest();
+        xhr.onload = function() {
+          resolve(xhr.response);
+        };
+        xhr.onerror = function() {
+          reject('XHR should succeed.');
+        };
+        xhr.responseType = 'text';
+        xhr.open('GET', 'data:text/html,Foobar', true);
+        xhr.send();
+      })
+    .then(function(data) {
+        assert_equals(data, 'Foobar');
+      });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-error-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-error-worker.js
new file mode 100644
index 000000000000..b8d3db99bcc8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-error-worker.js
@@ -0,0 +1,19 @@
+"use strict";
+
+self.onfetch = event => {
+  if (event.request.url.endsWith("non-existent-stream-1.txt")) {
+    const rs1 = new ReadableStream();
+    event.respondWith(new Response(rs1));
+    rs1.cancel(1);
+  } else if (event.request.url.endsWith("non-existent-stream-2.txt")) {
+    const rs2 = new ReadableStream({
+      start(controller) { controller.error(1) }
+    });
+    event.respondWith(new Response(rs2));
+  } else if (event.request.url.endsWith("non-existent-stream-3.txt")) {
+    const rs3 = new ReadableStream({
+      pull(controller) { controller.error(1) }
+    });
+    event.respondWith(new Response(rs3));
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-iframe.html
new file mode 100644
index 000000000000..900762ffc6cc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-iframe.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title>Service Worker: Synchronous XHR is intercepted iframe</title>
+<script>
+'use strict';
+
+function performSyncXHR(url) {
+  var syncXhr = new XMLHttpRequest();
+  syncXhr.open('GET', url, false);
+  syncXhr.send();
+
+  return syncXhr;
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-on-worker-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-on-worker-worker.js
new file mode 100644
index 000000000000..0d24ffc1f333
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-on-worker-worker.js
@@ -0,0 +1,41 @@
+'use strict';
+
+self.onfetch = function(event) {
+  if (event.request.url.indexOf('non-existent-file.txt') !== -1) {
+    event.respondWith(new Response('Response from service worker'));
+  } else if (event.request.url.indexOf('/iframe_page') !== -1) {
+    event.respondWith(new Response(
+        '<!DOCTYPE html>\n' +
+        '<script>\n' +
+        'function performSyncXHROnWorker(url) {\n' +
+        '  return new Promise((resolve) => {\n' +
+        '    var worker =\n' +
+        '        new Worker(\'./worker_script\');\n' +
+        '    worker.addEventListener(\'message\', (msg) => {\n' +
+        '      resolve(msg.data);\n' +
+        '    });\n' +
+        '    worker.postMessage({\n' +
+        '      url: url\n' +
+        '    });\n' +
+        '  });\n' +
+        '}\n' +
+        '</script>',
+        {
+          headers: [['content-type', 'text/html']]
+        }));
+  } else if (event.request.url.indexOf('/worker_script') !== -1) {
+    event.respondWith(new Response(
+        'self.onmessage = (msg) => {' +
+        '  const syncXhr = new XMLHttpRequest();' +
+        '  syncXhr.open(\'GET\', msg.data.url, false);' +
+        '  syncXhr.send();' +
+        '  self.postMessage({' +
+        '    status: syncXhr.status,' +
+        '    responseText: syncXhr.responseText' +
+        '  });' +
+        '}',
+        {
+          headers: [['content-type', 'application/javascript']]
+        }));
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-worker.js
new file mode 100644
index 000000000000..070e572f4004
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-worker.js
@@ -0,0 +1,7 @@
+'use strict';
+
+self.onfetch = function(event) {
+  if (event.request.url.indexOf('non-existent-file.txt') !== -1) {
+    event.respondWith(new Response('Response from service worker'));
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-worker.js
new file mode 100644
index 000000000000..4e428374bc22
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-worker.js
@@ -0,0 +1,22 @@
+self.addEventListener('fetch', function(event) {
+    var url = event.request.url;
+    if (url.indexOf('sample?test') == -1) {
+      return;
+    }
+    event.respondWith(new Promise(function(resolve) {
+        var headers = [];
+        for (var header of event.request.headers) {
+          headers.push(header);
+        }
+        event.request.text()
+          .then(function(result) {
+              resolve(new Response(JSON.stringify({
+                  method: event.request.method,
+                  mode: event.request.mode,
+                  credentials: event.request.credentials,
+                  headers: headers,
+                  body: result
+                })));
+            });
+      }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-taint-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-taint-iframe.html
new file mode 100644
index 000000000000..5f09efe28dff
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-taint-iframe.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<body></body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-xhr-iframe.https.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-xhr-iframe.https.html
new file mode 100644
index 000000000000..c26eebee49d8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-xhr-iframe.https.html
@@ -0,0 +1,53 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js?pipe=sub"></script>
+<script>
+var host_info = get_host_info();
+
+function xhr_send(method, data) {
+  return new Promise(function(resolve, reject) {
+      var xhr = new XMLHttpRequest();
+      xhr.onload = function() {
+        resolve(xhr);
+      };
+      xhr.onerror = function() {
+        reject('XHR should succeed.');
+      };
+      xhr.responseType = 'text';
+      xhr.open(method, './sample?test', true);
+      xhr.send(data);
+    });
+}
+
+function coalesce_headers_test() {
+  return xhr_send('POST', 'test string')
+  .then(function(xhr) {
+      window.parent.postMessage({results: xhr.getResponseHeader('foo')},
+                                host_info['HTTPS_ORIGIN']);
+
+      return new Promise(function(resolve) {
+          window.addEventListener('message', function handle(evt) {
+              if (evt.data !== 'ACK') {
+                return;
+              }
+
+              window.removeEventListener('message', handle);
+              resolve();
+            });
+        });
+    });
+}
+
+window.addEventListener('message', function(evt) {
+    var port;
+
+    if (evt.data !== 'START') {
+      return;
+    }
+
+    port = evt.ports[0];
+
+    coalesce_headers_test()
+      .then(function() { port.postMessage({results: 'finish'}); })
+      .catch(function(e) { port.postMessage({results: 'failure:' + e}); });
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-xhr-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-xhr-worker.js
new file mode 100644
index 000000000000..0301b12c18a5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-xhr-worker.js
@@ -0,0 +1,12 @@
+self.addEventListener('fetch', function(event) {
+    var url = event.request.url;
+    if (url.indexOf('sample?test') == -1) {
+      return;
+    }
+    event.respondWith(new Promise(function(resolve) {
+        var headers = new Headers;
+        headers.append('foo', 'foo');
+        headers.append('foo', 'bar');
+        resolve(new Response('hello world', {'headers': headers}));
+      }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response.html
new file mode 100644
index 000000000000..6d27cf19e56f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+
+<script>
+    const params  =new URLSearchParams(location.search);
+    const mode = params.get("mode") || "cors";
+    const path = params.get('path');
+    const bufferPromise =
+      new Promise(resolve =>
+        fetch(path, {mode})
+          .then(response => resolve(response.arrayBuffer()))
+          .catch(() => resolve(new Uint8Array())));
+
+    const entryPromise = new Promise(resolve => {
+      new PerformanceObserver(entries => {
+        const byName = entries.getEntriesByType("resource").find(e => e.name.includes(path));
+        if (byName)
+          resolve(byName);
+      }).observe({entryTypes: ["resource"]});
+    });
+
+    Promise.all([bufferPromise, entryPromise]).then(([buffer, entry]) => {
+      parent.postMessage({
+        buffer,
+        entry: entry.toJSON(),
+    }, '*');
+    });
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response.js
new file mode 100644
index 000000000000..775efc0bbd20
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response.js
@@ -0,0 +1,35 @@
+self.addEventListener('fetch', event => {
+    const path = event.request.url.match(/\/(?<name>[^\/]+)$/);
+    switch (path?.groups?.name) {
+        case 'constructed':
+            event.respondWith(new Response(new Uint8Array([1, 2, 3])));
+            break;
+        case 'forward':
+            event.respondWith(fetch('/common/text-plain.txt'));
+            break;
+        case 'stream':
+            event.respondWith((async() => {
+                const res = await fetch('/common/text-plain.txt');
+                const body = await res.body;
+                const reader = await body.getReader();
+                const stream = new ReadableStream({
+                    async start(controller) {
+                        while (true) {
+                            const {done, value} = await reader.read();
+                            if (done)
+                                break;
+
+                            controller.enqueue(value);
+                        }
+                        controller.close();
+                        reader.releaseLock();
+                    }
+                });
+                return new Response(stream);
+            })());
+            break;
+        default:
+          event.respondWith(fetch(event.request));
+          break;
+    }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker-referrer-policy.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker-referrer-policy.js
new file mode 100644
index 000000000000..64c99c95d86c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker-referrer-policy.js
@@ -0,0 +1,4 @@
+// This script is intended to be served with the `Referrer-Policy` header as
+// defined in the corresponding `.headers` file.
+
+importScripts('fetch-rewrite-worker.js');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker-referrer-policy.js.headers b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker-referrer-policy.js.headers
new file mode 100644
index 000000000000..5ae4265418e3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker-referrer-policy.js.headers
@@ -0,0 +1,2 @@
+Content-Type: application/javascript
+Referrer-Policy: origin
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker.js
new file mode 100644
index 000000000000..20a80665270d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker.js
@@ -0,0 +1,166 @@
+// By default, this worker responds to fetch events with
+// respondWith(fetch(request)). Additionally, if the request has a &url
+// parameter, it fetches the provided URL instead. Because it forwards fetch
+// events to this other URL, it is called the "fetch rewrite" worker.
+//
+// The worker also looks for other params on the request to do more custom
+// behavior, like falling back to network or throwing an error.
+
+function get_query_params(url) {
+  var search = (new URL(url)).search;
+  if (!search) {
+    return {};
+  }
+  var ret = {};
+  var params = search.substring(1).split('&');
+  params.forEach(function(param) {
+      var element = param.split('=');
+      ret[decodeURIComponent(element[0])] = decodeURIComponent(element[1]);
+    });
+  return ret;
+}
+
+function get_request_init(base, params) {
+  var init = {};
+  init['method'] = params['method'] || base['method'];
+  init['mode'] = params['mode'] || base['mode'];
+  if (init['mode'] == 'navigate') {
+    init['mode'] = 'same-origin';
+  }
+  init['credentials'] = params['credentials'] || base['credentials'];
+  init['redirect'] = params['redirect-mode'] || base['redirect'];
+  return init;
+}
+
+self.addEventListener('fetch', function(event) {
+    var params = get_query_params(event.request.url);
+    var init = get_request_init(event.request, params);
+    var url = params['url'];
+    if (params['ignore']) {
+      return;
+    }
+    if (params['throw']) {
+      throw new Error('boom');
+    }
+    if (params['reject']) {
+      event.respondWith(new Promise(function(resolve, reject) {
+          reject();
+        }));
+      return;
+    }
+    if (params['resolve-null']) {
+      event.respondWith(new Promise(function(resolve) {
+          resolve(null);
+        }));
+      return;
+    }
+    if (params['generate-png']) {
+      var binary = atob(
+          'iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAA' +
+          'RnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAAhSURBVDhPY3wro/Kf' +
+          'gQLABKXJBqMGjBoAAqMGDLwBDAwAEsoCTFWunmQAAAAASUVORK5CYII=');
+      var array = new Uint8Array(binary.length);
+      for(var i = 0; i < binary.length; i++) {
+        array[i] = binary.charCodeAt(i);
+      };
+      event.respondWith(new Response(new Blob([array], {type: 'image/png'})));
+      return;
+    }
+    if (params['check-ua-header']) {
+      var ua = event.request.headers.get('User-Agent');
+      if (ua) {
+        // We have a user agent!
+        event.respondWith(new Response(new Blob([ua])));
+      } else {
+        // We don't have a user-agent!
+        event.respondWith(new Response(new Blob(["NO_UA"])));
+      }
+      return;
+    }
+    if (params['check-accept-header']) {
+      var accept = event.request.headers.get('Accept');
+      if (accept) {
+        event.respondWith(new Response(accept));
+      } else {
+        event.respondWith(new Response('NO_ACCEPT'));
+      }
+      return;
+    }
+    event.respondWith(new Promise(function(resolve, reject) {
+        var request = event.request;
+        if (url) {
+          request = new Request(url, init);
+        } else if (params['change-request']) {
+          request = new Request(request, init);
+        }
+        const response_promise = params['navpreload'] ? event.preloadResponse
+                                                      : fetch(request);
+        response_promise.then(function(response) {
+          var expectedType = params['expected_type'];
+          if (expectedType && response.type !== expectedType) {
+            // Resolve a JSON object with a failure instead of rejecting
+            // in order to distinguish this from a NetworkError, which
+            // may be expected even if the type is correct.
+            resolve(new Response(JSON.stringify({
+              result: 'failure',
+              detail: 'got ' + response.type + ' Response.type instead of ' +
+                      expectedType
+            })));
+          }
+
+          var expectedRedirected = params['expected_redirected'];
+          if (typeof expectedRedirected !== 'undefined') {
+            var expected_redirected = (expectedRedirected === 'true');
+            if(response.redirected !== expected_redirected) {
+              // This is simply determining how to pass an error to the outer
+              // test case(fetch-request-redirect.https.html).
+              var execptedResolves = params['expected_resolves'];
+              if (execptedResolves === 'true') {
+                // Reject a JSON object with a failure since promise is expected
+                // to be resolved.
+                reject(new Response(JSON.stringify({
+                  result: 'failure',
+                  detail: 'got '+ response.redirected +
+                          ' Response.redirected instead of ' +
+                          expectedRedirected
+                })));
+              } else {
+                // Resolve a JSON object with a failure since promise is
+                // expected to be rejected.
+                resolve(new Response(JSON.stringify({
+                  result: 'failure',
+                  detail: 'got '+ response.redirected +
+                          ' Response.redirected instead of ' +
+                          expectedRedirected
+                })));
+              }
+            }
+          }
+
+          if (params['clone']) {
+            response = response.clone();
+          }
+
+          // |cache| means to bounce responses through Cache Storage and back.
+          if (params['cache']) {
+            var cacheName = "cached-fetches-" + performance.now() + "-" +
+                            event.request.url;
+            var cache;
+            var cachedResponse;
+            return self.caches.open(cacheName).then(function(opened) {
+              cache = opened;
+              return cache.put(request, response);
+            }).then(function() {
+              return cache.match(request);
+            }).then(function(cached) {
+              cachedResponse = cached;
+              return self.caches.delete(cacheName);
+            }).then(function() {
+               resolve(cachedResponse);
+            });
+          } else {
+            resolve(response);
+          }
+        }, reject)
+      }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker.js.headers b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker.js.headers
new file mode 100644
index 000000000000..123053b38c66
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker.js.headers
@@ -0,0 +1,2 @@
+Content-Type: text/javascript
+Service-Worker-Allowed: /
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-variants-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-variants-worker.js
new file mode 100644
index 000000000000..b950b9a18a6a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-variants-worker.js
@@ -0,0 +1,35 @@
+importScripts('/common/get-host-info.sub.js');
+importScripts('test-helpers.sub.js');
+importScripts('/resources/testharness.js');
+
+const storedResponse = new Response(new Blob(['a simple text file']))
+const absolultePath = `${base_path()}/simple.txt`
+
+self.addEventListener('fetch', event => {
+    const search = new URLSearchParams(new URL(event.request.url).search.substr(1))
+    const variant = search.get('variant')
+    const delay = search.get('delay')
+    if (!variant)
+        return
+
+    switch (variant) {
+        case 'forward':
+            event.respondWith(fetch(event.request.url))
+            break
+        case 'redirect':
+            event.respondWith(fetch(`/xhr/resources/redirect.py?location=${base_path()}/simple.txt`))
+            break
+        case 'delay-before-fetch':
+            event.respondWith(
+                new Promise(resolve => {
+                    step_timeout(() => fetch(event.request.url).then(resolve), delay)
+            }))
+            break
+        case 'delay-after-fetch':
+            event.respondWith(new Promise(resolve => {
+                fetch(event.request.url)
+                    .then(response => step_timeout(() => resolve(response), delay))
+            }))
+            break
+    }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-waits-for-activate-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-waits-for-activate-worker.js
new file mode 100644
index 000000000000..92a96ff88fb9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-waits-for-activate-worker.js
@@ -0,0 +1,31 @@
+var activatePromiseResolve;
+
+addEventListener('activate', function(evt) {
+  evt.waitUntil(new Promise(function(resolve) {
+    activatePromiseResolve = resolve;
+  }));
+});
+
+addEventListener('message', async function(evt) {
+  switch (evt.data) {
+    case 'CLAIM':
+      evt.waitUntil(new Promise(async resolve => {
+        await clients.claim();
+        evt.source.postMessage('CLAIMED');
+        resolve();
+      }));
+      break;
+    case 'ACTIVATE':
+      if (typeof activatePromiseResolve !== 'function') {
+        throw new Error('Not activating!');
+      }
+      activatePromiseResolve();
+      break;
+    default:
+      throw new Error('Unknown message!');
+  }
+});
+
+addEventListener('fetch', function(evt) {
+  evt.respondWith(new Response('Hello world'));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-with-body-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-with-body-worker.js
new file mode 100644
index 000000000000..bef899c1b000
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-with-body-worker.js
@@ -0,0 +1,4 @@
+self.addEventListener("fetch", (event) => {
+  event.request.body;
+  event.respondWith(fetch(event.request));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/form-poster.html b/test/fixtures/wpt/service-workers/service-worker/resources/form-poster.html
new file mode 100644
index 000000000000..cd11a30a5e85
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/form-poster.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<meta name="referrer" content="origin">
+<form method="POST" id="form"></form>
+<script>
+function onLoad() {
+  const params = new URLSearchParams(self.location.search);
+  const form = document.getElementById('form');
+  form.action = params.get('target');
+  form.submit();
+}
+self.addEventListener('load', onLoad);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/frame-for-getregistrations.html b/test/fixtures/wpt/service-workers/service-worker/resources/frame-for-getregistrations.html
new file mode 100644
index 000000000000..7fc35f18914c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/frame-for-getregistrations.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<title>Service Worker: frame for getRegistrations()</title>
+<script>
+var scope = 'scope-for-getregistrations';
+var script = 'empty-worker.js';
+var registration;
+
+navigator.serviceWorker.register(script, { scope: scope })
+  .then(function(r) { registration = r; window.parent.postMessage('ready', '*'); })
+
+self.onmessage = function(e) {
+  if (e.data == 'unregister') {
+    registration.unregister()
+      .then(function() {
+          e.ports[0].postMessage('unregistered');
+        });
+  }
+};
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/get-resultingClientId-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/get-resultingClientId-worker.js
new file mode 100644
index 000000000000..f0e6c7becab6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/get-resultingClientId-worker.js
@@ -0,0 +1,107 @@
+// This worker expects a fetch event for a navigation and messages back the
+// result of clients.get(event.resultingClientId).
+
+// Resolves when the test finishes.
+let testFinishPromise;
+let resolveTestFinishPromise;
+let rejectTestFinishPromise;
+
+// Resolves to clients.get(event.resultingClientId) from the fetch event.
+let getPromise;
+let resolveGetPromise;
+let rejectGetPromise;
+
+let resultingClientId;
+
+function startTest() {
+  testFinishPromise = new Promise((resolve, reject) => {
+    resolveTestFinishPromise = resolve;
+    rejectTestFinishPromise = reject;
+  });
+
+  getPromise = new Promise((resolve, reject) => {
+    resolveGetPromise = resolve;
+    rejectGetPromise = reject;
+  });
+}
+
+async function describeGetPromiseResult(promise) {
+  const result = {};
+
+  await promise.then(
+    (client) => {
+      result.promiseState = 'fulfilled';
+      if (client === undefined) {
+        result.promiseValue = 'undefinedValue';
+      } else if (client instanceof Client) {
+        result.promiseValue = 'client';
+        result.client = {
+          id:  client.id,
+          url: client.url
+        };
+      } else {
+        result.promiseValue = 'unknown';
+      }
+    },
+    (error) => {
+      result.promiseState = 'rejected';
+    });
+
+  return result;
+}
+
+async function handleGetResultingClient(event) {
+  // Note that this message can arrive before |resultingClientId| is populated.
+  const result = await describeGetPromiseResult(getPromise);
+  // |resultingClientId| must be populated by now.
+  result.queriedId = resultingClientId;
+  event.source.postMessage(result);
+};
+
+async function handleGetClient(event) {
+  const id = event.data.id;
+  const result = await describeGetPromiseResult(self.clients.get(id));
+  result.queriedId = id;
+  event.source.postMessage(result);
+};
+
+self.addEventListener('message', (event) => {
+  if (event.data.command == 'startTest') {
+    startTest();
+    event.waitUntil(testFinishPromise);
+    event.source.postMessage('ok');
+    return;
+  }
+
+  if (event.data.command == 'finishTest') {
+    resolveTestFinishPromise();
+    event.source.postMessage('ok');
+    return;
+  }
+
+  if (event.data.command == 'getResultingClient') {
+    event.waitUntil(handleGetResultingClient(event));
+    return;
+  }
+
+  if (event.data.command == 'getClient') {
+    event.waitUntil(handleGetClient(event));
+    return;
+  }
+});
+
+async function handleFetch(event) {
+  try {
+    resultingClientId = event.resultingClientId;
+    const client = await self.clients.get(resultingClientId);
+    resolveGetPromise(client);
+  } catch (error) {
+    rejectGetPromise(error);
+  }
+}
+
+self.addEventListener('fetch', (event) => {
+  if (event.request.mode != 'navigate')
+    return;
+  event.waitUntil(handleFetch(event));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/http-to-https-redirect-and-register-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/http-to-https-redirect-and-register-iframe.html
new file mode 100644
index 000000000000..bcab35364dff
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/http-to-https-redirect-and-register-iframe.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<title>register, unregister, and report result to opener</title>
+<body>
+<script>
+'use strict';
+
+if (!navigator.serviceWorker) {
+  window.opener.postMessage('FAIL: navigator.serviceWorker is undefined', '*');
+} else {
+  navigator.serviceWorker.register('empty-worker.js', {scope: 'scope-register'})
+    .then(
+      registration => {
+          registration.unregister().then(() => {
+              window.opener.postMessage('OK', '*');
+            });
+        },
+      error => {
+          window.opener.postMessage('FAIL: ' + error.name, '*');
+        })
+    .catch(error => {
+        window.opener.postMessage('ERROR: ' + error.name, '*');
+      });
+}
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/iframe-with-fetch-variants.html b/test/fixtures/wpt/service-workers/service-worker/resources/iframe-with-fetch-variants.html
new file mode 100644
index 000000000000..3a61d7bb890b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/iframe-with-fetch-variants.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset="utf-8" />
+<script>
+    const url = new URL(new URLSearchParams(location.search.substr(1)).get('url'), location.href);
+    const before = performance.now();
+    fetch(url)
+        .then(r => r.text())
+        .then(() =>
+            parent.postMessage({
+                before,
+                after: performance.now(),
+                entry: performance.getEntriesByName(url)[0].toJSON()
+            }));
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/iframe-with-image.html b/test/fixtures/wpt/service-workers/service-worker/resources/iframe-with-image.html
new file mode 100644
index 000000000000..ce78840cb283
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/iframe-with-image.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<img src="square">
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/immutable-prototype-serviceworker.js b/test/fixtures/wpt/service-workers/service-worker/resources/immutable-prototype-serviceworker.js
new file mode 100644
index 000000000000..d8a94ad46bef
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/immutable-prototype-serviceworker.js
@@ -0,0 +1,19 @@
+function prototypeChain(global) {
+  let result = [];
+  while (global !== null) {
+    let thrown = false;
+    let next = Object.getPrototypeOf(global);
+    try {
+      Object.setPrototypeOf(global, {});
+      result.push('mutable');
+    } catch (e) {
+      result.push('immutable');
+    }
+    global = next;
+  }
+  return result;
+}
+
+self.onmessage = function(e) {
+  e.data.postMessage(prototypeChain(self));
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-echo-cookie-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-echo-cookie-worker.js
new file mode 100644
index 000000000000..f5eac9508c9a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-echo-cookie-worker.js
@@ -0,0 +1 @@
+importScripts(`echo-cookie-worker.py${location.search}`);
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-relative.xsl b/test/fixtures/wpt/service-workers/service-worker/resources/import-relative.xsl
new file mode 100644
index 000000000000..063a62d03143
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-relative.xsl
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+    <xsl:import href="xslt-pass.xsl"/>
+</xsl:stylesheet>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404-after-update-plus-update-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404-after-update-plus-update-worker.js
new file mode 100644
index 000000000000..e9899d8e7274
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404-after-update-plus-update-worker.js
@@ -0,0 +1,8 @@
+// This worker imports a script that returns 200 on the first request and 404
+// on the second request, and a script that is updated every time when
+// requesting it.
+const params = new URLSearchParams(location.search);
+const key = params.get('Key');
+const additional_key = params.get('AdditionalKey');
+importScripts(`update-worker.py?Key=${key}&Mode=not_found`,
+              `update-worker.py?Key=${additional_key}&Mode=normal`);
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404-after-update.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404-after-update.js
new file mode 100644
index 000000000000..b569346035ac
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404-after-update.js
@@ -0,0 +1,6 @@
+// This worker imports a script that returns 200 on the first request and 404
+// on the second request. The resulting body also changes each time it is
+// requested.
+const params = new URLSearchParams(location.search);
+const key = params.get('Key');
+importScripts(`update-worker.py?Key=${key}&Mode=not_found`);
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404.js
new file mode 100644
index 000000000000..19c7a4b8e561
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404.js
@@ -0,0 +1 @@
+importScripts('404.py');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-cross-origin-worker.sub.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-cross-origin-worker.sub.js
new file mode 100644
index 000000000000..b432854db8bc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-cross-origin-worker.sub.js
@@ -0,0 +1 @@
+importScripts('https://{{domains[www1]}}:{{ports[https][0]}}/service-workers/service-worker/resources/import-scripts-version.py');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-data-url-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-data-url-worker.js
new file mode 100644
index 000000000000..fdabdafc6304
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-data-url-worker.js
@@ -0,0 +1 @@
+importScripts('data:text/javascript,');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-diff-resource-map-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-diff-resource-map-worker.js
new file mode 100644
index 000000000000..0fdcb0fcf80a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-diff-resource-map-worker.js
@@ -0,0 +1,10 @@
+importScripts('/resources/testharness.js');
+
+let echo1 = null;
+let echo2 = null;
+let arg1 = 'import-scripts-get.py?output=echo1&msg=test1';
+let arg2 = 'import-scripts-get.py?output=echo2&msg=test2';
+
+importScripts(arg1, arg2);
+assert_equals(echo1, 'test1');
+assert_equals(echo2, 'test2');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-mime-types-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-mime-types-worker.js
new file mode 100644
index 000000000000..7658eeace695
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-mime-types-worker.js
@@ -0,0 +1,54 @@
+const badMimeTypes = [
+  null,  // no MIME type
+  'text/plain',
+  // JSON is only valid for JSON module imports, never for classic
+  // importScripts(), even when the body is valid JavaScript.
+  'application/json',
+  'text/json',
+  'application/manifest+json',
+];
+
+const validMimeTypes = [
+  'application/ecmascript',
+  'application/javascript',
+  'application/x-ecmascript',
+  'application/x-javascript',
+  'text/ecmascript',
+  'text/javascript',
+  'text/javascript1.0',
+  'text/javascript1.1',
+  'text/javascript1.2',
+  'text/javascript1.3',
+  'text/javascript1.4',
+  'text/javascript1.5',
+  'text/jscript',
+  'text/livescript',
+  'text/x-ecmascript',
+  'text/x-javascript',
+];
+
+function importScriptsWithMimeType(mimeType) {
+  importScripts(`./mime-type-worker.py${mimeType ? '?mime=' + mimeType : ''}`);
+}
+
+importScripts('/resources/testharness.js');
+
+for (const mimeType of badMimeTypes) {
+  test(() => {
+    assert_throws_dom(
+      'NetworkError',
+      () => { importScriptsWithMimeType(mimeType); },
+      `importScripts with ${mimeType ? 'bad' : 'no'} MIME type ${mimeType || ''} throws NetworkError`,
+    );
+  }, `Importing script with ${mimeType ? 'bad' : 'no'} MIME type ${mimeType || ''}`);
+}
+
+for (const mimeType of validMimeTypes) {
+  test(() => {
+    try {
+      importScriptsWithMimeType(mimeType);
+    } catch {
+      assert_unreached(`importScripts with MIME type ${mimeType} should not throw`);
+    }
+  }, `Importing script with valid JavaScript MIME type ${mimeType}`);
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-import.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-import.js
new file mode 100644
index 000000000000..56c04f094602
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-import.js
@@ -0,0 +1 @@
+// empty script
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-on-second-time-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-on-second-time-worker.js
new file mode 100644
index 000000000000..f612ab8e6aa4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-on-second-time-worker.js
@@ -0,0 +1,7 @@
+// This worker imports a script that returns 200 on the first request and a
+// redirect on the second request. The resulting body also changes each time it
+// is requested.
+const params = new URLSearchParams(location.search);
+const key = params.get('Key');
+importScripts(`update-worker.py?Key=${key}&Mode=redirect&` +
+              `Redirect=update-worker.py?Key=${key}%26Mode=normal`);
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-worker.js
new file mode 100644
index 000000000000..d02a45349c24
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-worker.js
@@ -0,0 +1 @@
+importScripts('redirect.py?Redirect=import-scripts-version.py');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-resource-map-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-resource-map-worker.js
new file mode 100644
index 000000000000..b3b9bc46a024
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-resource-map-worker.js
@@ -0,0 +1,15 @@
+importScripts('/resources/testharness.js');
+
+let version = null;
+importScripts('import-scripts-version.py');
+// Once imported, the stored script should be loaded for subsequent importScripts.
+const expected_version = version;
+
+version = null;
+importScripts('import-scripts-version.py');
+assert_equals(expected_version, version, 'second import');
+
+version = null;
+importScripts('import-scripts-version.py', 'import-scripts-version.py',
+    'import-scripts-version.py');
+assert_equals(expected_version, version, 'multiple imports');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-updated-flag-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-updated-flag-worker.js
new file mode 100644
index 000000000000..e01664662ef1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-updated-flag-worker.js
@@ -0,0 +1,31 @@
+importScripts('/resources/testharness.js');
+
+let echo_output = null;
+
+// Tests importing a script that sets |echo_output| to the query string.
+function test_import(str) {
+  echo_output = null;
+  importScripts('import-scripts-echo.py?msg=' + str);
+  assert_equals(echo_output, str);
+}
+
+test_import('root');
+test_import('root-and-message');
+
+self.addEventListener('install', () => {
+    test_import('install');
+    test_import('install-and-message');
+  });
+
+self.addEventListener('message', e => {
+    var error = null;
+    echo_output = null;
+
+    try {
+      importScripts('import-scripts-echo.py?msg=' + e.data);
+    } catch (e) {
+      error = e && e.name;
+    }
+
+    e.source.postMessage({ error: error, value: echo_output });
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/imported-classic-script.js b/test/fixtures/wpt/service-workers/service-worker/resources/imported-classic-script.js
new file mode 100644
index 000000000000..5fc520405135
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/imported-classic-script.js
@@ -0,0 +1 @@
+const imported = 'A classic script.';
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/imported-module-script.js b/test/fixtures/wpt/service-workers/service-worker/resources/imported-module-script.js
new file mode 100644
index 000000000000..56d196df040f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/imported-module-script.js
@@ -0,0 +1 @@
+export const imported = 'A module script.';
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/imported-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/imported-sw.js
new file mode 100644
index 000000000000..04a894d77f87
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/imported-sw.js
@@ -0,0 +1,13 @@
+'use strict';
+
+import {routerRules} from './router-rules.js';
+
+const params = new URLSearchParams(location.search);
+const key = params.get('imported-sw-router-key');
+
+if (key) {
+  self.addEventListener('install', async e => {
+    await e.addRoutes(routerRules[key]);
+    self.skipWaiting();
+  });
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/indexeddb-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/indexeddb-worker.js
new file mode 100644
index 000000000000..9add47683884
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/indexeddb-worker.js
@@ -0,0 +1,57 @@
+self.addEventListener('message', function(e) {
+    var message = e.data;
+    if (message.action === 'create') {
+      e.waitUntil(deleteDB()
+          .then(doIndexedDBTest)
+          .then(function() {
+              message.port.postMessage({ type: 'created' });
+            })
+          .catch(function(reason) {
+              message.port.postMessage({ type: 'error', value: reason });
+            }));
+    } else if (message.action === 'cleanup') {
+      e.waitUntil(deleteDB()
+          .then(function() {
+              message.port.postMessage({ type: 'done' });
+            })
+          .catch(function(reason) {
+              message.port.postMessage({ type: 'error', value: reason });
+            }));
+    }
+  });
+
+function deleteDB() {
+  return new Promise(function(resolve, reject) {
+      var delete_request = indexedDB.deleteDatabase('db');
+
+      delete_request.onsuccess = resolve;
+      delete_request.onerror = reject;
+    });
+}
+
+function doIndexedDBTest(port) {
+  return new Promise(function(resolve, reject) {
+      var open_request = indexedDB.open('db');
+
+      open_request.onerror = reject;
+      open_request.onupgradeneeded = function() {
+        var db = open_request.result;
+        db.createObjectStore('store');
+      };
+      open_request.onsuccess = function() {
+        var db = open_request.result;
+        var tx = db.transaction('store', 'readwrite');
+        var store = tx.objectStore('store');
+        store.put('value', 'key');
+
+        tx.onerror = function() {
+            db.close();
+            reject(tx.error);
+          };
+        tx.oncomplete = function() {
+            db.close();
+            resolve();
+          };
+      };
+    });
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/install-event-type-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/install-event-type-worker.js
new file mode 100644
index 000000000000..1c94ae21ea9d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/install-event-type-worker.js
@@ -0,0 +1,9 @@
+importScripts('worker-testharness.js');
+
+self.oninstall = function(event) {
+    assert_true(event instanceof ExtendableEvent, 'instance of ExtendableEvent');
+    assert_true(event instanceof InstallEvent, 'instance of InstallEvent');
+    assert_equals(event.type, 'install', '`type` property value');
+    assert_false(event.cancelable, '`cancelable` property value');
+    assert_false(event.bubbles, '`bubbles` property value');
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/install-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/install-worker.html
new file mode 100644
index 000000000000..ed20cd4dca6a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/install-worker.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Loading...</p>
+<script>
+async function install() {
+  let script;
+  for (const q of location.search.slice(1).split('&')) {
+    if (q.split('=')[0] === 'script') {
+      script = q.split('=')[1];
+    }
+  }
+  const scope = location.href;
+  const reg = await navigator.serviceWorker.register(script, {scope});
+  await navigator.serviceWorker.ready;
+  location.reload();
+}
+
+install();
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/intercepted-referrer-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/intercepted-referrer-sw.js
new file mode 100644
index 000000000000..f0246c8dbe46
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/intercepted-referrer-sw.js
@@ -0,0 +1,35 @@
+self.addEventListener('install', event => {
+  // Activate immediately to simplify the test.
+  event.waitUntil(self.skipWaiting());
+});
+
+self.addEventListener('activate', event => {
+  // Make sure the very next navigation is controlled by this SW.
+  event.waitUntil(self.clients.claim());
+});
+
+self.addEventListener('fetch', event => {
+  // Only handle top-level navigations within our scope.
+  if (event.request.mode === 'navigate') {
+    const html = `<!doctype html>
+      <meta charset="utf-8">
+      <title>SW Intercepted Page</title>
+      <script>
+        // Post the referrer observed by this new Document.
+        window.addEventListener('load', () => {
+          parent.postMessage({
+            source: 'sw-intercepted',
+            referrer: document.referrer,
+            url: location.href
+          }, '*');
+        });
+      </script>
+      <h1>SW-synthesized page</h1>
+      <p>This page was served by a Service Worker via respondWith().</p>`;
+
+    event.respondWith(new Response(html, {
+      headers: { 'Content-Type': 'text/html; charset=utf-8' }
+    }));
+  }
+  // Otherwise, fall through to network.
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/interface-requirements-worker.sub.js b/test/fixtures/wpt/service-workers/service-worker/resources/interface-requirements-worker.sub.js
new file mode 100644
index 000000000000..a3f239b65481
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/interface-requirements-worker.sub.js
@@ -0,0 +1,59 @@
+'use strict';
+
+// This file checks additional interface requirements, on top of the basic IDL
+// that is validated in service-workers/idlharness.any.js
+
+importScripts('/resources/testharness.js');
+
+test(function() {
+    var req = new Request('http://{{host}}/',
+                          {method: 'POST',
+                           headers: [['Content-Type', 'Text/Html']]});
+    assert_equals(
+      new ExtendableEvent('ExtendableEvent').type,
+      'ExtendableEvent', 'Type of ExtendableEvent should be ExtendableEvent');
+    assert_throws_js(TypeError, function() {
+        new FetchEvent('FetchEvent');
+    }, 'FetchEvent constructor with one argument throws');
+    assert_throws_js(TypeError, function() {
+        new FetchEvent('FetchEvent', {});
+    }, 'FetchEvent constructor with empty init dict throws');
+    assert_throws_js(TypeError, function() {
+        new FetchEvent('FetchEvent', {request: null});
+    }, 'FetchEvent constructor with null request member throws');
+    assert_equals(
+      new FetchEvent('FetchEvent', {request: req}).type,
+      'FetchEvent', 'Type of FetchEvent should be FetchEvent');
+    assert_equals(
+      new FetchEvent('FetchEvent', {request: req}).cancelable,
+      false, 'Default FetchEvent.cancelable should be false');
+    assert_equals(
+      new FetchEvent('FetchEvent', {request: req}).bubbles,
+      false, 'Default FetchEvent.bubbles should be false');
+    assert_equals(
+      new FetchEvent('FetchEvent', {request: req}).clientId,
+      '', 'Default FetchEvent.clientId should be the empty string');
+    assert_equals(
+      new FetchEvent('FetchEvent', {request: req, cancelable: false}).cancelable,
+      false, 'FetchEvent.cancelable should be false');
+    assert_equals(
+      new FetchEvent('FetchEvent', {request: req, clientId : 'test-client-id'}).clientId, 'test-client-id',
+      'FetchEvent.clientId with option {clientId : "test-client-id"} should be "test-client-id"');
+    assert_equals(
+      new FetchEvent('FetchEvent', {request : req}).request.url,
+      'http://{{host}}/',
+      'FetchEvent.request.url should return the value it was initialized to');
+    assert_equals(
+      new FetchEvent('FetchEvent', {request : req}).isReload,
+      undefined,
+      'FetchEvent.isReload should not exist');
+
+  }, 'Event constructors');
+
+test(() => {
+    assert_false('XMLHttpRequest' in self);
+  }, 'xhr is not exposed');
+
+test(() => {
+    assert_false('createObjectURL' in self.URL);
+  }, 'URL.createObjectURL is not exposed')
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/invalid-blobtype-iframe.https.html b/test/fixtures/wpt/service-workers/service-worker/resources/invalid-blobtype-iframe.https.html
new file mode 100644
index 000000000000..04a9cb515e09
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/invalid-blobtype-iframe.https.html
@@ -0,0 +1,28 @@
+<script src="test-helpers.sub.js"></script>
+<script>
+
+function xhr_send(method, data) {
+  return new Promise(function(resolve, reject) {
+      var xhr = new XMLHttpRequest();
+      xhr.onload = function() {
+        if (xhr.getResponseHeader('Content-Type') !== null) {
+          reject('Content-Type must be null.');
+        }
+        resolve();
+      };
+      xhr.onerror = function() {
+        reject('XHR must succeed.');
+      };
+      xhr.responseType = 'text';
+      xhr.open(method, './sample?test', true);
+      xhr.send(data);
+    });
+}
+
+window.addEventListener('message', function(evt) {
+    var port = evt.ports[0];
+    xhr_send('POST', 'test string')
+      .then(function() { port.postMessage({results: 'finish'}); })
+      .catch(function(e) { port.postMessage({results: 'failure:' + e}); });
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/invalid-blobtype-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/invalid-blobtype-worker.js
new file mode 100644
index 000000000000..865dc30d4282
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/invalid-blobtype-worker.js
@@ -0,0 +1,10 @@
+self.addEventListener('fetch', function(event) {
+    var url = event.request.url;
+    if (url.indexOf('sample?test') == -1) {
+      return;
+    }
+    event.respondWith(new Promise(function(resolve) {
+        // null byte in blob type
+        resolve(new Response(new Blob([],{type: 'a\0b'})));
+      }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/invalid-header-iframe.https.html b/test/fixtures/wpt/service-workers/service-worker/resources/invalid-header-iframe.https.html
new file mode 100644
index 000000000000..8f0e6baca175
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/invalid-header-iframe.https.html
@@ -0,0 +1,25 @@
+<script src="test-helpers.sub.js"></script>
+<script>
+
+function xhr_send(method, data) {
+  return new Promise(function(resolve, reject) {
+      var xhr = new XMLHttpRequest();
+      xhr.onload = function() {
+        reject('XHR must fail.');
+      };
+      xhr.onerror = function() {
+        resolve();
+      };
+      xhr.responseType = 'text';
+      xhr.open(method, './sample?test', true);
+      xhr.send(data);
+    });
+}
+
+window.addEventListener('message', function(evt) {
+    var port = evt.ports[0];
+    xhr_send('POST', 'test string')
+      .then(function() { port.postMessage({results: 'finish'}); })
+      .catch(function(e) { port.postMessage({results: 'failure:' + e}); });
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/invalid-header-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/invalid-header-worker.js
new file mode 100644
index 000000000000..850874b8116d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/invalid-header-worker.js
@@ -0,0 +1,12 @@
+self.addEventListener('fetch', function(event) {
+    var url = event.request.url;
+    if (url.indexOf('sample?test') == -1) {
+      return;
+    }
+    event.respondWith(new Promise(function(resolve) {
+        var headers = new Headers;
+        headers.append('foo', 'foo');
+        headers.append('foo', 'b\0r'); // header value with a null byte
+        resolve(new Response('hello world', {'headers': headers}));
+      }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/iso-latin1-header-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/iso-latin1-header-iframe.html
new file mode 100644
index 000000000000..cf2fa8d14f7c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/iso-latin1-header-iframe.html
@@ -0,0 +1,23 @@
+<script>
+function xhr_send(method, data) {
+  return new Promise(function(resolve, reject) {
+      var xhr = new XMLHttpRequest();
+      xhr.onload = function() {
+        resolve();
+      };
+      xhr.onerror = function() {
+        reject('XHR must succeed.');
+      };
+      xhr.responseType = 'text';
+      xhr.open(method, './sample?test', true);
+      xhr.send(data);
+    });
+}
+
+window.addEventListener('message', function(evt) {
+    var port = evt.ports[0];
+    xhr_send('POST', 'test string')
+      .then(function() { port.postMessage({results: 'finish'}); })
+      .catch(function(e) { port.postMessage({results: 'failure:' + e}); });
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/iso-latin1-header-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/iso-latin1-header-worker.js
new file mode 100644
index 000000000000..d9ecca277b3f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/iso-latin1-header-worker.js
@@ -0,0 +1,12 @@
+self.addEventListener('fetch', function(event) {
+    var url = event.request.url;
+    if (url.indexOf('sample?test') == -1) {
+      return;
+    }
+
+    event.respondWith(new Promise(function(resolve) {
+        var headers = new Headers;
+        headers.append('TEST', 'ßÀ¿'); // header value holds the Latin1 (ISO8859-1) string.
+        resolve(new Response('hello world', {'headers': headers}));
+      }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/load_worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/load_worker.js
new file mode 100644
index 000000000000..18c673bebcab
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/load_worker.js
@@ -0,0 +1,29 @@
+function run_test(data, sender) {
+  if (data === 'xhr') {
+    const xhr = new XMLHttpRequest();
+    xhr.open('GET', 'synthesized-response.txt', true);
+    xhr.responseType = 'text';
+    xhr.send();
+    xhr.onload = evt => sender.postMessage(xhr.responseText);
+    xhr.onerror = () => sender.postMessage('XHR failed!');
+  } else if (data === 'fetch') {
+    fetch('synthesized-response.txt')
+        .then(response => response.text())
+        .then(data => sender.postMessage(data))
+        .catch(error => sender.postMessage('Fetch failed!'));
+  } else if (data === 'importScripts') {
+    importScripts('synthesized-response.js');
+    // |message| is provided by 'synthesized-response.js';
+    sender.postMessage(message);
+  } else {
+    sender.postMessage('Unexpected message! ' + data);
+  }
+}
+
+// Entry point for dedicated workers.
+self.onmessage = evt => run_test(evt.data, self);
+
+// Entry point for shared workers.
+self.onconnect = evt => {
+  evt.ports[0].onmessage = e => run_test(e.data, evt.ports[0]);
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/loaded.html b/test/fixtures/wpt/service-workers/service-worker/resources/loaded.html
new file mode 100644
index 000000000000..0cabce69f8e8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/loaded.html
@@ -0,0 +1,9 @@
+<script>
+addEventListener('load', function() {
+  opener.postMessage({ type: 'LOADED' }, '*');
+});
+
+addEventListener('pageshow', function() {
+  opener.postMessage({ type: 'PAGESHOW' }, '*');
+});
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/local-url-inherit-controller-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/local-url-inherit-controller-frame.html
new file mode 100644
index 000000000000..e7214827a4cf
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/local-url-inherit-controller-frame.html
@@ -0,0 +1,189 @@
+<!DOCTYPE html>
+<html>
+<script>
+
+const fetchURL = new URL('sample.js', window.location).href;
+
+const frameControllerText =
+`<script>
+  let t = null;
+  try {
+    if (navigator.serviceWorker.controller) {
+      t = navigator.serviceWorker.controller.scriptURL;
+    }
+  } catch (e) {
+    t = e.message;
+  } finally {
+    parent.postMessage({ data: t }, '*');
+  }
+</` + `script>`;
+
+const frameFetchText =
+`<script>
+  fetch('${fetchURL}', { mode: 'no-cors' }).then(response => {
+    return response.text();
+  }).then(text => {
+    parent.postMessage({ data: text }, '*');
+  }).catch(e => {
+    parent.postMessage({ data: e.message }, '*');
+  });
+</` + `script>`;
+
+const workerControllerText =
+`let t = navigator.serviceWorker.controller
+       ? navigator.serviceWorker.controller.scriptURL
+       : null;
+self.postMessage(t);`;
+
+const workerFetchText =
+`fetch('${fetchURL}', { mode: 'no-cors' }).then(response => {
+  return response.text();
+}).then(text => {
+  self.postMessage(text);
+}).catch(e => {
+  self.postMessage(e.message);
+});`;
+
+const sharedWorkerControllerText =
+`const ports = [];
+self.onconnect = evt => {
+  const port = evt.ports[0];
+  ports.push(port);
+  const t = navigator.serviceWorker.controller
+        ? navigator.serviceWorker.controller.scriptURL
+        : null;
+  port.postMessage(t);
+};
+self.onerror = msg => {
+  ports.forEach(port => {port.postMessage(msg);});
+};`;
+
+const sharedWorkerFetchText =
+`self.onconnect = evt => {
+  const port = evt.ports[0];
+  fetch('${fetchURL}', { mode: 'no-cors' }).then(response => {
+    return response.text();
+  }).then(text => {
+    port.postMessage(text);
+  }).catch(e => {
+    port.postMessage(e.message);
+  });
+};`;
+
+function getChildText(opts) {
+  if (opts.child === 'iframe') {
+    if (opts.check === 'controller') {
+      return frameControllerText;
+    }
+
+    if (opts.check === 'fetch') {
+      return frameFetchText;
+    }
+
+    throw('unexpected feature to check: ' + opts.check);
+  }
+
+  if (opts.child === 'worker') {
+    if (opts.check === 'controller') {
+      return workerControllerText;
+    }
+
+    if (opts.check === 'fetch') {
+      return workerFetchText;
+    }
+
+    throw('unexpected feature to check: ' + opts.check);
+  }
+
+  if (opts.child === 'sharedworker') {
+    if (opts.check === 'controller') {
+      return sharedWorkerControllerText;
+    }
+
+    if (opts.check === 'fetch') {
+      return sharedWorkerFetchText;
+    }
+
+    throw('unexpected feature to check: ' + opts.check);
+  }
+
+  throw('unexpected child type ' + opts.child);
+}
+
+function makeURL(opts) {
+  let mimetype = opts.child === 'iframe' ? 'text/html'
+                                         : 'text/javascript';
+
+  if (opts.scheme === 'blob') {
+    let blob = new Blob([getChildText(opts)], { type: mimetype });
+    return URL.createObjectURL(blob);
+  }
+
+  if (opts.scheme === 'data') {
+    return `data:${mimetype},${getChildText(opts)}`;
+  }
+
+  throw(`unexpected URL scheme ${opts.scheme}`);
+}
+
+function testWorkerChild(url) {
+  let w = new Worker(url);
+  return new Promise((resolve, reject) => {
+    w.onmessage = resolve;
+    w.onerror = evt => {
+      reject(evt.message);
+    }
+  });
+}
+
+function testSharedWorkerChild(url) {
+  let w = new SharedWorker(url);
+  return new Promise((resolve, reject) => {
+    w.port.onmessage = m => {
+      // (null is a valid value when the SharedWorker is not controlled)
+      if (m.data?.includes("Error")) {
+        reject(m.data);
+        return;
+      }
+      resolve(m);
+    }
+    w.onerror = evt => {
+      reject(evt.message);
+    }
+  });
+}
+
+function testIframeChild(url) {
+  let frame = document.createElement('iframe');
+  frame.src = url;
+  document.body.appendChild(frame);
+
+  return new Promise(resolve => {
+    addEventListener('message', evt => {
+      resolve(evt.data);
+    }, { once: true });
+  });
+}
+
+function testURL(opts, url) {
+  if (opts.child === 'worker') {
+    return testWorkerChild(url);
+  }
+
+  if (opts.child === 'sharedworker') {
+    return testSharedWorkerChild(url);
+  }
+
+  if (opts.child === 'iframe') {
+    return testIframeChild(url);
+  }
+
+  throw(`unexpected child type ${opts.child}`);
+}
+
+function checkChildController(opts) {
+  let url = makeURL(opts);
+  return testURL(opts, url);
+}
+</script>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/local-url-inherit-controller-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/local-url-inherit-controller-worker.js
new file mode 100644
index 000000000000..4b7aad0f58a8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/local-url-inherit-controller-worker.js
@@ -0,0 +1,5 @@
+addEventListener('fetch', evt => {
+  if (evt.request.url.includes('sample')) {
+    evt.respondWith(new Response('intercepted'));
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/location-setter.html b/test/fixtures/wpt/service-workers/service-worker/resources/location-setter.html
new file mode 100644
index 000000000000..f0ced06ec26d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/location-setter.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<meta name="referrer" content="origin">
+<script>
+function onLoad() {
+  const params = new URLSearchParams(self.location.search);
+  self.location = params.get('target');
+}
+self.addEventListener('load', onLoad);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/malformed-http-response.asis b/test/fixtures/wpt/service-workers/service-worker/resources/malformed-http-response.asis
new file mode 100644
index 000000000000..bc3c68d46d53
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/malformed-http-response.asis
@@ -0,0 +1 @@
+HAHAHA THIS IS NOT HTTP AND THE BROWSER SHOULD CONSIDER IT A NETWORK ERROR
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/message-vs-microtask.html b/test/fixtures/wpt/service-workers/service-worker/resources/message-vs-microtask.html
new file mode 100644
index 000000000000..2c45c59a475a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/message-vs-microtask.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<script>
+  let draft = [];
+  var resolve_manual_promise;
+  let manual_promise =
+    new Promise(resolve => resolve_manual_promise = resolve).then(() => draft.push('microtask'));
+
+  let resolve_message_promise;
+  let message_promise = new Promise(resolve => resolve_message_promise = resolve);
+  function handle_message(event) {
+    draft.push('message');
+    resolve_message_promise();
+  }
+
+  var result = Promise.all([manual_promise, message_promise]).then(() => draft);
+</script>
+
+<script src="empty.js?key=start"></script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/mime-sniffing-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/mime-sniffing-worker.js
new file mode 100644
index 000000000000..5c34a7a49e87
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/mime-sniffing-worker.js
@@ -0,0 +1,9 @@
+self.addEventListener('fetch', function(event) {
+    // Use an empty content-type value to force mime-sniffing.  Note, this
+    // must be passed to the constructor since the mime-type of the Response
+    // is fixed and cannot be later changed.
+    var res = new Response('<!DOCTYPE html>\n<h1 id=\'testid\'>test</h1>', {
+      headers: { 'content-type': '' }
+    });
+    event.respondWith(res);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/missing.asis b/test/fixtures/wpt/service-workers/service-worker/resources/missing.asis
new file mode 100644
index 000000000000..4846fe01d61a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/missing.asis
@@ -0,0 +1,4 @@
+HTTP/1.1 404 Not Found
+Content-Type: text/javascript
+
+alert("hello");
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/module-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/module-worker.js
new file mode 100644
index 000000000000..385fe7101503
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/module-worker.js
@@ -0,0 +1 @@
+import * as module from './imported-module-script.js';
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/multipart-image-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/multipart-image-iframe.html
new file mode 100644
index 000000000000..c59b95594ff5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/multipart-image-iframe.html
@@ -0,0 +1,19 @@
+<script>
+function load_multipart_image(src) {
+    return new Promise((resolve, reject) => {
+        const img = document.createElement('img');
+        img.addEventListener('load', () => resolve(img));
+        img.addEventListener('error', (e) => reject(new DOMException('load failed', 'NetworkError')));
+        img.src = src;
+    });
+}
+
+function get_image_data(img) {
+    const canvas = document.createElement('canvas');
+    const context = canvas.getContext('2d');
+    context.drawImage(img, 0, 0);
+    // When |img.src| is cross origin, this should throw a SecurityError.
+    const imageData = context.getImageData(0, 0, 1, 1);
+    return imageData;
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/multipart-image-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/multipart-image-worker.js
new file mode 100644
index 000000000000..a38fe54d34fc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/multipart-image-worker.js
@@ -0,0 +1,21 @@
+importScripts('/common/get-host-info.sub.js');
+importScripts('test-helpers.sub.js');
+
+const host_info = get_host_info();
+
+const multipart_image_path = base_path() + 'multipart-image.py';
+const sameorigin_url = host_info['HTTPS_ORIGIN'] + multipart_image_path;
+const cross_origin_url = host_info['HTTPS_REMOTE_ORIGIN'] + multipart_image_path;
+
+self.addEventListener('fetch', event => {
+    const url = event.request.url;
+    if (url.indexOf('cross-origin-multipart-image-with-no-cors') >= 0) {
+        event.respondWith(fetch(cross_origin_url, {mode: 'no-cors'}));
+    } else if (url.indexOf('cross-origin-multipart-image-with-cors-rejected') >= 0) {
+        event.respondWith(fetch(cross_origin_url, {mode: 'cors'}));
+    } else if (url.indexOf('cross-origin-multipart-image-with-cors-approved') >= 0) {
+        event.respondWith(fetch(cross_origin_url + '?approvecors', {mode: 'cors'}));
+    } else if (url.indexOf('same-origin-multipart-image') >= 0) {
+        event.respondWith(fetch(sameorigin_url));
+    }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/navigate-window-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/navigate-window-worker.js
new file mode 100644
index 000000000000..f9617439fc60
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/navigate-window-worker.js
@@ -0,0 +1,21 @@
+addEventListener('message', function(evt) {
+  if (evt.data.type === 'GET_CLIENTS') {
+    clients.matchAll(evt.data.opts).then(function(clientList) {
+      var resultList = clientList.map(function(c) {
+        return { url: c.url, frameType: c.frameType, id: c.id };
+      });
+      evt.source.postMessage({ type: 'success', detail: resultList });
+    }).catch(function(err) {
+      evt.source.postMessage({
+        type: 'failure',
+        detail: 'matchAll() rejected with "' + err + '"'
+      });
+    });
+    return;
+  }
+
+  evt.source.postMessage({
+    type: 'failure',
+    detail: 'Unexpected message type "' + evt.data.type + '"'
+  });
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-body-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-body-worker.js
new file mode 100644
index 000000000000..39f11baf8cb9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-body-worker.js
@@ -0,0 +1,11 @@
+self.addEventListener('fetch', function(event) {
+    event.respondWith(
+        fetch(event.request)
+          .then(
+              function(response) {
+                return response;
+              },
+              function(error) {
+                return new Response('Error:' + error);
+              }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-other-origin.html b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-other-origin.html
new file mode 100644
index 000000000000..d82571d1a3c7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-other-origin.html
@@ -0,0 +1,89 @@
+<!DOCTYPE html>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js"></script>
+<script>
+var host_info = get_host_info();
+var SCOPE = 'navigation-redirect-scope1.py';
+var SCRIPT = 'redirect-worker.js';
+
+var registration;
+var worker;
+var wait_for_worker_promise = navigator.serviceWorker.getRegistration(SCOPE)
+  .then(function(reg) {
+      if (reg)
+        return reg.unregister();
+    })
+  .then(function() {
+      return navigator.serviceWorker.register(SCRIPT, {scope: SCOPE});
+    })
+  .then(function(reg) {
+      registration = reg;
+      worker = reg.installing;
+      return new Promise(function(resolve) {
+          worker.addEventListener('statechange', function() {
+              if (worker.state == 'activated')
+                resolve();
+            });
+        });
+    });
+
+function send_result(message_id, result) {
+  window.parent.postMessage(
+      {id: message_id, result: result},
+      host_info['HTTPS_ORIGIN']);
+}
+
+function get_request_infos(worker) {
+  return new Promise(function(resolve) {
+    var channel = new MessageChannel();
+    channel.port1.onmessage = (msg) => {
+      resolve(msg.data.requestInfos);
+    };
+    worker.postMessage({command: 'getRequestInfos', port: channel.port2},
+                       [channel.port2]);
+  });
+}
+
+function get_clients(worker, actual_ids) {
+  return new Promise(function(resolve) {
+      var channel = new MessageChannel();
+      channel.port1.onmessage = (msg) => {
+        resolve(msg.data.clients);
+      };
+      worker.postMessage({
+        command: 'getClients',
+        actual_ids,
+        port: channel.port2
+      }, [channel.port2]);
+    });
+}
+
+window.addEventListener('message', on_message, false);
+
+function on_message(e) {
+  if (e.origin != host_info['HTTPS_ORIGIN']) {
+    console.error('invalid origin: ' + e.origin);
+    return;
+  }
+  const command = e.data.message.command;
+  if (command == 'wait_for_worker') {
+    wait_for_worker_promise.then(function() { send_result(e.data.id, 'ok'); });
+  } else if (command == 'get_request_infos') {
+    get_request_infos(worker)
+      .then(function(data) {
+          send_result(e.data.id, data);
+        });
+  } else if (command == 'get_clients') {
+    get_clients(worker, e.data.message.actual_ids)
+      .then(function(data) {
+          send_result(e.data.id, data);
+        });
+  } else if (command == 'unregister') {
+    registration.unregister()
+      .then(function() {
+          send_result(e.data.id, 'ok');
+        });
+  }
+}
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-to-http-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-to-http-iframe.html
new file mode 100644
index 000000000000..40e27c630d29
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-to-http-iframe.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js"></script>
+<script>
+var SCOPE = './redirect.py?Redirect=' + encodeURI('http://example.com');
+var SCRIPT = 'navigation-redirect-to-http-worker.js';
+var host_info = get_host_info();
+
+navigator.serviceWorker.getRegistration(SCOPE)
+  .then(function(registration) {
+      if (registration)
+        return registration.unregister();
+    })
+  .then(function() {
+      return navigator.serviceWorker.register(SCRIPT, {scope: SCOPE});
+    })
+  .then(function(registration) {
+      return new Promise(function(resolve) {
+          registration.addEventListener('updatefound', function() {
+              resolve(registration.installing);
+            });
+        });
+    })
+  .then(function(worker) {
+      worker.addEventListener('statechange', on_state_change);
+    })
+  .catch(function(reason) {
+      window.parent.postMessage({results: 'FAILURE: ' + reason.message},
+                                host_info['HTTPS_ORIGIN']);
+     });
+
+function on_state_change(event) {
+  if (event.target.state != 'activated')
+    return;
+  with_iframe(SCOPE, {auto_remove: false})
+    .then(function(frame) {
+        window.parent.postMessage(
+            {results: frame.contentDocument.body.textContent},
+            host_info['HTTPS_ORIGIN']);
+      });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-to-http-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-to-http-worker.js
new file mode 100644
index 000000000000..6f2a8ae1d749
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-to-http-worker.js
@@ -0,0 +1,22 @@
+importScripts('/resources/testharness.js');
+
+self.addEventListener('fetch', function(event) {
+    event.respondWith(new Promise(function(resolve) {
+      Promise.resolve()
+        .then(function() {
+            assert_equals(
+                event.request.redirect, 'manual',
+                'The redirect mode of navigation request must be manual.');
+            return fetch(event.request);
+          })
+        .then(function(response) {
+            assert_equals(
+                response.type, 'opaqueredirect',
+                'The response type of 302 response must be opaqueredirect.');
+            resolve(new Response('OK'));
+          })
+        .catch(function(error) {
+            resolve(new Response('Failed in SW: ' + error));
+          });
+    }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/navigation-timing-worker-extended.js b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-timing-worker-extended.js
new file mode 100644
index 000000000000..79c54088ff60
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-timing-worker-extended.js
@@ -0,0 +1,22 @@
+importScripts("/resources/testharness.js");
+const timings = {}
+
+const DELAY_ACTIVATION = 500
+
+self.addEventListener('activate', event => {
+    event.waitUntil(new Promise(resolve => {
+        timings.activateWorkerStart = performance.now() + performance.timeOrigin;
+
+        // This gives us enough time to ensure activation would delay fetch handling
+        step_timeout(resolve, DELAY_ACTIVATION);
+    }).then(() => timings.activateWorkerEnd = performance.now() + performance.timeOrigin));
+})
+
+self.addEventListener('fetch', event => {
+    timings.handleFetchEvent = performance.now() + performance.timeOrigin;
+    event.respondWith(Promise.resolve(new Response(new Blob([`
+            <script>
+                parent.postMessage(${JSON.stringify(timings)}, "*")
+            </script>
+    `]))));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/navigation-timing-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-timing-worker.js
new file mode 100644
index 000000000000..8539b40066dd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-timing-worker.js
@@ -0,0 +1,15 @@
+self.addEventListener('fetch', (event) => {
+    const url = event.request.url;
+
+    // Network fallback.
+    if (url.indexOf('network-fallback') >= 0) {
+        return;
+    }
+
+    // Don't intercept redirect.
+    if (url.indexOf('redirect.py') >= 0) {
+        return;
+    }
+
+    event.respondWith(fetch(url));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/nested-blob-url-worker-created-from-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/nested-blob-url-worker-created-from-worker.html
new file mode 100644
index 000000000000..fc048e288e90
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/nested-blob-url-worker-created-from-worker.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<script>
+const baseLocation = window.location;
+const workerUrl = new URL('create-blob-url-worker.js', baseLocation).href;
+const worker = new Worker(workerUrl);
+
+function fetch_in_worker(url) {
+  const resourceUrl = new URL(url, baseLocation).href;
+  return new Promise((resolve) => {
+    worker.onmessage = (event) => {
+      resolve(event.data);
+    };
+    worker.postMessage(resourceUrl);
+  });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/nested-blob-url-workers.html b/test/fixtures/wpt/service-workers/service-worker/resources/nested-blob-url-workers.html
new file mode 100644
index 000000000000..f0eafcd3e01c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/nested-blob-url-workers.html
@@ -0,0 +1,38 @@
+<!doctype html>
+<script>
+const baseLocation = window.location;
+const parentWorkerScript = `
+  const childWorkerScript = 'self.onmessage = async (e) => {' +
+    '  const response = await fetch(e.data);' +
+    '  const text = await response.text();' +
+    '  self.postMessage(text);' +
+    '};';
+  const blob = new Blob([childWorkerScript], { type: 'text/javascript' });
+  const blobUrl = URL.createObjectURL(blob);
+  const childWorker = new Worker(blobUrl);
+
+  // When a message comes from the parent frame, sends a resource url to the
+  // child worker.
+  self.onmessage = (e) => {
+    childWorker.postMessage(e.data);
+  };
+  // When a message comes from the child worker, sends a content of fetch() to
+  // the parent frame.
+  childWorker.onmessage = (e) => {
+    self.postMessage(e.data);
+  };
+`;
+const blob = new Blob([parentWorkerScript], { type: 'text/javascript' });
+const blobUrl = URL.createObjectURL(blob);
+const worker = new Worker(blobUrl);
+
+function fetch_in_worker(url) {
+  const resourceUrl = new URL(url, baseLocation).href;
+  return new Promise((resolve) => {
+    worker.onmessage = (event) => {
+      resolve(event.data);
+    };
+    worker.postMessage(resourceUrl);
+  });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/nested-iframe-parent.html b/test/fixtures/wpt/service-workers/service-worker/resources/nested-iframe-parent.html
new file mode 100644
index 000000000000..115ab26e1221
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/nested-iframe-parent.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<script>
+  navigator.serviceWorker.onmessage = event => parent.postMessage(event.data, '*', event.ports);
+</script>
+<iframe id='child'></iframe>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/nested-parent.html b/test/fixtures/wpt/service-workers/service-worker/resources/nested-parent.html
new file mode 100644
index 000000000000..b4832d461d5c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/nested-parent.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<meta name="referrer" content="origin">
+<script>
+async function onLoad() {
+  self.addEventListener('message', evt => {
+    if (self.opener)
+      self.opener.postMessage(evt.data, '*');
+    else
+      self.top.postMessage(evt.data, '*');
+  }, { once: true });
+  const params = new URLSearchParams(self.location.search);
+  const frame = document.createElement('iframe');
+  frame.src = params.get('target');
+  document.body.appendChild(frame);
+}
+self.addEventListener('load', onLoad);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/nested-worker-created-from-blob-url-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/nested-worker-created-from-blob-url-worker.html
new file mode 100644
index 000000000000..3fad2c9228ce
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/nested-worker-created-from-blob-url-worker.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<script>
+const baseLocation = window.location;
+const parentWorkerScript = `
+  const workerUrl =
+    new URL('postmessage-fetched-text.js', '${baseLocation}').href;
+  const childWorker = new Worker(workerUrl);
+
+  // When a message comes from the parent frame, sends a resource url to the
+  // child worker.
+  self.onmessage = (e) => {
+    childWorker.postMessage(e.data);
+  };
+  // When a message comes from the child worker, sends a content of fetch() to
+  // the parent frame.
+  childWorker.onmessage = (e) => {
+    self.postMessage(e.data);
+  };
+`;
+const blob = new Blob([parentWorkerScript], { type: 'text/javascript' });
+const blobUrl = URL.createObjectURL(blob);
+const worker = new Worker(blobUrl);
+
+function fetch_in_worker(url) {
+  const resourceUrl = new URL(url, baseLocation).href;
+  return new Promise((resolve) => {
+    worker.onmessage = (event) => {
+      resolve(event.data);
+    };
+    worker.postMessage(resourceUrl);
+  });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/nested_load_worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/nested_load_worker.js
new file mode 100644
index 000000000000..7296d8fe1a3a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/nested_load_worker.js
@@ -0,0 +1,23 @@
+// Entry point for dedicated workers.
+self.onmessage = evt => {
+  try {
+    const worker = new Worker('load_worker.js');
+    worker.onmessage = msg => self.postMessage(msg.data);
+    worker.postMessage(evt.data);
+  } catch (err) {
+    self.postMessage('Unexpected error! ' + err.message);
+  }
+};
+
+// Entry point for shared workers.
+self.onconnect = evt => {
+  evt.ports[0].onmessage = e => {
+    try {
+      const worker = new Worker('load_worker.js');
+      worker.onmessage = msg => evt.ports[0].postMessage(msg.data);
+      worker.postMessage(e.data);
+    } catch (err) {
+      evt.ports[0].postMessage('Unexpected error! ' + err.message);
+    }
+  };
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/no-dynamic-import.js b/test/fixtures/wpt/service-workers/service-worker/resources/no-dynamic-import.js
new file mode 100644
index 000000000000..ecedd6c5d75c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/no-dynamic-import.js
@@ -0,0 +1,18 @@
+/** @type {[name: string, url: string][]} */
+const importUrlTests = [
+  ["Module URL", "./basic-module.js"],
+  // In no-dynamic-import-in-module.any.js, this module is also statically imported
+  ["Another module URL", "./basic-module-2.js"],
+  [
+    "Module data: URL",
+    "data:text/javascript;charset=utf-8," +
+      encodeURIComponent(`export default 'hello!';`),
+  ],
+];
+
+for (const [name, url] of importUrlTests) {
+  promise_test(
+    (t) => promise_rejects_js(t, TypeError, import(url), "Import must reject"),
+    name
+  );
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/object-image-is-not-intercepted-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/object-image-is-not-intercepted-iframe.html
new file mode 100644
index 000000000000..5a20a58ab169
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/object-image-is-not-intercepted-iframe.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe for embed-and-object-are-not-intercepted test</title>
+<body>
+<object type="image/png" data="/images/green.png"></embed>
+<script>
+// Our parent (the root frame of the test) will examine this to get the result.
+var test_promise = new Promise(resolve => {
+    if (!navigator.serviceWorker.controller)
+      resolve('FAIL: this iframe is not controlled');
+
+    const elem = document.querySelector('object');
+    elem.addEventListener('load', e => {
+        resolve('request was not intercepted');
+      });
+    elem.addEventListener('error', e => {
+        resolve('FAIL: request was intercepted');
+      });
+  });
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/object-is-not-intercepted-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/object-is-not-intercepted-iframe.html
new file mode 100644
index 000000000000..0aeb81951ede
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/object-is-not-intercepted-iframe.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe for embed-and-object-are-not-intercepted test</title>
+<body>
+<script>
+// The OBJECT element will call this with the result about whether the OBJECT
+// request was intercepted by the service worker.
+var report_result;
+
+// Our parent (the root frame of the test) will examine this to get the result.
+var test_promise = new Promise(resolve => {
+    report_result = resolve;
+  });
+</script>
+
+<object data="embedded-content-from-server.html"></object>
+</body>
+
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/object-navigation-is-not-intercepted-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/object-navigation-is-not-intercepted-iframe.html
new file mode 100644
index 000000000000..5c8ab79a500a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/object-navigation-is-not-intercepted-iframe.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe for embed-and-object-are-not-intercepted test</title>
+<body>
+<script>
+// The OBJECT element will call this with the result about whether the OBJECT
+// request was intercepted by the service worker.
+var report_result;
+
+// Our parent (the root frame of the test) will examine this to get the result.
+var test_promise = new Promise(resolve => {
+    report_result = resolve;
+  });
+
+let el = document.createElement('object');
+el.data = "/common/blank.html";
+el.addEventListener('load', _ => {
+  window[0].location = "/service-workers/service-worker/resources/embedded-content-from-server.html";
+}, { once: true });
+document.body.appendChild(el);
+</script>
+
+</body>
+
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-from-nested-event-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-from-nested-event-worker.js
new file mode 100644
index 000000000000..7c97014fd042
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-from-nested-event-worker.js
@@ -0,0 +1,13 @@
+var max_nesting_level = 8;
+
+self.addEventListener('message', function(event) {
+    var level = event.data;
+    if (level < max_nesting_level)
+      dispatchEvent(new MessageEvent('message', { data: level + 1 }));
+    throw Error('error at level ' + level);
+  });
+
+self.addEventListener('activate', function(event) {
+    dispatchEvent(new MessageEvent('message', { data: 1 }));
+  });
+
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-then-cancel-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-then-cancel-worker.js
new file mode 100644
index 000000000000..0bd9d318b241
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-then-cancel-worker.js
@@ -0,0 +1,3 @@
+self.onerror = function(event) { return true; };
+
+self.addEventListener('activate', function(event) { throw new Error(); });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-then-prevent-default-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-then-prevent-default-worker.js
new file mode 100644
index 000000000000..d56c95113917
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-then-prevent-default-worker.js
@@ -0,0 +1,7 @@
+// Ensure we can handle multiple error handlers. One error handler
+// calling preventDefault should cause the event to be treated as
+// handled.
+self.addEventListener('error', function(event) {});
+self.addEventListener('error', function(event) { event.preventDefault(); });
+self.addEventListener('error', function(event) {});
+self.addEventListener('activate', function(event) { throw new Error(); });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-with-empty-onerror-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-with-empty-onerror-worker.js
new file mode 100644
index 000000000000..eb12ae862c59
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-with-empty-onerror-worker.js
@@ -0,0 +1,2 @@
+self.addEventListener('error', function(event) {});
+self.addEventListener('activate', function(event) { throw new Error(); });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-worker.js
new file mode 100644
index 000000000000..1e88ac5c4e78
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-worker.js
@@ -0,0 +1,7 @@
+// Ensure we can handle multiple activate handlers. One handler throwing an
+// error should cause the event dispatch to be treated as having unhandled
+// errors.
+self.addEventListener('activate', function(event) {});
+self.addEventListener('activate', function(event) {});
+self.addEventListener('activate', function(event) { throw new Error(); });
+self.addEventListener('activate', function(event) {});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-waituntil-forever.js b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-waituntil-forever.js
new file mode 100644
index 000000000000..65b02b12b360
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-waituntil-forever.js
@@ -0,0 +1,8 @@
+'use strict';
+
+self.addEventListener('activate', event => {
+  event.waitUntil(new Promise(() => {
+        // Use a promise that never resolves to prevent this service worker from
+        // advancing past the 'activating' state.
+      }));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/onfetch-waituntil-forever.js b/test/fixtures/wpt/service-workers/service-worker/resources/onfetch-waituntil-forever.js
new file mode 100644
index 000000000000..b905d555986e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/onfetch-waituntil-forever.js
@@ -0,0 +1,10 @@
+'use strict';
+
+self.addEventListener('fetch', event => {
+  if (event.request.url.endsWith('waituntil-forever')) {
+    event.respondWith(new Promise(() => {
+        // Use a promise that never resolves to prevent this fetch from
+        // completing.
+    }));
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-from-nested-event-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-from-nested-event-worker.js
new file mode 100644
index 000000000000..6729ab61a371
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-from-nested-event-worker.js
@@ -0,0 +1,12 @@
+var max_nesting_level = 8;
+
+self.addEventListener('message', function(event) {
+    var level = event.data;
+    if (level < max_nesting_level)
+      dispatchEvent(new MessageEvent('message', { data: level + 1 }));
+    throw Error('error at level ' + level);
+  });
+
+self.addEventListener('install', function(event) {
+    dispatchEvent(new MessageEvent('message', { data: 1 }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-then-cancel-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-then-cancel-worker.js
new file mode 100644
index 000000000000..c2c499ab1a37
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-then-cancel-worker.js
@@ -0,0 +1,3 @@
+self.onerror = function(event) { return true; };
+
+self.addEventListener('install', function(event) { throw new Error(); });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-then-prevent-default-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-then-prevent-default-worker.js
new file mode 100644
index 000000000000..7667c2781d09
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-then-prevent-default-worker.js
@@ -0,0 +1,7 @@
+// Ensure we can handle multiple error handlers. One error handler
+// calling preventDefault should cause the event to be treated as
+// handled.
+self.addEventListener('error', function(event) {});
+self.addEventListener('error', function(event) { event.preventDefault(); });
+self.addEventListener('error', function(event) {});
+self.addEventListener('install', function(event) { throw new Error(); });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-with-empty-onerror-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-with-empty-onerror-worker.js
new file mode 100644
index 000000000000..8f56d1bf1491
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-with-empty-onerror-worker.js
@@ -0,0 +1,2 @@
+self.addEventListener('error', function(event) {});
+self.addEventListener('install', function(event) { throw new Error(); });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-worker.js
new file mode 100644
index 000000000000..cc2f6d7e5e78
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-worker.js
@@ -0,0 +1,7 @@
+// Ensure we can handle multiple install handlers. One handler throwing an
+// error should cause the event dispatch to be treated as having unhandled
+// errors.
+self.addEventListener('install', function(event) {});
+self.addEventListener('install', function(event) {});
+self.addEventListener('install', function(event) { throw new Error(); });
+self.addEventListener('install', function(event) {});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-waituntil-forever.js b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-waituntil-forever.js
new file mode 100644
index 000000000000..964483f2f427
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-waituntil-forever.js
@@ -0,0 +1,8 @@
+'use strict';
+
+self.addEventListener('install', event => {
+  event.waitUntil(new Promise(() => {
+        // Use a promise that never resolves to prevent this service worker from
+        // advancing past the 'installing' state.
+      }));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-waituntil-throw-error-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-waituntil-throw-error-worker.js
new file mode 100644
index 000000000000..6cb8f6ede635
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-waituntil-throw-error-worker.js
@@ -0,0 +1,5 @@
+self.addEventListener('install', function(event) {
+  event.waitUntil(new Promise(function(aRequest, aResponse) {
+      throw new Error();
+    }));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/onparse-infiniteloop-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/onparse-infiniteloop-worker.js
new file mode 100644
index 000000000000..6f439aee94d5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/onparse-infiniteloop-worker.js
@@ -0,0 +1,8 @@
+'use strict';
+
+// Use an infinite loop to prevent this service worker from advancing past the
+// 'parsed' state.
+let i = 0;
+while (true) {
+  ++i;
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-being-preloaded-xhr.html b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-being-preloaded-xhr.html
new file mode 100644
index 000000000000..9c6d8bd504a1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-being-preloaded-xhr.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<body></body>
+<script>
+const URL = 'opaque-response?from=opaque-response-being-preloaded-xhr.html';
+function runTest() {
+  var l = document.createElement('link');
+  // Use link rel=preload to try to get the browser to cache the opaque
+  // response.
+  l.setAttribute('rel', 'preload');
+  l.setAttribute('href', URL);
+  l.setAttribute('as', 'fetch');
+  l.onerror = function() {
+    parent.done('FAIL: preload failed unexpectedly');
+  };
+  document.body.appendChild(l);
+  xhr = new XMLHttpRequest;
+  xhr.withCredentials = true;
+  xhr.open('GET', URL);
+  // opaque-response returns an opaque response from serviceworker and thus
+  // the XHR must fail because it is not no-cors request.
+  // Particularly, the XHR must not reuse the opaque response from the
+  // preload request.
+  xhr.onerror = function() {
+    parent.done('PASS');
+  };
+  xhr.onload = function() {
+    parent.done('FAIL: ' + xhr.responseText);
+  };
+  xhr.send();
+}
+</script>
+<body onload="setTimeout(runTest, 100)"></body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-preloaded-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-preloaded-worker.js
new file mode 100644
index 000000000000..4fbe35df277e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-preloaded-worker.js
@@ -0,0 +1,12 @@
+importScripts('/common/get-host-info.sub.js');
+
+var remoteUrl = get_host_info()['HTTPS_REMOTE_ORIGIN'] +
+  '/service-workers/service-worker/resources/sample.js'
+
+self.addEventListener('fetch', event => {
+    if (!event.request.url.match(/opaque-response\?from=/)) {
+      return;
+    }
+
+    event.respondWith(fetch(remoteUrl, {mode: 'no-cors'}));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-preloaded-xhr.html b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-preloaded-xhr.html
new file mode 100644
index 000000000000..f31ac9b5c4ce
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-preloaded-xhr.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<body></body>
+<script>
+const URL = 'opaque-response?from=opaque-response-preloaded-xhr.html';
+function runTest() {
+  var l = document.createElement('link');
+  // Use link rel=preload to try to get the browser to cache the opaque
+  // response.
+  l.setAttribute('rel', 'preload');
+  l.setAttribute('href', URL);
+  l.setAttribute('as', 'fetch');
+  l.onload = function() {
+    xhr = new XMLHttpRequest;
+    xhr.withCredentials = true;
+    xhr.open('GET', URL);
+    // opaque-response returns an opaque response from serviceworker and thus
+    // the XHR must fail because it is not no-cors request.
+    // Particularly, the XHR must not reuse the opaque response from the
+    // preload request.
+    xhr.onerror = function() {
+      parent.done('PASS');
+    };
+    xhr.onload = function() {
+      parent.done('FAIL: ' + xhr.responseText);
+    };
+    xhr.send();
+  };
+  l.onerror = function() {
+    parent.done('FAIL: preload failed unexpectedly');
+  };
+  document.body.appendChild(l);
+}
+</script>
+<body onload="setTimeout(runTest, 100)"></body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-frame.html
new file mode 100644
index 000000000000..a57aacec7c6f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-frame.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+</head>
+<body>
+<script>
+self.addEventListener('error', evt => {
+  self.parent.postMessage({ type: 'ErrorEvent', msg: evt.message }, '*');
+});
+
+const el = document.createElement('script');
+const params = new URLSearchParams(self.location.search);
+el.src = params.get('script');
+el.addEventListener('load', evt => {
+  runScript();
+});
+document.body.appendChild(el);
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-large.js b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-large.js
new file mode 100644
index 000000000000..7e1c598efc5c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-large.js
@@ -0,0 +1,41 @@
+function runScript() {
+  throw new Error("Intentional error.");
+}
+
+function unused() {
+  // The following string is intended to be relatively large since some
+  // browsers trigger different code paths based on script size.
+  return "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec a " +
+         "tortor ut orci bibendum blandit non quis diam. Aenean sit amet " +
+         "urna sit amet neque malesuada ultricies at vel nisi. Nunc et lacus " +
+         "est. Nam posuere erat enim, ac fringilla purus pellentesque " +
+         "cursus. Proin sodales eleifend lorem, eu semper massa scelerisque " +
+         "ac. Maecenas pharetra leo malesuada vulputate vulputate. Sed at " +
+         "efficitur odio. In rhoncus neque varius nibh efficitur gravida. " +
+         "Curabitur vitae dolor enim. Mauris semper lobortis libero sed " +
+         "congue. Donec felis ante, fringilla eget urna ut, finibus " +
+         "hendrerit lacus. Donec at interdum diam. Proin a neque vitae diam " +
+         "egestas euismod. Mauris posuere elementum lorem, eget convallis " +
+         "nisl elementum et. In ut leo ac neque dapibus pharetra quis ac " +
+         "velit. Integer pretium lectus non urna vulputate, in interdum mi " +
+         "lobortis. Sed laoreet ex et metus pharetra blandit. Curabitur " +
+         "sollicitudin non neque eu varius. Phasellus posuere congue arcu, " +
+         "in aliquam nunc fringilla a. Morbi id facilisis libero. Phasellus " +
+         "metus. Lorem ipsum dolor sit amet, consectetur adipiscing elit. " +
+         "tortor ut orci bibendum blandit non quis diam. Aenean sit amet " +
+         "urna sit amet neque malesuada ultricies at vel nisi. Nunc et lacus " +
+         "est. Nam posuere erat enim, ac fringilla purus pellentesque " +
+         "cursus. Proin sodales eleifend lorem, eu semper massa scelerisque " +
+         "ac. Maecenas pharetra leo malesuada vulputate vulputate. Sed at " +
+         "efficitur odio. In rhoncus neque varius nibh efficitur gravida. " +
+         "Curabitur vitae dolor enim. Mauris semper lobortis libero sed " +
+         "congue. Donec felis ante, fringilla eget urna ut, finibus " +
+         "hendrerit lacus. Donec at interdum diam. Proin a neque vitae diam " +
+         "egestas euismod. Mauris posuere elementum lorem, eget convallis " +
+         "nisl elementum et. In ut leo ac neque dapibus pharetra quis ac " +
+         "velit. Integer pretium lectus non urna vulputate, in interdum mi " +
+         "lobortis. Sed laoreet ex et metus pharetra blandit. Curabitur " +
+         "sollicitudin non neque eu varius. Phasellus posuere congue arcu, " +
+         "in aliquam nunc fringilla a. Morbi id facilisis libero. Phasellus " +
+         "metus.";
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-small.js b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-small.js
new file mode 100644
index 000000000000..8b890985752f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-small.js
@@ -0,0 +1,3 @@
+function runScript() {
+  throw new Error("Intentional error.");
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-sw.js
new file mode 100644
index 000000000000..4d882c617d8d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-sw.js
@@ -0,0 +1,37 @@
+importScripts('test-helpers.sub.js');
+importScripts('/common/get-host-info.sub.js');
+
+const NAME = 'foo';
+const SAME_ORIGIN_BASE = new URL('./', self.location.href).href;
+const CROSS_ORIGIN_BASE = new URL('./',
+    get_host_info().HTTPS_REMOTE_ORIGIN + base_path()).href;
+
+const urls = [
+  `${SAME_ORIGIN_BASE}opaque-script-small.js`,
+  `${SAME_ORIGIN_BASE}opaque-script-large.js`,
+  `${CROSS_ORIGIN_BASE}opaque-script-small.js`,
+  `${CROSS_ORIGIN_BASE}opaque-script-large.js`,
+];
+
+self.addEventListener('install', evt => {
+  evt.waitUntil(async function() {
+    const c = await caches.open(NAME);
+    const promises = urls.map(async function(u) {
+      const r = await fetch(u, { mode: 'no-cors' });
+      await c.put(u, r);
+    });
+    await Promise.all(promises);
+  }());
+});
+
+self.addEventListener('fetch', evt => {
+  const url = new URL(evt.request.url);
+  if (!url.pathname.includes('opaque-script-small.js') &&
+      !url.pathname.includes('opaque-script-large.js')) {
+    return;
+  }
+  evt.respondWith(async function() {
+    const c = await caches.open(NAME);
+    return c.match(evt.request);
+  }());
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct1.text b/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct1.text
new file mode 100644
index 000000000000..f3d9861c137b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct1.text
@@ -0,0 +1 @@
+Network
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct1.text.headers b/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct1.text.headers
new file mode 100644
index 000000000000..156209f9c81f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct1.text.headers
@@ -0,0 +1 @@
+Content-Type: text/html
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct2.text b/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct2.text
new file mode 100644
index 000000000000..f3d9861c137b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct2.text
@@ -0,0 +1 @@
+Network
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct2.text.headers b/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct2.text.headers
new file mode 100644
index 000000000000..156209f9c81f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct2.text.headers
@@ -0,0 +1 @@
+Content-Type: text/html
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/other.html b/test/fixtures/wpt/service-workers/service-worker/resources/other.html
new file mode 100644
index 000000000000..b9f350438772
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/other.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<title>Other</title>
+Here's an other html file.
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/override_assert_object_equals.js b/test/fixtures/wpt/service-workers/service-worker/resources/override_assert_object_equals.js
new file mode 100644
index 000000000000..835046d472b2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/override_assert_object_equals.js
@@ -0,0 +1,58 @@
+// .body attribute of Request and Response object are experimental feture. It is
+// enabled when --enable-experimental-web-platform-features flag is set.
+// Touching this attribute can change the behavior of the objects. To avoid
+// touching it while comparing the objects in LayoutTest, we overwrite
+// assert_object_equals method.
+
+(function() {
+  var original_assert_object_equals = self.assert_object_equals;
+  function _brand(object) {
+    return Object.prototype.toString.call(object).match(/^\[object (.*)\]$/)[1];
+  }
+  var assert_request_equals = function(actual, expected, prefix) {
+    if (typeof actual !== 'object') {
+      assert_equals(actual, expected, prefix);
+      return;
+    }
+    assert_true(actual instanceof Request, prefix);
+    assert_true(expected instanceof Request, prefix);
+    assert_equals(actual.bodyUsed, expected.bodyUsed, prefix + '.bodyUsed');
+    assert_equals(actual.method, expected.method, prefix + '.method');
+    assert_equals(actual.url, expected.url, prefix + '.url');
+    original_assert_object_equals(actual.headers, expected.headers,
+                                  prefix + '.headers');
+    assert_equals(actual.context, expected.context, prefix + '.context');
+    assert_equals(actual.referrer, expected.referrer, prefix + '.referrer');
+    assert_equals(actual.mode, expected.mode, prefix + '.mode');
+    assert_equals(actual.credentials, expected.credentials,
+                  prefix + '.credentials');
+    assert_equals(actual.cache, expected.cache, prefix + '.cache');
+  };
+  var assert_response_equals = function(actual, expected, prefix) {
+    if (typeof actual !== 'object') {
+      assert_equals(actual, expected, prefix);
+      return;
+    }
+    assert_true(actual instanceof Response, prefix);
+    assert_true(expected instanceof Response, prefix);
+    assert_equals(actual.bodyUsed, expected.bodyUsed, prefix + '.bodyUsed');
+    assert_equals(actual.type, expected.type, prefix + '.type');
+    assert_equals(actual.url, expected.url, prefix + '.url');
+    assert_equals(actual.status, expected.status, prefix + '.status');
+    assert_equals(actual.statusText, expected.statusText,
+                  prefix + '.statusText');
+    original_assert_object_equals(actual.headers, expected.headers,
+                                  prefix + '.headers');
+  };
+  var assert_object_equals = function(actual, expected, description) {
+    var prefix = (description ? description + ': ' : '') + _brand(expected);
+    if (expected instanceof Request) {
+      assert_request_equals(actual, expected, prefix);
+    } else if (expected instanceof Response) {
+      assert_response_equals(actual, expected, prefix);
+    } else {
+      original_assert_object_equals(actual, expected, description);
+    }
+  };
+  self.assert_object_equals = assert_object_equals;
+})();
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-credentialless-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-credentialless-frame.html
new file mode 100644
index 000000000000..25ddf601457c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-credentialless-frame.html
@@ -0,0 +1,114 @@
+<!DOCTYPE html>
+<head>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>Service Worker: Partitioned Cookies 3P Credentialless Iframe</title>
+<script src="/resources/testharness.js"></script>
+<script src="test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+</head>
+
+<body>
+<script>
+
+// Check workers registered by a credentialless frame can access cookies set in that frame.
+promise_test(async t => {
+  const script = './partitioned-cookies-3p-sw.js';
+  const scope = './partitioned-cookies-3p-';
+  const absolute_scope = new URL(scope, window.location).href;
+
+  // Set a Partitioned cookie.
+  document.cookie = '__Host-partitioned=123; Secure; Path=/; SameSite=None; Partitioned;';
+  assert_true(document.cookie.includes('__Host-partitioned=123'));
+
+  // Make sure DOM cannot access the unpartitioned cookie.
+  assert_false(document.cookie.includes('unpartitioned=456'));
+
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  await wait_for_state(t, reg.installing, 'activated');
+
+  let retrieved_registrations =
+        await navigator.serviceWorker.getRegistrations();
+  let filtered_registrations =
+      retrieved_registrations.filter(reg => reg.scope == absolute_scope);
+
+  // on_message will be reassigned below based on the expected reply from the service worker.
+  let on_message;
+  self.addEventListener('message', ev => on_message(ev));
+  navigator.serviceWorker.addEventListener('message', evt => {
+    self.postMessage(evt.data, '*');
+  });
+
+  // First test that the worker script started correctly and message passing is enabled.
+  let resolve_wait_promise;
+  let wait_promise = new Promise(resolve => {
+    resolve_wait_promise = resolve;
+  });
+  let got;
+  on_message = ev => {
+    got = ev.data;
+    resolve_wait_promise();
+  };
+  filtered_registrations[0].active.postMessage({type: 'test_message'});
+  await wait_promise;
+  assert_true(got.ok, 'Message passing');
+
+  // Test that the partitioned cookie is available to this worker via CookieStore API.
+  wait_promise = new Promise(resolve => {
+    resolve_wait_promise = resolve;
+  });
+  on_message = ev => {
+    got = ev.data;
+    resolve_wait_promise();
+  };
+  filtered_registrations[0].active.postMessage({type: 'echo_cookies_js'});
+  await wait_promise;
+  assert_true(got.ok, 'Get cookies');
+  assert_true(
+      got.cookies.includes('__Host-partitioned'),
+      'Credentialless frame worker can access partitioned cookie via JS');
+  assert_false(
+      got.cookies.includes('unpartitioned'),
+      'Credentialless frame worker cannot access unpartitioned cookie via JS');
+
+  // Test that the partitioned cookie is available to this worker via HTTP.
+  wait_promise = new Promise(resolve => {
+    resolve_wait_promise = resolve;
+  });
+  on_message = ev => {
+    got = ev.data;
+    resolve_wait_promise();
+  };
+  filtered_registrations[0].active.postMessage({ type: 'echo_cookies_http' });
+  await wait_promise;
+  assert_true(got.ok, 'Get cookies');
+  assert_true(
+      got.cookies.includes('__Host-partitioned'),
+      'Credentialless frame worker can access partitioned cookie via HTTP');
+  assert_false(
+      got.cookies.includes('unpartitioned'),
+      'Credentialless frame worker cannot access unpartitioned cookie via HTTP');
+
+  // Test that the partitioned cookie is not available to this worker in HTTP
+  // requests from importScripts.
+  wait_promise = new Promise(resolve => {
+    resolve_wait_promise = resolve;
+  });
+  on_message = ev => {
+    got = ev.data;
+    resolve_wait_promise();
+  };
+  filtered_registrations[0].active.postMessage({ type: 'echo_cookies_import' });
+  await wait_promise;
+  assert_true(got.ok, 'Get cookies');
+  assert_true(
+      got.cookies.includes('__Host-partitioned'),
+      'Credentialless frame worker can access partitioned cookie via importScripts');
+  assert_false(
+      got.cookies.includes('unpartitioned'),
+      'Credentialless frame worker cannot access unpartitioned cookie via importScripts');
+});
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-frame.html
new file mode 100644
index 000000000000..97f3a9c3df3e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-frame.html
@@ -0,0 +1,77 @@
+<!DOCTYPE html>
+<head>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>Service Worker: Partitioned Cookies 3P Iframe</title>
+<script src="partitioned-cookies-test-helpers.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="test-helpers.sub.js"></script>
+</head>
+
+<body>
+<script>
+
+promise_test(async t => {
+  const script = './partitioned-cookies-3p-sw.js';
+  const scope = './partitioned-cookies-3p-';
+  const absolute_scope = new URL(scope, window.location).href;
+
+  assert_false(
+      document.cookie.includes('__Host-partitioned=123'),
+      'DOM cannot access partitioned cookie');
+
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  await wait_for_state(t, reg.installing, 'activated');
+
+  let retrieved_registrations =
+        await navigator.serviceWorker.getRegistrations();
+  let filtered_registrations =
+    retrieved_registrations.filter(reg => reg.scope == absolute_scope);
+
+  const next_message = worker_message_generator();
+
+  // First test that the worker script started correctly and message passing
+  // is enabled.
+  filtered_registrations[0].active.postMessage({type: 'test_message'});
+  const msg1 = await next_message();
+  assert_true(msg1.ok, 'Message passing');
+
+  // Test that the partitioned cookie is not available to this worker via HTTP.
+  filtered_registrations[0].active.postMessage({type: 'echo_cookies_http'});
+  const msg2 = await next_message();
+  assert_true(msg2.ok, 'Get cookies');
+  assert_false(
+      msg2.cookies.includes('__Host-partitioned'),
+      'Worker cannot access partitioned cookie via HTTP');
+  assert_true(
+      msg2.cookies.includes('unpartitioned'),
+      'Worker can access unpartitioned cookie via HTTP');
+
+  // Test that the partitioned cookie is not available to this worker via
+  // CookieStore API.
+  filtered_registrations[0].active.postMessage({type: 'echo_cookies_js'});
+  const msg3 = await next_message();
+  assert_true(msg3.ok, 'Get cookies');
+  assert_false(
+      msg3.cookies.includes('__Host-partitioned'),
+      'Worker cannot access partitioned cookie via JS');
+  assert_true(
+      msg3.cookies.includes('unpartitioned'),
+      'Worker can access unpartitioned cookie via JS');
+
+  // Test that the partitioned cookie is not available to this worker in HTTP
+  // requests from importScripts.
+  filtered_registrations[0].active.postMessage({type: 'echo_cookies_import'});
+  const msg4 = await next_message();
+  assert_true(msg4.ok, 'Get cookies');
+  assert_false(
+      msg4.cookies.includes('__Host-partitioned'),
+      'Worker cannot access partitioned cookie via importScripts');
+  assert_true(
+      msg4.cookies.includes('unpartitioned'),
+      'Worker can access unpartitioned cookie via importScripts');
+});
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-sw.js
new file mode 100644
index 000000000000..c9713b6c50c4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-sw.js
@@ -0,0 +1,3 @@
+// Import the code from the 1P partitioned worker.
+// We use separate URLs for each worker script to keep their scopes unique.
+importScripts('./partitioned-cookies-sw.js');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-window.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-window.html
new file mode 100644
index 000000000000..40d38b3f79f3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-window.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<head>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>Service Worker: Partitioned Cookies 3P Window</title>
+<script src="/resources/testharness.js"></script>
+</head>
+
+<body>
+<script>
+
+promise_test(async t => {
+  assert_true(
+      location.search.includes('origin='), 'First party origin passed');
+  const first_party_origin = decodeURIComponent(
+      location.search.split('origin=')[1]);
+  const iframe = document.createElement('iframe');
+  iframe.src = new URL(
+      './partitioned-cookies-3p-frame.html',
+      first_party_origin + location.pathname).href;
+  document.body.appendChild(iframe);
+  await fetch_tests_from_window(iframe.contentWindow);
+
+  const credentialless_frame = document.createElement('iframe');
+  credentialless_frame.credentialless = true;
+  credentialless_frame.src = new URL(
+      './partitioned-cookies-3p-credentialless-frame.html',
+      first_party_origin + location.pathname).href;
+  document.body.appendChild(credentialless_frame);
+  await fetch_tests_from_window(credentialless_frame.contentWindow);
+});
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-sw.js
new file mode 100644
index 000000000000..767dbf443275
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-sw.js
@@ -0,0 +1,53 @@
+self.addEventListener('message', ev => ev.waitUntil(onMessage(ev)));
+
+async function onMessage(event) {
+  if (!event.data)
+    return;
+  switch (event.data.type) {
+    case 'test_message':
+      return onTestMessage(event);
+    case 'echo_cookies_http':
+      return onEchoCookiesHttp(event);
+    case 'echo_cookies_js':
+      return onEchoCookiesJs(event);
+    case 'echo_cookies_import':
+      return onEchoCookiesImport(event);
+    default:
+      return;
+  }
+}
+
+// test_message just verifies that the message passing is working.
+async function onTestMessage(event) {
+  event.source.postMessage({ok: true});
+}
+
+async function onEchoCookiesHttp(event) {
+  try {
+    const resp = await fetch(
+        `${self.origin}/cookies/resources/list.py`, {credentials: 'include'});
+    const cookies = await resp.json();
+    event.source.postMessage({ok: true, cookies: Object.keys(cookies)});
+  } catch (err) {
+    event.source.postMessage({ok: false});
+  }
+}
+
+// echo_cookies returns the names of all of the cookies available to the worker.
+async function onEchoCookiesJs(event) {
+  try {
+    const cookie_objects = await self.cookieStore.getAll();
+    const cookies = cookie_objects.map(c => c.name);
+    event.source.postMessage({ok: true, cookies});
+  } catch (err) {
+    event.source.postMessage({ok: false});
+  }
+}
+
+// Sets `self._cookies` variable, array of the names of cookies available to
+// the request.
+importScripts(`${self.origin}/cookies/resources/list-cookies-for-script.py`);
+
+function onEchoCookiesImport(event) {
+  event.source.postMessage({ok: true, cookies: self._cookies});
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-test-helpers.js b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-test-helpers.js
new file mode 100644
index 000000000000..73f3b0bde069
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-test-helpers.js
@@ -0,0 +1,31 @@
+// Return a generator containing the worker's message.
+//
+// Usage:
+//   await navigator.serviceWorker.register(...)
+//   ...
+//   const nextMessage = worker_message_generator();
+//   const msg_1 = await nextMessage();
+//   const msg_2 = await nextMessage();
+//   const msg_3 = await nextMessage();
+//
+// Worker should have its own onmessage event listener that
+// postMessages replies to the DOM.
+function worker_message_generator() {
+  const buffer = [];
+  let resolve = null;
+
+  navigator.serviceWorker.addEventListener('message', message => {
+    buffer.push(message.data);
+    if (resolve) {
+      resolve();
+    }
+  });
+
+  return async function () {
+    if (buffer.length != 0) {
+      return buffer.shift();
+    }
+    await new Promise(r => resolve = r);
+    return buffer.shift();
+  }
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-iframe-claim.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-iframe-claim.html
new file mode 100644
index 000000000000..12b048ee04c7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-iframe-claim.html
@@ -0,0 +1,59 @@
+<!DOCTYPE html>
+<title>Service Worker: 3P iframe for partitioned service workers</title>
+<script src="./test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="./partitioned-utils.js"></script>
+
+<body>
+  <script>
+    // 1p mode will respond to requests for its current controller and
+    // postMessage when its controller changes.
+    async function onLoad1pMode(){
+      self.addEventListener('message', evt => {
+        if(!evt.data)
+          return;
+
+        if (evt.data.type === "get-controller") {
+          window.parent.postMessage({controller: navigator.serviceWorker.controller});
+        }
+      });
+
+      navigator.serviceWorker.addEventListener('controllerchange', evt => {
+        window.parent.postMessage({status: "success", context: "1p"}, '*');
+      });
+    }
+
+    // 3p mode will tell its SW to claim and then postMessage its results
+    // automatically.
+    async function onLoad3pMode() {
+      reg = await setupServiceWorker();
+
+      if(navigator.serviceWorker.controller != null){
+        //This iframe is already under control of a service worker, testing for
+        // a controller change will timeout. Return a failure.
+        window.parent.postMessage({status: "failure", context: "3p"}, '*');
+        return;
+      }
+
+      // Once this client is claimed, let the test know.
+      navigator.serviceWorker.addEventListener('controllerchange', evt => {
+        window.parent.postMessage({status: "success", context: "3p"}, '*');
+      });
+
+      // Trigger the SW to claim.
+      reg.active.postMessage({type: "claim"});
+
+    }
+
+    const request_url = new URL(window.location.href);
+    var url_search = request_url.search.substr(1);
+
+    if(url_search == "1p-mode") {
+      self.addEventListener('load', onLoad1pMode);
+    }
+    else if(url_search == "3p-mode") {
+      self.addEventListener('load', onLoad3pMode);
+    }
+    // Else do nothing.
+  </script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-nested-iframe-child.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-nested-iframe-child.html
new file mode 100644
index 000000000000..d05fef48bf0e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-nested-iframe-child.html
@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+<title>Service Worker: Innermost nested iframe for partitioned service workers</title>
+<script src="./test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="./partitioned-utils.js"></script>
+
+<body>
+Innermost 1p iframe (A2) with 3p ancestor (A1-B-A2-A3): this iframe will
+register a service worker when it loads and then add its own iframe (A3) that
+will attempt to navigate to a url. ServiceWorker will intercept this navigation
+and resolve the ServiceWorker's internal Promise. When
+ThirdPartyStoragePartitioning is enabled, this iframe should be partitioned
+from the main frame and should not share a ServiceWorker.
+<script>
+
+async function onLoad() {
+  // Set-up the ServiceWorker for this iframe, defined in:
+  // service-workers/service-worker/resources/partitioned-utils.js
+  await setupServiceWorker();
+
+  // When the SW's iframe finishes it'll post a message. This forwards
+  // it up to the middle-iframe.
+  self.addEventListener('message', evt => {
+      window.parent.postMessage(evt.data, '*');
+  });
+
+  // Now that we have set up the ServiceWorker, we need it to
+  // intercept a navigation that will resolve its promise.
+  // To do this, we create an additional iframe to send that
+  // navigation request to resolve (`resolve.fakehtml`). If we're
+  // partitioned then there shouldn't be a promise to resolve. Defined
+  // in: service-workers/service-worker/resources/partitioned-storage-sw.js
+  const resolve_frame_url = new URL('./partitioned-resolve.fakehtml?FromNestedFrame', self.location);
+  const frame_resolve = await new Promise(resolve => {
+    var frame = document.createElement('iframe');
+    frame.src = resolve_frame_url;
+    frame.onload = function() { resolve(frame); };
+    document.body.appendChild(frame);
+  });
+}
+
+self.addEventListener('load', onLoad);
+</script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-nested-iframe-parent.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-nested-iframe-parent.html
new file mode 100644
index 000000000000..f748e2f78d91
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-nested-iframe-parent.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<title>Service Worker: Middle nested iframe for partitioned service workers</title>
+<script src="./test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="./partitioned-utils.js"></script>
+
+<body>
+Middle of the nested iframes (3p ancestor or B in A1-B-A2).
+<script>
+
+async function onLoad() {
+  // The innermost iframe will recieve a message from the
+  // ServiceWorker and pass it to this iframe. We need to
+  // then pass that message to the main frame to complete
+  // the test.
+  self.addEventListener('message', evt => {
+      window.parent.postMessage(evt.data, '*');
+  });
+
+  // Embed the innermost iframe and set-up the service worker there.
+  const innermost_iframe_url = new URL('./partitioned-service-worker-nested-iframe-child.html',
+    get_host_info().HTTPS_ORIGIN + self.location.pathname);
+  var frame = document.createElement('iframe');
+  frame.src = innermost_iframe_url;
+  document.body.appendChild(frame);
+}
+
+self.addEventListener('load', onLoad);
+</script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe-getRegistrations.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe-getRegistrations.html
new file mode 100644
index 000000000000..747c05894602
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe-getRegistrations.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<title>Service Worker: 3P iframe for partitioned service workers</title>
+<script src="./test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="./partitioned-utils.js"></script>
+
+<body>
+  This iframe will register a service worker when it loads and then will use
+  getRegistrations to get a handle to the SW. It will then postMessage to the
+  SW to retrieve the SW's ID. This iframe will then forward that message up,
+  eventually, to the test.
+  <script>
+
+    async function onLoad() {
+      const scope = './partitioned-'
+      const absoluteScope = new URL(scope, window.location).href;
+
+      await setupServiceWorker();
+
+      // Once the SW sends us its ID, forward it up to the window.
+      navigator.serviceWorker.addEventListener('message', evt => {
+        window.parent.postMessage(evt.data, '*');
+      });
+
+      // Now get the SW with getRegistrations.
+      const retrieved_registrations =
+        await navigator.serviceWorker.getRegistrations();
+
+      // It's possible that other tests have left behind other service workers.
+      // This steps filters those other SWs out.
+      const filtered_registrations =
+        retrieved_registrations.filter(reg => reg.scope == absoluteScope);
+
+      filtered_registrations[0].active.postMessage({type: "get-id"});
+
+    }
+
+    self.addEventListener('load', onLoad);
+  </script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe-matchAll.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe-matchAll.html
new file mode 100644
index 000000000000..7a2c36693e1e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe-matchAll.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<title>Service Worker: 3P iframe for partitioned service workers</title>
+<script src="./test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="./partitioned-utils.js"></script>
+
+<body>
+  This iframe will register a service worker when it loads and then will use
+  getRegistrations to get a handle to the SW. It will then postMessage to the
+  SW to get the SW's clients via matchAll(). This iframe will then forward the
+  SW's response up, eventually, to the test.
+  <script>
+    async function onLoad() {
+      reg = await setupServiceWorker();
+
+      // Once the SW sends us its ID, forward it up to the window.
+      navigator.serviceWorker.addEventListener('message', evt => {
+        window.parent.postMessage(evt.data, '*');
+      });
+
+      reg.active.postMessage({type: "get-match-all"});
+
+    }
+
+    self.addEventListener('load', onLoad);
+  </script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe.html
new file mode 100644
index 000000000000..1b7f671b3714
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<title>Service Worker: 3P iframe for partitioned service workers</title>
+<script src="./test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="./partitioned-utils.js"></script>
+
+
+<body>
+This iframe will register a service worker when it loads and then add its own
+iframe that will attempt to navigate to a url that service worker will intercept
+and use to resolve the service worker's internal Promise.
+<script>
+
+async function onLoad() {
+  await setupServiceWorker();
+
+  // When the SW's iframe finishes it'll post a message. This forwards it up to
+  // the window.
+  self.addEventListener('message', evt => {
+      window.parent.postMessage(evt.data, '*');
+  });
+
+  // Now try to resolve the SW's promise. If we're partitioned then there
+  // shouldn't be a promise to resolve.
+  const resolve_frame_url = new URL('./partitioned-resolve.fakehtml?From3pFrame', self.location);
+  const frame_resolve = await new Promise(resolve => {
+    var frame = document.createElement('iframe');
+    frame.src = resolve_frame_url;
+    frame.onload = function() { resolve(frame); };
+    document.body.appendChild(frame);
+  });
+}
+
+self.addEventListener('load', onLoad);
+</script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-window.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-window.html
new file mode 100644
index 000000000000..86384ce28087
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-window.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<title>Service Worker: 3P window for partitioned service workers</title>
+<script src="./test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+
+
+<body>
+This page should be opened as a third-party window. It then loads an iframe
+specified by the query parameter. Finally it forwards the postMessage from the
+iframe up to the opener (the test).
+
+<script>
+
+async function onLoad() {
+  const message_promise = new Promise(resolve => {
+    self.addEventListener('message', evt => {
+      resolve(evt.data);
+    });
+  });
+
+  const search_param = new URLSearchParams(window.location.search);
+  const iframe_url = search_param.get('target');
+
+  var frame = document.createElement('iframe');
+  frame.src = iframe_url;
+  frame.style.position = 'absolute';
+  document.body.appendChild(frame);
+
+
+  await message_promise.then(data => {
+    // We're done, forward the message and clean up.
+    window.opener.postMessage(data, '*');
+
+    frame.remove();
+  });
+}
+
+self.addEventListener('load', onLoad);
+
+</script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-storage-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-storage-sw.js
new file mode 100644
index 000000000000..00f797981037
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-storage-sw.js
@@ -0,0 +1,81 @@
+// Holds the promise that the "resolve.fakehtml" call attempts to resolve.
+// This is "the SW's promise" that other parts of the test refer to.
+var promise;
+// Stores the resolve funcution for the current promise.
+var pending_resolve_func = null;
+// Unique ID to determine which service worker is being used.
+const ID = Math.random();
+
+function callAndResetResolve() {
+  var local_resolve = pending_resolve_func;
+  pending_resolve_func = null;
+  local_resolve();
+}
+
+self.addEventListener('fetch', function(event) {
+  fetchEventHandler(event);
+})
+
+self.addEventListener('message', (event) => {
+  event.waitUntil(async function() {
+    if(!event.data)
+      return;
+
+    if (event.data.type === "get-id") {
+      event.source.postMessage({ID: ID});
+    }
+    else if(event.data.type === "get-match-all") {
+      clients.matchAll({includeUncontrolled: true}).then(clients_list => {
+        const url_list = clients_list.map(item => item.url);
+        event.source.postMessage({urls_list: url_list});
+      });
+    }
+    else if(event.data.type === "claim") {
+      await clients.claim();
+    }
+  }());
+});
+
+async function fetchEventHandler(event){
+  var request_url = new URL(event.request.url);
+  var url_search = request_url.search.substr(1);
+  request_url.search = "";
+  if ( request_url.href.endsWith('waitUntilResolved.fakehtml') ) {
+
+      if (pending_resolve_func != null) {
+        // Respond with an error if there is already a pending promise
+        event.respondWith(Response.error());
+        return;
+      }
+
+      // Create the new promise.
+      promise = new Promise(function(resolve) {
+        pending_resolve_func = resolve;
+      });
+      event.waitUntil(promise);
+
+      event.respondWith(new Response(`
+        <html>
+        Promise created by ${url_search}
+        <script>self.parent.postMessage({ ID:${ID}, source: "${url_search}"
+          }, '*');</script>
+        </html>
+        `, {headers: {'Content-Type': 'text/html'}}
+      ));
+
+  }
+  else if ( request_url.href.endsWith('resolve.fakehtml') ) {
+    var has_pending = !!pending_resolve_func;
+    event.respondWith(new Response(`
+      <html>
+      Promise settled for ${url_search}
+      <script>self.parent.postMessage({ ID:${ID}, has_pending: ${has_pending},
+        source: "${url_search}"  }, '*');</script>
+      </html>
+    `, {headers: {'Content-Type': 'text/html'}}));
+
+    if (has_pending) {
+      callAndResetResolve();
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-utils.js b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-utils.js
new file mode 100644
index 000000000000..22e90beaec77
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-utils.js
@@ -0,0 +1,110 @@
+// The resolve function for the current pending event listener's promise.
+// It is nulled once the promise is resolved.
+var message_event_promise_resolve = null;
+
+function messageEventHandler(evt) {
+  if (message_event_promise_resolve) {
+    local_resolve = message_event_promise_resolve;
+    message_event_promise_resolve = null;
+    local_resolve(evt.data);
+  }
+}
+
+function makeMessagePromise() {
+  if (message_event_promise_resolve != null) {
+    // Do not create a new promise until the previous is settled.
+    return;
+  }
+
+  return new Promise(resolve => {
+    message_event_promise_resolve = resolve;
+  });
+}
+
+// Loads a url for the frame type and then returns a promise for
+// the data that was postMessage'd from the loaded frame.
+// If the frame type is 'window' then `url` is encoded into the search param
+// as the url the 3p window is meant to iframe.
+function loadAndReturnSwData(t, url, frame_type) {
+  if (frame_type !== 'iframe' && frame_type !== 'window') {
+    return;
+  }
+
+  const message_promise = makeMessagePromise();
+
+  // Create the iframe or window and then return the promise for data.
+  if ( frame_type === 'iframe' ) {
+    const frame = with_iframe(url, false);
+    t.add_cleanup(async () => {
+      const f = await frame;
+      f.remove();
+    });
+  }
+  else {
+    // 'window' case.
+    const search_param = new URLSearchParams();
+    search_param.append('target', url);
+
+    const third_party_window_url = new URL(
+    './resources/partitioned-service-worker-third-party-window.html' +
+    '?' + search_param,
+    get_host_info().HTTPS_NOTSAMESITE_ORIGIN + self.location.pathname);
+
+    const w = window.open(third_party_window_url);
+    t.add_cleanup(() => w.close());
+  }
+
+  return message_promise;
+}
+
+// Checks for an existing service worker registration. If not present,
+// registers and maintains a service worker. Used in windows or iframes
+// that will be partitioned from the main frame.
+async function setupServiceWorker() {
+
+  const script = './partitioned-storage-sw.js';
+  const scope = './partitioned-';
+
+  var reg = await navigator.serviceWorker.register(script, { scope: scope });
+
+  // We should keep track if we installed a worker or not. If we did then we
+  // need to uninstall it. Otherwise we let the top level test uninstall it
+  // (If partitioning is not working).
+  var installed_a_worker = true;
+  await new Promise(resolve => {
+    // Check if a worker is already activated.
+    var worker = reg.active;
+    // If so, just resolve.
+    if ( worker ) {
+      installed_a_worker = false;
+      resolve();
+      return;
+    }
+
+    //Otherwise check if one is waiting.
+    worker = reg.waiting;
+    // If not waiting, grab the installing worker.
+    if ( !worker ) {
+      worker = reg.installing;
+    }
+
+    // Resolve once it's activated.
+    worker.addEventListener('statechange', evt => {
+      if (worker.state === 'activated') {
+        resolve();
+      }
+    });
+  });
+
+  self.addEventListener('unload', async () => {
+    // If we didn't install a worker then that means the top level test did, and
+    // that test is therefore responsible for cleaning it up.
+    if ( !installed_a_worker ) {
+        return;
+    }
+
+    await reg.unregister();
+  });
+
+  return reg;
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/pass-through-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/pass-through-worker.js
new file mode 100644
index 000000000000..5eaf48d5887d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/pass-through-worker.js
@@ -0,0 +1,3 @@
+addEventListener('fetch', evt => {
+  evt.respondWith(fetch(evt.request));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/pass.txt b/test/fixtures/wpt/service-workers/service-worker/resources/pass.txt
new file mode 100644
index 000000000000..7ef22e9a431a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/pass.txt
@@ -0,0 +1 @@
+PASS
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/performance-timeline-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/performance-timeline-worker.js
new file mode 100644
index 000000000000..6c6dfcbd2811
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/performance-timeline-worker.js
@@ -0,0 +1,62 @@
+importScripts('/resources/testharness.js');
+
+promise_test(function(test) {
+    var durationMsec = 100;
+    // There are limits to our accuracy here.  Timers may fire up to a
+    // millisecond early due to platform-dependent rounding.  In addition
+    // the performance API introduces some rounding as well to prevent
+    // timing attacks.
+    var accuracy = 1.5;
+    return new Promise(function(resolve) {
+        performance.mark('startMark');
+        setTimeout(resolve, durationMsec);
+      }).then(function() {
+          performance.mark('endMark');
+          performance.measure('measure', 'startMark', 'endMark');
+          var startMark = performance.getEntriesByName('startMark')[0];
+          var endMark = performance.getEntriesByName('endMark')[0];
+          var measure = performance.getEntriesByType('measure')[0];
+          assert_equals(measure.startTime, startMark.startTime);
+          assert_approx_equals(endMark.startTime - startMark.startTime,
+                               measure.duration, 0.001);
+          assert_greater_than(measure.duration, durationMsec - accuracy);
+          assert_equals(performance.getEntriesByType('mark').length, 2);
+          assert_equals(performance.getEntriesByType('measure').length, 1);
+          performance.clearMarks('startMark');
+          performance.clearMeasures('measure');
+          assert_equals(performance.getEntriesByType('mark').length, 1);
+          assert_equals(performance.getEntriesByType('measure').length, 0);
+      });
+  }, 'User Timing');
+
+promise_test(function(test) {
+    return fetch('sample.txt')
+      .then(function(resp) {
+          return resp.text();
+        })
+      .then(function(text) {
+          var expectedResources = ['testharness.js', 'sample.txt'];
+          assert_equals(performance.getEntriesByType('resource').length, expectedResources.length);
+          for (var i = 0; i < expectedResources.length; i++) {
+              var entry = performance.getEntriesByType('resource')[i];
+              assert_true(entry.name.endsWith(expectedResources[i]));
+              assert_equals(entry.workerStart, 0);
+              assert_greater_than(entry.startTime, 0);
+              assert_greater_than(entry.responseEnd, entry.startTime);
+          }
+          return new Promise(function(resolve) {
+              performance.onresourcetimingbufferfull = _ => {
+                resolve('bufferfull');
+              }
+              performance.setResourceTimingBufferSize(expectedResources.length);
+              fetch('sample.txt');
+          });
+        })
+      .then(function(result) {
+          assert_equals(result, 'bufferfull');
+          performance.clearResourceTimings();
+          assert_equals(performance.getEntriesByType('resource').length, 0);
+        })
+  }, 'Resource Timing');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-blob-url.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-blob-url.js
new file mode 100644
index 000000000000..9095194a4c03
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-blob-url.js
@@ -0,0 +1,5 @@
+self.onmessage = e => {
+  fetch(e.data)
+  .then(response => response.text())
+  .then(text => e.source.postMessage('Worker reply:' + text));
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-dictionary-transferables-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-dictionary-transferables-worker.js
new file mode 100644
index 000000000000..87a4500d754a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-dictionary-transferables-worker.js
@@ -0,0 +1,24 @@
+var messageHandler = function(port, e) {
+    var text_decoder = new TextDecoder;
+    port.postMessage({
+      content: text_decoder.decode(e.data),
+      byteLength: e.data.byteLength
+    });
+
+    // Send back the array buffer via Client.postMessage.
+    port.postMessage(e.data, {transfer: [e.data.buffer]});
+
+    port.postMessage({
+      content: text_decoder.decode(e.data),
+      byteLength: e.data.byteLength
+    });
+};
+
+self.addEventListener('message', e => {
+    if (e.ports[0]) {
+      // Wait for messages sent via MessagePort.
+      e.ports[0].onmessage = messageHandler.bind(null, e.ports[0]);
+      return;
+    }
+    messageHandler(e.source, e);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-echo-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-echo-worker.js
new file mode 100644
index 000000000000..f088ad127804
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-echo-worker.js
@@ -0,0 +1,3 @@
+self.addEventListener('message', event => {
+  event.source.postMessage(event.data);
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-fetched-text.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-fetched-text.js
new file mode 100644
index 000000000000..9fc67171d05d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-fetched-text.js
@@ -0,0 +1,5 @@
+self.onmessage = async (e) => {
+  const response = await fetch(e.data);
+  const text = await response.text();
+  self.postMessage(text);
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-msgport-to-client-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-msgport-to-client-worker.js
new file mode 100644
index 000000000000..7af935f4f8fc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-msgport-to-client-worker.js
@@ -0,0 +1,19 @@
+self.onmessage = function(e) {
+  e.waitUntil(self.clients.matchAll().then(function(clients) {
+      clients.forEach(function(client) {
+          var messageChannel = new MessageChannel();
+          messageChannel.port1.onmessage =
+            onMessageViaMessagePort.bind(null, messageChannel.port1);
+          client.postMessage(undefined, [messageChannel.port2]);
+        });
+    }));
+};
+
+function onMessageViaMessagePort(port, e) {
+  var message = e.data;
+  if ('value' in message) {
+    port.postMessage({ack: 'Acking value: ' + message.value});
+  } else if ('done' in message) {
+    port.postMessage({done: true});
+  }
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-on-load-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-on-load-worker.js
new file mode 100644
index 000000000000..c2b0bcb8bfb0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-on-load-worker.js
@@ -0,0 +1,9 @@
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  postMessage('dedicated worker script loaded');
+} else if ('SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = evt => {
+    evt.ports[0].postMessage('shared worker script loaded');
+  };
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-to-client-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-to-client-worker.js
new file mode 100644
index 000000000000..17913063583a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-to-client-worker.js
@@ -0,0 +1,10 @@
+self.onmessage = function(e) {
+  e.waitUntil(self.clients.matchAll().then(function(clients) {
+      clients.forEach(function(client) {
+          client.postMessage('Sending message via clients');
+          if (!Array.isArray(clients))
+            client.postMessage('clients is not an array');
+          client.postMessage('quit');
+        });
+    }));
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-transferables-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-transferables-worker.js
new file mode 100644
index 000000000000..d35c1c952b88
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-transferables-worker.js
@@ -0,0 +1,24 @@
+var messageHandler = function(port, e) {
+    var text_decoder = new TextDecoder;
+    port.postMessage({
+      content: text_decoder.decode(e.data),
+      byteLength: e.data.byteLength
+    });
+
+    // Send back the array buffer via Client.postMessage.
+    port.postMessage(e.data, [e.data.buffer]);
+
+    port.postMessage({
+      content: text_decoder.decode(e.data),
+      byteLength: e.data.byteLength
+    });
+};
+
+self.addEventListener('message', e => {
+    if (e.ports[0]) {
+      // Wait for messages sent via MessagePort.
+      e.ports[0].onmessage = messageHandler.bind(null, e.ports[0]);
+      return;
+    }
+    messageHandler(e.source, e);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-worker.js
new file mode 100644
index 000000000000..858cf04267c2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-worker.js
@@ -0,0 +1,19 @@
+var port;
+
+// Exercise the 'onmessage' handler:
+self.onmessage = function(e) {
+  var message = e.data;
+  if ('port' in message) {
+    port = message.port;
+  }
+};
+
+// And an event listener:
+self.addEventListener('message', function(e) {
+    var message = e.data;
+    if ('value' in message) {
+      port.postMessage('Acking value: ' + message.value);
+    } else if ('done' in message) {
+      port.postMessage('quit');
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/range-request-to-different-origins-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/range-request-to-different-origins-worker.js
new file mode 100644
index 000000000000..cab605833905
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/range-request-to-different-origins-worker.js
@@ -0,0 +1,40 @@
+// This worker is meant to test range requests where the responses come from
+// multiple origins. It forwards the first request to a cross-origin URL
+// (generating an opaque response). The server is expected to return a 206
+// Partial Content response.  Then the worker lets subsequent range requests
+// fall back to network (generating same-origin responses). The intent is to try
+// to trick the browser into treating the resource as same-origin.
+//
+// It would also be interesting to do the reverse test where the first request
+// goes to the same-origin URL, and subsequent range requests go cross-origin in
+// 'no-cors' mode to receive opaque responses. But the service worker cannot do
+// this, because in 'no-cors' mode the 'range' HTTP header is disallowed.
+
+importScripts('/common/get-host-info.sub.js')
+
+let initial = true;
+function is_initial_request() {
+  const old = initial;
+  initial = false;
+  return old;
+}
+
+self.addEventListener('fetch', e => {
+    const url = new URL(e.request.url);
+    if (url.search.indexOf('VIDEO') == -1) {
+      // Fall back for non-video.
+      return;
+    }
+
+    // Make the first request go cross-origin.
+    if (is_initial_request()) {
+      const cross_origin_url = get_host_info().HTTPS_REMOTE_ORIGIN +
+          url.pathname + url.search;
+      const cross_origin_request = new Request(cross_origin_url,
+          {mode: 'no-cors', headers: e.request.headers});
+      e.respondWith(fetch(cross_origin_request));
+      return;
+    }
+
+    // Fall back to same origin for subsequent range requests.
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/range-request-with-different-cors-modes-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/range-request-with-different-cors-modes-worker.js
new file mode 100644
index 000000000000..7580b0b68a95
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/range-request-with-different-cors-modes-worker.js
@@ -0,0 +1,60 @@
+// This worker is meant to test range requests where the responses are a mix of
+// opaque ones and non-opaque ones. It forwards the first request to a
+// cross-origin URL (generating an opaque response). The server is expected to
+// return a 206 Partial Content response.  Then the worker forwards subsequent
+// range requests to that URL, with CORS sharing generating a non-opaque
+// responses. The intent is to try to trick the browser into treating the
+// resource as non-opaque.
+//
+// It would also be interesting to do the reverse test where the first request
+// uses 'cors', and subsequent range requests use 'no-cors' mode. But the
+// service worker cannot do this, because in 'no-cors' mode the 'range' HTTP
+// header is disallowed.
+
+importScripts('/common/get-host-info.sub.js')
+
+let initial = true;
+function is_initial_request() {
+  const old = initial;
+  initial = false;
+  return old;
+}
+
+self.addEventListener('fetch', e => {
+    const url = new URL(e.request.url);
+    if (url.search.indexOf('VIDEO') == -1) {
+      // Fall back for non-video.
+      return;
+    }
+
+    let cross_origin_url = get_host_info().HTTPS_REMOTE_ORIGIN +
+        url.pathname + url.search;
+
+    // The first request is no-cors.
+    if (is_initial_request()) {
+      const init = { mode: 'no-cors', headers: e.request.headers };
+      const cross_origin_request = new Request(cross_origin_url, init);
+      e.respondWith(fetch(cross_origin_request));
+      return;
+    }
+
+    // Subsequent range requests are cors.
+
+    // Copy headers needed for range requests.
+    let my_headers = new Headers;
+    if (e.request.headers.get('accept'))
+      my_headers.append('accept', e.request.headers.get('accept'));
+    if (e.request.headers.get('range'))
+    my_headers.append('range', e.request.headers.get('range'));
+
+    // Add &ACAOrigin to allow CORS.
+    cross_origin_url += '&ACAOrigin=' + get_host_info().HTTPS_ORIGIN;
+    // Add &ACAHeaders to allow range requests.
+    cross_origin_url += '&ACAHeaders=accept,range';
+
+    // Make the CORS request.
+    const init = { mode: 'cors', headers: my_headers };
+    const cross_origin_request = new Request(cross_origin_url, init);
+    e.respondWith(fetch(cross_origin_request));
+  });
+
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/range-request-with-synth-head-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/range-request-with-synth-head-worker.js
new file mode 100644
index 000000000000..6b6395aecaef
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/range-request-with-synth-head-worker.js
@@ -0,0 +1,36 @@
+// This worker is meant to test range requests where the initial response
+// synthesizes a 206 Partial Content response with leading bytes.
+// Then the worker lets subsequent range requests fall back to network.
+
+let initial = true;
+function is_initial_request() {
+  const old = initial;
+  initial = false;
+  return old;
+}
+
+self.addEventListener('fetch', e => {
+    const url = new URL(e.request.url);
+    if (url.search.indexOf('VIDEO') == -1) {
+      // Fall back for non-video.
+      return;
+    }
+
+    // Synthesize the response to the first request.
+    if (is_initial_request()) {
+      // Consistent with fetch-access-control.py?VIDEO
+      const init = {
+        status: 206,
+        headers: {
+          "Accept-Ranges": "bytes",
+          "Content-Type": "video/webm",
+          "Content-Range": "bytes 0-1/*",
+          "Content-Length": "2",
+        },
+      };
+      e.respondWith(new Response(new Uint8Array([0x1a, 0x45]), init));
+      return;
+    }
+
+    // Fall back for subsequent range requests.
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/redirect-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/redirect-worker.js
new file mode 100644
index 000000000000..82e21fc26fdb
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/redirect-worker.js
@@ -0,0 +1,145 @@
+// We store an empty response for each fetch event request we see
+// in this Cache object so we can get the list of urls in the
+// message event.
+var cacheName = 'urls-' + self.registration.scope;
+
+var waitUntilPromiseList = [];
+
+// Sends the requests seen by this worker. The output is:
+// {
+//   requestInfos: [
+//     {url: url1, resultingClientId: id1},
+//     {url: url2, resultingClientId: id2},
+//   ]
+// }
+async function getRequestInfos(event) {
+  // Wait for fetch events to finish.
+  await Promise.all(waitUntilPromiseList);
+  waitUntilPromiseList = [];
+
+  // Generate the message.
+  const cache = await caches.open(cacheName);
+  const requestList = await cache.keys();
+  const requestInfos = [];
+  for (let i = 0; i < requestList.length; i++) {
+    const response = await cache.match(requestList[i]);
+    const body = await response.json();
+    requestInfos[i] = {
+      url: requestList[i].url,
+      resultingClientId: body.resultingClientId
+    };
+  }
+  await caches.delete(cacheName);
+
+  event.data.port.postMessage({requestInfos});
+}
+
+// Sends the results of clients.get(id) from this worker. The
+// input is:
+// {
+//   actual_ids: {a: id1, b: id2, x: id3}
+// }
+//
+// The output is:
+// {
+//   clients: {
+//     a: {found: false},
+//     b: {found: false},
+//     x: {
+//       id: id3,
+//       url: url1,
+//       found: true
+//    }
+//   }
+// }
+async function getClients(event) {
+  // |actual_ids| is like:
+  // {a: id1, b: id2, x: id3}
+  const actual_ids = event.data.actual_ids;
+  const result = {}
+  for (let key of Object.keys(actual_ids)) {
+    const id = actual_ids[key];
+    const client = await self.clients.get(id);
+    if (client === undefined)
+      result[key] = {found: false};
+    else
+      result[key] = {found: true, url: client.url, id: client.id};
+  }
+  event.data.port.postMessage({clients: result});
+}
+
+self.addEventListener('message', async function(event) {
+  if (event.data.command == 'getRequestInfos') {
+    event.waitUntil(getRequestInfos(event));
+    return;
+  }
+
+  if (event.data.command == 'getClients') {
+    event.waitUntil(getClients(event));
+    return;
+  }
+});
+
+function get_query_params(url) {
+  var search = (new URL(url)).search;
+  if (!search) {
+    return {};
+  }
+  var ret = {};
+  var params = search.substring(1).split('&');
+  params.forEach(function(param) {
+      var element = param.split('=');
+      ret[decodeURIComponent(element[0])] = decodeURIComponent(element[1]);
+    });
+  return ret;
+}
+
+self.addEventListener('fetch', function(event) {
+    var waitUntilPromise = caches.open(cacheName).then(function(cache) {
+      const responseBody = {};
+      responseBody['resultingClientId'] = event.resultingClientId;
+      const headers = new Headers({'Content-Type': 'application/json'});
+      const response = new Response(JSON.stringify(responseBody), {headers});
+      return cache.put(event.request, response);
+    });
+    event.waitUntil(waitUntilPromise);
+
+    var params = get_query_params(event.request.url);
+    if (!params['sw']) {
+      // To avoid races, add the waitUntil() promise to our global list.
+      // If we get a message event before we finish here, it will wait
+      // these promises to complete before proceeding to read from the
+      // cache.
+      waitUntilPromiseList.push(waitUntilPromise);
+      return;
+    }
+
+    event.respondWith(waitUntilPromise.then(async () => {
+      if (params['sw'] == 'gen') {
+        return Response.redirect(params['url']);
+      } else if (params['sw'] == 'gen-manual') {
+        // Note this differs from Response.redirect() in that relative URLs are
+        // preserved.
+        return new Response("", {
+          status: 301,
+          headers: {location: params['url']},
+        });
+      } else if (params['sw'] == 'fetch') {
+        return fetch(event.request);
+      } else if (params['sw'] == 'fetch-url') {
+        return fetch(params['url']);
+      } else if (params['sw'] == 'follow') {
+        return fetch(new Request(event.request.url, {redirect: 'follow'}));
+      } else if (params['sw'] == 'manual') {
+        return fetch(new Request(event.request.url, {redirect: 'manual'}));
+      } else if (params['sw'] == 'manualThroughCache') {
+        const url = event.request.url;
+        await caches.delete(url)
+        const cache = await self.caches.open(url);
+        const response = await fetch(new Request(url, {redirect: 'manual'}));
+        await cache.put(event.request, response);
+        return cache.match(url);
+      }
+      // unexpected... trigger an interception failure
+    }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/referer-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/referer-iframe.html
new file mode 100644
index 000000000000..295ff4567154
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/referer-iframe.html
@@ -0,0 +1,39 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js"></script>
+<script>
+function check_referer(url, expected_referer) {
+  return fetch(url)
+    .then(function(res) { return res.json(); })
+    .then(function(headers) {
+        if (headers['referer'] === expected_referer) {
+          return Promise.resolve();
+        } else {
+          return Promise.reject('Referer for ' + url + ' must be ' +
+                                expected_referer + ' but got ' +
+                                headers['referer']);
+        }
+      });
+}
+
+window.addEventListener('message', function(evt) {
+    var host_info = get_host_info();
+    var port = evt.ports[0];
+    check_referer('request-headers.py?ignore=true',
+                  host_info['HTTPS_ORIGIN'] +
+                  base_path() + 'referer-iframe.html')
+      .then(function() {
+          return check_referer(
+              'request-headers.py',
+              host_info['HTTPS_ORIGIN'] +
+              base_path() + 'referer-iframe.html');
+        })
+      .then(function() {
+          return check_referer(
+              'request-headers.py?url=request-headers.py',
+              host_info['HTTPS_ORIGIN'] +
+              base_path() + 'fetch-rewrite-worker.js');
+        })
+      .then(function() { port.postMessage({results: 'finish'}); })
+      .catch(function(e) { port.postMessage({results: 'failure:' + e}); });
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/referrer-policy-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/referrer-policy-iframe.html
new file mode 100644
index 000000000000..9ef3cd19a982
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/referrer-policy-iframe.html
@@ -0,0 +1,32 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js"></script>
+<script>
+function check_referer(url, expected_referer) {
+  return fetch(url)
+    .then(function(res) { return res.json(); })
+    .then(function(headers) {
+        if (headers['referer'] === expected_referer) {
+          return Promise.resolve();
+        } else {
+          return Promise.reject('Referer for ' + url + ' must be ' +
+                                expected_referer + ' but got ' +
+                                headers['referer']);
+        }
+      });
+}
+
+window.addEventListener('message', function(evt) {
+    var host_info = get_host_info();
+    var port = evt.ports[0];
+    check_referer('request-headers.py?ignore=true',
+                  host_info['HTTPS_ORIGIN'] +
+                  base_path() + 'referrer-policy-iframe.html')
+      .then(function() {
+          return check_referer(
+              'request-headers.py?url=request-headers.py',
+              host_info['HTTPS_ORIGIN'] + '/');
+        })
+      .then(function() { port.postMessage({results: 'finish'}); })
+      .catch(function(e) { port.postMessage({results: 'failure:' + e}); });
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/register-closed-window-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/register-closed-window-iframe.html
new file mode 100644
index 000000000000..bd386574e2c5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/register-closed-window-iframe.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<script>
+window.addEventListener('message', async function(evt) {
+  if (evt.data === 'START') {
+    var w = window.open('./');
+    var sw = w.navigator.serviceWorker;
+    w.close();
+    w = null;
+
+    // Ensure sw.register receives a valid URL. The popup might have
+    // about:blank as base so sw.register('doestnmatter.js') would be invalid.
+    const swUrl = new URL('doestnmatter.js', document.baseURI).href;
+    try {
+      await sw.register(swUrl);
+    } finally {
+      parent.postMessage('OK', '*');
+    }
+  }
+});
+</script>
+</head>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/register-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/register-iframe.html
new file mode 100644
index 000000000000..f5a040e41d96
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/register-iframe.html
@@ -0,0 +1,4 @@
+<script type="text/javascript">
+navigator.serviceWorker.register('empty-worker.js',
+                                 {scope: 'register-iframe.html'});
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/register-rewrite-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/register-rewrite-worker.html
new file mode 100644
index 000000000000..bf06317ad9e3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/register-rewrite-worker.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<script>
+async function onLoad() {
+  const params = new URLSearchParams(self.location.search);
+  const scope = self.origin + params.get('scopepath');
+  const script = './fetch-rewrite-worker.js';
+  const reg = await navigator.serviceWorker.register(script, { scope: scope });
+  // In nested cases we may be impacted by partitioning or not depending on
+  // the browser.  With partitioning we will be installing a new worker here,
+  // but without partitioning the worker will already exist.  Handle both cases.
+  if (reg.installing) {
+    await new Promise(resolve => {
+      const worker = reg.installing;
+      worker.addEventListener('statechange', evt => {
+        if (worker.state === 'activated') {
+          resolve();
+        }
+      });
+    });
+    if (reg.navigationPreload) {
+      await reg.navigationPreload.enable();
+    }
+  }
+  if (window.opener) {
+    window.opener.postMessage({ type: 'SW-REGISTERED' }, '*');
+  } else {
+    window.top.postMessage({ type: 'SW-REGISTERED' }, '*');
+  }
+}
+self.addEventListener('load', onLoad);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/register-static-router-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/register-static-router-iframe.html
new file mode 100644
index 000000000000..f23353af9cf9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/register-static-router-iframe.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<script>
+  const params = new URLSearchParams(location.search);
+  const key = params.get('key');
+  async function setup() {
+    try {
+      const reg = await navigator.serviceWorker.register('static-router-sw.js?key=' + key, {scope: './', type: 'module'});
+      const worker = reg.installing || reg.waiting || reg.active;
+
+      // Wait for activation to ensure the SW controls the page and doesn't
+      // overwrite the cache entry in its install handler.
+      await new Promise(resolve => {
+        if (worker.state === 'activated') {
+          resolve();
+          return;
+        }
+        worker.addEventListener('statechange', () => {
+          if (worker.state === 'activated') resolve();
+        });
+      });
+
+      // Put a custom response for 'cache.html' that sends a message back.
+      const cache = await caches.open('v1');
+      await cache.put('cache.html', new Response(
+        '<html><body><script>window.parent.postMessage({type: "loaded_from_cache"}, "*");<\/script><\/body><\/html>',
+        {headers: {'Content-Type': 'text/html'}}
+      ));
+
+      window.parent.postMessage({type: 'registered'}, '*');
+    } catch (err) {
+      window.parent.postMessage({type: 'error', error: err.message}, '*');
+    }
+  }
+  setup();
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-mime-types.js b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-mime-types.js
new file mode 100644
index 000000000000..7a64cd91e411
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-mime-types.js
@@ -0,0 +1,122 @@
+// Registration tests that mostly verify the MIME type.
+//
+// This file tests every MIME type so it necessarily starts many service
+// workers, so it may be slow.
+function registration_tests_mime_types(register_method) {
+  promise_test(function(t) {
+      var script = 'resources/mime-type-worker.py';
+      var scope = 'resources/scope/no-mime-type-worker/';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Registration of no MIME type script should fail.');
+    }, 'Registering script with no MIME type');
+
+  promise_test(function(t) {
+      var script = 'resources/mime-type-worker.py?mime=text/plain';
+      var scope = 'resources/scope/bad-mime-type-worker/';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Registration of plain text script should fail.');
+    }, 'Registering script with bad MIME type');
+
+  // The top-level service worker script must have a JavaScript MIME type. A
+  // JSON MIME type is only valid for imported (non-top-level) modules, so
+  // registering a top-level script served as JSON must fail even when the body
+  // happens to be valid JavaScript.
+  const jsonMimeTypes = [
+    'application/json',
+    'text/json',
+    'application/manifest+json',
+  ];
+
+  for (const jsonMimeType of jsonMimeTypes) {
+    promise_test(function(t) {
+        // Encode the MIME type so characters such as '+' survive the query
+        // string instead of being decoded to a space by the server.
+        var script =
+            `resources/mime-type-worker.py?mime=${encodeURIComponent(jsonMimeType)}`;
+        // Use a scope unique to each MIME type so the registrations don't
+        // interfere with one another.
+        var scope = `resources/scope/json-mime-type-worker/${jsonMimeType}`;
+        return promise_rejects_dom(t,
+            'SecurityError',
+            register_method(script, {scope: scope}),
+            'Registration of JSON MIME type script should fail.');
+      }, `Registering script with JSON MIME type ${jsonMimeType}`);
+  }
+
+  /**
+   * ServiceWorkerContainer.register() should throw a TypeError, according to
+   * step 17.1 of https://w3c.github.io/ServiceWorker/#importscripts
+   *
+   * "[17] If an uncaught runtime script error occurs during the above step, then:
+   *  [17.1] Invoke Reject Job Promise with job and TypeError"
+   *
+   * (Where the "uncaught runtime script error" is thrown by an unsuccessful
+   * importScripts())
+   */
+  promise_test(function(t) {
+      var script = 'resources/import-mime-type-worker.py';
+      var scope = 'resources/scope/no-mime-type-worker/';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registration of no MIME type imported script should fail.');
+    }, 'Registering script that imports script with no MIME type');
+
+  promise_test(function(t) {
+      var script = 'resources/import-mime-type-worker.py?mime=text/plain';
+      var scope = 'resources/scope/bad-mime-type-worker/';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registration of plain text imported script should fail.');
+    }, 'Registering script that imports script with bad MIME type');
+
+  const validMimeTypes = [
+    'application/ecmascript',
+    'application/javascript',
+    'application/x-ecmascript',
+    'application/x-javascript',
+    'text/ecmascript',
+    'text/javascript',
+    'text/javascript1.0',
+    'text/javascript1.1',
+    'text/javascript1.2',
+    'text/javascript1.3',
+    'text/javascript1.4',
+    'text/javascript1.5',
+    'text/jscript',
+    'text/livescript',
+    'text/x-ecmascript',
+    'text/x-javascript'
+  ];
+
+  for (const validMimeType of validMimeTypes) {
+    promise_test(() => {
+      var script = `resources/mime-type-worker.py?mime=${validMimeType}`;
+      var scope = 'resources/scope/good-mime-type-worker/';
+
+      return register_method(script, {scope}).then(registration => {
+        assert_true(
+          registration instanceof ServiceWorkerRegistration,
+          'Successfully registered.');
+        return registration.unregister();
+      });
+    }, `Registering script with good MIME type ${validMimeType}`);
+
+    promise_test(() => {
+      var script = `resources/import-mime-type-worker.py?mime=${validMimeType}`;
+      var scope = 'resources/scope/good-mime-type-worker/';
+
+      return register_method(script, { scope }).then(registration => {
+        assert_true(
+          registration instanceof ServiceWorkerRegistration,
+          'Successfully registered.');
+        return registration.unregister();
+      });
+    }, `Registering script that imports script with good MIME type ${validMimeType}`);
+  }
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-scope.js b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-scope.js
new file mode 100644
index 000000000000..30c424b2b423
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-scope.js
@@ -0,0 +1,120 @@
+// Registration tests that mostly exercise the scope option.
+function registration_tests_scope(register_method) {
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = 'resources/scope%2fencoded-slash-in-scope';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'URL-encoded slash in the scope should be rejected.');
+    }, 'Scope including URL-encoded slash');
+
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = 'resources/scope%5cencoded-slash-in-scope';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'URL-encoded backslash in the scope should be rejected.');
+    }, 'Scope including URL-encoded backslash');
+
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = 'data:text/html,';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'scope URL scheme is not "http" or "https"');
+    }, 'Scope URL scheme is a data: URL');
+
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = new URL('resources', location).href.replace('https:', 'ftp:');
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'scope URL scheme is not "http" or "https"');
+    }, 'Scope URL scheme is an ftp: URL');
+
+  promise_test(function(t) {
+      // URL-encoded full-width 'scope'.
+      var name = '%ef%bd%93%ef%bd%83%ef%bd%8f%ef%bd%90%ef%bd%85';
+      var script = 'resources/empty-worker.js';
+      var scope = 'resources/' + name + '/escaped-multibyte-character-scope';
+      return register_method(script, {scope: scope})
+        .then(function(registration) {
+            assert_equals(
+              registration.scope,
+              normalizeURL(scope),
+              'URL-encoded multibyte characters should be available.');
+            return registration.unregister();
+          });
+    }, 'Scope including URL-encoded multibyte characters');
+
+  promise_test(function(t) {
+      // Non-URL-encoded full-width "scope".
+      var name = String.fromCodePoint(0xff53, 0xff43, 0xff4f, 0xff50, 0xff45);
+      var script = 'resources/empty-worker.js';
+      var scope = 'resources/' + name  + '/non-escaped-multibyte-character-scope';
+      return register_method(script, {scope: scope})
+        .then(function(registration) {
+            assert_equals(
+              registration.scope,
+              normalizeURL(scope),
+              'Non-URL-encoded multibyte characters should be available.');
+            return registration.unregister();
+          });
+    }, 'Scope including non-escaped multibyte characters');
+
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = 'resources/././scope/self-reference-in-scope';
+      return register_method(script, {scope: scope})
+        .then(function(registration) {
+            assert_equals(
+              registration.scope,
+              normalizeURL('resources/scope/self-reference-in-scope'),
+              'Scope including self-reference should be normalized.');
+            return registration.unregister();
+          });
+    }, 'Scope including self-reference');
+
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = 'resources/../resources/scope/parent-reference-in-scope';
+      return register_method(script, {scope: scope})
+        .then(function(registration) {
+            assert_equals(
+              registration.scope,
+              normalizeURL('resources/scope/parent-reference-in-scope'),
+              'Scope including parent-reference should be normalized.');
+            return registration.unregister();
+          });
+    }, 'Scope including parent-reference');
+
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = 'resources/scope////consecutive-slashes-in-scope';
+      return register_method(script, {scope: scope})
+        .then(function(registration) {
+            // Although consecutive slashes in the scope are not unified, the
+            // scope is under the script directory and registration should
+            // succeed.
+            assert_equals(
+              registration.scope,
+              normalizeURL(scope),
+              'Should successfully be registered.');
+            return registration.unregister();
+          })
+    }, 'Scope including consecutive slashes');
+
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = 'filesystem:' + normalizeURL('resources/scope/filesystem-scope-url');
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registering with the scope that has same-origin filesystem: URL ' +
+              'should fail with TypeError.');
+    }, 'Scope URL is same-origin filesystem: URL');
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-script-url.js b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-script-url.js
new file mode 100644
index 000000000000..55cbe6fa9594
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-script-url.js
@@ -0,0 +1,82 @@
+// Registration tests that mostly exercise the scriptURL parameter.
+function registration_tests_script_url(register_method) {
+  promise_test(function(t) {
+        var script = 'resources%2fempty-worker.js';
+        var scope = 'resources/scope/encoded-slash-in-script-url';
+        return promise_rejects_js(t,
+            TypeError,
+            register_method(script, {scope: scope}),
+            'URL-encoded slash in the script URL should be rejected.');
+      }, 'Script URL including URL-encoded slash');
+
+  promise_test(function(t) {
+      var script = 'resources%2Fempty-worker.js';
+      var scope = 'resources/scope/encoded-slash-in-script-url';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'URL-encoded slash in the script URL should be rejected.');
+    }, 'Script URL including uppercase URL-encoded slash');
+
+  promise_test(function(t) {
+      var script = 'resources%5cempty-worker.js';
+      var scope = 'resources/scope/encoded-slash-in-script-url';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'URL-encoded backslash in the script URL should be rejected.');
+    }, 'Script URL including URL-encoded backslash');
+
+  promise_test(function(t) {
+      var script = 'resources%5Cempty-worker.js';
+      var scope = 'resources/scope/encoded-slash-in-script-url';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'URL-encoded backslash in the script URL should be rejected.');
+    }, 'Script URL including uppercase URL-encoded backslash');
+
+  promise_test(function(t) {
+      var script = 'data:application/javascript,';
+      var scope = 'resources/scope/data-url-in-script-url';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Data URLs should not be registered as service workers.');
+    }, 'Script URL is a data URL');
+
+  promise_test(function(t) {
+      var script = 'data:application/javascript,';
+      var scope = new URL('resources/scope/data-url-in-script-url', location);
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Data URLs should not be registered as service workers.');
+    }, 'Script URL is a data URL and scope URL is not relative');
+
+  promise_test(function(t) {
+      var script = 'resources/././empty-worker.js';
+      var scope = 'resources/scope/parent-reference-in-script-url';
+      return register_method(script, {scope: scope})
+        .then(function(registration) {
+            assert_equals(
+              get_newest_worker(registration).scriptURL,
+              normalizeURL('resources/empty-worker.js'),
+              'Script URL including self-reference should be normalized.');
+            return registration.unregister();
+          });
+    }, 'Script URL including self-reference');
+
+  promise_test(function(t) {
+      var script = 'resources/../resources/empty-worker.js';
+      var scope = 'resources/scope/parent-reference-in-script-url';
+      return register_method(script, {scope: scope})
+        .then(function(registration) {
+            assert_equals(
+              get_newest_worker(registration).scriptURL,
+              normalizeURL('resources/empty-worker.js'),
+              'Script URL including parent-reference should be normalized.');
+            return registration.unregister();
+          });
+    }, 'Script URL including parent-reference');
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-script.js b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-script.js
new file mode 100644
index 000000000000..a74cab8e3ace
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-script.js
@@ -0,0 +1,121 @@
+// Registration tests that mostly exercise the service worker script contents or
+// response.
+function registration_tests_script(register_method, type) {
+  promise_test(function(t) {
+      var script = 'resources/invalid-chunked-encoding.py';
+      var scope = 'resources/scope/invalid-chunked-encoding/';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registration of invalid chunked encoding script should fail.');
+    }, 'Registering invalid chunked encoding script');
+
+  promise_test(function(t) {
+      var script = 'resources/invalid-chunked-encoding-with-flush.py';
+      var scope = 'resources/scope/invalid-chunked-encoding-with-flush/';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registration of invalid chunked encoding script should fail.');
+    }, 'Registering invalid chunked encoding script with flush');
+
+  promise_test(function(t) {
+      var script = 'resources/malformed-worker.py?parse-error';
+      var scope = 'resources/scope/parse-error';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registration of script including parse error should fail.');
+    }, 'Registering script including parse error');
+
+  promise_test(function(t) {
+      var script = 'resources/malformed-worker.py?undefined-error';
+      var scope = `resources/scope/undefined-error/${type}`;
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registration of script including undefined error should fail.');
+    }, `Registering script including undefined error: ${type}`);
+
+  promise_test(function(t) {
+      var script = 'resources/malformed-worker.py?uncaught-exception';
+      var scope = `resources/scope/uncaught-exception/${type}`;
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registration of script including uncaught exception should fail.');
+    }, `Registering script including uncaught exception: ${type}`);
+
+  if (type === 'classic') {
+    promise_test(function(t) {
+        var script = 'resources/malformed-worker.py?import-malformed-script';
+        var scope = 'resources/scope/import-malformed-script';
+        return promise_rejects_js(t,
+            TypeError,
+            register_method(script, {scope: scope}),
+            'Registration of script importing malformed script should fail.');
+      }, 'Registering script importing malformed script');
+  }
+
+  if (type === 'module') {
+    promise_test(function(t) {
+        var script = 'resources/malformed-worker.py?top-level-await';
+        var scope = 'resources/scope/top-level-await';
+        return promise_rejects_js(t,
+            TypeError,
+            register_method(script, {scope: scope}),
+            'Registration of script with top-level await should fail.');
+      }, 'Registering script with top-level await');
+
+    promise_test(function(t) {
+        var script = 'resources/malformed-worker.py?instantiation-error';
+        var scope = 'resources/scope/instantiation-error';
+        return promise_rejects_js(t,
+            TypeError,
+            register_method(script, {scope: scope}),
+            'Registration of script with module instantiation error should fail.');
+      }, 'Registering script with module instantiation error');
+
+    promise_test(function(t) {
+        var script = 'resources/malformed-worker.py?instantiation-error-and-top-level-await';
+        var scope = 'resources/scope/instantiation-error-and-top-level-await';
+        return promise_rejects_js(t,
+            TypeError,
+            register_method(script, {scope: scope}),
+            'Registration of script with module instantiation error and top-level await should fail.');
+      }, 'Registering script with module instantiation error and top-level await');
+  }
+
+  promise_test(function(t) {
+      var script = 'resources/no-such-worker.js';
+      var scope = 'resources/scope/no-such-worker';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registration of non-existent script should fail.');
+    }, 'Registering non-existent script');
+
+  if (type === 'classic') {
+    promise_test(function(t) {
+        var script = 'resources/malformed-worker.py?import-no-such-script';
+        var scope = 'resources/scope/import-no-such-script';
+        return promise_rejects_js(t,
+            TypeError,
+            register_method(script, {scope: scope}),
+            'Registration of script importing non-existent script should fail.');
+      }, 'Registering script importing non-existent script');
+  }
+
+  promise_test(function(t) {
+      var script = 'resources/malformed-worker.py?caught-exception';
+      var scope = 'resources/scope/caught-exception';
+      return register_method(script, {scope: scope})
+        .then(function(registration) {
+            assert_true(
+              registration instanceof ServiceWorkerRegistration,
+              'Successfully registered.');
+            return registration.unregister();
+          });
+    }, 'Registering script including caught exception');
+
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-security-error.js b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-security-error.js
new file mode 100644
index 000000000000..c45fbd45789a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-security-error.js
@@ -0,0 +1,78 @@
+// Registration tests that mostly exercise SecurityError cases.
+function registration_tests_security_error(register_method) {
+  promise_test(function(t) {
+      var script = 'resources/registration-worker.js';
+      var scope = 'resources';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Registering same scope as the script directory without the last ' +
+              'slash should fail with SecurityError.');
+    }, 'Registering same scope as the script directory without the last slash');
+
+  promise_test(function(t) {
+      var script = 'resources/registration-worker.js';
+      var scope = 'different-directory/';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Registration scope outside the script directory should fail ' +
+              'with SecurityError.');
+    }, 'Registration scope outside the script directory');
+
+  promise_test(function(t) {
+      var script = 'resources/registration-worker.js';
+      var scope = 'http://example.com/';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Registration scope outside domain should fail with SecurityError.');
+    }, 'Registering scope outside domain');
+
+  promise_test(function(t) {
+      var script = 'http://example.com/worker.js';
+      var scope = 'http://example.com/scope/';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Registration script outside domain should fail with SecurityError.');
+    }, 'Registering script outside domain');
+
+  promise_test(function(t) {
+      var script = 'resources/redirect.py?Redirect=' +
+                    encodeURIComponent('/resources/registration-worker.js');
+      var scope = 'resources/scope/redirect/';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Registration of redirected script should fail.');
+    }, 'Registering redirected script');
+
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = 'resources/../scope/parent-reference-in-scope';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Scope not under the script directory should be rejected.');
+    }, 'Scope including parent-reference and not under the script directory');
+
+  promise_test(function(t) {
+      var script = 'resources////empty-worker.js';
+      var scope = 'resources/scope/consecutive-slashes-in-script-url';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Consecutive slashes in the script url should not be unified.');
+    }, 'Script URL including consecutive slashes');
+
+  promise_test(function(t) {
+      var script = 'filesystem:' + normalizeURL('resources/empty-worker.js');
+      var scope = 'resources/scope/filesystem-script-url';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registering a script which has same-origin filesystem: URL should ' +
+              'fail with TypeError.');
+    }, 'Script URL is same-origin filesystem: URL');
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/registration-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/registration-worker.js
new file mode 100644
index 000000000000..44d1d2774a24
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/registration-worker.js
@@ -0,0 +1 @@
+// empty for now
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/reject-install-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/reject-install-worker.js
new file mode 100644
index 000000000000..41f07fd5db81
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/reject-install-worker.js
@@ -0,0 +1,3 @@
+self.oninstall = function(event) {
+  event.waitUntil(Promise.reject());
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/reply-to-message.html b/test/fixtures/wpt/service-workers/service-worker/resources/reply-to-message.html
new file mode 100644
index 000000000000..8a70e2ad933e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/reply-to-message.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<script>
+window.addEventListener('message', event => {
+    var port = event.ports[0];
+    port.postMessage(event.data);
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/request-end-to-end-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/request-end-to-end-worker.js
new file mode 100644
index 000000000000..6bd2b72137e5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/request-end-to-end-worker.js
@@ -0,0 +1,34 @@
+'use strict';
+
+onfetch = function(e) {
+  var headers = {};
+  for (var header of e.request.headers) {
+    var key = header[0], value = header[1];
+    headers[key] = value;
+  }
+  var append_header_error = '';
+  try {
+    e.request.headers.append('Test-Header', 'TestValue');
+  } catch (error) {
+    append_header_error = error.name;
+  }
+
+  var request_construct_error = '';
+  try {
+    new Request(e.request, {method: 'GET'});
+  } catch (error) {
+    request_construct_error = error.name;
+  }
+
+  e.respondWith(new Response(JSON.stringify({
+    url: e.request.url,
+    method: e.request.method,
+    referrer: e.request.referrer,
+    headers: headers,
+    mode: e.request.mode,
+    credentials: e.request.credentials,
+    redirect: e.request.redirect,
+    append_header_error: append_header_error,
+    request_construct_error: request_construct_error
+  })));
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/resource-timing-iframe.sub.html b/test/fixtures/wpt/service-workers/service-worker/resources/resource-timing-iframe.sub.html
new file mode 100644
index 000000000000..ec4c726331d6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/resource-timing-iframe.sub.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<script src="empty.js"></script>
+<script src="sample.js"></script>
+<script src="redirect.py?Redirect=empty.js"></script>
+<img src="square.png">
+<img src="https://{{hosts[alt][]}}:{{ports[https][0]}}/service-workers/service-worker/resources/square.png">
+<img src="missing.jpg">
+<img src="https://{{hosts[alt][]}}:{{ports[https][0]}}/service-workers/service-worker/resources/missing.asis">
+<img src='missing.jpg?SWRespondsWithFetch'>
+<script src='empty-worker.js'></script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/resource-timing-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/resource-timing-worker.js
new file mode 100644
index 000000000000..b74e8cd6a236
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/resource-timing-worker.js
@@ -0,0 +1,12 @@
+self.addEventListener('fetch', function(event) {
+  if (event.request.url.indexOf('sample.js') != -1) {
+    event.respondWith(new Promise(resolve => {
+      // Slightly delay the response so we ensure we get a non-zero
+      // duration.
+      setTimeout(_ => resolve(new Response('// Empty javascript')), 50);
+    }));
+  }
+  else if (event.request.url.indexOf('missing.jpg?SWRespondsWithFetch') != -1) {
+    event.respondWith(fetch('sample.txt?SWFetched'));
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/respond-then-throw-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/respond-then-throw-worker.js
new file mode 100644
index 000000000000..adb48de69e72
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/respond-then-throw-worker.js
@@ -0,0 +1,40 @@
+var syncport = null;
+
+self.addEventListener('message', function(e) {
+  if ('port' in e.data) {
+    if (syncport) {
+      syncport(e.data.port);
+    } else {
+      syncport = e.data.port;
+    }
+  }
+});
+
+function sync() {
+  return new Promise(function(resolve) {
+      if (syncport) {
+        resolve(syncport);
+      } else {
+        syncport = resolve;
+      }
+    }).then(function(port) {
+      port.postMessage('SYNC');
+      return new Promise(function(resolve) {
+          port.onmessage = function(e) {
+            if (e.data === 'ACK') {
+              resolve();
+            }
+          }
+        });
+    });
+}
+
+
+self.addEventListener('fetch', function(event) {
+    // In Firefox the result would depend on a race between fetch handling
+    // and exception handling code. On the assumption that this might be a common
+    // design error, we explicitly allow the exception to be handled first.
+    event.respondWith(sync().then(() => new Response('intercepted')));
+
+    throw("error");
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response-iframe.html
new file mode 100644
index 000000000000..7be314879499
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response-iframe.html
@@ -0,0 +1,20 @@
+<script>
+var callback;
+
+// Creates a <script> element with |url| source, and returns a promise for the
+// result of the executed script. Uses JSONP because some responses to |url|
+// are opaque so their body cannot be tested directly.
+function getJSONP(url) {
+  var sc = document.createElement('script');
+  sc.src = url;
+  var promise = new Promise(function(resolve, reject) {
+      // This callback function is called by appending a script element.
+      callback = resolve;
+      sc.addEventListener(
+          'error',
+          function() { reject('Failed to load url:' + url); });
+    });
+  document.body.appendChild(sc);
+  return promise;
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response-worker.js
new file mode 100644
index 000000000000..c602109bc683
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response-worker.js
@@ -0,0 +1,93 @@
+importScripts('/common/get-host-info.sub.js');
+importScripts('test-helpers.sub.js');
+
+function getQueryParams(url) {
+  var search = (new URL(url)).search;
+  if (!search) {
+    return {};
+  }
+  var ret = {};
+  var params = search.substring(1).split('&');
+  params.forEach(function(param) {
+      var element = param.split('=');
+      ret[decodeURIComponent(element[0])] = decodeURIComponent(element[1]);
+    });
+  return ret;
+}
+
+function createResponse(params) {
+  if (params['type'] == 'basic') {
+    return fetch('respond-with-body-accessed-response.jsonp');
+  }
+  if (params['type'] == 'opaque') {
+    return fetch(get_host_info()['HTTPS_REMOTE_ORIGIN'] + base_path() +
+          'respond-with-body-accessed-response.jsonp',
+          {mode: 'no-cors'});
+  }
+  if (params['type'] == 'default') {
+    return Promise.resolve(new Response('callback(\'OK\');'));
+  }
+
+  return Promise.reject(new Error('unexpected type :' + params['type']));
+}
+
+function cloneResponseIfNeeded(params, response) {
+  if (params['clone'] == '1') {
+    return response.clone();
+  } else if (params['clone'] == '2') {
+    response.clone();
+    return response;
+  }
+  return response;
+}
+
+function passThroughCacheIfNeeded(params, request, response) {
+  return new Promise(function(resolve) {
+      if (params['passThroughCache'] == 'true') {
+        var cache_name = request.url;
+        var cache;
+        self.caches.delete(cache_name)
+          .then(function() {
+              return self.caches.open(cache_name);
+            })
+          .then(function(c) {
+              cache = c;
+              return cache.put(request, response);
+            })
+          .then(function() {
+              return cache.match(request.url);
+            })
+          .then(function(res) {
+              // Touch .body here to test the behavior after touching it.
+              res.body;
+              resolve(res);
+            });
+      } else {
+        resolve(response);
+      }
+    })
+}
+
+self.addEventListener('fetch', function(event) {
+    if (event.request.url.indexOf('TestRequest') == -1) {
+      return;
+    }
+    var params = getQueryParams(event.request.url);
+    event.respondWith(
+        createResponse(params)
+          .then(function(response) {
+              // Touch .body here to test the behavior after touching it.
+              response.body;
+              return cloneResponseIfNeeded(params, response);
+            })
+          .then(function(response) {
+              // Touch .body here to test the behavior after touching it.
+              response.body;
+              return passThroughCacheIfNeeded(params, event.request, response);
+            })
+          .then(function(response) {
+              // Touch .body here to test the behavior after touching it.
+              response.body;
+              return response;
+            }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response.jsonp b/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response.jsonp
new file mode 100644
index 000000000000..b9c28f51f90a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response.jsonp
@@ -0,0 +1 @@
+callback('OK');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/router-rules.js b/test/fixtures/wpt/service-workers/service-worker/resources/router-rules.js
new file mode 100644
index 000000000000..27462b6c1d74
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/router-rules.js
@@ -0,0 +1,148 @@
+const TEST_CACHE_NAME = 'v1';
+// https://w3c.github.io/ServiceWorker/#check-router-registration-limit-algorithm
+const CONDITION_MAX_RECURSION_DEPTH = 10;
+const CONDITION_MAX_COUNT = 1024;
+
+const routerRules = {
+  'condition-urlpattern-constructed-source-network': [{
+    condition: {urlPattern: new URLPattern({pathname: '/**/direct.txt'})},
+    source: 'network'
+  }],
+  'condition-urlpattern-not-source-network': [{
+    condition: {not: {urlPattern: new URLPattern({pathname: '/**/not.txt'})}},
+    source: 'network'
+  }],
+  'condition-urlpattern-constructed-match-all-source-cache': [
+    {condition: {urlPattern: new URLPattern({})}, source: 'cache'},
+  ],
+  'condition-urlpattern-urlpatterncompatible-source-network': [
+    {condition: {urlPattern: {pathname: '/**/direct.txt'}}, source: 'network'},
+  ],
+  'condition-urlpattern-string-source-network': [
+    {condition: {urlPattern: '/**/direct.txt'}, source: 'network'},
+  ],
+  'condition-urlpattern-string-source-cache': [
+    {condition: {urlPattern: '/**/cache.txt'}, source: 'cache'},
+  ],
+  'condition-urlpattern-string-source-cache-with-name': [
+    {condition: {urlPattern: '/**/cache.txt'}, source: {cacheName: TEST_CACHE_NAME}},
+  ],
+  'condition-urlpattern-constructed-ignore-case-source-network': [{
+    condition: {
+      urlPattern:
+          new URLPattern({pathname: '/**/DiReCT.TxT'}, {ignoreCase: true})
+    },
+    source: 'network'
+  }],
+  'condition-urlpattern-constructed-respect-case-source-network': [{
+    condition: {urlPattern: new URLPattern({pathname: '/**/DiReCT.TxT'})},
+    source: 'network'
+  }],
+  'condition-request-source-network':
+      [{condition: {requestMode: 'no-cors'}, source: 'network'}],
+  'condition-request-navigate-source-cache':
+      [{condition: {requestMode: 'navigate'}, source: 'cache'}],
+  'condition-request-method-get-network':
+      [{condition: {requestMethod: 'GET'}, source: 'network'}],
+  'condition-request-method-post-network':
+      [{condition: {requestMethod: 'POST'}, source: 'network'}],
+  'condition-request-method-put-network':
+      [{condition: {requestMethod: 'PUT'}, source: 'network'}],
+  'condition-request-method-delete-network':
+      [{condition: {requestMethod: 'DELETE'}, source: 'network'}],
+  'condition-lack-of-condition': [{
+    source: 'network'
+  }],
+  'condition-lack-of-source': [{
+    condition: {requestMode: 'no-cors'},
+  }],
+  'condition-invalid-bytestring-request-method': [{
+    condition: {requestMethod: String.fromCodePoint(0x3042)},
+    source: 'network'
+  }],
+  'condition-invalid-http-request-method': [{
+    condition: {requestMethod: '(GET|POST)'},
+    source: 'network'
+  }],
+  'condition-forbidden-request-method': [{
+    condition: {requestMethod: 'connect'},
+    source: 'network'
+  }],
+  'condition-invalid-or-condition-depth': (() => {
+    const addOrCondition = (depth) => {
+      if (depth > CONDITION_MAX_RECURSION_DEPTH + 1) {
+        return {urlPattern: '/foo'};
+      }
+      return {
+        or: [addOrCondition(depth + 1)]
+      };
+    };
+    return {condition: addOrCondition(1), source: 'network'};
+  })(),
+  'condition-invalid-not-condition-depth': (() => {
+    const generateNotCondition = (depth) => {
+      if (depth > CONDITION_MAX_RECURSION_DEPTH + 1) {
+        return {
+          urlPattern: '/**/example.txt',
+        };
+      }
+      return {not: generateNotCondition(depth + 1)};
+    };
+    return {condition: generateNotCondition(1), source: 'network'};
+  })(),
+  'condition-invalid-router-size': [...Array(CONDITION_MAX_COUNT + 1)].map((val, i) => {
+    return {
+      condition: {urlPattern: `/foo-${i}`},
+      source: 'network'
+    };
+  }),
+  'condition-request-destination-script-network':
+      [{condition: {requestDestination: 'script'}, source: 'network'}],
+  'condition-or-source-network': [{
+    condition: {
+      or: [
+        {
+          or: [{urlPattern: '/**/or-test/direct1.*??*'}],
+        },
+        {urlPattern: '/**/or-test/direct2.*??*'}
+      ]
+    },
+    source: 'network'
+  }],
+  'condition-request-source-fetch-event':
+      [{condition: {requestMode: 'no-cors'}, source: 'fetch-event'}],
+  'condition-urlpattern-string-source-fetch-event':
+      [{condition: {urlPattern: '/**/*'}, source: 'fetch-event'}],
+  'multiple-router-rules': [
+    {
+      condition: {
+        urlPattern: '/**/direct.txt',
+      },
+      source: 'network'
+    },
+    {condition: {urlPattern: '/**/direct.html'}, source: 'network'}
+  ],
+  'condition-urlpattern-string-source-race-network-and-fetch-handler': [
+    {
+      condition: {urlPattern: '/**/direct.py'},
+      source: 'race-network-and-fetch-handler'
+    },
+  ],
+  'multiple-conditions-network': {
+    condition: {
+      urlPattern: new URLPattern({search: 'test'}),
+      requestMode: 'cors',
+      requestMethod: 'post',
+    },
+    source: 'network'
+  },
+  'multiple-conditions-with-destination-network' : {
+    condition: {
+      urlPattern: new URLPattern({search: 'test'}),
+      requestDestination: 'style'
+    },
+    source: 'network'
+  }
+};
+
+export {routerRules, TEST_CACHE_NAME as cacheName};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/sample-worker-interceptor.js b/test/fixtures/wpt/service-workers/service-worker/resources/sample-worker-interceptor.js
new file mode 100644
index 000000000000..c06f8dd77b79
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/sample-worker-interceptor.js
@@ -0,0 +1,62 @@
+importScripts('/common/get-host-info.sub.js');
+
+const text = 'worker loading intercepted by service worker';
+const dedicated_worker_script = `postMessage('${text}');`;
+const shared_worker_script =
+    `onconnect = evt => evt.ports[0].postMessage('${text}');`;
+
+let source;
+let resolveDone;
+let done = new Promise(resolve => resolveDone = resolve);
+
+// The page messages this worker to ask for the result. Keep the worker alive
+// via waitUntil() until the result is sent.
+self.addEventListener('message', event => {
+  source = event.data.port;
+  source.postMessage({id: event.source.id});
+  source.onmessage = resolveDone;
+  event.waitUntil(done);
+});
+
+self.onfetch = event => {
+  const url = event.request.url;
+  const destination = event.request.destination;
+
+  if (source)
+     source.postMessage({clientId:event.clientId, resultingClientId: event.resultingClientId});
+
+  // Request handler for a synthesized response.
+  if (url.indexOf('synthesized') != -1) {
+    let script_headers = new Headers({ "Content-Type": "text/javascript" });
+    if (destination === 'worker')
+      event.respondWith(new Response(dedicated_worker_script, { 'headers': script_headers }));
+    else if (destination === 'sharedworker')
+      event.respondWith(new Response(shared_worker_script, { 'headers': script_headers }));
+    else
+      event.respondWith(new Response('Unexpected request! ' + destination));
+    return;
+  }
+
+  // Request handler for a same-origin response.
+  if (url.indexOf('same-origin') != -1) {
+    event.respondWith(fetch('postmessage-on-load-worker.js'));
+    return;
+  }
+
+  // Request handler for a cross-origin response.
+  if (url.indexOf('cors') != -1) {
+    const filename = 'postmessage-on-load-worker.js';
+    const path = (new URL(filename, self.location)).pathname;
+    let new_url = get_host_info()['HTTPS_REMOTE_ORIGIN'] + path;
+    let mode;
+    if (url.indexOf('no-cors') != -1) {
+      // Test no-cors mode.
+      mode = 'no-cors';
+    } else {
+      // Test cors mode.
+      new_url += '?pipe=header(Access-Control-Allow-Origin,*)';
+      mode = 'cors';
+    }
+    event.respondWith(fetch(new_url, { mode: mode }));
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/sample.html b/test/fixtures/wpt/service-workers/service-worker/resources/sample.html
new file mode 100644
index 000000000000..12a179980df2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/sample.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<body>Hello world
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/sample.js b/test/fixtures/wpt/service-workers/service-worker/resources/sample.js
new file mode 100644
index 000000000000..b8889db05d08
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/sample.js
@@ -0,0 +1 @@
+var hello = "world";
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/sample.txt b/test/fixtures/wpt/service-workers/service-worker/resources/sample.txt
new file mode 100644
index 000000000000..802992c4220d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/sample.txt
@@ -0,0 +1 @@
+Hello world
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-fetch-event-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-fetch-event-iframe.html
new file mode 100644
index 000000000000..239fa7330371
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-fetch-event-iframe.html
@@ -0,0 +1,63 @@
+<script>
+function with_iframe(url) {
+  return new Promise(resolve => {
+    let frame = document.createElement('iframe');
+    frame.src = url;
+    frame.onload = () => { resolve(frame); };
+    document.body.appendChild(frame);
+  });
+}
+
+function with_sandboxed_iframe(url, sandbox) {
+  return new Promise(resolve => {
+    let frame = document.createElement('iframe');
+    frame.sandbox = sandbox;
+    frame.src = url;
+    frame.onload = () => { resolve(frame); };
+    document.body.appendChild(frame);
+  });
+}
+
+function fetch_from_worker(url) {
+  return new Promise(resolve => {
+    let blob = new Blob([
+      `fetch('${url}', {mode: 'no-cors'})` +
+      "  .then(() => { self.postMessage('OK'); });"]);
+    let worker_url = URL.createObjectURL(blob);
+    let worker = new Worker(worker_url);
+    worker.onmessage = resolve;
+  });
+}
+
+function run_test(type) {
+  const base_path = location.href;
+  switch (type) {
+    case 'fetch':
+      return fetch(`${base_path}&test=fetch`, {mode: 'no-cors'});
+    case 'fetch-from-worker':
+      return fetch_from_worker(`${base_path}&test=fetch-from-worker`);
+    case 'iframe':
+      return with_iframe(`${base_path}&test=iframe`);
+    case 'sandboxed-iframe':
+      return with_sandboxed_iframe(`${base_path}&test=sandboxed-iframe`,
+                                   "allow-scripts");
+    case 'sandboxed-iframe-same-origin':
+      return with_sandboxed_iframe(
+        `${base_path}&test=sandboxed-iframe-same-origin`,
+        "allow-scripts allow-same-origin");
+    default:
+      return Promise.reject(`Unknown type: ${type}`);
+  }
+}
+
+window.onmessage = event => {
+  let id = event.data['id'];
+  run_test(event.data['type'])
+    .then(() => {
+      window.top.postMessage({id: id, result: 'done'}, '*');
+    })
+    .catch(e => {
+      window.top.postMessage({id: id, result: 'error: ' + e.toString()}, '*');
+    });
+};
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-fetch-event-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-fetch-event-worker.js
new file mode 100644
index 000000000000..4035a8b19b90
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-fetch-event-worker.js
@@ -0,0 +1,20 @@
+var requests = [];
+
+self.addEventListener('message', function(event) {
+    event.waitUntil(self.clients.matchAll()
+      .then(function(clients) {
+          var client_urls = [];
+          for(var client of clients){
+            client_urls.push(client.url);
+          }
+          client_urls = client_urls.sort();
+          event.data.port.postMessage(
+              {clients: client_urls, requests: requests});
+          requests = [];
+        }));
+  });
+
+self.addEventListener('fetch', function(event) {
+    requests.push(event.request.url);
+    event.respondWith(fetch(event.request));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-navigator-serviceworker-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-navigator-serviceworker-iframe.html
new file mode 100644
index 000000000000..1d682e47ef5e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-navigator-serviceworker-iframe.html
@@ -0,0 +1,25 @@
+<script>
+window.onmessage = function(e) {
+  const id = e.data['id'];
+  try {
+    var sw = window.navigator.serviceWorker;
+  } catch (e) {
+    window.top.postMessage({
+        id: id,
+        result: 'navigator.serviceWorker failed: ' + e.name
+      }, '*');
+    return;
+  }
+
+  window.navigator.serviceWorker.getRegistration()
+    .then(function() {
+        window.top.postMessage({id: id, result:'ok'}, '*');
+      })
+    .catch(function(e) {
+        window.top.postMessage({
+            id: id,
+            result: 'getRegistration() failed: ' + e.name
+          }, '*');
+        });
+};
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/scope1/module-worker-importing-redirect-to-scope2.js b/test/fixtures/wpt/service-workers/service-worker/resources/scope1/module-worker-importing-redirect-to-scope2.js
new file mode 100644
index 000000000000..ae681ba30e0b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/scope1/module-worker-importing-redirect-to-scope2.js
@@ -0,0 +1 @@
+import * as module from './redirect.py?Redirect=/service-workers/service-worker/resources/scope2/imported-module-script.js';
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/scope1/module-worker-importing-scope2.js b/test/fixtures/wpt/service-workers/service-worker/resources/scope1/module-worker-importing-scope2.js
new file mode 100644
index 000000000000..e28505249c28
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/scope1/module-worker-importing-scope2.js
@@ -0,0 +1 @@
+import * as module from '../scope2/imported-module-script.js';
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/scope2/imported-module-script.js b/test/fixtures/wpt/service-workers/service-worker/resources/scope2/imported-module-script.js
new file mode 100644
index 000000000000..a18e704a3c58
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/scope2/imported-module-script.js
@@ -0,0 +1,4 @@
+export const imported = 'A module script.';
+onmessage = msg => {
+    msg.source.postMessage('pong');
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/scope2/simple.txt b/test/fixtures/wpt/service-workers/service-worker/resources/scope2/simple.txt
new file mode 100644
index 000000000000..cd876676e85e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/scope2/simple.txt
@@ -0,0 +1 @@
+a simple text file (scope2/)
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/secure-context-service-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/secure-context-service-worker.js
new file mode 100644
index 000000000000..5ba99f075362
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/secure-context-service-worker.js
@@ -0,0 +1,21 @@
+self.addEventListener('fetch', event => {
+    let url = new URL(event.request.url);
+    if (url.pathname.indexOf('sender.html') != -1) {
+        event.respondWith(new Response(
+            "<script>window.parent.postMessage('interception', '*');</script>",
+            { headers: { 'Content-Type': 'text/html'} }
+        ));
+    } else if (url.pathname.indexOf('report') != -1) {
+        self.clients.matchAll().then(clients => {
+            for (client of clients) {
+                client.postMessage(url.searchParams.get('result'));
+            }
+        });
+        event.respondWith(
+            new Response(
+                '<script>window.close()</script>',
+                { headers: { 'Content-Type': 'text/html'} }
+            )
+        );
+    }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/secure-context/sender.html b/test/fixtures/wpt/service-workers/service-worker/resources/secure-context/sender.html
new file mode 100644
index 000000000000..05e58822a862
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/secure-context/sender.html
@@ -0,0 +1 @@
+<script>window.parent.postMessage('network', '*');</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/secure-context/window.html b/test/fixtures/wpt/service-workers/service-worker/resources/secure-context/window.html
new file mode 100644
index 000000000000..071a507cb33e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/secure-context/window.html
@@ -0,0 +1,15 @@
+<body>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="../test-helpers.sub.js"></script>
+<script>
+const HTTPS_PREFIX = get_host_info().HTTPS_ORIGIN + base_path();
+
+window.onmessage = event => {
+    window.location = HTTPS_PREFIX + 'report?result=' + event.data;
+};
+
+const frame = document.createElement('iframe');
+frame.src = HTTPS_PREFIX + 'sender.html';
+document.body.appendChild(frame);
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-dynamic-import-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-dynamic-import-worker.js
new file mode 100644
index 000000000000..680e07ff588c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-dynamic-import-worker.js
@@ -0,0 +1 @@
+import('./service-worker-interception-network-worker.js');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-network-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-network-worker.js
new file mode 100644
index 000000000000..5ff390010134
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-network-worker.js
@@ -0,0 +1 @@
+postMessage('LOADED_FROM_NETWORK');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-service-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-service-worker.js
new file mode 100644
index 000000000000..6b43a3769637
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-service-worker.js
@@ -0,0 +1,9 @@
+const kURL = '/service-worker-interception-network-worker.js';
+const kScript = 'postMessage("LOADED_FROM_SERVICE_WORKER")';
+const kHeaders = [['content-type', 'text/javascript']];
+
+self.addEventListener('fetch', e => {
+  // Serve a generated response for kURL.
+  if (e.request.url.indexOf(kURL) != -1)
+    e.respondWith(new Response(kScript, { headers: kHeaders }));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-static-import-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-static-import-worker.js
new file mode 100644
index 000000000000..e570958701db
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-static-import-worker.js
@@ -0,0 +1 @@
+import './service-worker-interception-network-worker.js';
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/silence.oga b/test/fixtures/wpt/service-workers/service-worker/resources/silence.oga
new file mode 100644
index 000000000000..af591880436a
Binary files /dev/null and b/test/fixtures/wpt/service-workers/service-worker/resources/silence.oga differ
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/simple-intercept-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/simple-intercept-worker.js
new file mode 100644
index 000000000000..f8b5f8c5cb77
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/simple-intercept-worker.js
@@ -0,0 +1,5 @@
+self.onfetch = function(event) {
+  if (event.request.url.indexOf('simple') != -1)
+    event.respondWith(
+      new Response(new Blob(['intercepted by service worker'])));
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/simple-intercept-worker.js.headers b/test/fixtures/wpt/service-workers/service-worker/resources/simple-intercept-worker.js.headers
new file mode 100644
index 000000000000..a17a9a3a12ce
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/simple-intercept-worker.js.headers
@@ -0,0 +1 @@
+Content-Type: application/javascript
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/simple-test-for-condition-main-resource.html b/test/fixtures/wpt/service-workers/service-worker/resources/simple-test-for-condition-main-resource.html
new file mode 100644
index 000000000000..0c3e3e78707b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/simple-test-for-condition-main-resource.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<title>Simple</title>
+Here's a simple html file.
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/simple.csv b/test/fixtures/wpt/service-workers/service-worker/resources/simple.csv
new file mode 100644
index 000000000000..ecbef786e738
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/simple.csv
@@ -0,0 +1 @@
+matched,with,non-url,conditions
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/simple.html b/test/fixtures/wpt/service-workers/service-worker/resources/simple.html
new file mode 100644
index 000000000000..0c3e3e78707b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/simple.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<title>Simple</title>
+Here's a simple html file.
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/simple.txt b/test/fixtures/wpt/service-workers/service-worker/resources/simple.txt
new file mode 100644
index 000000000000..9e3cb91fb9b9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/simple.txt
@@ -0,0 +1 @@
+a simple text file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/skip-waiting-installed-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/skip-waiting-installed-worker.js
new file mode 100644
index 000000000000..6f7008bddcdf
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/skip-waiting-installed-worker.js
@@ -0,0 +1,33 @@
+var saw_activate_event = false
+
+self.addEventListener('activate', function() {
+    saw_activate_event = true;
+  });
+
+self.addEventListener('message', function(event) {
+    var port = event.data.port;
+    event.waitUntil(self.skipWaiting()
+      .then(function(result) {
+          if (result !== undefined) {
+            port.postMessage('FAIL: Promise should be resolved with undefined');
+            return;
+          }
+
+          if (!saw_activate_event) {
+            port.postMessage(
+                'FAIL: Promise should be resolved after activate event is dispatched');
+            return;
+          }
+
+          if (self.registration.active.state !== 'activating') {
+            port.postMessage(
+                'FAIL: Promise should be resolved before ServiceWorker#state is set to activated');
+            return;
+          }
+
+          port.postMessage('PASS');
+        })
+      .catch(function(e) {
+          port.postMessage('FAIL: unexpected exception: ' + e);
+        }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/skip-waiting-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/skip-waiting-worker.js
new file mode 100644
index 000000000000..3fc1d1e237aa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/skip-waiting-worker.js
@@ -0,0 +1,21 @@
+importScripts('worker-testharness.js');
+
+promise_test(function() {
+    return skipWaiting()
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Promise should be resolved with undefined');
+        })
+      .then(function() {
+          var promises = [];
+          for (var i = 0; i < 8; ++i)
+            promises.push(self.skipWaiting());
+          return Promise.all(promises);
+        })
+      .then(function(results) {
+          results.forEach(function(r) {
+              assert_equals(r, undefined,
+                            'Promises should be resolved with undefined');
+            });
+        });
+  }, 'skipWaiting');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/square.png b/test/fixtures/wpt/service-workers/service-worker/resources/square.png
new file mode 100644
index 000000000000..01c9666a8de9
Binary files /dev/null and b/test/fixtures/wpt/service-workers/service-worker/resources/square.png differ
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/square.png.sub.headers b/test/fixtures/wpt/service-workers/service-worker/resources/square.png.sub.headers
new file mode 100644
index 000000000000..7341132745be
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/square.png.sub.headers
@@ -0,0 +1,2 @@
+Content-Type: image/png
+Access-Control-Allow-Origin: *
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/srcdoc-iframe-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/srcdoc-iframe-worker.js
new file mode 100644
index 000000000000..548116c89ea8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/srcdoc-iframe-worker.js
@@ -0,0 +1,11 @@
+self.addEventListener('message', event => {
+  event.source.postMessage('passed');
+});
+
+self.addEventListener('fetch', event => {
+  let url = new URL(event.request.url);
+  if (!url.searchParams.get('test_resource')) {
+    return;
+  }
+  event.respondWith(new Response('passed'));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/srcdoc-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/srcdoc-iframe.html
new file mode 100644
index 000000000000..6407845c5adf
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/srcdoc-iframe.html
@@ -0,0 +1,92 @@
+<!doctype html>
+<html>
+<body>
+<iframe id="srcdocFrame" srcdoc="
+<script>
+  function reportTestResult(result) {
+    top.postMessage({ type: 'TEST_RESULT', result: result }, '*');
+  }
+
+  async function postMessageToController() {
+    let controller = navigator.serviceWorker.controller;
+    if (!controller) {
+      reportTestResult('no navigator.serviceWorker.controller');
+    }
+    try {
+      controller.postMessage('test');
+    } catch (e) {
+      reportTestResult('Unexpected Error ' + e.name + ' : ' + e.message);
+    }
+  }
+
+  async function getServiceWorkerRegistration(scope) {
+    try {
+      let reg = await navigator.serviceWorker.getRegistration(scope);
+      if (!reg) {
+        reportTestResult('no regsitration for ' + scope);
+      }
+      if (reg.scope !==  scope) {
+        reportTestResult('regsitration scope does not match');
+      }
+
+      if (!reg.active) {
+        reportTestResult('regsitration.active is not valid' + reg.active);
+      }
+      reportTestResult('passed');
+    } catch (e) {
+      reportTestResult('Unexpected Error ' + e.name + ' : ' + e.message);
+    }
+  }
+
+  function addSrcdocIframeWithSandbox(sandbox) {
+    let frame = document.createElement('iframe');
+    frame.sandbox = sandbox;
+    frame.srcdoc = `
+    <script>
+      function reportTestResult(result) {
+        top.postMessage({ type: 'TEST_RESULT', result: result }, '*');
+      }
+
+      window.onload = function onLoad() {
+        try {
+          let controller = navigator.serviceWorker.controller;
+          reportTestResult(controller ? 'HasController' : 'NoController');
+        } catch (e) {
+          reportTestResult((e.name == 'SecurityError') ?
+              'NoController' : 'UnexpectedError:' + e.message);
+        }
+      }
+    <\/script>`;
+    document.body.appendChild(frame);
+  }
+
+  function addSandboxedSrcdocFrame() {
+    addSrcdocIframeWithSandbox('allow-scripts');
+  }
+
+  function addSameOriginSandboxedSrcdocFrame() {
+    addSrcdocIframeWithSandbox('allow-scripts allow-same-origin');
+  }
+
+  async function fetchResource() {
+    let response = await fetch('?test_resource=1');
+    reportTestResult(await response.text());
+  }
+
+  window.navigator.serviceWorker.addEventListener(
+      'message', function onMsg(evt) {
+    // Forward the message as test result.
+    reportTestResult(evt.data);
+  });
+</script>
+"></iframe>
+
+<script>
+// Helper routine to make it slightly easier for our parent to find
+// the srcdoc frame.
+function srcdocFrame() {
+  return document.getElementById('srcdocFrame').contentWindow;
+}
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/stalling-service-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/stalling-service-worker.js
new file mode 100644
index 000000000000..fdf1e6cac04e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/stalling-service-worker.js
@@ -0,0 +1,54 @@
+async function post_message_to_client(role, message, ports) {
+    (await clients.matchAll()).forEach(client => {
+        if (new URL(client.url).searchParams.get('role') === role) {
+            client.postMessage(message, ports);
+        }
+    });
+}
+
+async function post_message_to_child(message, ports) {
+    await post_message_to_client('child', message, ports);
+}
+
+function ping_message(data) {
+    return { type: 'ping', data };
+}
+
+self.onmessage = event => {
+    const message = ping_message(event.data);
+    post_message_to_child(message);
+    post_message_to_parent(message);
+}
+
+async function post_message_to_parent(message, ports) {
+    await post_message_to_client('parent', message, ports);
+}
+
+function fetch_message(key) {
+    return { type: 'fetch', key };
+}
+
+// Send a message to the parent along with a MessagePort to respond
+// with.
+function report_fetch_request(key) {
+    const channel = new MessageChannel();
+    const reply = new Promise(resolve => {
+        channel.port1.onmessage = resolve;
+    }).then(event => event.data);
+    return post_message_to_parent(fetch_message(key), [channel.port2]).then(() => reply);
+}
+
+function respond_with_script(script) {
+    return new Response(new Blob(script, { type: 'text/javascript' }));
+}
+
+// Whenever a controlled document requests a URL with a 'key' search
+// parameter we report the request to the parent frame and wait for
+// a response. The content of the response is then used to respond to
+// the fetch request.
+addEventListener('fetch', event => {
+    let key = new URL(event.request.url).searchParams.get('key');
+    if (key) {
+        event.respondWith(report_fetch_request(key).then(respond_with_script));
+    }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/static-router-helpers.sub.js b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-helpers.sub.js
new file mode 100644
index 000000000000..0ab1f1fae1dd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-helpers.sub.js
@@ -0,0 +1,82 @@
+// Helper functions for ServiceWorker static routing API.
+//
+// test-helpers.sub.js must be loaded before using this.
+
+// Get a dictionary of information recorded inside ServiceWorker.
+// It includes:
+// - request URL and mode.
+// - errors.
+//
+// See: static-router-sw.js for details.
+const get_info_from_worker =
+    async worker => {
+  const promise = new Promise(function(resolve) {
+      var channel = new MessageChannel();
+      channel.port1.onmessage = function(msg) { resolve(msg); };
+      worker.postMessage({port: channel.port2}, [channel.port2]);
+    });
+  const message = await promise;
+
+  return message.data;
+}
+
+// Reset information stored inside ServiceWorker.
+const reset_info_in_worker =
+    async worker => {
+  const promise = new Promise(function(resolve) {
+      var channel = new MessageChannel();
+      channel.port1.onmessage = function(msg) { resolve(msg); };
+      worker.postMessage({port: channel.port2, reset: true}, [channel.port2]);
+    });
+  await promise;
+}
+
+// This script's directory name. It is used for specifying test files.
+const scriptDir = document.currentScript.src.match(/.*\//)[0];
+
+// Register the ServiceWorker and wait until activated.
+// {ruleKey} represents the key of routerRules defined in router-rules.js.
+// {swScript} represents the service worker source URL.
+// {swScope} represents the service worker resource scope.
+const registerAndActivate = async (test, ruleKey, swScript, swScope) => {
+  if (!swScript) {
+    swScript = scriptDir + 'static-router-sw.js'
+  }
+  if (!swScope) {
+    swScope = scriptDir;
+  }
+  const swURL = `${swScript}?key=${ruleKey}`;
+  const reg = await service_worker_unregister_and_register(
+    test, swURL, swScope, { type: 'module' });
+  add_completion_callback(() => reg.unregister());
+  const worker = reg.installing;
+  await wait_for_state(test, worker, 'activated');
+
+  return worker;
+};
+
+// Create iframe with the given url. This automatically removes the iframe in a
+// cleanup.
+const createIframe = async (t, url) => {
+  const iframe = await with_iframe(url);
+  t.add_cleanup(() => iframe.remove());
+
+  return iframe;
+};
+
+// Register a service worker, then create an iframe at url.
+function iframeTest(url, ruleKey, callback, name) {
+  return promise_test(async t => {
+    const worker = await registerAndActivate(t, ruleKey);
+    const iframe = await createIframe(t, url);
+    await callback(t, iframe.contentWindow, worker);
+  }, name);
+};
+
+function randomString() {
+  let result = "";
+  for (let i = 0; i < 5; i++) {
+    result += String.fromCharCode(97 + Math.floor(Math.random() * 26));
+  }
+  return result;
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/static-router-no-fetch-handler-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-no-fetch-handler-sw.js
new file mode 100644
index 000000000000..1ba5fd7d463b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-no-fetch-handler-sw.js
@@ -0,0 +1,35 @@
+'use strict';
+
+import {routerRules} from './router-rules.js';
+import {
+  recordError,
+  getRecords,
+  resetRecords } from './static-router-sw.sub.js';
+
+self.addEventListener('install', async e => {
+  e.waitUntil(caches.open('v1').then(
+      cache => {cache.put('cache.txt', new Response('From cache'))}));
+
+  const params = new URLSearchParams(location.search);
+  const key = params.get('key');
+  try {
+    await e.addRoutes(routerRules[key]);
+  } catch (e) {
+    recordError(e);
+  }
+  self.skipWaiting();
+});
+
+self.addEventListener('activate', e => {
+  e.waitUntil(clients.claim());
+});
+
+self.addEventListener('message', function(event) {
+  if (event.data.reset) {
+    resetRecords();
+  }
+  if (event.data.port) {
+    const {requests, errors} = getRecords();
+    event.data.port.postMessage({requests, errors});
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/static-router-race-network-and-fetch-handler-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-race-network-and-fetch-handler-sw.js
new file mode 100644
index 000000000000..904ff0f46d8f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-race-network-and-fetch-handler-sw.js
@@ -0,0 +1,62 @@
+'use strict';
+
+import {routerRules} from './router-rules.js';
+import {
+  recordRequest,
+  recordError,
+  getRecords,
+  resetRecords } from './static-router-sw.sub.js';
+
+import './imported-sw.js';
+
+self.addEventListener('install', async e => {
+  e.waitUntil(caches.open('v1').then(
+      cache => {cache.put('cache.txt', new Response('From cache'))}));
+
+  const params = new URLSearchParams(location.search);
+  const key = params.get('key');
+  try {
+    await e.addRoutes(routerRules[key]);
+  } catch (e) {
+    recordError(e);
+  }
+  self.skipWaiting();
+});
+
+self.addEventListener('activate', e => {
+  e.waitUntil(clients.claim());
+});
+
+self.addEventListener('fetch', async function(event) {
+  try {
+    recordRequest(event.request);
+    const url = new URL(event.request.url);
+    // Force slow response
+    if (url.searchParams.has('sw_slow')) {
+      const start = Date.now();
+      while (true) {
+        if (Date.now() - start > 200) {
+          break;
+        }
+      }
+    }
+    const nonce = url.searchParams.get('nonce');
+    event.respondWith(new Response(nonce));
+    // Call `fetch(e.request)` but it's not consumed.
+    if (url.searchParams.has('call_fetch')) {
+      await fetch(event.request);
+    }
+  } catch (e) {
+    recordError(e)
+  }
+});
+
+self.addEventListener('message', function(event) {
+  if (event.data.reset) {
+    resetRecords();
+  }
+  if (event.data.port) {
+    const {requests, errors} = getRecords();
+    event.data.port.postMessage({requests, errors});
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/static-router-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-sw.js
new file mode 100644
index 000000000000..c0bd683f9182
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-sw.js
@@ -0,0 +1,45 @@
+'use strict';
+
+import {routerRules, cacheName} from './router-rules.js';
+import {
+  recordRequest,
+  recordError,
+  getRecords,
+  resetRecords } from './static-router-sw.sub.js';
+
+import './imported-sw.js';
+
+self.addEventListener('install', async e => {
+  e.waitUntil(caches.open(cacheName).then(
+      cache => {cache.put('cache.txt', new Response('From cache'))}));
+
+  const params = new URLSearchParams(location.search);
+  const key = params.get('key');
+  try {
+    await e.addRoutes(routerRules[key]);
+  } catch (e) {
+    recordError(e);
+  }
+  self.skipWaiting();
+});
+
+self.addEventListener('activate', e => {
+  e.waitUntil(clients.claim());
+});
+
+self.addEventListener('fetch', function(event) {
+  recordRequest(event.request);
+  const url = new URL(event.request.url);
+  const nonce = url.searchParams.get('nonce');
+  event.respondWith(new Response(nonce));
+});
+
+self.addEventListener('message', function(event) {
+  if (event.data.reset) {
+    resetRecords();
+  }
+  if (event.data.port) {
+    const {requests, errors} = getRecords();
+    event.data.port.postMessage({requests, errors});
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/static-router-sw.sub.js b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-sw.sub.js
new file mode 100644
index 000000000000..04f9c5533a48
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-sw.sub.js
@@ -0,0 +1,29 @@
+let requests = [];
+let errors = [];
+
+const recordRequest = req => {
+  requests.push({url: req.url, mode: req.mode, destination: req.destination});
+};
+
+const recordError = (error) => {
+  errors.push(error);
+};
+
+const getRecords = () => {
+  return {
+    requests,
+    errors
+  };
+}
+
+const resetRecords = () => {
+  requests = [];
+  errors = [];
+}
+
+export {
+  recordRequest,
+  recordError,
+  getRecords,
+  resetRecords
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/subdir/blank.html b/test/fixtures/wpt/service-workers/service-worker/resources/subdir/blank.html
new file mode 100644
index 000000000000..a3c3a4689a62
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/subdir/blank.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<title>Empty doc</title>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/subdir/simple.txt b/test/fixtures/wpt/service-workers/service-worker/resources/subdir/simple.txt
new file mode 100644
index 000000000000..86bcdd7dc56f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/subdir/simple.txt
@@ -0,0 +1 @@
+a simple text file (subdir/)
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-001-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-001-frame.html
new file mode 100644
index 000000000000..59fb524049d8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-001-frame.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<img src="/images/green.svg">
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-001.html b/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-001.html
new file mode 100644
index 000000000000..9a93d3b37047
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-001.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Green svg box reference file</title>
+<p>Pass if you see a green box below.</p>
+<iframe src="svg-target-reftest-001-frame.html">
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-frame.html
new file mode 100644
index 000000000000..d6fc820f7834
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-frame.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<img src="/images/colors.svg#green">
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/test-helpers.sub.js b/test/fixtures/wpt/service-workers/service-worker/resources/test-helpers.sub.js
new file mode 100644
index 000000000000..74301523e735
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/test-helpers.sub.js
@@ -0,0 +1,300 @@
+// Adapter for testharness.js-style tests with Service Workers
+
+/**
+ * @param options an object that represents RegistrationOptions except for scope.
+ * @param options.type a WorkerType.
+ * @param options.updateViaCache a ServiceWorkerUpdateViaCache.
+ * @see https://w3c.github.io/ServiceWorker/#dictdef-registrationoptions
+ */
+function service_worker_unregister_and_register(test, url, scope, options) {
+  if (!scope || scope.length == 0)
+    return Promise.reject(new Error('tests must define a scope'));
+
+  if (options && options.scope)
+    return Promise.reject(new Error('scope must not be passed in options'));
+
+  options = Object.assign({ scope: scope }, options);
+  return service_worker_unregister(test, scope)
+    .then(function() {
+        return navigator.serviceWorker.register(url, options);
+      })
+    .catch(unreached_rejection(test,
+                               'unregister and register should not fail'));
+}
+
+// This unregisters the registration that precisely matches scope. Use this
+// when unregistering by scope. If no registration is found, it just resolves.
+function service_worker_unregister(test, scope) {
+  var absoluteScope = (new URL(scope, window.location).href);
+  return navigator.serviceWorker.getRegistration(scope)
+    .then(function(registration) {
+        if (registration && registration.scope === absoluteScope)
+          return registration.unregister();
+      })
+    .catch(unreached_rejection(test, 'unregister should not fail'));
+}
+
+function service_worker_unregister_and_done(test, scope) {
+  return service_worker_unregister(test, scope)
+    .then(test.done.bind(test));
+}
+
+function unreached_fulfillment(test, prefix) {
+  return test.step_func(function(result) {
+      var error_prefix = prefix || 'unexpected fulfillment';
+      assert_unreached(error_prefix + ': ' + result);
+    });
+}
+
+// Rejection-specific helper that provides more details
+function unreached_rejection(test, prefix) {
+  return test.step_func(function(error) {
+      var reason = error.message || error.name || error;
+      var error_prefix = prefix || 'unexpected rejection';
+      assert_unreached(error_prefix + ': ' + reason);
+    });
+}
+
+/**
+ * Adds an iframe to the document and returns a promise that resolves to the
+ * iframe when it finishes loading. The caller is responsible for removing the
+ * iframe later if needed.
+ *
+ * @param {string} url
+ * @returns {HTMLIFrameElement}
+ */
+function with_iframe(url) {
+  return new Promise(function(resolve) {
+      var frame = document.createElement('iframe');
+      frame.className = 'test-iframe';
+      frame.src = url;
+      frame.onload = function() { resolve(frame); };
+      document.body.appendChild(frame);
+    });
+}
+
+function normalizeURL(url) {
+  return new URL(url, self.location).toString().replace(/#.*$/, '');
+}
+
+function wait_for_update(test, registration) {
+  if (!registration || registration.unregister == undefined) {
+    return Promise.reject(new Error(
+      'wait_for_update must be passed a ServiceWorkerRegistration'));
+  }
+
+  return new Promise(test.step_func(function(resolve) {
+      var handler = test.step_func(function() {
+        registration.removeEventListener('updatefound', handler);
+        resolve(registration.installing);
+      });
+      registration.addEventListener('updatefound', handler);
+    }));
+}
+
+// Return true if |state_a| is more advanced than |state_b|.
+function is_state_advanced(state_a, state_b) {
+  if (state_b === 'installing') {
+    switch (state_a) {
+      case 'installed':
+      case 'activating':
+      case 'activated':
+      case 'redundant':
+        return true;
+    }
+  }
+
+  if (state_b === 'installed') {
+    switch (state_a) {
+      case 'activating':
+      case 'activated':
+      case 'redundant':
+        return true;
+    }
+  }
+
+  if (state_b === 'activating') {
+    switch (state_a) {
+      case 'activated':
+      case 'redundant':
+        return true;
+    }
+  }
+
+  if (state_b === 'activated') {
+    switch (state_a) {
+      case 'redundant':
+        return true;
+    }
+  }
+  return false;
+}
+
+function wait_for_state(test, worker, state) {
+  if (!worker || worker.state == undefined) {
+    return Promise.reject(new Error(
+      'wait_for_state needs a ServiceWorker object to be passed.'));
+  }
+  if (worker.state === state)
+    return Promise.resolve(state);
+
+  if (is_state_advanced(worker.state, state)) {
+    return Promise.reject(new Error(
+      `Waiting for ${state} but the worker is already ${worker.state}.`));
+  }
+  return new Promise(test.step_func(function(resolve, reject) {
+      worker.addEventListener('statechange', test.step_func(function() {
+          if (worker.state === state)
+            resolve(state);
+
+          if (is_state_advanced(worker.state, state)) {
+            reject(new Error(
+              `The state of the worker becomes ${worker.state} while waiting` +
+                `for ${state}.`));
+          }
+        }));
+    }));
+}
+
+// Declare a test that runs entirely in the ServiceWorkerGlobalScope. The |url|
+// is the service worker script URL. This function:
+// - Instantiates a new test with the description specified in |description|.
+//   The test will succeed if the specified service worker can be successfully
+//   registered and installed.
+// - Creates a new ServiceWorker registration with a scope unique to the current
+//   document URL. Note that this doesn't allow more than one
+//   service_worker_test() to be run from the same document.
+// - Waits for the new worker to begin installing.
+// - Imports tests results from tests running inside the ServiceWorker.
+function service_worker_test(url, description) {
+  // If the document URL is https://example.com/document and the script URL is
+  // https://example.com/script/worker.js, then the scope would be
+  // https://example.com/script/scope/document.
+  var scope = new URL('scope' + window.location.pathname,
+                      new URL(url, window.location)).toString();
+  promise_test(function(test) {
+      return service_worker_unregister_and_register(test, url, scope)
+        .then(function(registration) {
+            add_completion_callback(function() {
+                registration.unregister();
+              });
+            return wait_for_update(test, registration)
+              .then(function(worker) {
+                  return fetch_tests_from_worker(worker);
+                });
+          });
+    }, description);
+}
+
+function base_path() {
+  return location.pathname.replace(/\/[^\/]*$/, '/');
+}
+
+function test_login(test, origin, username, password, cookie) {
+  return new Promise(function(resolve, reject) {
+      with_iframe(
+        origin + base_path() +
+        'resources/fetch-access-control-login.html')
+        .then(test.step_func(function(frame) {
+            var channel = new MessageChannel();
+            channel.port1.onmessage = test.step_func(function() {
+                frame.remove();
+                resolve();
+              });
+            frame.contentWindow.postMessage(
+              {username: username, password: password, cookie: cookie},
+              origin, [channel.port2]);
+          }));
+    });
+}
+
+function test_websocket(test, frame, url) {
+  return new Promise(function(resolve, reject) {
+      var ws = new frame.contentWindow.WebSocket(url, ['echo', 'chat']);
+      var openCalled = false;
+      ws.addEventListener('open', test.step_func(function(e) {
+          assert_equals(ws.readyState, 1, "The WebSocket should be open");
+          openCalled = true;
+          ws.close();
+        }), true);
+
+      ws.addEventListener('close', test.step_func(function(e) {
+          assert_true(openCalled, "The WebSocket should be closed after being opened");
+          resolve();
+        }), true);
+
+      ws.addEventListener('error', reject);
+    });
+}
+
+function login_https(test) {
+  var host_info = get_host_info();
+  return test_login(test, host_info.HTTPS_REMOTE_ORIGIN,
+                    'username1s', 'password1s', 'cookie1')
+    .then(function() {
+        return test_login(test, host_info.HTTPS_ORIGIN,
+                          'username2s', 'password2s', 'cookie2');
+      });
+}
+
+function websocket(test, frame) {
+  return test_websocket(test, frame, get_websocket_url());
+}
+
+function get_websocket_url() {
+  return 'wss://{{host}}:{{ports[wss][0]}}/echo';
+}
+
+// The navigator.serviceWorker.register() method guarantees that the newly
+// installing worker is available as registration.installing when its promise
+// resolves. However some tests test installation using a <link> element where
+// it is possible for the installing worker to have already become the waiting
+// or active worker. So this method is used to get the newest worker when these
+// tests need access to the ServiceWorker itself.
+function get_newest_worker(registration) {
+  if (registration.installing)
+    return registration.installing;
+  if (registration.waiting)
+    return registration.waiting;
+  if (registration.active)
+    return registration.active;
+}
+
+function register_using_link(script, options) {
+  var scope = options.scope;
+  var link = document.createElement('link');
+  link.setAttribute('rel', 'serviceworker');
+  link.setAttribute('href', script);
+  link.setAttribute('scope', scope);
+  document.getElementsByTagName('head')[0].appendChild(link);
+  return new Promise(function(resolve, reject) {
+        link.onload = resolve;
+        link.onerror = reject;
+      })
+    .then(() => navigator.serviceWorker.getRegistration(scope));
+}
+
+function with_sandboxed_iframe(url, sandbox) {
+  return new Promise(function(resolve) {
+      var frame = document.createElement('iframe');
+      frame.sandbox = sandbox;
+      frame.src = url;
+      frame.onload = function() { resolve(frame); };
+      document.body.appendChild(frame);
+    });
+}
+
+// Registers, waits for activation, then unregisters on a sample scope.
+//
+// This can be used to wait for a period of time needed to register,
+// activate, and then unregister a service worker.  When checking that
+// certain behavior does *NOT* happen, this is preferable to using an
+// arbitrary delay.
+async function wait_for_activation_on_sample_scope(t, window_or_workerglobalscope) {
+  const script = '/service-workers/service-worker/resources/empty-worker.js';
+  const scope = 'resources/there/is/no/there/there?' + Date.now();
+  let registration = await window_or_workerglobalscope.navigator.serviceWorker.register(script, { scope });
+  await wait_for_state(t, registration.installing, 'activated');
+  await registration.unregister();
+}
+
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/test-request-headers-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/test-request-headers-worker.js
new file mode 100644
index 000000000000..566e2e9984b5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/test-request-headers-worker.js
@@ -0,0 +1,10 @@
+// Add a unique UUID per request to induce service worker script update.
+// Time stamp: %UUID%
+
+// The server injects the request headers here as a JSON string.
+const headersAsJson = `%HEADERS%`;
+const headers = JSON.parse(headersAsJson);
+
+self.addEventListener('message', async (e) => {
+  e.source.postMessage(headers);
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/test-request-mode-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/test-request-mode-worker.js
new file mode 100644
index 000000000000..566e2e9984b5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/test-request-mode-worker.js
@@ -0,0 +1,10 @@
+// Add a unique UUID per request to induce service worker script update.
+// Time stamp: %UUID%
+
+// The server injects the request headers here as a JSON string.
+const headersAsJson = `%HEADERS%`;
+const headers = JSON.parse(headersAsJson);
+
+self.addEventListener('message', async (e) => {
+  e.source.postMessage(headers);
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/testharness-helpers.js b/test/fixtures/wpt/service-workers/service-worker/resources/testharness-helpers.js
new file mode 100644
index 000000000000..5f93a25438a0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/testharness-helpers.js
@@ -0,0 +1,136 @@
+/*
+ * testharness-helpers contains various useful extensions to testharness.js to
+ * allow them to be used across multiple tests before they have been
+ * upstreamed. This file is intended to be usable from both document and worker
+ * environments, so code should for example not rely on the DOM.
+ */
+
+// Asserts that two objects |actual| and |expected| are weakly equal under the
+// following definition:
+//
+// |a| and |b| are weakly equal if any of the following are true:
+//   1. If |a| is not an 'object', and |a| === |b|.
+//   2. If |a| is an 'object', and all of the following are true:
+//     2.1 |a.p| is weakly equal to |b.p| for all own properties |p| of |a|.
+//     2.2 Every own property of |b| is an own property of |a|.
+//
+// This is a replacement for the version of assert_object_equals() in
+// testharness.js. The latter doesn't handle own properties correctly. I.e. if
+// |a.p| is not an own property, it still requires that |b.p| be an own
+// property.
+//
+// Note that |actual| must not contain cyclic references.
+self.assert_object_equals = function(actual, expected, description) {
+  var object_stack = [];
+
+  function _is_equal(actual, expected, prefix) {
+    if (typeof actual !== 'object') {
+      assert_equals(actual, expected, prefix);
+      return;
+    }
+    assert_equals(typeof expected, 'object', prefix);
+    assert_equals(object_stack.indexOf(actual), -1,
+                  prefix + ' must not contain cyclic references.');
+
+    object_stack.push(actual);
+
+    Object.getOwnPropertyNames(expected).forEach(function(property) {
+        assert_own_property(actual, property, prefix);
+        _is_equal(actual[property], expected[property],
+                  prefix + '.' + property);
+      });
+    Object.getOwnPropertyNames(actual).forEach(function(property) {
+        assert_own_property(expected, property, prefix);
+      });
+
+    object_stack.pop();
+  }
+
+  function _brand(object) {
+    return Object.prototype.toString.call(object).match(/^\[object (.*)\]$/)[1];
+  }
+
+  _is_equal(actual, expected,
+            (description ? description + ': ' : '') + _brand(expected));
+};
+
+// Equivalent to assert_in_array, but uses a weaker equivalence relation
+// (assert_object_equals) than '==='.
+function assert_object_in_array(actual, expected_array, description) {
+  assert_true(expected_array.some(function(element) {
+      try {
+        assert_object_equals(actual, element);
+        return true;
+      } catch (e) {
+        return false;
+      }
+    }), description);
+}
+
+// Assert that the two arrays |actual| and |expected| contain the same set of
+// elements as determined by assert_object_equals. The order is not significant.
+//
+// |expected| is assumed to not contain any duplicates as determined by
+// assert_object_equals().
+function assert_array_equivalent(actual, expected, description) {
+  assert_true(Array.isArray(actual), description);
+  assert_equals(actual.length, expected.length, description);
+  expected.forEach(function(expected_element) {
+      // assert_in_array treats the first argument as being 'actual', and the
+      // second as being 'expected array'. We are switching them around because
+      // we want to be resilient against the |actual| array containing
+      // duplicates.
+      assert_object_in_array(expected_element, actual, description);
+    });
+}
+
+// Asserts that two arrays |actual| and |expected| contain the same set of
+// elements as determined by assert_object_equals(). The corresponding elements
+// must occupy corresponding indices in their respective arrays.
+function assert_array_objects_equals(actual, expected, description) {
+  assert_true(Array.isArray(actual), description);
+  assert_equals(actual.length, expected.length, description);
+  actual.forEach(function(value, index) {
+      assert_object_equals(value, expected[index],
+                           description + ' : object[' + index + ']');
+    });
+}
+
+// Asserts that |object| that is an instance of some interface has the attribute
+// |attribute_name| following the conditions specified by WebIDL, but it's
+// acceptable that the attribute |attribute_name| is an own property of the
+// object because we're in the middle of moving the attribute to a prototype
+// chain.  Once we complete the transition to prototype chains,
+// assert_will_be_idl_attribute must be replaced with assert_idl_attribute
+// defined in testharness.js.
+//
+// FIXME: Remove assert_will_be_idl_attribute once we complete the transition
+// of moving the DOM attributes to prototype chains.  (http://crbug.com/43394)
+function assert_will_be_idl_attribute(object, attribute_name, description) {
+  assert_equals(typeof object, "object", description);
+
+  assert_true("hasOwnProperty" in object, description);
+
+  // Do not test if |attribute_name| is not an own property because
+  // |attribute_name| is in the middle of the transition to a prototype
+  // chain.  (http://crbug.com/43394)
+
+  assert_true(attribute_name in object, description);
+}
+
+// Stringifies a DOM object.  This function stringifies not only own properties
+// but also DOM attributes which are on a prototype chain.  Note that
+// JSON.stringify only stringifies own properties.
+function stringifyDOMObject(object)
+{
+    function deepCopy(src) {
+        if (typeof src != "object")
+            return src;
+        var dst = Array.isArray(src) ? [] : {};
+        for (var property in src) {
+            dst[property] = deepCopy(src[property]);
+        }
+        return dst;
+    }
+    return JSON.stringify(deepCopy(object));
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/type-check-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/type-check-worker.js
new file mode 100644
index 000000000000..1779e2323d92
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/type-check-worker.js
@@ -0,0 +1,10 @@
+let type = '';
+try {
+  importScripts('empty.js');
+  type = 'classic';
+} catch (e) {
+  type = 'module';
+}
+onmessage = e => {
+  e.source.postMessage(type);
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/unregister-controller-page.html b/test/fixtures/wpt/service-workers/service-worker/resources/unregister-controller-page.html
new file mode 100644
index 000000000000..18a95ee892b1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/unregister-controller-page.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<script>
+function fetch_url(url) {
+    return new Promise(function(resolve, reject) {
+        var request = new XMLHttpRequest();
+        request.addEventListener('load', function(event) {
+            if (request.status == 200)
+                resolve(request.response);
+            else
+                reject(Error(request.statusText));
+        });
+        request.open('GET', url);
+        request.send();
+    });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/unregister-immediately-helpers.js b/test/fixtures/wpt/service-workers/service-worker/resources/unregister-immediately-helpers.js
new file mode 100644
index 000000000000..91a30de5b777
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/unregister-immediately-helpers.js
@@ -0,0 +1,19 @@
+'use strict';
+
+// Returns a promise for a network response that contains the Clear-Site-Data:
+// "storage" header.
+function clear_site_data() {
+  return fetch('resources/blank.html?pipe=header(Clear-Site-Data,"storage")');
+}
+
+async function assert_no_registrations_exist() {
+  const registrations = await navigator.serviceWorker.getRegistrations();
+  assert_equals(registrations.length, 0);
+}
+
+async function add_controlled_iframe(test, url) {
+  const frame = await with_iframe(url);
+  test.add_cleanup(() => { frame.remove(); });
+  assert_not_equals(frame.contentWindow.navigator.serviceWorker.controller, null);
+  return frame;
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/unregister-rewrite-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/unregister-rewrite-worker.html
new file mode 100644
index 000000000000..f5d0367877a4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/unregister-rewrite-worker.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<script>
+async function onLoad() {
+  const params = new URLSearchParams(self.location.search);
+  const scope = self.origin + params.get('scopepath');
+  const reg = await navigator.serviceWorker.getRegistration(scope);
+  if (reg) {
+    await reg.unregister();
+  }
+  if (window.opener) {
+    window.opener.postMessage({ type: 'SW-UNREGISTERED' }, '*');
+  } else {
+    window.top.postMessage({ type: 'SW-UNREGISTERED' }, '*');
+  }
+}
+self.addEventListener('load', onLoad);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/update-during-installation-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/update-during-installation-worker.js
new file mode 100644
index 000000000000..f1997bd824e8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/update-during-installation-worker.js
@@ -0,0 +1,61 @@
+'use strict';
+
+const installEventFired = new Promise(resolve => {
+  self.fireInstallEvent = resolve;
+});
+
+const installFinished = new Promise(resolve => {
+  self.finishInstall = resolve;
+});
+
+addEventListener('install', event => {
+  fireInstallEvent();
+  event.waitUntil(installFinished);
+});
+
+addEventListener('message', event => {
+  let resolveWaitUntil;
+  event.waitUntil(new Promise(resolve => { resolveWaitUntil = resolve; }));
+
+  // Use a dedicated MessageChannel for every request so senders can wait for
+  // individual requests to finish, and concurrent requests (to different
+  // workers) don't cause race conditions.
+  const port = event.data;
+  port.onmessage = (event) => {
+    switch (event.data) {
+      case 'awaitInstallEvent':
+        installEventFired.then(() => {
+            port.postMessage('installEventFired');
+        }).finally(resolveWaitUntil);
+        break;
+
+      case 'finishInstall':
+        installFinished.then(() => {
+            port.postMessage('installFinished');
+        }).finally(resolveWaitUntil);
+        finishInstall();
+        break;
+
+      case 'callUpdate': {
+        const channel = new MessageChannel();
+        registration.update().then(() => {
+            channel.port2.postMessage({
+                success: true,
+            });
+        }).catch((exception) => {
+            channel.port2.postMessage({
+                success: false,
+                exception: exception.name,
+            });
+        }).finally(resolveWaitUntil);
+        port.postMessage(channel.port1, [channel.port1]);
+        break;
+      }
+
+      default:
+        port.postMessage('Unexpected command ' + event.data);
+        resolveWaitUntil();
+        break;
+    }
+  };
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/update-smaller-body-after-update-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/update-smaller-body-after-update-worker.js
new file mode 100644
index 000000000000..d43f6b2f5c3d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/update-smaller-body-after-update-worker.js
@@ -0,0 +1 @@
+// Hello world!
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/update-smaller-body-before-update-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/update-smaller-body-before-update-worker.js
new file mode 100644
index 000000000000..30c8783a7025
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/update-smaller-body-before-update-worker.js
@@ -0,0 +1,2 @@
+// Hello world!
+// **with extra body**
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/update/update-after-oneday.https.html b/test/fixtures/wpt/service-workers/service-worker/resources/update/update-after-oneday.https.html
new file mode 100644
index 000000000000..9d4c98272187
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/update/update-after-oneday.https.html
@@ -0,0 +1,8 @@
+<body>
+<script>
+function load_image(url) {
+  var img = document.createElement('img');
+  img.src = url;
+}
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/vtt-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/vtt-frame.html
new file mode 100644
index 000000000000..c3ac8034e192
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/vtt-frame.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Page Title</title>
+<video>
+  <track>
+</video>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/wait-forever-in-install-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/wait-forever-in-install-worker.js
new file mode 100644
index 000000000000..af85a73ad3e1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/wait-forever-in-install-worker.js
@@ -0,0 +1,12 @@
+var waitUntilResolve;
+self.addEventListener('install', function(event) {
+    event.waitUntil(new Promise(function(resolve) {
+        waitUntilResolve = resolve;
+      }));
+  });
+
+self.addEventListener('message', function(event) {
+    if (event.data === 'STOP_WAITING') {
+      waitUntilResolve();
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/websocket-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/websocket-worker.js
new file mode 100644
index 000000000000..bb2dc81e553f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/websocket-worker.js
@@ -0,0 +1,35 @@
+let port;
+let received = false;
+
+function reportFailure(details) {
+  port.postMessage('FAIL: ' + details);
+}
+
+onmessage = event => {
+  port = event.source;
+
+  const ws = new WebSocket('wss://{{host}}:{{ports[wss][0]}}/echo');
+  ws.onopen = () => {
+    ws.send('Hello');
+  };
+  ws.onmessage = msg => {
+    if (msg.data !== 'Hello') {
+      reportFailure('Unexpected reply: ' + msg.data);
+      return;
+    }
+
+    received = true;
+    ws.close();
+  };
+  ws.onclose = (event) => {
+    if (!received) {
+      reportFailure('Closed before receiving reply: ' + event.code);
+      return;
+    }
+
+    port.postMessage('PASS');
+  };
+  ws.onerror = () => {
+    reportFailure('Got an error event');
+  };
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/websocket.js b/test/fixtures/wpt/service-workers/service-worker/resources/websocket.js
new file mode 100644
index 000000000000..fc6abd283a04
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/websocket.js
@@ -0,0 +1,7 @@
+self.urls = [];
+self.addEventListener('fetch', function(event) {
+    self.urls.push(event.request.url);
+  });
+self.addEventListener('message', function(event) {
+    event.data.port.postMessage({urls: self.urls});
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/window-opener.html b/test/fixtures/wpt/service-workers/service-worker/resources/window-opener.html
new file mode 100644
index 000000000000..32d074464679
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/window-opener.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<meta name="referrer" content="origin">
+<script>
+function onLoad() {
+  self.onmessage = evt => {
+    if (self.opener)
+      self.opener.postMessage(evt.data, '*');
+    else
+      self.top.postMessage(evt.data, '*');
+  }
+  const params = new URLSearchParams(self.location.search);
+  const w = window.open(params.get('target'));
+  self.addEventListener('unload', evt => w.close());
+}
+self.addEventListener('load', onLoad);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/windowclient-navigate-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/windowclient-navigate-worker.js
new file mode 100644
index 000000000000..383f66631d3a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/windowclient-navigate-worker.js
@@ -0,0 +1,75 @@
+importScripts('/resources/testharness.js');
+
+function matchQuery(queryString) {
+  return self.location.search.substr(1) === queryString;
+}
+
+async function navigateTest(t, e) {
+  const port = e.data.port;
+  const url = e.data.url;
+  const expected = e.data.expected;
+
+  let p = clients.matchAll({ includeUncontrolled : true })
+    .then(function(clients) {
+      for (const client of clients) {
+        if (client.url === e.data.clientUrl) {
+          assert_equals(client.frameType, e.data.frameType);
+          return client.navigate(url);
+        }
+      }
+      throw 'Could not locate window client.';
+    }).then(function(newClient) {
+      // If we didn't reject, we better get resolved with the right thing.
+      if (newClient === null) {
+        assert_equals(newClient, expected);
+      } else {
+        assert_equals(newClient.url, expected);
+      }
+    });
+
+  if (typeof self[expected] === "function") {
+    // It's a JS error type name.  We are expecting our promise to be rejected
+    // with that error.
+    p = promise_rejects_js(t, self[expected], p);
+  }
+
+  // Let our caller know we are done.
+  return p.finally(() => port.postMessage(null));
+}
+
+function getTestClient() {
+  return clients.matchAll({ includeUncontrolled: true })
+    .then(function(clients) {
+      for (const client of clients) {
+        if (client.url.includes('windowclient-navigate.https.html')) {
+          return client;
+        }
+      }
+
+      throw new Error('Service worker was unable to locate test client.');
+    });
+}
+
+function waitForMessage(client) {
+  const channel = new MessageChannel();
+  client.postMessage({ port: channel.port2 }, [channel.port2]);
+
+  return new Promise(function(resolve) {
+    channel.port1.onmessage = resolve;
+  });
+}
+
+// The worker must remain in the "installing" state for the duration of some
+// sub-tests. In order to achieve this coordination without relying on global
+// state, the worker must create a message channel with the client from within
+// the "install" event handler.
+if (matchQuery('installing')) {
+  self.addEventListener('install', function(e) {
+    e.waitUntil(getTestClient().then(waitForMessage));
+  });
+}
+
+self.addEventListener('message', function(e) {
+  e.waitUntil(promise_test(t => navigateTest(t, e),
+                           e.data.description + " worker side"));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/worker-client-id-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/worker-client-id-worker.js
new file mode 100644
index 000000000000..f592629d074b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/worker-client-id-worker.js
@@ -0,0 +1,25 @@
+addEventListener('fetch', evt => {
+  if (evt.request.url.includes('worker-echo-client-id.js')) {
+    evt.respondWith(new Response(
+      'fetch("fetch-echo-client-id").then(r => r.text()).then(t => self.postMessage(t));',
+      { headers: { 'Content-Type': 'application/javascript' }}));
+    return;
+  }
+
+  if (evt.request.url.includes('fetch-echo-client-id')) {
+    evt.respondWith(new Response(evt.clientId));
+    return;
+  }
+
+  if (evt.request.url.includes('frame.html')) {
+    evt.respondWith(new Response(''));
+    return;
+  }
+});
+
+addEventListener('message', evt => {
+  if (evt.data === 'echo-client-id') {
+    evt.ports[0].postMessage(evt.source.id);
+    return;
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/worker-fetching-cross-origin.js b/test/fixtures/wpt/service-workers/service-worker/resources/worker-fetching-cross-origin.js
new file mode 100644
index 000000000000..a81bb3dd6ed7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/worker-fetching-cross-origin.js
@@ -0,0 +1,12 @@
+importScripts('/common/get-host-info.sub.js');
+importScripts('test-helpers.sub.js');
+
+self.addEventListener('fetch', event => {
+  const host_info = get_host_info();
+  // The sneaky Service Worker changes the same-origin 'square' request for a cross-origin image.
+  if (event.request.url.indexOf('square') != -1) {
+    const searchParams = new URLSearchParams(location.search);
+    const mode = searchParams.get("mode") || "cors";
+    event.respondWith(fetch(`${host_info['HTTPS_REMOTE_ORIGIN']}${base_path()}square.png`, { mode }));
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/worker-interception-redirect-serviceworker.js b/test/fixtures/wpt/service-workers/service-worker/resources/worker-interception-redirect-serviceworker.js
new file mode 100644
index 000000000000..d36b0b6da64d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/worker-interception-redirect-serviceworker.js
@@ -0,0 +1,53 @@
+let name;
+if (self.registration.scope.indexOf('scope1') != -1)
+  name = 'sw1';
+if (self.registration.scope.indexOf('scope2') != -1)
+  name = 'sw2';
+
+
+self.addEventListener('fetch', evt => {
+  // There are three types of requests this service worker handles.
+
+  // (1) The first request for the worker, which will redirect elsewhere.
+  // "redirect.py" means to test network redirect, so let network handle it.
+  if (evt.request.url.indexOf('redirect.py') != -1) {
+    return;
+  }
+  // "sw-redirect" means to test service worker redirect, so respond with a
+  // redirect.
+  if (evt.request.url.indexOf('sw-redirect') != -1) {
+    const url = new URL(evt.request.url);
+    const redirect_to = url.searchParams.get('Redirect');
+    evt.respondWith(Response.redirect(redirect_to));
+    return;
+  }
+
+  // (2) After redirect, the request is for a "webworker.py" URL.
+  // Add a search parameter to indicate this service worker handled the
+  // final request for the worker.
+  if (evt.request.url.indexOf('webworker.py') != -1) {
+    const greeting = encodeURIComponent(`${name} saw the request for the worker script`);
+    // Serve from `./subdir/`, not `./`,
+    // to conform that the base URL used in the worker is
+    // the response URL (`./subdir/`), not the current request URL (`./`).
+    evt.respondWith(fetch(`subdir/worker_interception_redirect_webworker.py?greeting=${greeting}`));
+    return;
+  }
+
+  const path = (new URL(evt.request.url)).pathname;
+
+  // (3) The worker does an importScripts() to import-scripts-echo.py. Indicate
+  // that this service worker handled the request.
+  if (evt.request.url.indexOf('import-scripts-echo.py') != -1) {
+    const msg = encodeURIComponent(`${name} saw importScripts from the worker: ${path}`);
+    evt.respondWith(fetch(`import-scripts-echo.py?msg=${msg}`));
+    return;
+  }
+
+  // (4) The worker does a fetch() to simple.txt. Indicate that this service
+  // worker handled the request.
+  if (evt.request.url.indexOf('simple.txt') != -1) {
+    evt.respondWith(new Response(`${name} saw the fetch from the worker: ${path}`));
+    return;
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/worker-interception-redirect-webworker.js b/test/fixtures/wpt/service-workers/service-worker/resources/worker-interception-redirect-webworker.js
new file mode 100644
index 000000000000..b7e6d81b091a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/worker-interception-redirect-webworker.js
@@ -0,0 +1,56 @@
+// This is the (shared or dedicated) worker file for the
+// worker-interception-redirect test. It should be served by the corresponding
+// .py file instead of being served directly.
+//
+// This file is served from both resources/*webworker.py,
+// resources/scope2/*webworker.py and resources/subdir/*webworker.py.
+// Relative paths are used in `fetch()` and `importScripts()` to confirm that
+// the correct base URLs are used.
+
+// This greeting text is meant to be injected by the Python script that serves
+// this file, to indicate how the script was served (from network or from
+// service worker).
+//
+// We can't just use a sub pipe and name this file .sub.js since we want
+// to serve the file from multiple URLs (see above).
+let greeting = '%GREETING_TEXT%';
+if (!greeting)
+  greeting = 'the worker script was served from network';
+
+// Call importScripts() which fills |echo_output| with a string indicating
+// whether a service worker intercepted the importScripts() request.
+let echo_output;
+const import_scripts_msg = encodeURIComponent(
+    'importScripts: served from network');
+let import_scripts_greeting = 'not set';
+try {
+  importScripts(`import-scripts-echo.py?msg=${import_scripts_msg}`);
+  import_scripts_greeting = echo_output;
+} catch(e) {
+  import_scripts_greeting = 'importScripts failed';
+}
+
+async function runTest(port) {
+  port.postMessage(greeting);
+
+  port.postMessage(import_scripts_greeting);
+
+  const response = await fetch('simple.txt');
+  const text = await response.text();
+  port.postMessage('fetch(): ' + text);
+
+  port.postMessage(self.location.href);
+}
+
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  runTest(self);
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = function(e) {
+    const port = e.ports[0];
+    port.start();
+    runTest(port);
+  };
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/worker-load-interceptor.js b/test/fixtures/wpt/service-workers/service-worker/resources/worker-load-interceptor.js
new file mode 100644
index 000000000000..ebc0db67aa50
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/worker-load-interceptor.js
@@ -0,0 +1,16 @@
+importScripts('/common/get-host-info.sub.js');
+
+const response_text = 'This load was successfully intercepted.';
+const response_script =
+    `const message = 'This load was successfully intercepted.';`;
+
+self.onfetch = event => {
+  const url = event.request.url;
+  if (url.indexOf('synthesized-response.txt') != -1) {
+    event.respondWith(new Response(response_text));
+  } else if (url.indexOf('synthesized-response.js') != -1) {
+    event.respondWith(new Response(
+        response_script,
+        {headers: {'Content-Type': 'application/javascript'}}));
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/worker-testharness.js b/test/fixtures/wpt/service-workers/service-worker/resources/worker-testharness.js
new file mode 100644
index 000000000000..73e97be1eaa4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/worker-testharness.js
@@ -0,0 +1,49 @@
+/*
+ * worker-test-harness should be considered a temporary polyfill around
+ * testharness.js for supporting Service Worker based tests. It should not be
+ * necessary once the test harness is able to drive worker based tests natively.
+ * See https://github.com/w3c/testharness.js/pull/82 for status of effort to
+ * update upstream testharness.js. Once the upstreaming is complete, tests that
+ * reference worker-test-harness should be updated to directly import
+ * testharness.js.
+ */
+
+importScripts('/resources/testharness.js');
+
+(function() {
+  var next_cache_index = 1;
+
+  // Returns a promise that resolves to a newly created Cache object. The
+  // returned Cache will be destroyed when |test| completes.
+  function create_temporary_cache(test) {
+    var uniquifier = String(++next_cache_index);
+    var cache_name = self.location.pathname + '/' + uniquifier;
+
+    test.add_cleanup(function() {
+        return self.caches.delete(cache_name);
+      });
+
+    return self.caches.delete(cache_name)
+      .then(function() {
+          return self.caches.open(cache_name);
+        });
+  }
+
+  self.create_temporary_cache = create_temporary_cache;
+})();
+
+// Runs |test_function| with a temporary unique Cache passed in as the only
+// argument. The function is run as a part of Promise chain owned by
+// promise_test(). As such, it is expected to behave in a manner identical (with
+// the exception of the argument) to a function passed into promise_test().
+//
+// E.g.:
+//    cache_test(function(cache) {
+//      // Do something with |cache|, which is a Cache object.
+//    }, "Some Cache test");
+function cache_test(test_function, description) {
+  promise_test(function(test) {
+      return create_temporary_cache(test)
+        .then(test_function);
+    }, description);
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/xhr-content-length-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/xhr-content-length-worker.js
new file mode 100644
index 000000000000..604deece2d25
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/xhr-content-length-worker.js
@@ -0,0 +1,22 @@
+// Service worker for the xhr-content-length test.
+
+self.addEventListener("fetch", event => {
+  const url = new URL(event.request.url);
+  const type = url.searchParams.get("type");
+
+  if (type === "no-content-length") {
+    event.respondWith(new Response("Hello!"));
+  }
+
+  if (type === "larger-content-length") {
+    event.respondWith(new Response("meeeeh", { headers: [["Content-Length", "10000"]] }));
+  }
+
+  if (type === "double-content-length") {
+    event.respondWith(new Response("meeeeh", { headers: [["Content-Length", "10000"], ["Content-Length", "10000"]] }));
+  }
+
+  if (type === "bogus-content-length") {
+    event.respondWith(new Response("meeeeh", { headers: [["Content-Length", "test"]] }));
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/xhr-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/xhr-iframe.html
new file mode 100644
index 000000000000..4c57bbbc6589
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/xhr-iframe.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe for xhr tests</title>
+<script>
+async function xhr(url, options) {
+  return new Promise((resolve, reject) => {
+    const xhr = new XMLHttpRequest();
+    const opts = options ? options : {};
+    xhr.onload = () => {
+      resolve(xhr);
+    };
+    xhr.onerror = () => {
+      reject('xhr failed');
+    };
+
+    xhr.open('GET', url);
+    if (opts.responseType) {
+      xhr.responseType = opts.responseType;
+    }
+    xhr.send();
+  });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/xhr-response-url-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/xhr-response-url-worker.js
new file mode 100644
index 000000000000..906ad5005b59
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/xhr-response-url-worker.js
@@ -0,0 +1,32 @@
+// Service worker for the xhr-response-url test.
+
+self.addEventListener('fetch', event => {
+  const url = new URL(event.request.url);
+  const respondWith = url.searchParams.get('respondWith');
+  if (!respondWith)
+    return;
+
+  if (respondWith == 'fetch') {
+    const target = url.searchParams.get('url');
+    event.respondWith(fetch(target));
+    return;
+  }
+
+  if (respondWith == 'string') {
+    const headers = {'content-type': 'text/plain'};
+    event.respondWith(new Response('hello', {headers}));
+    return;
+  }
+
+  if (respondWith == 'document') {
+    const doc = `
+        <!DOCTYPE html>
+        <html>
+        <title>hi</title>
+        <body>hello</body>
+        </html>`;
+    const headers = {'content-type': 'text/html'};
+    event.respondWith(new Response(doc, {headers}));
+    return;
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/xsl-base-url-iframe.xml b/test/fixtures/wpt/service-workers/service-worker/resources/xsl-base-url-iframe.xml
new file mode 100644
index 000000000000..065a07acb284
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/xsl-base-url-iframe.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="resources/request-url-path/import-relative.xsl"?>
+<stylesheet-test>
+This tests a stylesheet which has a xsl:import with a relative URL.
+</stylesheet-test>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/xsl-base-url-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/xsl-base-url-worker.js
new file mode 100644
index 000000000000..50e2b1842ffc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/xsl-base-url-worker.js
@@ -0,0 +1,12 @@
+self.addEventListener('fetch', event => {
+  const url = new URL(event.request.url);
+
+  // For the import-relative.xsl file, respond in a way that changes the
+  // response URL. This is expected to change the base URL and allow the import
+  // from the file to succeed.
+  const path = 'request-url-path/import-relative.xsl';
+  if (url.pathname.indexOf(path) != -1) {
+    // Respond with a different URL, deleting "request-url-path/".
+    event.respondWith(fetch('import-relative.xsl'));
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/xslt-pass.xsl b/test/fixtures/wpt/service-workers/service-worker/resources/xslt-pass.xsl
new file mode 100644
index 000000000000..2cd7f2f8f86a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/xslt-pass.xsl
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:template match="/">
+    <html>
+      <body>
+           <p>PASS</p>
+      </body>
+    </html>
+  </xsl:template>
+</xsl:stylesheet>
diff --git a/test/fixtures/wpt/service-workers/service-worker/respond-with-body-accessed-response.https.html b/test/fixtures/wpt/service-workers/service-worker/respond-with-body-accessed-response.https.html
new file mode 100644
index 000000000000..f6713d89216e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/respond-with-body-accessed-response.https.html
@@ -0,0 +1,54 @@
+<!DOCTYPE html>
+<title>Service Worker responds with .body accessed response.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+let frame;
+
+promise_test(t => {
+    const SCOPE = 'resources/respond-with-body-accessed-response-iframe.html';
+    const SCRIPT = 'resources/respond-with-body-accessed-response-worker.js';
+
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(reg => {
+          promise_test(t => {
+              if (frame)
+                frame.remove();
+              return reg.unregister();
+            }, 'restore global state');
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(() => { return with_iframe(SCOPE); })
+      .then(f => { frame = f; });
+  }, 'initialize global state');
+
+const TEST_CASES = [
+  "type=basic",
+  "type=opaque",
+  "type=default",
+  "type=basic&clone=1",
+  "type=opaque&clone=1",
+  "type=default&clone=1",
+  "type=basic&clone=2",
+  "type=opaque&clone=2",
+  "type=default&clone=2",
+  "type=basic&passThroughCache=true",
+  "type=opaque&passThroughCache=true",
+  "type=default&passThroughCache=true",
+  "type=basic&clone=1&passThroughCache=true",
+  "type=opaque&clone=1&passThroughCache=true",
+  "type=default&clone=1&passThroughCache=true",
+  "type=basic&clone=2&passThroughCache=true",
+  "type=opaque&clone=2&passThroughCache=true",
+  "type=default&clone=2&passThroughCache=true",
+];
+
+TEST_CASES.forEach(param => {
+    promise_test(t => {
+        const url = 'TestRequest?' + param;
+        return frame.contentWindow.getJSONP(url)
+          .then(result => { assert_equals(result, 'OK'); });
+      }, 'test: ' + param);
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/same-site-cookies.https.html b/test/fixtures/wpt/service-workers/service-worker/same-site-cookies.https.html
new file mode 100644
index 000000000000..1d9b60d44701
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/same-site-cookies.https.html
@@ -0,0 +1,496 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>Service Worker: Same-site cookie behavior</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
+<script src="/cookies/resources/cookie-helper.sub.js"></script>
+<body>
+<script>
+'use strict';
+
+const COOKIE_VALUE = 'COOKIE_VALUE';
+
+function make_nested_url(nested_origins, target_url) {
+  for (let i = nested_origins.length - 1; i >= 0; --i) {
+    target_url = new URL(
+      `./resources/nested-parent.html?target=${encodeURIComponent(target_url)}`,
+      nested_origins[i] + self.location.pathname);
+  }
+  return target_url;
+}
+
+const scopepath = '/cookies/resources/postToParent.py?with-sw';
+
+async function unregister_service_worker(origin, nested_origins=[]) {
+  let target_url = origin +
+      '/service-workers/service-worker/resources/unregister-rewrite-worker.html' +
+      '?scopepath=' + encodeURIComponent(scopepath);
+  target_url = make_nested_url(nested_origins, target_url);
+  const w = window.open(target_url);
+  try {
+    await wait_for_message('SW-UNREGISTERED');
+  } finally {
+    w.close();
+  }
+}
+
+async function register_service_worker(origin, nested_origins=[]) {
+  let target_url = origin +
+      '/service-workers/service-worker/resources/register-rewrite-worker.html' +
+      '?scopepath=' + encodeURIComponent(scopepath);
+  target_url = make_nested_url(nested_origins, target_url);
+  const w = window.open(target_url);
+  try {
+    await wait_for_message('SW-REGISTERED');
+  } finally {
+    w.close();
+  }
+}
+
+async function run_test(t, origin, navaction, swaction, expected,
+                        redirect_origins=[], nested_origins=[]) {
+  if (swaction === 'navpreload') {
+    assert_true('navigationPreload' in ServiceWorkerRegistration.prototype,
+                'navigation preload must be supported');
+  }
+  const sw_param = swaction === 'no-sw' ? 'no-sw' : 'with-sw';
+  let action_param = '';
+  if (swaction === 'fallback') {
+    action_param = '&ignore';
+  } else if (swaction !== 'no-sw') {
+    action_param = '&' + swaction;
+  }
+  const navpreload_param = swaction === 'navpreload' ? '&navpreload' : '';
+  const change_request_param = swaction === 'change-request' ? '&change-request' : '';
+  const target_string = origin + `/cookies/resources/postToParent.py?` +
+                                 `${sw_param}${action_param}`
+  let target_url = new URL(target_string);
+
+  for (let i = redirect_origins.length - 1; i >= 0; --i) {
+    const redirect_url = new URL(
+        `./resources/redirect.py?Status=307&Redirect=${encodeURIComponent(target_url)}`,
+        redirect_origins[i] + self.location.pathname);
+    target_url = redirect_url;
+  }
+
+  if (navaction === 'window.open') {
+    target_url = new URL(
+        `./resources/window-opener.html?target=${encodeURIComponent(target_url)}`,
+        self.origin + self.location.pathname);
+  } else if (navaction === 'form post') {
+    target_url = new URL(
+        `./resources/form-poster.html?target=${encodeURIComponent(target_url)}`,
+        self.origin + self.location.pathname);
+  } else if (navaction === 'set location') {
+    target_url = new URL(
+        `./resources/location-setter.html?target=${encodeURIComponent(target_url)}`,
+        self.origin + self.location.pathname);
+  }
+
+  const w = window.open(make_nested_url(nested_origins, target_url));
+  t.add_cleanup(() => w.close());
+
+  const result = await wait_for_message('COOKIES');
+  verifySameSiteCookieState(expected, COOKIE_VALUE, result.data);
+}
+
+promise_test(async t => {
+  await resetSameSiteCookies(self.origin, COOKIE_VALUE);
+  await register_service_worker(self.origin);
+
+  await resetSameSiteCookies(SECURE_SUBDOMAIN_ORIGIN, COOKIE_VALUE);
+  await register_service_worker(SECURE_SUBDOMAIN_ORIGIN);
+
+  await resetSameSiteCookies(SECURE_CROSS_SITE_ORIGIN, COOKIE_VALUE);
+  await register_service_worker(SECURE_CROSS_SITE_ORIGIN);
+
+  await register_service_worker(self.origin,
+      [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'Setup service workers');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'no-sw',
+                  SameSiteStatus.STRICT);
+}, 'same-origin, window.open with no service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'fallback',
+                  SameSiteStatus.STRICT);
+}, 'same-origin, window.open with fallback');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'passthrough',
+                  SameSiteStatus.STRICT);
+}, 'same-origin, window.open with passthrough');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'change-request',
+                  SameSiteStatus.STRICT);
+}, 'same-origin, window.open with change-request');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'navpreload',
+                  SameSiteStatus.STRICT);
+}, 'same-origin, window.open with navpreload');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'window.open', 'no-sw',
+                  SameSiteStatus.STRICT);
+}, 'same-site, window.open with no service worker');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'window.open', 'fallback',
+                  SameSiteStatus.STRICT);
+}, 'same-site, window.open with fallback');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'window.open', 'passthrough',
+                  SameSiteStatus.STRICT);
+}, 'same-site, window.open with passthrough');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'window.open', 'change-request',
+                  SameSiteStatus.STRICT);
+}, 'same-site, window.open with change-request');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'window.open', 'navpreload',
+                  SameSiteStatus.STRICT);
+}, 'same-site, window.open with navpreload');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'window.open', 'no-sw',
+                  SameSiteStatus.LAX);
+}, 'cross-site, window.open with no service worker');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'window.open', 'fallback',
+                  SameSiteStatus.LAX);
+}, 'cross-site, window.open with fallback');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'window.open', 'passthrough',
+                  SameSiteStatus.LAX);
+}, 'cross-site, window.open with passthrough');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'window.open', 'change-request',
+                  SameSiteStatus.STRICT);
+}, 'cross-site, window.open with change-request');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'window.open', 'navpreload',
+                  SameSiteStatus.LAX);
+}, 'cross-site, window.open with navpreload');
+
+//
+// window.open redirect tests
+//
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'no-sw',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, window.open with no service worker and same-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'fallback',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, window.open with fallback and same-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'passthrough',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, window.open with passthrough and same-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'change-request',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, window.open with change-request and same-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'navpreload',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, window.open with navpreload and same-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'no-sw',
+                  SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, window.open with no service worker and cross-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'fallback',
+                  SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, window.open with fallback and cross-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'passthrough',
+                  SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, window.open with passthrough and cross-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'change-request',
+                  SameSiteStatus.STRICT, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, window.open with change-request and cross-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'navpreload',
+                  SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, window.open with navpreload and cross-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'no-sw',
+                  SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN, self.origin]);
+}, 'same-origin, window.open with no service worker, cross-site redirect, and ' +
+   'same-origin redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'fallback',
+                  SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN, self.origin]);
+}, 'same-origin, window.open with fallback, cross-site redirect, and ' +
+   'same-origin redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'passthrough',
+                  SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN, self.origin]);
+}, 'same-origin, window.open with passthrough, cross-site redirect, and ' +
+   'same-origin redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'change-request',
+                  SameSiteStatus.STRICT, [SECURE_CROSS_SITE_ORIGIN, self.origin]);
+}, 'same-origin, window.open with change-request, cross-site redirect, and ' +
+   'same-origin redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'navpreload',
+                  SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN, self.origin]);
+}, 'same-origin, window.open with navpreload, cross-site redirect, and ' +
+   'same-origin redirect');
+
+//
+// Double-nested frame calling open.window() tests
+//
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'no-sw',
+                  SameSiteStatus.STRICT, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested window.open with cross-site middle frame and ' +
+   'no service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'fallback',
+                  SameSiteStatus.STRICT, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested window.open with cross-site middle frame and ' +
+   'fallback service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'passthrough',
+                  SameSiteStatus.STRICT, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested window.open with cross-site middle frame and ' +
+   'passthrough service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'change-request',
+                  SameSiteStatus.STRICT, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested window.open with cross-site middle frame and ' +
+   'change-request service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'navpreload',
+                  SameSiteStatus.STRICT, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested window.open with cross-site middle frame and ' +
+   'navpreload service worker');
+
+//
+// Double-nested frame setting location tests
+//
+promise_test(t => {
+  return run_test(t, self.origin, 'set location', 'no-sw',
+                  SameSiteStatus.CROSS_SITE, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested set location with cross-site middle frame and ' +
+   'no service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'set location', 'fallback',
+                  SameSiteStatus.CROSS_SITE, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested set location with cross-site middle frame and ' +
+   'fallback service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'set location', 'passthrough',
+                  SameSiteStatus.CROSS_SITE, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested set location with cross-site middle frame and ' +
+   'passthrough service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'set location', 'change-request',
+                  SameSiteStatus.CROSS_SITE, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested set location with cross-site middle frame and ' +
+   'change-request service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'set location', 'navpreload',
+                  SameSiteStatus.CROSS_SITE, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested set location with cross-site middle frame and ' +
+   'navpreload service worker');
+
+//
+// Form POST tests
+//
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'no-sw', SameSiteStatus.STRICT);
+}, 'same-origin, form post with no service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'fallback',
+                  SameSiteStatus.STRICT);
+}, 'same-origin, form post with fallback');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'passthrough',
+                  SameSiteStatus.STRICT);
+}, 'same-origin, form post with passthrough');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'change-request',
+                  SameSiteStatus.STRICT);
+}, 'same-origin, form post with change-request');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'form post', 'no-sw',
+                  SameSiteStatus.STRICT);
+}, 'same-site, form post with no service worker');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'form post', 'fallback',
+                  SameSiteStatus.STRICT);
+}, 'same-site, form post with fallback');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'form post', 'passthrough',
+                  SameSiteStatus.STRICT);
+}, 'same-site, form post with passthrough');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'form post', 'change-request',
+                  SameSiteStatus.STRICT);
+}, 'same-site, form post with change-request');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'form post', 'no-sw',
+                  SameSiteStatus.CROSS_SITE);
+}, 'cross-site, form post with no service worker');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'form post', 'fallback',
+                  SameSiteStatus.CROSS_SITE);
+}, 'cross-site, form post with fallback');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'form post', 'passthrough',
+                  SameSiteStatus.CROSS_SITE);
+}, 'cross-site, form post with passthrough');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'form post', 'change-request',
+                  SameSiteStatus.STRICT);
+}, 'cross-site, form post with change-request');
+
+//
+// Form POST redirect tests
+//
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'no-sw',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, form post with no service worker and same-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'fallback',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, form post with fallback and same-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'passthrough',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, form post with passthrough and same-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'change-request',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, form post with change-request and same-site redirect');
+
+// navpreload is not supported for POST requests
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'no-sw',
+                  SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, form post with no service worker and cross-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'fallback',
+                  SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, form post with fallback and cross-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'passthrough',
+                  SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, form post with passthrough and cross-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'change-request',
+                  SameSiteStatus.STRICT, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, form post with change-request and cross-site redirect');
+
+// navpreload is not supported for POST requests
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'no-sw',
+                  SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN,
+                                              self.origin]);
+}, 'same-origin, form post with no service worker, cross-site redirect, and ' +
+   'same-origin redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'fallback',
+                  SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN,
+                                              self.origin]);
+}, 'same-origin, form post with fallback, cross-site redirect, and ' +
+   'same-origin redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'passthrough',
+                  SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN,
+                                              self.origin]);
+}, 'same-origin, form post with passthrough, cross-site redirect, and ' +
+   'same-origin redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'change-request',
+                  SameSiteStatus.STRICT, [SECURE_CROSS_SITE_ORIGIN,
+                                          self.origin]);
+}, 'same-origin, form post with change-request, cross-site redirect, and ' +
+   'same-origin redirect');
+
+// navpreload is not supported for POST requests
+
+promise_test(async t => {
+  await unregister_service_worker(self.origin);
+  await unregister_service_worker(SECURE_SUBDOMAIN_ORIGIN);
+  await unregister_service_worker(SECURE_CROSS_SITE_ORIGIN);
+  await unregister_service_worker(self.origin,
+      [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'Cleanup service workers');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/sandboxed-iframe-fetch-event.https.html b/test/fixtures/wpt/service-workers/service-worker/sandboxed-iframe-fetch-event.https.html
new file mode 100644
index 000000000000..ba34e790ff07
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/sandboxed-iframe-fetch-event.https.html
@@ -0,0 +1,536 @@
+<!DOCTYPE html>
+<title>ServiceWorker FetchEvent for sandboxed iframe.</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var lastCallbackId = 0;
+var callbacks = {};
+function doTest(frame, type) {
+  return new Promise(function(resolve) {
+    var id = ++lastCallbackId;
+    callbacks[id] = resolve;
+    frame.contentWindow.postMessage({id: id, type: type}, '*');
+  });
+}
+
+// Asks the service worker for data about requests and clients seen. The
+// worker posts a message back with |data| where:
+// |data.requests|: the requests the worker received FetchEvents for
+// |data.clients|: the URLs of all the worker's clients
+// The worker clears its data after responding.
+function getResultsFromWorker(worker) {
+  return new Promise(resolve => {
+    let channel = new MessageChannel();
+    channel.port1.onmessage = msg => {
+      resolve(msg.data);
+    };
+    worker.postMessage({port: channel.port2}, [channel.port2]);
+  });
+}
+
+window.onmessage = function (e) {
+  message = e.data;
+  var id = message['id'];
+  var callback = callbacks[id];
+  delete callbacks[id];
+  callback(message['result']);
+};
+
+const SCOPE = 'resources/sandboxed-iframe-fetch-event-iframe.py';
+const SCRIPT = 'resources/sandboxed-iframe-fetch-event-worker.js';
+const expected_base_url = new URL(SCOPE, location.href);
+// Service worker controlling |SCOPE|.
+let worker;
+// A normal iframe.
+// This should be controlled by a service worker.
+let normal_frame;
+// An iframe created by <iframe sandbox='allow-scripts'>.
+// This should NOT be controlled by a service worker.
+let sandboxed_frame;
+// An iframe created by <iframe sandbox='allow-scripts allow-same-origin'>.
+// This should be controlled by a service worker.
+let sandboxed_same_origin_frame;
+// An iframe whose response header has
+// 'Content-Security-Policy: allow-scripts'.
+// This should NOT be controlled by a service worker.
+let sandboxed_frame_by_header;
+// An iframe whose response header has
+// 'Content-Security-Policy: allow-scripts allow-same-origin'.
+// This should be controlled by a service worker.
+let sandboxed_same_origin_frame_by_header;
+
+promise_test(t => {
+  return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+    .then(function(registration) {
+      add_completion_callback(() => registration.unregister());
+      worker = registration.installing;
+      return wait_for_state(t, registration.installing, 'activated');
+    });
+}, 'Prepare a service worker.');
+
+promise_test(t => {
+  return with_iframe(SCOPE + '?iframe')
+    .then(f => {
+      normal_frame = f;
+      add_completion_callback(() => f.remove());
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1);
+      assert_equals(requests[0], expected_base_url + '?iframe');
+      assert_true(data.clients.includes(expected_base_url + '?iframe'));
+    });
+}, 'Prepare a normal iframe.');
+
+promise_test(t => {
+  return with_sandboxed_iframe(SCOPE + '?sandboxed-iframe', 'allow-scripts')
+    .then(f => {
+      sandboxed_frame = f;
+      add_completion_callback(() => f.remove());
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0);
+      assert_false(data.clients.includes(expected_base_url +
+                                         '?sandboxed-iframe'));
+    });
+}, 'Prepare an iframe sandboxed by <iframe sandbox="allow-scripts">.');
+
+promise_test(t => {
+  return with_sandboxed_iframe(SCOPE + '?sandboxed-iframe-same-origin',
+                               'allow-scripts allow-same-origin')
+    .then(f => {
+      sandboxed_same_origin_frame = f;
+      add_completion_callback(() => f.remove());
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1);
+      assert_equals(requests[0],
+                    expected_base_url + '?sandboxed-iframe-same-origin');
+      assert_true(data.clients.includes(
+        expected_base_url + '?sandboxed-iframe-same-origin'));
+    })
+}, 'Prepare an iframe sandboxed by ' +
+   '<iframe sandbox="allow-scripts allow-same-origin">.');
+
+promise_test(t => {
+  const iframe_full_url = expected_base_url + '?sandbox=allow-scripts&' +
+                          'sandboxed-frame-by-header';
+  return with_iframe(iframe_full_url)
+    .then(f => {
+      sandboxed_frame_by_header = f;
+      add_completion_callback(() => f.remove());
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'Service worker should provide the response');
+      assert_equals(requests[0], iframe_full_url);
+      assert_false(data.clients.includes(iframe_full_url),
+                   'Service worker should NOT control the sandboxed page');
+    });
+}, 'Prepare an iframe sandboxed by CSP HTTP header with allow-scripts.');
+
+promise_test(t => {
+  const iframe_full_url =
+    expected_base_url + '?sandbox=allow-scripts%20allow-same-origin&' +
+    'sandboxed-iframe-same-origin-by-header';
+  return with_iframe(iframe_full_url)
+    .then(f => {
+      sandboxed_same_origin_frame_by_header = f;
+      add_completion_callback(() => f.remove());
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1);
+      assert_equals(requests[0], iframe_full_url);
+      assert_true(data.clients.includes(iframe_full_url));
+    })
+}, 'Prepare an iframe sandboxed by CSP HTTP header with allow-scripts and ' +
+   'allow-same-origin.');
+
+promise_test(t => {
+  let frame = normal_frame;
+  return doTest(frame, 'fetch')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The fetch request should be handled by SW.');
+      assert_equals(requests[0], frame.src + '&test=fetch');
+    });
+}, 'Fetch request from a normal iframe');
+
+promise_test(t => {
+  let frame = normal_frame;
+  return doTest(frame, 'fetch-from-worker')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The fetch request should be handled by SW.');
+      assert_equals(requests[0], frame.src + '&test=fetch-from-worker');
+    });
+}, 'Fetch request from a worker in a normal iframe');
+
+promise_test(t => {
+  let frame = normal_frame;
+  return doTest(frame, 'iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The request should be handled by SW.');
+      assert_equals(requests[0], frame.src + '&test=iframe');
+      assert_true(data.clients.includes(frame.src + '&test=iframe'));
+
+    });
+}, 'Request for an iframe in the normal iframe');
+
+promise_test(t => {
+  let frame = normal_frame;
+  return doTest(frame, 'sandboxed-iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts flag in the normal ' +
+   'iframe');
+
+promise_test(t => {
+  let frame = normal_frame;
+  return doTest(frame, 'sandboxed-iframe-same-origin')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The request should be handled by SW.');
+      assert_equals(requests[0],
+                    frame.src + '&test=sandboxed-iframe-same-origin');
+      assert_true(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe-same-origin'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts and ' +
+   'allow-same-origin flag in the normal iframe');
+
+promise_test(t => {
+  let frame = sandboxed_frame;
+  return doTest(frame, 'fetch')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The fetch request should NOT be handled by SW.');
+    });
+}, 'Fetch request from iframe sandboxed by an attribute with allow-scripts ' +
+   'flag');
+
+promise_test(t => {
+  let frame = sandboxed_frame;
+  return doTest(frame, 'fetch-from-worker')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The fetch request should NOT be handled by SW.');
+    });
+}, 'Fetch request from a worker in iframe sandboxed by an attribute with ' +
+   'allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_frame;
+  return doTest(frame, 'iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(data.clients.includes(frame.src + '&test=iframe'));
+    });
+}, 'Request for an iframe in the iframe sandboxed by an attribute with ' +
+   'allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_frame;
+  return doTest(frame, 'sandboxed-iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts flag in the iframe ' +
+   'sandboxed by an attribute with allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_frame;
+  return doTest(frame, 'sandboxed-iframe-same-origin')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe-same-origin'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts and ' +
+   'allow-same-origin flag in the iframe sandboxed by an attribute with ' +
+   'allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame;
+  return doTest(frame, 'fetch')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The fetch request should be handled by SW.');
+      assert_equals(requests[0], frame.src + '&test=fetch');
+    });
+}, 'Fetch request from iframe sandboxed by an attribute with allow-scripts ' +
+   'and allow-same-origin flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame;
+  return doTest(frame, 'fetch-from-worker')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The fetch request should be handled by SW.');
+      assert_equals(requests[0],
+                    frame.src + '&test=fetch-from-worker');
+    });
+}, 'Fetch request from a worker in iframe sandboxed by an attribute with ' +
+   'allow-scripts and allow-same-origin flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame;
+  return doTest(frame, 'iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The request should be handled by SW.');
+      assert_equals(requests[0], frame.src + '&test=iframe');
+      assert_true(data.clients.includes(frame.src + '&test=iframe'));
+    });
+}, 'Request for an iframe in the iframe sandboxed by an attribute with ' +
+   'allow-scripts and allow-same-origin flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame;
+  return doTest(frame, 'sandboxed-iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts flag in the iframe ' +
+   'sandboxed by attribute with allow-scripts and allow-same-origin flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame;
+  return doTest(frame, 'sandboxed-iframe-same-origin')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The request should be handled by SW.');
+      assert_equals(requests[0],
+                    frame.src + '&test=sandboxed-iframe-same-origin');
+      assert_true(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe-same-origin'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts and ' +
+   'allow-same-origin flag in the iframe sandboxed by attribute with ' +
+   'allow-scripts and allow-same-origin flag');
+
+promise_test(t => {
+  let frame = sandboxed_frame_by_header;
+  return doTest(frame, 'fetch')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+    });
+}, 'Fetch request from iframe sandboxed by CSP HTTP header with ' +
+   'allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_frame_by_header;
+  return doTest(frame, 'iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(data.clients.includes(frame.src + '&test=iframe'));
+    });
+}, 'Request for an iframe in the iframe sandboxed by CSP HTTP header with ' +
+   'allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_frame_by_header;
+  return doTest(frame, 'sandboxed-iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts flag in the iframe ' +
+   'sandboxed by CSP HTTP header with allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_frame_by_header;
+  return doTest(frame, 'sandboxed-iframe-same-origin')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe-same-origin'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts and ' +
+   'allow-same-origin flag in the iframe sandboxed by CSP HTTP header with ' +
+   'allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame_by_header;
+  return doTest(frame, 'fetch')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The request should be handled by SW.');
+      assert_equals(requests[0], frame.src + '&test=fetch');
+    });
+}, 'Fetch request from iframe sandboxed by CSP HTTP header with ' +
+   'allow-scripts and allow-same-origin flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame_by_header;
+  return doTest(frame, 'iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The request should be handled by SW.');
+      assert_equals(requests[0], frame.src + '&test=iframe');
+      assert_true(data.clients.includes(frame.src + '&test=iframe'));
+    });
+}, 'Request for an iframe in the iframe sandboxed by CSP HTTP header with ' +
+   'allow-scripts and allow-same-origin flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame_by_header;
+  return doTest(frame, 'sandboxed-iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(
+        data.clients.includes(frame.src + '&test=sandboxed-iframe'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts flag in the ' +
+   'iframe sandboxed by CSP HTTP header with allow-scripts and ' +
+   'allow-same-origin flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame_by_header;
+  return doTest(frame, 'sandboxed-iframe-same-origin')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The request should be handled by SW.');
+      assert_equals(requests[0],
+                    frame.src + '&test=sandboxed-iframe-same-origin');
+      assert_true(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe-same-origin'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts and ' +
+   'allow-same-origin flag in the iframe sandboxed by CSP HTTP header with ' +
+   'allow-scripts and allow-same-origin flag');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/sandboxed-iframe-navigator-serviceworker.https.html b/test/fixtures/wpt/service-workers/service-worker/sandboxed-iframe-navigator-serviceworker.https.html
new file mode 100644
index 000000000000..70be6ef9b0a9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/sandboxed-iframe-navigator-serviceworker.https.html
@@ -0,0 +1,120 @@
+<!DOCTYPE html>
+<title>Accessing navigator.serviceWorker in sandboxed iframe.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var lastCallbackId = 0;
+var callbacks = {};
+function postMessageAndWaitResult(frame) {
+  return new Promise(function(resolve, reject) {
+    var id = ++lastCallbackId;
+    callbacks[id] = resolve;
+    frame.contentWindow.postMessage({id:id}, '*');
+    const timeout = 1000;
+    step_timeout(() => reject("no msg back after " + timeout + "ms"), timeout);
+  });
+}
+
+window.onmessage = function(e) {
+  message = e.data;
+  var id = message['id'];
+  var callback = callbacks[id];
+  delete callbacks[id];
+  callback(message.result);
+};
+
+promise_test(function(t) {
+    var url = 'resources/sandboxed-iframe-navigator-serviceworker-iframe.html';
+    var frame;
+    return with_iframe(url)
+      .then(function(f) {
+          frame = f;
+          add_result_callback(() => { frame.remove(); });
+          return postMessageAndWaitResult(f);
+        })
+      .then(function(result) {
+          assert_equals(result, 'ok');
+        });
+  }, 'Accessing navigator.serviceWorker in normal iframe should not throw.');
+
+promise_test(function(t) {
+    var url = 'resources/sandboxed-iframe-navigator-serviceworker-iframe.html';
+    var frame;
+    return with_sandboxed_iframe(url, 'allow-scripts')
+      .then(function(f) {
+          frame = f;
+          add_result_callback(() => { frame.remove(); });
+          return postMessageAndWaitResult(f);
+        })
+      .then(function(result) {
+          assert_equals(
+              result,
+              'navigator.serviceWorker failed: SecurityError');
+        });
+  }, 'Accessing navigator.serviceWorker in sandboxed iframe should throw.');
+
+promise_test(function(t) {
+    var url = 'resources/sandboxed-iframe-navigator-serviceworker-iframe.html';
+    var frame;
+    return with_sandboxed_iframe(url, 'allow-scripts allow-same-origin')
+      .then(function(f) {
+          frame = f;
+          add_result_callback(() => { frame.remove(); });
+          return postMessageAndWaitResult(f);
+        })
+      .then(function(result) {
+          assert_equals(result, 'ok');
+        });
+  },
+  'Accessing navigator.serviceWorker in sandboxed iframe with ' +
+  'allow-same-origin flag should not throw.');
+
+promise_test(function(t) {
+    var url = 'resources/sandboxed-iframe-navigator-serviceworker-iframe.html';
+    var frame;
+    return new Promise(function(resolve) {
+          frame = document.createElement('iframe');
+          add_result_callback(() => { frame.remove(); });
+          frame.sandbox = '';
+          frame.src = url;
+          frame.onload = resolve;
+          document.body.appendChild(frame);
+          // Switch the sandbox attribute while loading the iframe.
+          frame.sandbox = 'allow-scripts allow-same-origin';
+        })
+      .then(function() {
+          return postMessageAndWaitResult(frame)
+        })
+      .then(function(result) {
+          // The HTML spec seems to say that changing the sandbox attribute
+          // after the iframe is inserted into its parent document does not
+          // affect the sandboxing. If that's true, the frame should still
+          // act as if it still doesn't have
+          // 'allow-scripts allow-same-origin' set and throw a SecurityError.
+          //
+          // 1) From Section 4.8.5 "The iframe element":
+          // "When an iframe element is inserted into a document that has a
+          // browsing context, the user agent must create a new browsing
+          // context..."
+          // 2) "Create a new browsing context" expands to Section 7.1
+          // "Browsing contexts", which includes creating a Document and
+          // "Implement the sandboxing for document."
+          // 3) "Implement the sandboxing" expands to Section 7.6 "Sandboxing",
+          // which includes "populate document's active sandboxing flag set".
+          //
+          // It's not clear whether navigation subsequently creates a new
+          // Document, but I'm assuming it wouldn't.
+          // https://html.spec.whatwg.org/multipage/embedded-content.html#attr-iframe-sandbox
+          assert_true(
+              false,
+              'should NOT get message back from a sandboxed frame where scripts are not allowed to execute');
+        })
+      .catch(msg => {
+        assert_true(msg.startsWith('no msg back'), 'expecting error message "no msg back"');
+      });
+  }, 'Switching iframe sandbox attribute while loading the iframe');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/secure-context.https.html b/test/fixtures/wpt/service-workers/service-worker/secure-context.https.html
new file mode 100644
index 000000000000..666a5d378760
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/secure-context.https.html
@@ -0,0 +1,57 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Ensure service worker is bypassed in insecure contexts</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+// This test checks that an HTTPS iframe embedded in an HTTP document is not
+// loaded via a service worker, since it's not a secure context. To that end, we
+// first register a service worker, wait for its activation, and create an
+// iframe that is controlled by said service worker. We use the iframe as a
+// way to receive messages from the service worker.
+// The bulk of the test begins by opening an HTTP window with the noopener
+// option, installing a message event handler, and embedding an HTTPS iframe. If
+// the browser behaves correctly then the iframe will be loaded from the network
+// and will contain a script that posts a message to the parent window,
+// informing it that it was loaded from the network. If, however, the iframe is
+// intercepted, the service worker will return a page with a script that posts a
+// message to the parent window, informing it that it was intercepted.
+// Upon getting either result, the window will report the result to the service
+// worker by navigating to a reporting URL. The service worker will then inform
+// all clients about the result, including the controlled iframe from the
+// beginning of the test. The message event handler will verify that the result
+// is as expected, concluding the test.
+promise_test(t => {
+    const SCRIPT = "resources/secure-context-service-worker.js";
+    const SCOPE = "resources/";
+    const HTTP_IFRAME_URL = get_host_info().HTTP_ORIGIN + base_path() + SCOPE + "secure-context/window.html";
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+        .then(registration => {
+            t.add_cleanup(() => {
+                return registration.unregister();
+            });
+            return wait_for_state(t, registration.installing, 'activated');
+        })
+        .then(() => {
+            return with_iframe(SCOPE + "blank.html");
+        })
+        .then(iframe => {
+            t.add_cleanup(() => {
+                iframe.remove();
+            });
+            return new Promise(resolve => {
+                iframe.contentWindow.navigator.serviceWorker.onmessage = t.step_func(event => {
+                    assert_equals(event.data, 'network');
+                    resolve();
+                });
+                window.open(HTTP_IFRAME_URL, 'MyWindow', 'noopener');
+            });
+        });
+})
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-connect.https.html b/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-connect.https.html
new file mode 100644
index 000000000000..226f4a40e4e9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-connect.https.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<title>Service Worker: CSP connect directive for ServiceWorker script</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+service_worker_test(
+    'resources/service-worker-csp-worker.py?directive=connect',
+    'CSP test for connect-src in ServiceWorkerGlobalScope');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-default.https.html b/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-default.https.html
new file mode 100644
index 000000000000..1d4e7624d861
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-default.https.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<title>Service Worker: CSP default directive for ServiceWorker script</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+service_worker_test(
+    'resources/service-worker-csp-worker.py?directive=default',
+    'CSP test for default-src in ServiceWorkerGlobalScope');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-script.https.html b/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-script.https.html
new file mode 100644
index 000000000000..14c2eb72bdc4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-script.https.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<title>Service Worker: CSP script directive for ServiceWorker script</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+service_worker_test(
+    'resources/service-worker-csp-worker.py?directive=script',
+    'CSP test for script-src in ServiceWorkerGlobalScope');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/service-worker-header.https.html b/test/fixtures/wpt/service-workers/service-worker/service-worker-header.https.html
new file mode 100644
index 000000000000..fb902cd1b455
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/service-worker-header.https.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<title>Service Worker: Service-Worker header</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(async t => {
+  const script = 'resources/service-worker-header.py'
+    + '?header&import=service-worker-header.py?no-header';
+  const scope = 'resources/service-worker-header';
+  const expected_url = normalizeURL(script);
+  const registration =
+    await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => registration.unregister());
+  assert_true(registration instanceof ServiceWorkerRegistration);
+
+  await wait_for_state(t, registration.installing, 'activated');
+  await registration.update();
+}, 'A request to fetch service worker main script should have Service-Worker '
+  + 'header and imported scripts should not have one');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/serviceworker-message-event-historical.https.html b/test/fixtures/wpt/service-workers/service-worker/serviceworker-message-event-historical.https.html
new file mode 100644
index 000000000000..fac8f2076fb6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/serviceworker-message-event-historical.https.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<title>Service Worker: ServiceWorkerMessageEvent</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(function(t) {
+    var scope = 'resources/blank.html';
+    var url = 'resources/postmessage-to-client-worker.js';
+    return service_worker_unregister_and_register(t, url, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          var w = frame.contentWindow;
+          var worker = w.navigator.serviceWorker.controller;
+          assert_equals(
+              self.ServiceWorkerMessageEvent, undefined,
+              'ServiceWorkerMessageEvent should not be defined.');
+          return new Promise(function(resolve) {
+              w.navigator.serviceWorker.onmessage = t.step_func(function(e) {
+                  assert_true(
+                      e instanceof w.MessageEvent,
+                      'message events should use MessageEvent interface.');
+                  assert_true(e.source instanceof w.ServiceWorker);
+                  assert_equals(e.type, 'message');
+                  assert_equals(e.source, worker,
+                                'source should equal to the controller.');
+                  assert_equals(e.ports.length, 0);
+                  resolve();
+                });
+              worker.postMessage('PING');
+            });
+        });
+  }, 'Test MessageEvent supplants ServiceWorkerMessageEvent.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/serviceworkerobject-scripturl.https.html b/test/fixtures/wpt/service-workers/service-worker/serviceworkerobject-scripturl.https.html
new file mode 100644
index 000000000000..6004985a3460
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/serviceworkerobject-scripturl.https.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<title>ServiceWorker object: scriptURL property</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+function url_test(name, url) {
+  const scope = 'resources/scope/' + name;
+  const expectedURL = normalizeURL(url);
+
+  promise_test(async t => {
+    const registration =
+        await service_worker_unregister_and_register(t, url, scope);
+    const worker = registration.installing;
+    assert_equals(worker.scriptURL, expectedURL, 'scriptURL');
+    await registration.unregister();
+  }, 'Verify the scriptURL property: ' + name);
+}
+
+url_test('relative', 'resources/empty-worker.js');
+url_test('with-fragment', 'resources/empty-worker.js#ref');
+url_test('with-query', 'resources/empty-worker.js?ref');
+url_test('absolute', normalizeURL('./resources/empty-worker.js'));
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/skip-waiting-installed.https.html b/test/fixtures/wpt/service-workers/service-worker/skip-waiting-installed.https.html
new file mode 100644
index 000000000000..b604f651b3c1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/skip-waiting-installed.https.html
@@ -0,0 +1,70 @@
+<!DOCTYPE html>
+<title>Service Worker: Skip waiting installed worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+promise_test(function(t) {
+    var scope = 'resources/blank.html?skip-waiting-installed';
+    var url1 = 'resources/empty.js';
+    var url2 = 'resources/skip-waiting-installed-worker.js';
+    var frame, frame_sw, service_worker, registration, onmessage, oncontrollerchanged;
+    var saw_message = new Promise(function(resolve) {
+        onmessage = function(e) {
+            resolve(e.data);
+          };
+        })
+      .then(function(message) {
+          assert_equals(
+            message, 'PASS',
+            'skipWaiting promise should be resolved with undefined');
+        });
+    var saw_controllerchanged = new Promise(function(resolve) {
+        oncontrollerchanged = function() {
+            assert_equals(
+                frame_sw.controller.scriptURL, normalizeURL(url2),
+                'Controller scriptURL should change to the second one');
+            assert_equals(registration.active.scriptURL, normalizeURL(url2),
+                          'Worker which calls skipWaiting should be active by controllerchange');
+            resolve();
+        };
+      });
+    return service_worker_unregister_and_register(t, url1, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          frame_sw = f.contentWindow.navigator.serviceWorker;
+          assert_equals(
+              frame_sw.controller.scriptURL, normalizeURL(url1),
+              'Document controller scriptURL should equal to the first one');
+          frame_sw.oncontrollerchange = t.step_func(oncontrollerchanged);
+          return navigator.serviceWorker.register(url2, {scope: scope});
+        })
+      .then(function(r) {
+          registration = r;
+          service_worker = r.installing;
+          return wait_for_state(t, service_worker, 'installed');
+        })
+      .then(function() {
+          var channel = new MessageChannel();
+          channel.port1.onmessage = t.step_func(onmessage);
+          service_worker.postMessage({port: channel.port2}, [channel.port2]);
+          return Promise.all([saw_message, saw_controllerchanged]);
+        })
+      .then(function() {
+          frame.remove();
+        });
+  }, 'Test skipWaiting when a installed worker is waiting');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/skip-waiting-using-registration.https.html b/test/fixtures/wpt/service-workers/service-worker/skip-waiting-using-registration.https.html
new file mode 100644
index 000000000000..412ee2a4438e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/skip-waiting-using-registration.https.html
@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<title>Service Worker: Skip waiting using registration</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+promise_test(function(t) {
+    var scope = 'resources/blank.html?skip-waiting-using-registration';
+    var url1 = 'resources/empty.js';
+    var url2 = 'resources/skip-waiting-worker.js';
+    var frame, frame_sw, sw_registration, oncontrollerchanged;
+    var saw_controllerchanged = new Promise(function(resolve) {
+        oncontrollerchanged = function(e) {
+            resolve(e);
+          };
+        })
+      .then(function(e) {
+          assert_equals(e.type, 'controllerchange',
+                        'Event name should be "controllerchange"');
+          assert_true(
+              e.target instanceof frame.contentWindow.ServiceWorkerContainer,
+              'Event target should be a ServiceWorkerContainer');
+          assert_equals(e.target.controller.state, 'activating',
+                        'Controller state should be activating');
+          assert_equals(
+              frame_sw.controller.scriptURL, normalizeURL(url2),
+              'Controller scriptURL should change to the second one');
+        });
+
+    return service_worker_unregister_and_register(t, url1, scope)
+      .then(function(registration) {
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          t.add_cleanup(function() {
+              f.remove();
+            });
+          frame = f;
+          frame_sw = f.contentWindow.navigator.serviceWorker;
+          assert_equals(
+              frame_sw.controller.scriptURL, normalizeURL(url1),
+              'Document controller scriptURL should equal to the first one');
+          frame_sw.oncontrollerchange = t.step_func(oncontrollerchanged);
+          return navigator.serviceWorker.register(url2, {scope: scope});
+        })
+      .then(function(registration) {
+          sw_registration = registration;
+          t.add_cleanup(function() {
+              return registration.unregister();
+            });
+          return saw_controllerchanged;
+        })
+      .then(function() {
+          assert_not_equals(sw_registration.active, null,
+                            'Registration active worker should not be null');
+          return fetch_tests_from_worker(sw_registration.active);
+        });
+  }, 'Test skipWaiting while a client is using the registration');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/skip-waiting-without-client.https.html b/test/fixtures/wpt/service-workers/service-worker/skip-waiting-without-client.https.html
new file mode 100644
index 000000000000..62060a82472f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/skip-waiting-without-client.https.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<title>Service Worker: Skip waiting without client</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+service_worker_test(
+    'resources/skip-waiting-worker.js',
+    'Test single skipWaiting() when no client attached');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/skip-waiting-without-using-registration.https.html b/test/fixtures/wpt/service-workers/service-worker/skip-waiting-without-using-registration.https.html
new file mode 100644
index 000000000000..ced64e5f67fb
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/skip-waiting-without-using-registration.https.html
@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+<title>Service Worker: Skip waiting without using registration</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+promise_test(function(t) {
+    var scope = 'resources/blank.html?skip-waiting-without-using-registration';
+    var url = 'resources/skip-waiting-worker.js';
+    var frame_sw, sw_registration;
+
+    return service_worker_unregister(t, scope)
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          t.add_cleanup(function() {
+              f.remove();
+            });
+          frame_sw = f.contentWindow.navigator.serviceWorker;
+          assert_equals(frame_sw.controller, null,
+                        'Document controller should be null');
+          return navigator.serviceWorker.register(url, {scope: scope});
+        })
+      .then(function(registration) {
+          sw_registration = registration;
+          t.add_cleanup(function() {
+              return registration.unregister();
+            });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          assert_equals(frame_sw.controller, null,
+                        'Document controller should still be null');
+          assert_not_equals(sw_registration.active, null,
+                            'Registration active worker should not be null');
+          return fetch_tests_from_worker(sw_registration.active);
+        });
+  }, 'Test skipWaiting while a client is not being controlled');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/skip-waiting.https.html b/test/fixtures/wpt/service-workers/service-worker/skip-waiting.https.html
new file mode 100644
index 000000000000..f8392fc955b4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/skip-waiting.https.html
@@ -0,0 +1,58 @@
+<!DOCTYPE html>
+<title>Service Worker: Skip waiting</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+promise_test(function(t) {
+    var scope = 'resources/blank.html?skip-waiting';
+    var url1 = 'resources/empty.js';
+    var url2 = 'resources/empty-worker.js';
+    var url3 = 'resources/skip-waiting-worker.js';
+    var sw_registration, activated_worker, waiting_worker;
+    return service_worker_unregister_and_register(t, url1, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          sw_registration = registration;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          t.add_cleanup(function() {
+              f.remove();
+            });
+          return navigator.serviceWorker.register(url2, {scope: scope});
+        })
+      .then(function(registration) {
+          return wait_for_state(t, registration.installing, 'installed');
+        })
+      .then(function() {
+          activated_worker = sw_registration.active;
+          waiting_worker = sw_registration.waiting;
+          assert_equals(activated_worker.scriptURL, normalizeURL(url1),
+                        'Worker with url1 should be activated');
+          assert_equals(waiting_worker.scriptURL, normalizeURL(url2),
+                        'Worker with url2 should be waiting');
+          return navigator.serviceWorker.register(url3, {scope: scope});
+        })
+      .then(function(registration) {
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          assert_equals(activated_worker.state, 'redundant',
+                        'Worker with url1 should be redundant');
+          assert_equals(waiting_worker.state, 'redundant',
+                        'Worker with url2 should be redundant');
+          assert_equals(sw_registration.active.scriptURL, normalizeURL(url3),
+                        'Worker with url3 should be activated');
+        });
+  }, 'Test skipWaiting with both active and waiting workers');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/soft-update-fetch-metadata.https.html b/test/fixtures/wpt/service-workers/service-worker/soft-update-fetch-metadata.https.html
new file mode 100644
index 000000000000..45bf61701c38
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/soft-update-fetch-metadata.https.html
@@ -0,0 +1,88 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<meta name="timeout" content="long">
+<title>Test that soft update script fetches send the same Fetch Metadata headers as the initial fetches</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/utils.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const scope = 'resources/';
+
+async function register_worker(t, scriptURL, options) {
+  await service_worker_unregister(t, scope);
+  const registration = await navigator.serviceWorker.register(scriptURL, options);
+  t.add_cleanup(() => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+  return registration;
+}
+
+async function trigger_soft_update_and_get_records(recordsURL, expectedRecordCount) {
+  const frame = await with_iframe(scope + 'blank.html');
+  frame.remove();
+
+  let records = [];
+  let counter = 0;
+  do {
+    await new Promise(resolve => step_timeout(resolve, 50));
+    records = await (await fetch(recordsURL)).json();
+  } while (records.length < expectedRecordCount && ++counter < 100);
+
+  return records;
+}
+
+function assert_records(records, expectedRecordCount, expectedRecord, description) {
+  // We expect records[0] to be the registration triggered load and records[1] to be the soft update load.
+  assert_greater_than_equal(records.length, expectedRecordCount,
+                            `${description}, got ${JSON.stringify(records)}`);
+  for (let index = 0; index < records.length; ++index)
+    assert_object_equals(records[index], expectedRecord, `${description}, request #${index}`);
+}
+
+promise_test(async (t) => {
+  const scriptURL = `${scope}soft-update-fetch-metadata.py?token=${token()}&kind=classic`;
+  await register_worker(t, scriptURL);
+
+  const records = await trigger_soft_update_and_get_records(`${scriptURL}&get_records`, 2);
+  assert_records(records, 2, {
+    'service-worker': 'script',
+    'sec-fetch-dest': 'serviceworker',
+    'sec-fetch-mode': 'same-origin',
+    'sec-fetch-site': 'same-origin',
+    'url': new URL(scriptURL, window.location).toString(),
+  }, 'expected one install and one update check request for the main script');
+}, 'headers of the main script');
+
+promise_test(async (t) => {
+  const importToken = token();
+  const scriptURL = `${scope}soft-update-fetch-metadata.py?token=${token()}&kind=classic-with-import&importtoken=${importToken}`;
+  const importedScriptURL = `${scope}soft-update-fetch-metadata.py?token=${importToken}&kind=imported`;
+  await register_worker(t, scriptURL);
+
+  const records = await trigger_soft_update_and_get_records(`${importedScriptURL}&get_records`, 2);
+  assert_records(records, 2, {
+    'service-worker': null,
+    'sec-fetch-dest': 'script',
+    'sec-fetch-mode': 'no-cors',
+    'sec-fetch-site': 'same-origin',
+    'url': new URL(importedScriptURL, window.location).toString(),
+  }, 'expected one install and one update check request for the imported script');
+}, 'headers of a script imported by a classic script');
+
+promise_test(async (t) => {
+  const importToken = token();
+  const scriptURL = `${scope}soft-update-fetch-metadata.py?token=${token()}&kind=module-with-import&importtoken=${importToken}`;
+  const importedScriptURL = `${scope}soft-update-fetch-metadata.py?token=${importToken}&kind=imported`;
+  await register_worker(t, scriptURL, { type: 'module' });
+
+  const records = await trigger_soft_update_and_get_records(`${importedScriptURL}&get_records`, 2);
+  assert_records(records, 2, {
+    'url': window.location + importedScriptURL,
+    'service-worker': null,
+    'sec-fetch-dest': 'serviceworker',
+    'sec-fetch-mode': 'cors',
+    'sec-fetch-site': 'same-origin',
+    'url': new URL(importedScriptURL, window.location).toString(),
+  }, 'expected one install and one update check request for the imported module script');
+}, 'headers of a script imported by a module script');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/srcdoc-iframe.https.html b/test/fixtures/wpt/service-workers/service-worker/srcdoc-iframe.https.html
new file mode 100644
index 000000000000..9c1c88e15a8e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/srcdoc-iframe.https.html
@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<title>Service Worker: srcdoc frame handling</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+// This test attempts to verify various service worker behaviors in
+// srcdoc iframe.
+
+function runTestInSrcDocFrame(testFunc, testFuncParam) {
+  return new Promise((resolve, reject) => {
+    window.addEventListener('message', function onMsg(evt) {
+      if (evt.data.type !== 'TEST_RESULT') {
+        return;
+      }
+      window.removeEventListener('message', onMsg);
+      resolve(evt.data.result);
+    });
+    testFunc(testFuncParam);
+  });
+}
+
+async function doAsyncTest(t, testFuncName, expectedResult) {
+  const worker = 'resources/srcdoc-iframe-worker.js';
+  const scope = 'resources/srcdoc-iframe.html';
+
+  let reg = await service_worker_unregister_and_register(t, worker, scope);
+
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  await wait_for_state(t, reg.installing, 'activated');
+
+  let frame = await with_iframe(scope);
+  let scopeFullUlr = frame.contentWindow.location.href;
+
+  let testFunc = frame.contentWindow.srcdocFrame()[testFuncName];
+  let testResult = await runTestInSrcDocFrame(testFunc, scopeFullUlr);
+  assert_equals(testResult, expectedResult);
+
+  frame.remove();
+}
+
+promise_test(async function(t) {
+  await doAsyncTest(t, 'addSandboxedSrcdocFrame', 'NoController');
+}, 'nested sandboxed srcdoc frame should not inherit controller');
+
+promise_test(async function(t) {
+  await doAsyncTest(t, 'addSameOriginSandboxedSrcdocFrame', 'HasController');
+}, 'nested same origin sandboxed srcdoc frame should inherit controller');
+
+promise_test(async function(t) {
+  await doAsyncTest(t, 'fetchResource', 'passed');
+}, 'should be able to serve resource from controller for srcdoc frame');
+
+promise_test(async function(t) {
+  await doAsyncTest(t, 'getServiceWorkerRegistration', 'passed');
+}, 'getRegistration should work in srcdoc iframe');
+
+promise_test(async function(t) {
+  await doAsyncTest(t, 'postMessageToController', 'passed');
+}, 'controller.postMessage should work in srcdoc iframe');
+
+</script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/state.https.html b/test/fixtures/wpt/service-workers/service-worker/state.https.html
new file mode 100644
index 000000000000..7358e58ff14a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/state.https.html
@@ -0,0 +1,74 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+promise_test(function (t) {
+    var currentState = 'test-is-starting';
+    var scope = 'resources/state/';
+
+    return service_worker_unregister_and_register(
+        t, 'resources/empty-worker.js', scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          var sw = registration.installing;
+
+          assert_equals(sw.state, 'installing',
+                        'the service worker should be in "installing" state.');
+          checkStateTransition(sw.state);
+          return onStateChange(sw);
+        });
+
+    function checkStateTransition(newState) {
+        switch (currentState) {
+        case 'test-is-starting':
+            break; // anything goes
+        case 'installing':
+            assert_in_array(newState, ['installed', 'redundant']);
+            break;
+        case 'installed':
+            assert_in_array(newState, ['activating', 'redundant']);
+            break;
+        case 'activating':
+            assert_in_array(newState, ['activated', 'redundant']);
+            break;
+        case 'activated':
+            assert_equals(newState, 'redundant');
+            break;
+        case 'redundant':
+            assert_unreached('a ServiceWorker should not transition out of ' +
+                             'the "redundant" state');
+            break;
+        default:
+            assert_unreached('should not transition into unknown state "' +
+                             newState + '"');
+            break;
+        }
+        currentState = newState;
+    }
+
+    function onStateChange(expectedTarget) {
+      return new Promise(function(resolve) {
+            expectedTarget.addEventListener('statechange', resolve);
+          }).then(function(event) {
+            assert_true(event.target instanceof ServiceWorker,
+                        'the target of the statechange event should be a ' +
+                        'ServiceWorker.');
+            assert_equals(event.target, expectedTarget,
+                          'the target of the statechange event should be ' +
+                          'the installing ServiceWorker');
+            assert_equals(event.type, 'statechange',
+                          'the type of the event should be "statechange".');
+
+            checkStateTransition(event.target.state);
+
+            if (event.target.state != 'activated')
+                return onStateChange(expectedTarget);
+          });
+    }
+}, 'Service Worker state property and "statechange" event');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-cross-origin-navigation.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-cross-origin-navigation.https.html
new file mode 100644
index 000000000000..0413bccfbd8e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-cross-origin-navigation.https.html
@@ -0,0 +1,71 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Static Router: Cross-origin navigation via cache source</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+const host_info = get_host_info();
+const path = new URL(".", window.location).pathname;
+const remote_origin = host_info.HTTPS_REMOTE_ORIGIN;
+
+// Use the rule that matches all requests and serves from cache.
+const ROUTER_KEY = 'condition-urlpattern-constructed-match-all-source-cache';
+const helper_url = `${remote_origin}${path}resources/register-static-router-iframe.html?key=${ROUTER_KEY}`;
+const target_url = `${remote_origin}${path}resources/cache.html`;
+
+promise_test(async t => {
+  // 1. Register SW on remote origin.
+  const remote_iframe = document.createElement('iframe');
+  t.add_cleanup(() => remote_iframe.remove());
+
+  const registered_promise = new Promise((resolve, reject) => {
+    window.addEventListener('message', e => {
+      if (e.data.type === 'registered') {
+        resolve();
+      } else if (e.data.type === 'error') {
+        reject(new Error(e.data.error));
+      }
+    });
+  });
+
+  remote_iframe.src = helper_url;
+  document.body.appendChild(remote_iframe);
+  await registered_promise;
+
+  // 2. Create same-origin iframe to initiate navigation.
+  const local_iframe = document.createElement('iframe');
+  t.add_cleanup(() => local_iframe.remove());
+  local_iframe.srcdoc = '<html><body></body></html>';
+  document.body.appendChild(local_iframe);
+
+  // Wait for srcdoc to load.
+  await new Promise(resolve => {
+    local_iframe.onload = resolve;
+  });
+
+  // 3. Click link inside local iframe to go to remote origin.
+  const link = local_iframe.contentDocument.createElement('a');
+  link.href = target_url;
+  link.innerText = 'Click me';
+  local_iframe.contentDocument.body.appendChild(link);
+
+  // Wait for the message from the cached response.
+  const cached_promise = new Promise(resolve => {
+    window.addEventListener('message', function handler(e) {
+      if (e.data.type === 'loaded_from_cache') {
+        window.removeEventListener('message', handler);
+        resolve();
+      }
+    });
+  });
+
+  link.click();
+  await cached_promise;
+
+  assert_true(true, "Navigation completed and loaded from cache");
+}, 'Cross-origin navigation with static router cache rule');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-fetch-event.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-fetch-event.https.html
new file mode 100644
index 000000000000..167e3af00909
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-fetch-event.https.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: routers are evaluated with the fetch-event source.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js">
+</script>
+<script src="resources/static-router-helpers.sub.js">
+</script>
+<body>
+<script>
+const ROUTER_KEY = 'condition-urlpattern-string-source-fetch-event';
+const REGISTERED_ROUTE = 'resources/simple.html';
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_KEY);
+  const rnd = randomString();
+  const iframe = await createIframe(t, `${REGISTERED_ROUTE}?nonce=${rnd}`);
+  const {errors, requests} = await get_info_from_worker(worker);
+
+  assert_equals(errors.length, 0);
+  assert_equals(requests.length, 1);
+  assert_equals(iframe.contentWindow.document.body.innerText, rnd);
+}, 'Main resource matched the rule with fetch-event source');
+
+iframeTest(REGISTERED_ROUTE, ROUTER_KEY, async (t, iwin, worker) => {
+  const rnd = randomString();
+  const response = await iwin.fetch(`?nonce=${rnd}`);
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), rnd);
+  const {requests} = await get_info_from_worker(worker);
+  // Main resource request + subreosurce request = 2.
+  assert_equals(requests.length, 2);
+}, 'Subresource load matched the rule fetch-event source');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-invalid-rules.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-invalid-rules.https.html
new file mode 100644
index 000000000000..958d74374d8c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-invalid-rules.https.html
@@ -0,0 +1,93 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: registration of invalid rules should raise.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js">
+</script>
+<script src="resources/static-router-helpers.sub.js">
+</script>
+<body>
+<script>
+
+const ROUTER_RULE_KEY_INVALID_BYTESTRING_REQUEST_METHOD =
+    'condition-invalid-bytestring-request-method';
+const ROUTER_RULE_KEY_INVALID_HTTP_REQUEST_METHOD =
+    'condition-invalid-http-request-method';
+const ROUTER_RULE_KEY_FORBIDDEN_REQUEST_METHOD =
+    'condition-invalid-forbidden-method';
+const ROUTER_RULE_KEY_INVALID_REQUEST_METHOD =
+    'condition-invalid-request-method';
+const ROUTER_RULE_KEY_INVALID_OR_CONDITION_DEPTH =
+    'condition-invalid-or-condition-depth';
+const ROUTER_RULE_KEY_INVALID_NOT_CONDITION_DEPTH =
+    'condition-invalid-not-condition-depth';
+const ROUTER_RULE_KEY_INVALID_ROUTER_SIZE =
+    'condition-invalid-router-size';
+const ROUTER_RULE_KEY_LACK_OF_CONDITION =
+    'condition-lack-of-condition';
+const ROUTER_RULE_KEY_LACK_OF_SOURCE =
+    'condition-lack-of-source';
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_INVALID_BYTESTRING_REQUEST_METHOD);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise for invalid ByteString request method.');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_INVALID_HTTP_REQUEST_METHOD);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise for invalid HTTP request method.');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_FORBIDDEN_REQUEST_METHOD);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise for forbidden request method.');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_INVALID_OR_CONDITION_DEPTH);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise if or condition exceeds the depth limit');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_INVALID_NOT_CONDITION_DEPTH);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise if not condition exceeds the depth limit');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_INVALID_ROUTER_SIZE);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise if the number of router rules exceeds the length limit');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_LACK_OF_CONDITION);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise if the conditon does not exist in the rule');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_LACK_OF_SOURCE);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise if the source does not exiswt in the rule');
+
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-main-resource.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-main-resource.https.html
new file mode 100644
index 000000000000..71bc0697f9c0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-main-resource.https.html
@@ -0,0 +1,93 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: simply skip fetch handler for main resource if pattern matches
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/static-router-helpers.sub.js"></script>
+<body>
+<script>
+const ROUTER_RULE_KEY = 'condition-urlpattern-constructed-source-network';
+const ROUTER_RULE_NOT_KEY = 'condition-urlpattern-not-source-network';
+const ROUTER_RULE_KEY_IGNORE_CASE =
+  'condition-urlpattern-constructed-ignore-case-source-network';
+const ROUTER_RULE_KEY_RESPECT_CASE =
+  'condition-urlpattern-constructed-respect-case-source-network';
+const ROUTER_RULE_KEY_URLPATTERN_CACHE =
+  'condition-urlpattern-string-source-cache';
+const ROUTER_RULE_KEY_REQUEST_CACHE = 'condition-request-navigate-source-cache';
+const ROUTER_RULE_KEY_URLPATTERN_CACHE_WITH_NAME =
+  'condition-urlpattern-string-source-cache-with-name';
+const REGISTERED_ROUTE = 'resources/direct.txt';
+const CACHED_ROUTE = 'resources/cache.txt';
+const NON_REGISTERED_ROUTE = 'resources/simple.html';
+const NOT_ROUTE = 'resources/not.txt';
+const host_info = get_host_info();
+const path = new URL(".", window.location).pathname;
+
+iframeTest(REGISTERED_ROUTE, ROUTER_RULE_KEY, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "Network\n");
+}, 'Main resource load matched with the condition');
+
+iframeTest(REGISTERED_ROUTE, ROUTER_RULE_KEY_IGNORE_CASE, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "Network\n");
+}, 'Main resource load matched with the ignore case condition');
+
+iframeTest(REGISTERED_ROUTE, ROUTER_RULE_KEY_RESPECT_CASE, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+}, 'Main resource load matched without the ignore case condition');
+
+iframeTest(NON_REGISTERED_ROUTE, ROUTER_RULE_KEY, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(
+    requests[0].url,
+    `${host_info['HTTPS_ORIGIN']}${path}${NON_REGISTERED_ROUTE}`);
+  assert_equals(requests[0].mode, 'navigate');
+}, 'Main resource load not matched with the condition');
+
+iframeTest(CACHED_ROUTE, ROUTER_RULE_KEY_URLPATTERN_CACHE, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "From cache");
+}, 'Main resource load matched with the cache source');
+
+iframeTest(NON_REGISTERED_ROUTE, ROUTER_RULE_KEY_REQUEST_CACHE, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  // When the request matched to the rule with the "cache" source but failed to
+  // get the cache entry, the fetch handler is not involved and the network
+  // fallback is triggered instead.
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "Here's a simple html file.");
+}, 'Main resource fallback to the network when there is no cache entry');
+
+iframeTest(CACHED_ROUTE, ROUTER_RULE_KEY_URLPATTERN_CACHE_WITH_NAME, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "From cache");
+}, 'Main resource load matched with the cache source, with specifying the cache name');
+
+iframeTest(NOT_ROUTE, ROUTER_RULE_NOT_KEY, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(
+    requests[0].url,
+    `${host_info['HTTPS_ORIGIN']}${path}${NOT_ROUTE}`);
+  assert_equals(requests[0].mode, 'navigate');
+}, 'Main resource load should not match the condition with not');
+
+iframeTest(REGISTERED_ROUTE, ROUTER_RULE_NOT_KEY, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "Network\n");
+}, 'Main resource load should match the condition without not');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-multiple-router-registrations.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-multiple-router-registrations.https.html
new file mode 100644
index 000000000000..dd7ff1e4e9dd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-multiple-router-registrations.https.html
@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: routers are registered multiple times.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js">
+</script>
+<script src="resources/static-router-helpers.sub.js">
+</script>
+<body>
+<script>
+const ROUTER_KEY_MULTIPLE_RULES = 'multiple-router-rules';
+const ROUTER_KEY_1 = 'condition-urlpattern-string-source-network';
+const ROUTER_KEY_2 = 'condition-request-method-post-network';
+
+const REGISTERED_ROUTE_1 = 'resources/direct.txt';
+const REGISTERED_ROUTE_2 = 'resources/direct.html';
+const REGISTERED_ROUTE_3 = 'direct.py';
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_KEY_MULTIPLE_RULES);
+
+  // Matched with the first rule.
+  const iframe = await createIframe(t, REGISTERED_ROUTE_1);
+  assert_equals(iframe.contentWindow.document.body.innerText, "Network\n");
+
+  // Matched with the second rule.
+  const second_iframe = await createIframe(t, REGISTERED_ROUTE_2);
+  assert_equals(second_iframe.contentWindow.document.body.innerText, "Here's a direct html from network.");
+
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+}, 'Main reosurce load matched with the service worker having multiple rules');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t,
+    `${ROUTER_KEY_1}&imported-sw-router-key=${ROUTER_KEY_2}`);
+
+  // Matched with the first rule.
+  const iframe = await createIframe(t, REGISTERED_ROUTE_1);
+  assert_equals(iframe.contentWindow.document.body.innerText, "Network\n");
+  let info = await get_info_from_worker(worker);
+  assert_equals(info.requests.length, 0);
+
+  // Matched with the second rule, which is registered in the service worker
+  // loaded via `import` by the main script.
+  const response = await iframe.contentWindow.fetch(REGISTERED_ROUTE_3, {method: 'POST'});
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), "Network with POST request");
+  info = await get_info_from_worker(worker);
+  assert_equals(info.requests.length, 0);
+}, 'Resource load matched with the rule registered in the imported service worker');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-mutiple-conditions.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-mutiple-conditions.https.html
new file mode 100644
index 000000000000..3d69411843c2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-mutiple-conditions.https.html
@@ -0,0 +1,112 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: routers are evaluated with the request method condition.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js">
+</script>
+<script src="resources/static-router-helpers.sub.js">
+</script>
+<body>
+<script>
+const ROUTER_KEY = 'multiple-conditions-network';
+const ROUTER_KEY_WITH_DESTINATION =
+  'multiple-conditions-with-destination-network';
+const HTML_FILE = 'resources/simple.html';
+const REQUEST_SRC = 'resources/direct.py';
+
+const is_matched = async (worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  return requests.length == 0;
+}
+
+const appendCSS = async (iwin, src) => {
+  const promise = new Promise(resolve => {
+    const link = iwin.document.createElement('link');
+    link.rel = 'stylesheet';
+    link.href = src;
+    iwin.document.head.appendChild(link);
+    link.onload = () => {
+      resolve(link);
+    };
+  });
+
+  return promise;
+};
+
+const appendScript = async (iwin, src) => {
+  const promise = new Promise(resolve => {
+    const script = iwin.document.createElement('script');
+    script.src = src;
+    iwin.document.body.appendChild(script);
+    script.onload = () => {
+      resolve(script);
+    };
+  });
+
+  return promise;
+};
+
+iframeTest(HTML_FILE, ROUTER_KEY, async (t, iwin, worker) => {
+  // Reset the fetch count created by the setup process.
+  await reset_info_in_worker(worker);
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+
+  // Expected condtion:
+  //  - urlPattern: { search: 'test' }
+  //  - mode: 'cors'
+  //  - method: POST
+
+  // Expect match.
+  let response = await iwin.fetch(`../${REQUEST_SRC}?test`, {mode: 'cors', method: 'post'});
+  assert_equals(response.status, 200);
+  assert_true(await is_matched(worker));
+  await reset_info_in_worker(worker);
+
+  // mode: 'no-cors' won't match.
+  response = await iwin.fetch(`../${REQUEST_SRC}?test`, {mode: 'no-cors', method: 'post'});
+  assert_false(await is_matched(worker));
+  await reset_info_in_worker(worker);
+
+  // method: GET won't match.
+  response = await iwin.fetch(`../${REQUEST_SRC}?test`, {mode: 'cors', method: 'get'});
+  assert_false(await is_matched(worker));
+  await reset_info_in_worker(worker);
+
+  // No seqarch query won't match.
+  response = await iwin.fetch(`../${REQUEST_SRC}`, {mode: 'cors', method: 'post'});
+  assert_false(await is_matched(worker));
+  await reset_info_in_worker(worker);
+}, 'Multiple conditions work with `and` operation');
+
+iframeTest(HTML_FILE, ROUTER_KEY_WITH_DESTINATION, async (t, iwin, worker) => {
+  // Reset the fetch count created by the setup process.
+  await reset_info_in_worker(worker);
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+
+  // Expected condtion:
+  //  - urlPattern: { search: 'test' }
+  //  - destination: style
+
+  // Expect match.
+  await appendCSS(iwin, `../${REQUEST_SRC}?test`);
+  assert_true(await is_matched(worker));
+  await reset_info_in_worker(worker);
+
+  // Other request destination won't match.
+  await appendScript(iwin, `../${REQUEST_SRC}?test`);
+  assert_false(await is_matched(worker));
+  await reset_info_in_worker(worker);
+
+  // No seqarch query won't match.
+  await appendCSS(iwin, `../${REQUEST_SRC}`);
+  assert_false(await is_matched(worker));
+  await reset_info_in_worker(worker);
+}, 'Multiple conditions including requestDestination work with `and` operation');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-no-fetch-handler.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-no-fetch-handler.https.html
new file mode 100644
index 000000000000..4dbbbe69c7df
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-no-fetch-handler.https.html
@@ -0,0 +1,60 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: routers are evaluated when there is no fetch handler.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js">
+</script>
+<script src="resources/static-router-helpers.sub.js">
+</script>
+<body>
+<script>
+const RULE_KEY_SOURCE_CACHE = 'condition-urlpattern-string-source-cache';
+const RULE_KEY_SOURCE_FETCH_EVENT =
+    'condition-request-source-fetch-event';
+const RULE_KEY_SOURCE_RACE_NETWORK_AND_FETCH_HANDLER =
+    'condition-urlpattern-string-source-race-network-and-fetch-handler';
+const SW_SRC = 'resources/static-router-no-fetch-handler-sw.js';
+const CACHED_FILE = 'cache.txt';
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, RULE_KEY_SOURCE_CACHE, SW_SRC);
+
+  // Matched with the main reosurce load.
+  const {contentWindow} = await createIframe(t, `resources/${CACHED_FILE}`);
+  assert_equals(contentWindow.document.body.innerText, "From cache");
+
+  // Matched with the subreosurce load.
+  const response = await contentWindow.fetch(CACHED_FILE);
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), "From cache");
+
+  // Both requests are served from cache.
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+}, 'The router rule is evaluated without fetch handlers in service worker');
+
+promise_test(async t => {
+  const worker =
+      await registerAndActivate(t, RULE_KEY_SOURCE_FETCH_EVENT, SW_SRC);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise if the fetch-event source is used without onfetch')
+
+promise_test(async t => {
+  const worker =
+      await registerAndActivate(t,
+          RULE_KEY_SOURCE_RACE_NETWORK_AND_FETCH_HANDLER, SW_SRC);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise if the race-network-and-fetch-handler source is used without onfetch')
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-race-network-and-fetch-handler.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-race-network-and-fetch-handler.https.html
new file mode 100644
index 000000000000..6bc2fff1d874
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-race-network-and-fetch-handler.https.html
@@ -0,0 +1,116 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: routers are evaluated with the request desitnation condition.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js">
+</script>
+<script src="resources/static-router-helpers.sub.js">
+</script>
+<body>
+<script>
+const ROUTER_KEY = 'condition-urlpattern-string-source-race-network-and-fetch-handler';
+const SW_SRC = 'resources/static-router-race-network-and-fetch-handler-sw.js';
+const FRAME_SRC = 'resources/direct.py';
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, ROUTER_KEY, SW_SRC);
+  const iframe = await createIframe(t, `${FRAME_SRC}?nonce=${rnd}&server_slow`);
+  // Expect the response from the fetch handler.
+  assert_equals(iframe.contentWindow.document.body.innerText, rnd);
+  const {requests, errors}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(errors.length, 0);
+}, 'Main resource load matched the rule with race-network-and-fetch-handler source, and the fetch handler response is faster than the server response');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, ROUTER_KEY, SW_SRC);
+  const iframe = await createIframe(t, `${FRAME_SRC}?nonce=${rnd}&sw_slow`);
+  // Expect the response from the netowrk request.
+  assert_equals(iframe.contentWindow.document.body.innerText, "Network with GET request");
+  // Ensure the fetch handler is also executed.
+  const {requests, errors}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(errors.length, 0);
+}, 'Main resource load matched the rule with race-network-and-fetch-handler source, and the server reseponse is faster than the fetch handler');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, ROUTER_KEY, SW_SRC);
+  const iframe = await createIframe(t, `${FRAME_SRC}?nonce=${rnd}&server_slow&call_fetch`);
+  // Expect the response from the fetch handler.
+  assert_equals(iframe.contentWindow.document.body.innerText, rnd);
+  const {requests, errors}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(errors.length, 0);
+}, 'Main resource load matched the rule with race-network-and-fetch-handler source, and the fetch handler response is faster than the server response while fetch() is triggered inside the fetch handler');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, ROUTER_KEY, SW_SRC);
+  const iframe = await createIframe(t, `${FRAME_SRC}?nonce=${rnd}&sw_slow&call_fetch`);
+  // Expect the response from the netowrk request.
+  assert_equals(iframe.contentWindow.document.body.innerText, "Network with GET request");
+  // Ensure the fetch handler is also executed.
+  const {requests, errors}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(errors.length, 0);
+}, 'Main resource load matched the rule with race-network-and-fetch-handler source, and the server reseponse is faster than the fetch handler while fetch() is triggered inside the fetch handler');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, ROUTER_KEY, SW_SRC);
+  const iframe = await createIframe(t, FRAME_SRC);
+  // Expect the response from the fetch handler.
+  const response = await iframe.contentWindow.fetch(`?nonce=${rnd}&server_slow`);
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), rnd);
+  const {requests}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 2);
+}, 'Subresource load matched the rule with race-network-and-fetch-handler source, and the fetch handler response is faster than the server response');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, ROUTER_KEY, SW_SRC);
+  const iframe = await createIframe(t, FRAME_SRC);
+  // Expect the response from the network request.
+  const response = await iframe.contentWindow.fetch(`?nonce=${rnd}&sw_slow`);
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), "Network with GET request");
+  // Ensure the fetch handler is also executed.
+  const {requests}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 2);
+}, 'Subresource load matched the rule with race-network-and-fetch-handler source, and the server reseponse is faster than the fetch handler');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, ROUTER_KEY, SW_SRC);
+  const iframe = await createIframe(t, FRAME_SRC);
+  // Expect the response from the network request.
+  const response = await iframe.contentWindow.fetch(`?nonce=${rnd}&sw_slow&server_no_content`);
+  assert_equals(response.status, 204);
+  // Ensure the fetch handler is also executed.
+  const {requests}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 2);
+}, 'Subresource load matched the rule with race-network-and-fetch-handler source, and the server reseponse with 204 response is faster than the fetch handler');
+
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, ROUTER_KEY, SW_SRC);
+  const iframe = await createIframe(t, FRAME_SRC);
+  const response = await iframe.contentWindow.fetch(`?nonce=${rnd}&sw_slow&server_not_found`);
+  // Expect the response from the network request was faster, but the result was 404.
+  // So, the fetch handler result will be used instead.
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), rnd);
+  const {requests}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 2);
+}, 'Subresource load matched the rule with race-network-and-fetch-handler source, and the server reseponse is faster than the fetch handler, but not found');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-request-destination.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-request-destination.https.html
new file mode 100644
index 000000000000..55ad6da31aad
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-request-destination.https.html
@@ -0,0 +1,77 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: routers are evaluated with the request desitnation condition.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js">
+</script>
+<script src="resources/static-router-helpers.sub.js">
+</script>
+<body>
+<script>
+const ROUTER_KEY_DESTINATION_SCRIPT = 'condition-request-destination-script-network';
+const FRAME_SRC = 'resources/direct.html';
+const SCRIPT_SRC = 'direct.js';
+const STYLE_SRC = 'direct.txt';
+
+const appendScript = async (iwin, src) => {
+  const promise = new Promise(resolve => {
+    const script = iwin.document.createElement('script');
+    script.src = src;
+    iwin.document.body.appendChild(script);
+    script.onload = () => {
+      resolve(script);
+    };
+  });
+
+  return promise;
+};
+
+const appendCSS = async (iwin, src) => {
+  const promise = new Promise(resolve => {
+    const link = iwin.document.createElement('link');
+    link.rel = 'stylesheet';
+    link.href = src;
+    iwin.document.head.appendChild(link);
+    link.onload = () => {
+      resolve(link);
+    };
+  });
+
+  return promise;
+};
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_KEY_DESTINATION_SCRIPT);
+  const iframe = await createIframe(t, FRAME_SRC);
+
+  let info = await get_info_from_worker(worker);
+  assert_equals(info.requests.length, 1);
+  assert_equals(info.requests[0].destination, 'iframe');
+
+  // JavaScript is not handled by fetch handler.
+  await appendScript(iframe.contentWindow, SCRIPT_SRC);
+  assert_equals(iframe.contentWindow.router_condition_request_destination_script, true);
+  info = await get_info_from_worker(worker);
+  assert_equals(info.requests.length, 1);
+}, 'Subreosurce load matched with the requestMethod script condition');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_KEY_DESTINATION_SCRIPT);
+  const iframe = await createIframe(t, FRAME_SRC);
+
+  let info = await get_info_from_worker(worker);
+  assert_equals(info.requests.length, 1);
+  assert_equals(info.requests[0].destination, 'iframe');
+
+  // Stylesheet is not handled by fetch handler.
+  await appendCSS(iframe.contentWindow, STYLE_SRC);
+  info = await get_info_from_worker(worker);
+  assert_equals(info.requests.length, 2);
+  assert_equals(info.requests[1].destination, 'style');
+}, 'Subreosurce load not matched with the requestMethod script condition');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-request-method.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-request-method.https.html
new file mode 100644
index 000000000000..8e219532a3e6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-request-method.https.html
@@ -0,0 +1,59 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: routers are evaluated with the request method condition.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js">
+</script>
+<script src="resources/static-router-helpers.sub.js">
+</script>
+<body>
+<script>
+const ROUTER_KEY_MEHOD_GET = 'condition-request-method-get-network';
+const ROUTER_KEY_MEHOD_POST = 'condition-request-method-post-network';
+const ROUTER_KEY_MEHOD_PUT = 'condition-request-method-put-network';
+const ROUTER_KEY_MEHOD_DELETE = 'condition-request-method-delete-network';
+const REQUET_SRC = 'resources/direct.py';
+
+iframeTest(REQUET_SRC, ROUTER_KEY_MEHOD_GET, async (t, iwin, worker) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), "Network with GET request");
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+}, 'Subresource load matched with the requestMethod GET condition');
+
+iframeTest(REQUET_SRC, ROUTER_KEY_MEHOD_POST, async (t, iwin, worker) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd, {method: 'POST'});
+  assert_equals(await response.text(), "Network with POST request");
+  const {requests} = await get_info_from_worker(worker);
+  // The navigation request is the only request handled by fetch handler.
+  assert_equals(requests.length, 1);
+  assert_equals(requests[0].mode, 'navigate');
+}, 'Subresource load matched with the requestMethod POST condition');
+
+iframeTest(REQUET_SRC, ROUTER_KEY_MEHOD_PUT, async (t, iwin, worker) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd, {method: 'PUT'});
+  assert_equals(await response.text(), "Network with PUT request");
+  const {requests} = await get_info_from_worker(worker);
+  // The navigation request is the only request handled by fetch handler.
+  assert_equals(requests.length, 1);
+  assert_equals(requests[0].mode, 'navigate');
+}, 'Subresource load matched with the requestMethod PUT condition');
+
+iframeTest(REQUET_SRC, ROUTER_KEY_MEHOD_DELETE, async (t, iwin, worker) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd, {method: 'DELETE'});
+  assert_equals(await response.text(), "Network with DELETE request");
+  const {requests} = await get_info_from_worker(worker);
+  // The navigation request is the only request handled by fetch handler.
+  assert_equals(requests.length, 1);
+  assert_equals(requests[0].mode, 'navigate');
+}, 'Subresource load matched with the requestMethod DELETE condition');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-subresource.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-subresource.https.html
new file mode 100644
index 000000000000..ab05a3d25282
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-subresource.https.html
@@ -0,0 +1,202 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Static Router: simply skip fetch handler if pattern matches</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/static-router-helpers.sub.js"></script>
+<body>
+<script>
+const SCRIPT = 'resources/static-router-sw.js';
+const ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED =
+  'condition-urlpattern-constructed-source-network';
+const ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED_IGNORE_CASE =
+  'condition-urlpattern-constructed-ignore-case-source-network';
+const ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED_RESPECT_CASE =
+  'condition-urlpattern-constructed-respect-case-source-network';
+const ROUTER_RULE_KEY_URL_PATTERN_URLPATTERNCOMPATIBLE =
+  'condition-urlpattern-urlpatterncompatible-source-network';
+const ROUTER_RULE_KEY_URL_PATTERN_STRING =
+  'condition-urlpattern-string-source-network';
+const ROUTER_RULE_KEY_REQUEST = 'condition-request-source-network'
+const ROUTER_RULE_KEY_URL_PATTERN_STRING_CACHE =
+  'condition-urlpattern-string-source-cache';
+const ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED_MATCH_ALL_CACHE =
+  'condition-urlpattern-constructed-match-all-source-cache';
+const ROUTER_RULE_KEY_URLPATTERN_CACHE_WITH_NAME =
+  'condition-urlpattern-string-source-cache-with-name';
+const ROUTER_RULE_KEY_OR = 'condition-or-source-network'
+const ROUTER_RULE_KEY_NOT = 'condition-urlpattern-not-source-network';
+const SCOPE = 'resources/';
+const HTML_FILE = 'resources/simple.html';
+const TXT_FILE = 'resources/direct.txt';
+const CSV_FILE = 'resources/simple.csv';
+const NOT_FILE = 'resources/not.txt';
+// Warning: please prepare the corresponding `*.text.headers` files, otherwise
+// iframeTest() fails to load the following files due to MIME mismatches.
+const OR_TEST_FILES = [
+  'resources/or-test/direct1.text',
+  'resources/or-test/direct2.text',
+  'resources/or-test/does-not-exist.text',
+];
+
+iframeTest(HTML_FILE, ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), rnd);
+}, 'Subresource load not matched with URLPattern condition');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), "Network\n");
+}, 'Subresource load matched with URLPattern condition');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED, async (t, iwin, worker) => {
+  const rnd = randomString();
+  // Confirm that the given URLPatternCompatible has a wildcard pattern for the
+  // hostname. Also, if |urlPattern| is a consutructed URLPattern object,
+  // baseURL won't be set while adding router rules, thus it matches the cross
+  // origin request as far as other components matches. So expecting the direct
+  // network request and the fetch handler doesn't capture the response.
+  // The response is going to be a opaque.
+  const origin = get_host_info().HTTPS_REMOTE_ORIGIN;
+  const response = await iwin.fetch(
+    `${origin}/${TXT_FILE}?nonce=${rnd}`, {mode: 'no-cors'});
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  assert_equals(response.type, 'opaque');
+}, 'Subresource cross origin load matched with URLPattern condition via constructed object');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED_IGNORE_CASE, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), "Network\n");
+}, 'Subresource load matched with ignoreCase URLPattern condition');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED_RESPECT_CASE, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), rnd);
+}, 'Subresource load matched without ignoreCase URLPattern condition');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_URLPATTERNCOMPATIBLE, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), "Network\n");
+}, 'Subresource load matched with URLPattern condition via URLPatternCompatible');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_URLPATTERNCOMPATIBLE, async (t, iwin, worker) => {
+  // The SW script URL is added as a baseURL when |urlPattern| is passed via
+  // URLPatternCompatible, and there is not |baseURL| in it. Cross
+  // origin request will go through the fetch handler because |baseURL| info
+  // complements hostname with the hostname of the SW script.
+  const rnd = randomString();
+  const origin = get_host_info().HTTPS_REMOTE_ORIGIN;
+  const response = await iwin.fetch(`${origin}/${TXT_FILE}?nonce=${rnd}`);
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(await response.text(), rnd);
+}, 'Subresource cross origin load not matched with URLPattern condition via URLPatternCompatible');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_STRING, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), "Network\n");
+}, 'Subresource load matched with URLPattern condition via string');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_STRING, async (t, iwin, worker) => {
+  // The SW script URL is added as a baseURL when |urlPattern| is passed via
+  // string, and there is not |baseURL| in it. Cross origin request will go
+  // through the fetch handler because |baseURL| info complements hostname with
+  // the hostname of the SW script.
+  const rnd = randomString();
+  const origin = get_host_info().HTTPS_REMOTE_ORIGIN;
+  const response = await iwin.fetch(`${origin}/${TXT_FILE}?nonce=${rnd}`);
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(await response.text(), rnd);
+}, 'Subresource cross origin load not matched with URLPattern condition via string');
+
+iframeTest(CSV_FILE, ROUTER_RULE_KEY_REQUEST, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd, { mode: 'no-cors' });
+  assert_equals(await response.text(), "matched,with,non-url,conditions\n");
+}, 'Subresource load matched with RequestMode condition');
+
+iframeTest(OR_TEST_FILES[0], ROUTER_RULE_KEY_OR, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), "Network\n");
+}, 'Subresource load matched with the nested `or` condition');
+
+iframeTest(OR_TEST_FILES[1], ROUTER_RULE_KEY_OR, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), "Network\n");
+}, 'Subresource load matched with the next `or` condition');
+
+iframeTest(OR_TEST_FILES[2], ROUTER_RULE_KEY_OR, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), rnd);
+}, 'Subresource load not matched with `or` condition');
+
+iframeTest(HTML_FILE, ROUTER_RULE_KEY_URL_PATTERN_STRING_CACHE, async (t, iwin) => {
+  // No need to set `resources/` because the request is dispatched from iframe.
+  const CACHED_FILE = 'cache.txt';
+  const response = await iwin.fetch(CACHED_FILE);
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), "From cache");
+
+  // This doesn't match because the cache key is wrong.
+  const rnd = randomString();
+  const response_with_param = await iwin.fetch(`${CACHED_FILE}?nonce=${rnd}`);
+  assert_equals(response_with_param.status, 404);
+}, 'Subresource load matched with the cache source rule');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED_MATCH_ALL_CACHE, async (t, iwin, worker) => {
+  // Send a request, which is not stored in the cache, but it exists over the network.
+  const rnd = randomString();
+  let response = await iwin.fetch(`?nonce=${rnd}`);
+  assert_equals(await response.text(), "Network\n");
+  assert_equals(response.status, 200);
+
+  // Send a request, which is not stored in the cache, and does not exist over the network.
+  const NON_EXISTING_FILE = 'not-found.txt';
+  response = await iwin.fetch(`${NON_EXISTING_FILE}?nonce=${randomString()}`);
+  assert_equals(response.status, 404);
+
+  // Both requests are not handled by ServiceWorker.
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+}, 'Subresource load did not match with the cache and fallback to the network');
+
+iframeTest(HTML_FILE, ROUTER_RULE_KEY_URLPATTERN_CACHE_WITH_NAME, async (t, iwin, worker) => {
+  // No need to set `resources/` because the request is dispatched from iframe.
+  const CACHED_FILE = 'cache.txt';
+  const response = await iwin.fetch(CACHED_FILE);
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), "From cache");
+
+  // This doesn't match because the cache key is wrong.
+  const rnd = randomString();
+  const response_with_param = await iwin.fetch(`${CACHED_FILE}?nonce=${rnd}`);
+  assert_equals(response_with_param.status, 404);
+}, 'Subresource load matched with the cache source, with specifying the cache name');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_NOT, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch(`${NOT_FILE}?nonce=${rnd}`);
+  assert_equals(await response.text(), rnd);
+}, 'Subresource load should not match with the not condition');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_NOT, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), "Network\n");
+}, 'Subresource load should match with a file other than not');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/svg-target-reftest.https.html b/test/fixtures/wpt/service-workers/service-worker/svg-target-reftest.https.html
new file mode 100644
index 000000000000..3710ee61d85f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/svg-target-reftest.https.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<meta charset="utf-8">
+<title>Service worker interception does not break SVG fragment targets</title>
+<meta name="assert" content="SVG with link fragment should render correctly when intercepted by a service worker.">
+<script src="resources/test-helpers.sub.js"></script>
+<link rel="match" href="resources/svg-target-reftest-001.html">
+<p>Pass if you see a green box below.</p>
+<script>
+// We want to use utility functions designed for testharness.js where
+// there is a test object.  We don't have a test object in reftests
+// so fake one for now.
+const fake_test = { step_func: f => f };
+
+async function runTest() {
+  const script = './resources/pass-through-worker.js';
+  const scope = './resources/svg-target-reftest-frame.html';
+  let reg = await navigator.serviceWorker.register(script, { scope });
+  await wait_for_state(fake_test, reg.installing, 'activated');
+  let f = await with_iframe(scope);
+  document.documentElement.classList.remove('reftest-wait');
+  await reg.unregister();
+  // Note, we cannot remove the frame explicitly because we can't
+  // tell when the reftest completes.
+}
+runTest();
+</script>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/synced-state.https.html b/test/fixtures/wpt/service-workers/service-worker/synced-state.https.html
new file mode 100644
index 000000000000..0e9f63a9a2e5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/synced-state.https.html
@@ -0,0 +1,93 @@
+<!doctype html>
+<title>ServiceWorker: worker objects have synced state</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// Tests that ServiceWorker objects representing the same Service Worker
+// entity have the same state. JS-level equality is now required according to
+// the spec.
+'use strict';
+
+function nextChange(worker) {
+  return new Promise(function(resolve, reject) {
+      worker.addEventListener('statechange', function handler(event) {
+          try {
+            worker.removeEventListener('statechange', handler);
+            resolve(event.currentTarget.state);
+          } catch (err) {
+            reject(err);
+          }
+        });
+    });
+}
+
+promise_test(function(t) {
+    var scope = 'resources/synced-state';
+    var script = 'resources/empty-worker.js';
+    var registration, worker;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(r) {
+          registration = r;
+          worker = registration.installing;
+
+          t.add_cleanup(function() {
+              return r.unregister();
+            });
+
+          return nextChange(worker);
+        })
+      .then(function(state) {
+          assert_equals(state, 'installed',
+                        'original SW should be installed');
+          assert_equals(registration.installing, null,
+                        'in installed, .installing should be null');
+          assert_equals(registration.waiting, worker,
+                        'in installed, .waiting should be equal to the ' +
+                          'original worker');
+          assert_equals(registration.waiting.state, 'installed',
+                        'in installed, .waiting should be installed');
+          assert_equals(registration.active, null,
+                        'in installed, .active should be null');
+
+          return nextChange(worker);
+        })
+      .then(function(state) {
+          assert_equals(state, 'activating',
+                        'original SW should be activating');
+          assert_equals(registration.installing, null,
+                        'in activating, .installing should be null');
+          assert_equals(registration.waiting, null,
+                        'in activating, .waiting should be null');
+          assert_equals(registration.active, worker,
+                        'in activating, .active should be equal to the ' +
+                          'original worker');
+          assert_equals(
+              registration.active.state, 'activating',
+              'in activating, .active should be activating');
+
+          return nextChange(worker);
+        })
+      .then(function(state) {
+          assert_equals(state, 'activated',
+                        'original SW should be activated');
+          assert_equals(registration.installing, null,
+                        'in activated, .installing should be null');
+          assert_equals(registration.waiting, null,
+                        'in activated, .waiting should be null');
+          assert_equals(registration.active, worker,
+                        'in activated, .active should be equal to the ' +
+                          'original worker');
+          assert_equals(registration.active.state, 'activated',
+                        'in activated .active should be activated');
+        })
+      .then(function() {
+          return navigator.serviceWorker.getRegistration(scope);
+        })
+      .then(function(r) {
+          assert_equals(r, registration, 'getRegistration should return the ' +
+                                         'same object');
+        });
+  }, 'worker objects for the same entity have the same state');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/tentative/WEB_FEATURES.yml b/test/fixtures/wpt/service-workers/service-worker/tentative/WEB_FEATURES.yml
new file mode 100644
index 000000000000..5bee18ab21d0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/tentative/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [service-workers]
diff --git a/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-fallback.https.html b/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-fallback.https.html
new file mode 100644
index 000000000000..34a1674d5cf7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-fallback.https.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<title>Service Worker: download FetchEvent without respondWith() falls through (crbug.com/40410035)</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script src="../resources/fetch-event-download-helpers.js"></script>
+<body>
+<script>
+'use strict';
+
+// When the SW observes the download FetchEvent but does NOT call
+// event.respondWith(), the request must fall back to the network. We can't
+// observe the saved file from script, but we can observe that:
+//   (a) the SW saw the fetch event (so the new interception path ran), and
+//   (b) the page itself didn't navigate (so the click was treated as a
+//       download, not as a regular link click).
+
+const WORKER = 'resources/fetch-event-download-worker.js';
+const SCOPE = 'resources/';
+
+promise_test(async (t) => {
+  const reg = await service_worker_unregister_and_register(t, WORKER, SCOPE);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  const channelId = uniqueChannelId();
+  const targetUrl =
+      SCOPE + 'download-target.txt?channel=' + channelId + '&mode=fallback';
+  const messagePromise = nextChannelMessage(t, channelId);
+
+  const urlBefore = location.href;
+  await clickDownloadAnchor(t, targetUrl);
+
+  const data = await messagePromise;
+  assert_equals(data.type, 'fetch',
+      'SW must still observe the fetch event even without respondWith().');
+  assert_equals(data.destination, '');
+  assert_equals(data.mode, 'navigate',
+      'Download FetchEvent mode must be "navigate" (HTML "Downloading hyperlinks").');
+
+  // The page must not navigate as a result of the download click.
+  assert_equals(location.href, urlBefore,
+      'The page must not navigate when <a download> is clicked.');
+}, 'Download FetchEvent without respondWith() falls back without navigating the page.');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-out-of-scope.https.html b/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-out-of-scope.https.html
new file mode 100644
index 000000000000..3a71d85259a0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-out-of-scope.https.html
@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<title>Service Worker: download FetchEvent only fires for in-scope URLs (crbug.com/40410035)</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script src="../resources/fetch-event-download-helpers.js"></script>
+<body>
+<script>
+'use strict';
+
+// A download whose URL falls outside the SW's registration scope must NOT
+// dispatch a FetchEvent on that SW. We register the worker with scope
+// resources/ and then trigger a download against a URL outside that path.
+//
+// Verifying a *negative* (no message) requires a timeout. To avoid spurious
+// failures we first prove the SW is healthy by issuing an in-scope download
+// and observing its FetchEvent on the same channel; only after that do we
+// expect silence for the out-of-scope click.
+
+const WORKER = 'resources/fetch-event-download-worker.js';
+const SCOPE = 'resources/';
+const QUIET_TIMEOUT_MS = 500;
+
+promise_test(async (t) => {
+  const reg = await service_worker_unregister_and_register(t, WORKER, SCOPE);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Sanity: in-scope download dispatches a FetchEvent.
+  {
+    const channelId = uniqueChannelId();
+    const inScopeUrl = SCOPE + 'in-scope.txt?channel=' + channelId;
+    const message = nextChannelMessage(t, channelId);
+    await clickDownloadAnchor(t, inScopeUrl);
+    const data = await message;
+    assert_equals(data.type, 'fetch',
+        'In-scope sanity check: SW saw the fetch event.');
+  }
+
+  // Out-of-scope: same origin, but URL not under SCOPE → no FetchEvent.
+  {
+    const channelId = uniqueChannelId();
+    // 'out-of-scope.txt' has no leading 'resources/' segment, so it is not
+    // covered by the worker's scope.
+    const outOfScopeUrl = 'out-of-scope.txt?channel=' + channelId;
+    const sawMessage = awaitChannelSilence(t, channelId, QUIET_TIMEOUT_MS);
+    await clickDownloadAnchor(t, outOfScopeUrl);
+    const received = await sawMessage;
+    assert_false(received,
+        'SW must not receive a FetchEvent for an out-of-scope download URL.');
+  }
+}, 'Download FetchEvent fires only for URLs within the SW registration scope.');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-respond-with.https.html b/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-respond-with.https.html
new file mode 100644
index 000000000000..11c97c5bb05d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-respond-with.https.html
@@ -0,0 +1,55 @@
+<!DOCTYPE html>
+<title>Service Worker: event.respondWith() accepted for download FetchEvent (crbug.com/40410035)</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script src="../resources/fetch-event-download-helpers.js"></script>
+<body>
+<script>
+'use strict';
+
+// Verifies that a service worker may call event.respondWith() on a download
+// FetchEvent without raising errors. We can't read the saved file's bytes
+// from script (no filesystem access), so we assert the SW-side observable
+// outcome: the fetch event was dispatched, the SW called respondWith, and
+// no error event fired on the SW.
+
+const WORKER = 'resources/fetch-event-download-worker.js';
+const SCOPE = 'resources/';
+
+promise_test(async (t) => {
+  const reg = await service_worker_unregister_and_register(t, WORKER, SCOPE);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Watch for SW errors. Using `error` on the registration's active worker
+  // fires for uncaught exceptions thrown inside the worker, which is what
+  // a misbehaving respondWith() would surface as.
+  let workerError = null;
+  reg.active.addEventListener('error', (e) => { workerError = e; });
+
+  const channelId = uniqueChannelId();
+  // mode=respond is the worker's default; making it explicit for readability.
+  const targetUrl =
+      SCOPE + 'download-target.txt?channel=' + channelId + '&mode=respond';
+  const messagePromise = nextChannelMessage(t, channelId);
+
+  await clickDownloadAnchor(t, targetUrl);
+
+  const data = await messagePromise;
+  assert_equals(data.type, 'fetch',
+      'SW should observe the fetch event before respondWith() resolves.');
+  assert_equals(data.destination, '',
+      'Per HTML "Downloading hyperlinks", the request destination must be "".');
+
+  // Give the microtask that resolves respondWith()'s promise a turn to run,
+  // then ensure no error escaped from the worker.
+  await new Promise((r) => step_timeout(r, 100));
+  assert_equals(workerError, null,
+      'No error event should fire on the worker after respondWith().');
+}, 'event.respondWith() is accepted for a download FetchEvent.');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download.https.html b/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download.https.html
new file mode 100644
index 000000000000..21cd28003e69
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download.https.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<title>Service Worker: FetchEvent fires for &lt;a download&gt; (crbug.com/40410035)</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script src="../resources/fetch-event-download-helpers.js"></script>
+<body>
+<script>
+'use strict';
+
+// The SW lives at resources/fetch-event-download-worker.js with scope
+// resources/. The `<a download>` link points into that scope so the SW
+// receives the fetch event.
+const WORKER = 'resources/fetch-event-download-worker.js';
+const SCOPE = 'resources/';
+
+promise_test(async (t) => {
+  const reg = await service_worker_unregister_and_register(t, WORKER, SCOPE);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  const channelId = uniqueChannelId();
+  const targetUrl = SCOPE + 'download-target.txt?channel=' + channelId;
+  const messagePromise = nextChannelMessage(t, channelId);
+
+  await clickDownloadAnchor(t, targetUrl);
+
+  const data = await messagePromise;
+  assert_equals(data.type, 'fetch',
+      'SW should observe a fetch event for the download URL.');
+  assert_equals(new URL(data.url).pathname,
+      new URL(targetUrl, location).pathname,
+      'fetch event URL matches the <a download> target.');
+  assert_equals(data.destination, '',
+      'Per HTML "Downloading hyperlinks", the request destination must be "".');
+  assert_equals(data.mode, 'navigate',
+      'Per HTML "Downloading hyperlinks", the request mode must be "navigate".');
+  assert_equals(data.method, 'GET',
+      'Downloads use GET.');
+}, 'FetchEvent fires for <a download> with destination "".');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/tentative/static-router/README.md b/test/fixtures/wpt/service-workers/service-worker/tentative/static-router/README.md
new file mode 100644
index 000000000000..33e508aba2c4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/tentative/static-router/README.md
@@ -0,0 +1,4 @@
+A test suite for the ServiceWorker Static Routing API Resource Timing.
+
+Explainer: https://github.com/WICG/service-worker-static-routing-api/blob/main/resource-timing-api.md
+Resource-Timing Proposal: https://github.com/w3c/resource-timing/issues/389
diff --git a/test/fixtures/wpt/service-workers/service-worker/tentative/static-router/static-router-resource-timing.https.html b/test/fixtures/wpt/service-workers/service-worker/tentative/static-router/static-router-resource-timing.https.html
new file mode 100644
index 000000000000..5046c9a4e7c2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/tentative/static-router/static-router-resource-timing.https.html
@@ -0,0 +1,341 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: timing information should be shown when used.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
+<script src="/service-workers/service-worker/resources/static-router-helpers.sub.js"></script>
+<body>
+<script>
+const ROUTER_RULE_KEY = 'condition-urlpattern-constructed-source-network';
+const ROUTER_RULE_KEY_URLPATTERN_CACHE =
+  'condition-urlpattern-string-source-cache';
+const ROUTER_RULE_KEY_REQUEST_CACHE = 'condition-request-navigate-source-cache';
+const ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED_MATCH_ALL_CACHE =
+  'condition-urlpattern-constructed-match-all-source-cache';
+const ROUTER_RULE_KEY_REQUEST_FETCH = 'condition-urlpattern-string-source-fetch-event';
+const REGISTERED_ROUTE = '/service-workers/service-worker/resources/direct.txt';
+const CACHED_ROUTE = '/service-workers/service-worker/resources/cache.txt';
+const NON_REGISTERED_ROUTE = '/service-workers/service-worker/resources/simple.html';
+
+const RACE_ROUTER_KEY =
+  'condition-urlpattern-string-source-race-network-and-fetch-handler';
+const RACE_SW_SRC = '/service-workers/service-worker/resources/static-router-race-network-and-fetch-handler-sw.js';
+const RACE_ROUTE = '/service-workers/service-worker/resources/direct.py';
+
+const host_info = get_host_info();
+
+function resourceUrl(resource) {
+  return `${host_info['HTTPS_ORIGIN']}${resource}`;
+}
+
+// Verify existance of a PerformanceEntry and the order between the timings of
+// ServiceWorker Static routing API.
+//
+// |options| has these properties:
+// performance: Performance interface to verify existance of the entry.
+// url: the URL of resource
+// description: the description passed to each assertion.
+// matched_source: the expected matched source of router evaluation.
+// actual_source: the expected actual source used to get the resource.
+function test_resource_timing(options) {
+  const description = options.description;
+  const entryList = options.performance.getEntriesByName(resourceUrl(options.url));
+  assert_equals(entryList.length, 1, description);
+  const entry = entryList[0];
+
+  // FIXME: Remove workerMatchedSourceType and workerFinalSourceType when moved out of tentative.
+  const workerMatchedRouterSource = "workerMatchedRouterSource" in entry ? entry.workerMatchedRouterSource : entry.workerMatchedSourceType;
+  const workerFinalRouterSource = "workerFinalRouterSource" in entry ? entry.workerFinalRouterSource : entry.workerFinalSourceType;
+
+  assert_equals(workerMatchedRouterSource, options.matched_source_type, description);
+  assert_equals(workerFinalRouterSource, options.final_source_type, description);
+
+  assert_greater_than(entry.workerRouterEvaluationStart, 0, description);
+  switch (entry.matchedSouceType) {
+    case 'network':
+      assert_equals(entry.workerStart, 0, description);
+      assert_equals(entry.workerCacheLookupStart, 0, description);
+      assert_less_than_equal(entry.workerRouterEvaluationStart, entry.fetchStart, description);
+      assert_greater_than(entry.encodedBodySize, 0, description);
+      break;
+    case 'cache':
+      assert_equals(entry.workerStart, 0, description);
+      assert_greater_than_equal(entry.workerCacheLookupStart, entry.workerRouterEvaluationStart, description);
+      assert_greater_than(entry.encodedBodySize, 0, description);
+      if (entry.workerFinalSourceType === 'cache') {
+        assert_equals(entry.fetchStart, entry.responseStart, description);
+        assert_less_than_equal(entry.workerCacheLookupStart, entry.responseStart, description);
+        assert_equals(entry.deliveryType, 'cache-storage', description);
+      } else {
+        assert_less_than_equal(entry.workerCacheLookupStart, entry.fetchStart, description);
+      }
+      break;
+    case 'race-network-and-fetch-handler':
+      assert_equals(entry.workerCacheLookupStart, 0, description);
+      assert_greater_than(entry.encodedBodySize, 0, description);
+      if (entry.workerFinalSourceType === 'network') {
+        assert_equals(entry.workerStart, 0, description);
+        assert_less_than_equal(entry.workerRouterEvaluationStart, entry.fetchStart, description);
+      } else {
+        assert_greater_than_equal(entry.workerStart, entry.workerRouterEvaluationStart, description);
+        assert_greater_than_equal(entry.fetchStart, entry.workerStart, description);
+      }
+      break;
+    case 'fetch-event':
+      assert_greater_than(entry.encodedBodySize, 0, description);
+      break;
+    case '':  // i.e. no matching rules
+      assert_equals(entry.workerCacheLookupStart, 0, description);
+      assert_greater_than_equal(entry.workerStart, entry.workerRouterEvaluationStart, description);
+      assert_greater_than_equal(entry.fetchStart, entry.workerStart, description);
+      break;
+  }
+}
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_REQUEST_FETCH);
+  const rnd = randomString();
+  const url = `${NON_REGISTERED_ROUTE}?nonce=${rnd}`;
+  const iframe = await createIframe(t, url);
+  const {errors, requests} = await get_info_from_worker(worker);
+
+  assert_equals(errors.length, 0);
+  assert_equals(requests.length, 1);
+  assert_equals(iframe.contentWindow.document.body.innerText, rnd);
+
+  test_resource_timing({
+    performance: iframe.contentWindow.performance,
+    url: url,
+    matched_source_type: 'fetch-event',
+    final_source_type: 'fetch-event',
+    description: "fetch-event as source on main resource"
+  });
+}, 'Main resource matched the rule with fetch-event source');
+
+iframeTest(REGISTERED_ROUTE, ROUTER_RULE_KEY, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "Network\n");
+  test_resource_timing({
+    performance: iwin.performance,
+    url: REGISTERED_ROUTE,
+    matched_source_type: 'network',
+    final_source_type: 'network',
+    description: "network as source on main resource"
+  });
+}, 'Main resource load matched with the condition and resource timing');
+
+iframeTest(NON_REGISTERED_ROUTE, ROUTER_RULE_KEY, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(
+    requests[0].url,
+    resourceUrl(NON_REGISTERED_ROUTE));
+  assert_equals(requests[0].mode, 'navigate');
+  test_resource_timing({
+    performance: iwin.performance,
+    url: NON_REGISTERED_ROUTE,
+    matched_source_type: '',
+    final_source_type: '',
+    description: "no rule matched on main resource"
+  });
+}, 'Main resource load not matched with the condition and resource timing');
+
+iframeTest(CACHED_ROUTE, ROUTER_RULE_KEY_URLPATTERN_CACHE, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "From cache");
+  test_resource_timing({
+    performance: iwin.performance,
+    url: CACHED_ROUTE,
+    matched_source_type: 'cache',
+    final_source_type: 'cache',
+    description: "cache as source on main resource and cache hit"
+  });
+}, 'Main resource load matched with the cache source and resource timing');
+
+iframeTest(NON_REGISTERED_ROUTE, ROUTER_RULE_KEY_REQUEST_CACHE, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  // When the request matched to the rule with the "cache" source but failed to
+  // get the cache entry, the fetch handler is not involved and the network
+  // fallback is triggered instead.
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "Here's a simple html file.");
+  test_resource_timing({
+    performance: iwin.performance,
+    url: NON_REGISTERED_ROUTE,
+    matched_source_type: 'cache',
+    final_source_type: 'network',
+    description: "cache as source on main resource and cache miss, fallback to network"
+  });
+}, 'Main resource fallback to the network when there is no cache entry and resource timing');
+
+// Subresource
+iframeTest(NON_REGISTERED_ROUTE, ROUTER_RULE_KEY_REQUEST_FETCH, async (t, iwin, worker) => {
+  const rnd = randomString();
+  const subresource = `?nonce=${rnd}`;
+  const response = await iwin.fetch(subresource);
+
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), rnd);
+  const {requests} = await get_info_from_worker(worker);
+  // Main resource request + subreosurce request = 2.
+  assert_equals(requests.length, 2);
+
+  test_resource_timing({
+    performance: iwin.performance,
+    url: `${NON_REGISTERED_ROUTE}${subresource}`,
+    matched_source_type: 'fetch-event',
+    final_source_type: 'fetch-event',
+    description: "fetch-event as source on sub resource"
+  });
+}, 'Subresource load matched the rule fetch-event source');
+
+iframeTest(NON_REGISTERED_ROUTE, ROUTER_RULE_KEY, async (t, iwin) => {
+  const rnd = randomString();
+  const subresource = `?nonce=${rnd}`;
+  const response = await iwin.fetch(subresource);
+  assert_equals(await response.text(), rnd);
+  test_resource_timing({
+    performance: iwin.performance,
+    url: NON_REGISTERED_ROUTE + subresource,
+    matched_source_type: '',
+    final_source_type: '',
+    description: "no source type matched"
+  });
+}, 'Subresource load not matched with URLPattern condition');
+
+iframeTest(REGISTERED_ROUTE, ROUTER_RULE_KEY, async (t, iwin) => {
+  const rnd = randomString();
+  const subresource = `?nonce=${rnd}`;
+  const response = await iwin.fetch(subresource);
+  assert_equals(await response.text(), "Network\n");
+  test_resource_timing({
+    performance: iwin.performance,
+    url: REGISTERED_ROUTE + subresource,
+    matched_source_type: 'network',
+    final_source_type: 'network',
+    description: "network as source on subresource"
+  });
+}, 'Subresource load matched with URLPattern condition');
+
+iframeTest(NON_REGISTERED_ROUTE, ROUTER_RULE_KEY_URLPATTERN_CACHE, async (t, iwin) => {
+  // No need to set `resources/` because the request is dispatched from iframe.
+  const CACHED_FILE = 'cache.txt';
+  const response = await iwin.fetch(CACHED_FILE);
+  assert_equals(await response.text(), "From cache");
+  test_resource_timing({
+    performance: iwin.performance,
+    url: CACHED_ROUTE, // We need a path including `resources/` to get the resource
+    matched_source_type: 'cache',
+    final_source_type: 'cache',
+    description: "cache as source on subresource and cache hits"
+  });
+}, 'Subresource load matched with the cache source rule');
+
+iframeTest(REGISTERED_ROUTE, ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED_MATCH_ALL_CACHE, async (t, iwin, worker) => {
+  // Send a request, which is not stored in the cache, but it exists over the network.
+  const rnd = randomString();
+  let subresource = `?nonce=${rnd}`;
+  let response = await iwin.fetch(subresource);
+  assert_equals(await response.text(), "Network\n");
+  assert_equals(response.status, 200);
+
+  // Request is not handled by ServiceWorker.
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  test_resource_timing({
+    performance: iwin.performance,
+    url: `${REGISTERED_ROUTE}${subresource}`,
+    matched_source_type: 'cache',
+    final_source_type: 'network',
+    description: "cache as source on subresource and cache misses"
+  });
+}, 'Subresource load did not match with the cache and fallback to the network');
+
+// Race Tests
+promise_test(async t => {
+  const rnd = randomString();
+  const url = `${RACE_ROUTE}?nonce=${rnd}&server_slow`;
+  const worker = await registerAndActivate(t, RACE_ROUTER_KEY, RACE_SW_SRC);
+  const iframe = await createIframe(t, url);
+  // Expect the response from the fetch handler.
+  assert_equals(iframe.contentWindow.document.body.innerText, rnd);
+  const {requests}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  test_resource_timing({
+    performance: iframe.contentWindow.performance,
+    url: url,
+    matched_source_type: 'race-network-and-fetch-handler',
+    final_source_type: 'fetch-event',
+    description: "race as source on main resource, and fetch-event wins"
+  });
+}, 'Main resource load matched the rule with race-network-and-fetch-handler source, and the fetch handler response is faster than the server response');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const url = `${RACE_ROUTE}?nonce=${rnd}&sw_slow`;
+  const worker = await registerAndActivate(t, RACE_ROUTER_KEY, RACE_SW_SRC);
+  const iframe = await createIframe(t, url);
+  // Expect the response from the netowrk request.
+  assert_equals(iframe.contentWindow.document.body.innerText, "Network with GET request");
+  // Ensure the fetch handler is also executed.
+  const {requests}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  test_resource_timing({
+    performance: iframe.contentWindow.performance,
+    url: url,
+    matched_source_type: 'race-network-and-fetch-handler',
+    final_source_type: 'network',
+    description: "race as source on main resource, and network wins"
+  });
+}, 'Main resource load matched the rule with race-network-and-fetch-handler source, and the server reseponse is faster than the fetch handler');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, RACE_ROUTER_KEY, RACE_SW_SRC);
+  const iframe = await createIframe(t, RACE_ROUTE);
+  const subresource = `?nonce=${rnd}&server_slow`;
+  // Expect the response from the fetch handler.
+  const response = await iframe.contentWindow.fetch(subresource);
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), rnd);
+  const {requests}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 2);
+
+  test_resource_timing({
+    performance: iframe.contentWindow.performance,
+    url: `${RACE_ROUTE}${subresource}`,
+    matched_source_type: 'race-network-and-fetch-handler',
+    final_source_type: 'fetch-event',
+    description: "race as source on subresource and fetch wins"
+  });
+}, 'Subresource load matched the rule with race-network-and-fetch-handler source, and the fetch handler response is faster than the server response');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, RACE_ROUTER_KEY, RACE_SW_SRC);
+  const iframe = await createIframe(t, RACE_ROUTE);
+  const subresource = `?nonce=${rnd}&sw_slow`;
+  // Expect the response from the network request.
+  const response = await iframe.contentWindow.fetch(subresource);
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), "Network with GET request");
+  // Ensure the fetch handler is also executed.
+  const {requests}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 2);
+
+  test_resource_timing({
+    performance: iframe.contentWindow.performance,
+    url: `${RACE_ROUTE}${subresource}`,
+    matched_source_type: 'race-network-and-fetch-handler',
+    final_source_type: 'network',
+    description: "race as source on subresource and network wins"
+  });
+}, 'Subresource load matched the rule with race-network-and-fetch-handler source, and the server reseponse is faster than the fetch handler');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/uncontrolled-page.https.html b/test/fixtures/wpt/service-workers/service-worker/uncontrolled-page.https.html
new file mode 100644
index 000000000000..e22ca8f0a91a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/uncontrolled-page.https.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function fetch_url(url) {
+  return new Promise(function(resolve, reject) {
+      var request = new XMLHttpRequest();
+      request.addEventListener('load', function(event) {
+          if (request.status == 200)
+            resolve(request.response);
+          else
+            reject(Error(request.statusText));
+        });
+      request.open('GET', url);
+      request.send();
+    });
+}
+var worker = 'resources/fail-on-fetch-worker.js';
+
+promise_test(function(t) {
+    var scope = 'resources/scope/uncontrolled-page/';
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() {
+          return fetch_url('resources/simple.txt');
+        })
+      .then(function(text) {
+          assert_equals(text, 'a simple text file\n');
+        });
+  }, 'Fetch events should not go through uncontrolled page.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/unregister-controller.https.html b/test/fixtures/wpt/service-workers/service-worker/unregister-controller.https.html
new file mode 100644
index 000000000000..3bf4cff7200e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/unregister-controller.https.html
@@ -0,0 +1,108 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var worker_url = 'resources/simple-intercept-worker.js';
+
+async_test(function(t) {
+    var scope =
+        'resources/unregister-controller-page.html?load-before-unregister';
+    var frame_window;
+    var controller;
+    var registration;
+    var frame;
+
+    service_worker_unregister_and_register(t, worker_url, scope)
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          frame_window = frame.contentWindow;
+          controller = frame_window.navigator.serviceWorker.controller;
+          assert_true(controller instanceof frame_window.ServiceWorker,
+                      'document should load with a controller');
+          return registration.unregister();
+        })
+      .then(function() {
+          assert_equals(frame_window.navigator.serviceWorker.controller,
+                        controller,
+                        'unregistration should not modify controller');
+          return frame_window.fetch_url('simple.txt');
+        })
+      .then(function(response) {
+          assert_equals(response, 'intercepted by service worker',
+                        'controller should intercept requests');
+          frame.remove();
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Unregister does not affect existing controller');
+
+async_test(function(t) {
+    var scope =
+        'resources/unregister-controller-page.html?load-after-unregister';
+    var registration;
+    var frame;
+
+    service_worker_unregister_and_register(t, worker_url, scope)
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(function() {
+          return registration.unregister();
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          var frame_window = frame.contentWindow;
+          assert_equals(frame_window.navigator.serviceWorker.controller, null,
+                        'document should not have a controller');
+          return frame_window.fetch_url('simple.txt');
+        })
+      .then(function(response) {
+          assert_equals(response, 'a simple text file\n',
+                        'requests should not be intercepted');
+          frame.remove();
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Unregister prevents control of subsequent navigations');
+
+async_test(function(t) {
+    var scope =
+        'resources/scope/no-new-controllee-even-if-registration-is-still-used';
+    var registration;
+
+    service_worker_unregister_and_register(t, worker_url, scope)
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          return registration.unregister();
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          assert_equals(frame.contentWindow.navigator.serviceWorker.controller,
+                        null,
+                        'document should not have a controller');
+          frame.remove();
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Unregister prevents new controllee even if registration is still in use');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/unregister-immediately-before-installed.https.html b/test/fixtures/wpt/service-workers/service-worker/unregister-immediately-before-installed.https.html
new file mode 100644
index 000000000000..c56674c0fb1b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/unregister-immediately-before-installed.https.html
@@ -0,0 +1,57 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Use Clear-Site-Data to immediately unregister service workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/unregister-immediately-helpers.js"></script>
+<body>
+<script>
+'use strict';
+
+// These tests use the Clear-Site-Data network response header to immediately
+// unregister a service worker registration with a worker whose state is
+// 'installing' or 'parsed'.  Clear-Site-Data must delete the registration,
+// abort the installation and then clear the registration by setting the
+// worker's state to 'redundant'.
+
+promise_test(async test => {
+  // This test keeps the service worker in the 'parsed' state by using a
+  // script with an infinite loop.
+  const script_url = 'resources/onparse-infiniteloop-worker.js';
+  const scope_url =
+    'resources/scope-for-unregister-immediately-with-parsed-worker';
+
+  await service_worker_unregister(test, /*scope=*/script_url);
+
+  // Clear-Site-Data must cause register() to fail.
+  const register_promise = promise_rejects_dom(test, 'AbortError',
+    navigator.serviceWorker.register(script_url, { scope: scope_url}));;
+
+  await Promise.all([clear_site_data(), register_promise]);
+
+  await assert_no_registrations_exist();
+ }, 'Clear-Site-Data must abort service worker registration.');
+
+promise_test(async test => {
+  // This test keeps the service worker in the 'installing' state by using a
+  // script with an install event waitUntil() promise that never resolves.
+  const script_url = 'resources/oninstall-waituntil-forever.js';
+  const scope_url =
+    'resources/scope-for-unregister-immediately-with-installing-worker';
+
+  const registration = await service_worker_unregister_and_register(
+    test, script_url, scope_url);
+  const service_worker = registration.installing;
+
+  // Clear-Site-Data must cause install to fail.
+  await Promise.all([
+    clear_site_data(),
+    wait_for_state(test, service_worker, 'redundant')]);
+
+  await assert_no_registrations_exist();
+ }, 'Clear-Site-Data must unregister a registration with a worker '
+     + 'in the "installing" state.');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/unregister-immediately-during-extendable-events.https.html b/test/fixtures/wpt/service-workers/service-worker/unregister-immediately-during-extendable-events.https.html
new file mode 100644
index 000000000000..6ba87a7ce80e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/unregister-immediately-during-extendable-events.https.html
@@ -0,0 +1,50 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Use Clear-Site-Data to immediately unregister service workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/unregister-immediately-helpers.js"></script>
+<body>
+<script>
+'use strict';
+
+// These tests use the Clear-Site-Data network response header to immediately
+// unregister a service worker registration with a worker that has pending
+// extendable events.  Clear-Site-Data must delete the registration,
+// abort all pending extendable events and then clear the registration by
+// setting the worker's state to 'redundant'
+
+promise_test(async test => {
+  // Use a service worker script that can produce fetch events with pending
+  // respondWith() promises that never resolve.
+  const script_url = 'resources/onfetch-waituntil-forever.js';
+  const scope_url =
+    'resources/blank.html?unregister-immediately-with-fetch-event';
+
+  const registration = await service_worker_unregister_and_register(
+    test, script_url, scope_url);
+
+  await wait_for_state(test, registration.installing, 'activated');
+
+  const frame = await add_controlled_iframe(test, scope_url);
+
+  // Clear-Site-Data must cause the pending fetch promise to reject.
+  const fetch_promise = promise_rejects_js(
+    test, TypeError, frame.contentWindow.fetch('waituntil-forever'));
+
+  const event_watcher = new EventWatcher(
+    test, frame.contentWindow.navigator.serviceWorker, 'controllerchange');
+
+  await Promise.all([
+    clear_site_data(),
+    fetch_promise,
+    event_watcher.wait_for('controllerchange'),
+    wait_for_state(test, registration.active, 'redundant'),]);
+
+  assert_equals(frame.contentWindow.navigator.serviceWorker.controller, null);
+  await assert_no_registrations_exist();
+}, 'Clear-Site-Data must fail pending subresource fetch events.');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/unregister-immediately.https.html b/test/fixtures/wpt/service-workers/service-worker/unregister-immediately.https.html
new file mode 100644
index 000000000000..c6a91f8e235f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/unregister-immediately.https.html
@@ -0,0 +1,134 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Use Clear-Site-Data to immediately unregister service workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/unregister-immediately-helpers.js"></script>
+<body>
+<script>
+'use strict';
+
+// These tests use the Clear-Site-Data network response header to immediately
+// unregister a service worker registration with a worker whose state is
+// 'installed', 'waiting', 'activating' or 'activated'.  Immediately
+// unregistering runs the "Clear Registration" algorithm without waiting for the
+// active worker's controlled clients to unload.
+
+promise_test(async test => {
+  // This test keeps the service worker in the 'activating' state by using a
+  // script with an activate event waitUntil() promise that never resolves.
+  const script_url = 'resources/onactivate-waituntil-forever.js';
+  const scope_url =
+    'resources/scope-for-unregister-immediately-with-waiting-worker';
+
+  const registration = await service_worker_unregister_and_register(
+    test, script_url, scope_url);
+  const service_worker = registration.installing;
+
+  await wait_for_state(test, service_worker, 'activating');
+
+  // Clear-Site-Data must cause activation to fail.
+  await Promise.all([
+    clear_site_data(),
+    wait_for_state(test, service_worker, 'redundant')]);
+
+  await assert_no_registrations_exist();
+ }, 'Clear-Site-Data must unregister a registration with a worker '
+     + 'in the "activating" state.');
+
+promise_test(async test => {
+  // Create an registration with two service workers: one activated and one
+  // installed.
+  const script_url = 'resources/update_shell.py';
+  const scope_url =
+    'resources/scope-for-unregister-immediately-with-with-update';
+
+  const registration = await service_worker_unregister_and_register(
+    test, script_url, scope_url);
+  const first_service_worker = registration.installing;
+
+  await wait_for_state(test, first_service_worker, 'activated');
+  registration.update();
+
+  const event_watcher = new EventWatcher(test, registration, 'updatefound');
+  await event_watcher.wait_for('updatefound');
+
+  const second_service_worker = registration.installing;
+  await wait_for_state(test, second_service_worker, 'installed');
+
+  // Clear-Site-Data must clear both workers from the registration.
+  await Promise.all([
+    clear_site_data(),
+    wait_for_state(test, first_service_worker, 'redundant'),
+    wait_for_state(test, second_service_worker, 'redundant')]);
+
+  await assert_no_registrations_exist();
+}, 'Clear-Site-Data must unregister an activated registration with '
+    + 'an update waiting.');
+
+promise_test(async test => {
+  const script_url = 'resources/empty.js';
+  const scope_url =
+    'resources/blank.html?unregister-immediately-with-controlled-client';
+
+  const registration = await service_worker_unregister_and_register(
+    test, script_url, scope_url);
+  const service_worker = registration.installing;
+
+  await wait_for_state(test, service_worker, 'activated');
+  const frame = await add_controlled_iframe(test, scope_url);
+  const frame_registration =
+    await frame.contentWindow.navigator.serviceWorker.ready;
+
+  const event_watcher = new EventWatcher(
+    test, frame.contentWindow.navigator.serviceWorker, 'controllerchange');
+
+  // Clear-Site-Data must remove the iframe's controller.
+  await Promise.all([
+    clear_site_data(),
+    event_watcher.wait_for('controllerchange'),
+    wait_for_state(test, service_worker, 'redundant')]);
+
+  assert_equals(frame.contentWindow.navigator.serviceWorker.controller, null);
+  await assert_no_registrations_exist();
+
+  // The ready promise must continue to resolve with the unregistered
+  // registration.
+  assert_equals(frame_registration,
+    await frame.contentWindow.navigator.serviceWorker.ready);
+}, 'Clear-Site-Data must unregister an activated registration with controlled '
+   + 'clients.');
+
+promise_test(async test => {
+  const script_url = 'resources/empty.js';
+  const scope_url =
+    'resources/blank.html?unregister-immediately-while-waiting-to-clear';
+
+  const registration = await service_worker_unregister_and_register(
+    test, script_url, scope_url);
+  const service_worker = registration.installing;
+
+  await wait_for_state(test, service_worker, 'activated');
+  const frame = await add_controlled_iframe(test, scope_url);
+
+  const event_watcher = new EventWatcher(
+    test, frame.contentWindow.navigator.serviceWorker, 'controllerchange');
+
+  // Unregister waits to clear the registration until no controlled clients
+  // exist.
+  await registration.unregister();
+
+  // Clear-Site-Data must clear the unregistered registration immediately.
+  await Promise.all([
+    clear_site_data(),
+    event_watcher.wait_for('controllerchange'),
+    wait_for_state(test, service_worker, 'redundant')]);
+
+  assert_equals(frame.contentWindow.navigator.serviceWorker.controller, null);
+  await assert_no_registrations_exist();
+}, 'Clear-Site-Data must clear an unregistered registration waiting for '
+   + ' controlled clients to unload.');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/unregister-then-register-new-script.https.html b/test/fixtures/wpt/service-workers/service-worker/unregister-then-register-new-script.https.html
new file mode 100644
index 000000000000..d046423e0c29
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/unregister-then-register-new-script.https.html
@@ -0,0 +1,136 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var worker_url = 'resources/empty-worker.js';
+
+promise_test(async function(t) {
+  const scope = 'resources/scope/unregister-then-register-new-script-that-exists';
+  const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+  t.add_cleanup(() => registration.unregister());
+
+  const newWorkerURL = worker_url + '?new';
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const iframe = await with_iframe(scope);
+  t.add_cleanup(() => iframe.remove());
+
+  await registration.unregister();
+
+  const newRegistration = await navigator.serviceWorker.register(newWorkerURL, { scope });
+  t.add_cleanup(() => newRegistration.unregister());
+
+  assert_equals(
+    registration.installing,
+    null,
+    'before activated registration.installing'
+  );
+  assert_equals(
+    registration.waiting,
+    null,
+    'before activated registration.waiting'
+  );
+  assert_equals(
+    registration.active.scriptURL,
+    normalizeURL(worker_url),
+    'before activated registration.active'
+  );
+  assert_equals(
+    newRegistration.installing.scriptURL,
+    normalizeURL(newWorkerURL),
+    'before activated newRegistration.installing'
+  );
+  assert_equals(
+    newRegistration.waiting,
+    null,
+    'before activated newRegistration.waiting'
+  );
+  assert_equals(
+    newRegistration.active,
+    null,
+    'before activated newRegistration.active'
+  );
+  iframe.remove();
+
+  await wait_for_state(t, newRegistration.installing, 'activated');
+
+  assert_equals(
+    newRegistration.installing,
+    null,
+    'after activated newRegistration.installing'
+  );
+  assert_equals(
+    newRegistration.waiting,
+    null,
+    'after activated newRegistration.waiting'
+  );
+  assert_equals(
+    newRegistration.active.scriptURL,
+    normalizeURL(newWorkerURL),
+    'after activated newRegistration.active'
+  );
+
+  const newIframe = await with_iframe(scope);
+  t.add_cleanup(() => newIframe.remove());
+
+  assert_equals(
+    newIframe.contentWindow.navigator.serviceWorker.controller.scriptURL,
+    normalizeURL(newWorkerURL),
+    'the new worker should control a new document'
+  );
+}, 'Registering a new script URL while an unregistered registration is in use');
+
+promise_test(async function(t) {
+  const scope = 'resources/scope/unregister-then-register-new-script-that-404s';
+  const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+  t.add_cleanup(() => registration.unregister());
+
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const iframe = await with_iframe(scope);
+  t.add_cleanup(() => iframe.remove());
+
+  await registration.unregister();
+
+  await promise_rejects_js(
+    t, TypeError,
+    navigator.serviceWorker.register('this-will-404', { scope })
+  );
+
+  assert_equals(registration.installing, null, 'registration.installing');
+  assert_equals(registration.waiting, null, 'registration.waiting');
+  assert_equals(registration.active.scriptURL, normalizeURL(worker_url), 'registration.active');
+
+  const newIframe = await with_iframe(scope);
+  t.add_cleanup(() => newIframe.remove());
+
+  assert_equals(newIframe.contentWindow.navigator.serviceWorker.controller, null, 'Document should not be controlled');
+}, 'Registering a new script URL that 404s does not resurrect unregistered registration');
+
+promise_test(async function(t) {
+  const scope = 'resources/scope/unregister-then-register-reject-install-worker';
+  const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+  t.add_cleanup(() => registration.unregister());
+
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const iframe = await with_iframe(scope);
+  t.add_cleanup(() => iframe.remove());
+
+  await registration.unregister();
+
+  const newRegistration = await navigator.serviceWorker.register(
+    'resources/reject-install-worker.js', { scope }
+  );
+  t.add_cleanup(() => newRegistration.unregister());
+
+  await wait_for_state(t, newRegistration.installing, 'redundant');
+
+  assert_equals(registration.installing, null, 'registration.installing');
+  assert_equals(registration.waiting, null, 'registration.waiting');
+  assert_equals(registration.active.scriptURL, normalizeURL(worker_url),
+                'registration.active');
+  assert_not_equals(registration, newRegistration, 'New registration is different');
+}, 'Registering a new script URL that fails to install does not resurrect unregistered registration');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/unregister-then-register.https.html b/test/fixtures/wpt/service-workers/service-worker/unregister-then-register.https.html
new file mode 100644
index 000000000000..b61608c8419f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/unregister-then-register.https.html
@@ -0,0 +1,107 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var worker_url = 'resources/empty-worker.js';
+
+promise_test(async function(t) {
+    const scope = 'resources/scope/re-register-resolves-to-new-value';
+    const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+    t.add_cleanup(() => registration.unregister());
+
+    await wait_for_state(t, registration.installing, 'activated');
+    await registration.unregister();
+    const newRegistration = await navigator.serviceWorker.register(worker_url, { scope });
+    t.add_cleanup(() => newRegistration.unregister());
+
+    assert_not_equals(
+      registration, newRegistration,
+      'register should resolve to a new value'
+    );
+  }, 'Unregister then register resolves to a new value');
+
+promise_test(async function(t) {
+  const scope = 'resources/scope/re-register-while-old-registration-in-use';
+  const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+  t.add_cleanup(() => registration.unregister());
+
+  await wait_for_state(t, registration.installing, 'activated');
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+
+  await registration.unregister();
+  const newRegistration = await navigator.serviceWorker.register(worker_url, { scope });
+  t.add_cleanup(() => newRegistration.unregister());
+
+  assert_not_equals(
+    registration, newRegistration,
+    'Unregister and register should always create a new registration'
+  );
+}, 'Unregister then register does not resolve to the original value even if the registration is in use.');
+
+promise_test(function(t) {
+    var scope = 'resources/scope/re-register-does-not-affect-existing-controllee';
+    var iframe;
+    var registration;
+    var controller;
+
+    return service_worker_unregister_and_register(t, worker_url, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+            return service_worker_unregister(t, scope);
+          });
+
+          registration = r;
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          iframe = frame;
+          controller = iframe.contentWindow.navigator.serviceWorker.controller;
+          return registration.unregister();
+        })
+      .then(function() {
+          return navigator.serviceWorker.register(worker_url, { scope: scope });
+        })
+      .then(function(newRegistration) {
+          assert_equals(registration.installing, null,
+                        'installing version is null');
+          assert_equals(registration.waiting, null, 'waiting version is null');
+          assert_equals(
+              iframe.contentWindow.navigator.serviceWorker.controller,
+              controller,
+              'the worker from the first registration is the controller');
+          iframe.remove();
+        });
+  }, 'Unregister then register does not affect existing controllee');
+
+promise_test(async function(t) {
+  const scope = 'resources/scope/resurrection';
+  const altWorkerURL = worker_url + '?alt';
+  const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+  t.add_cleanup(() => registration.unregister());
+
+  await wait_for_state(t, registration.installing, 'activating');
+  const iframe = await with_iframe(scope);
+  t.add_cleanup(() => iframe.remove());
+
+  await registration.unregister();
+  const newRegistration = await navigator.serviceWorker.register(altWorkerURL, { scope });
+  t.add_cleanup(() => newRegistration.unregister());
+
+  assert_equals(newRegistration.active, null, 'Registration is new');
+
+  await wait_for_state(t, newRegistration.installing, 'activating');
+
+  const newIframe = await with_iframe(scope);
+  t.add_cleanup(() => newIframe.remove());
+
+  const iframeController = iframe.contentWindow.navigator.serviceWorker.controller;
+  const newIframeController = newIframe.contentWindow.navigator.serviceWorker.controller;
+
+  assert_not_equals(iframeController, newIframeController, 'iframes have different controllers');
+}, 'Unregister then register does not resurrect the registration');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/unregister.https.html b/test/fixtures/wpt/service-workers/service-worker/unregister.https.html
new file mode 100644
index 000000000000..492aecb21a87
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/unregister.https.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+async_test(function(t) {
+    var scope = 'resources/scope/unregister-twice';
+    var registration;
+    navigator.serviceWorker.register('resources/empty-worker.js',
+                                     {scope: scope})
+      .then(function(r) {
+          registration = r;
+          return registration.unregister();
+        })
+      .then(function() {
+          return registration.unregister();
+        })
+      .then(function(value) {
+          assert_equals(value, false,
+                        'unregistering twice should resolve with false');
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Unregister twice');
+
+async_test(function(t) {
+    var scope = 'resources/scope/successful-unregister/';
+    navigator.serviceWorker.register('resources/empty-worker.js',
+                                     {scope: scope})
+      .then(function(registration) {
+          return registration.unregister();
+        })
+      .then(function(value) {
+          assert_equals(value, true,
+                        'unregistration should resolve with true');
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Register then unregister');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-after-navigation-fetch-event.https.html b/test/fixtures/wpt/service-workers/service-worker/update-after-navigation-fetch-event.https.html
new file mode 100644
index 000000000000..ff51f7f902c7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-after-navigation-fetch-event.https.html
@@ -0,0 +1,91 @@
+<!DOCTYPE html>
+<meta name=timeout content=long>
+<title>Service Worker: Update should be triggered after a navigation</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+async function cleanup(frame, registration) {
+  if (frame)
+    frame.remove();
+  if (registration)
+   await registration.unregister();
+}
+
+promise_test(async t => {
+  const script = 'resources/update_shell.py?filename=empty.js';
+  const scope = 'resources/scope/update';
+  let registration;
+  let frame;
+
+  async function run() {
+    registration = await service_worker_unregister_and_register(
+        t, script, scope);
+    await wait_for_state(t, registration.installing, 'activated');
+
+    // Navigation should trigger update.
+    frame = await with_iframe(scope);
+    await wait_for_update(t, registration);
+  }
+
+  try {
+    await run();
+  } finally {
+    await cleanup(frame, registration);
+  }
+}, 'Update should be triggered after a navigation (no fetch event worker).');
+
+promise_test(async t => {
+  const script = 'resources/update_shell.py?filename=simple-intercept-worker.js';
+  const scope = 'resources/scope/update';
+  let registration;
+  let frame;
+
+  async function run() {
+    registration = await service_worker_unregister_and_register(
+        t, script, scope);
+    await wait_for_state(t, registration.installing, 'activated');
+
+    // Navigation should trigger update (network fallback).
+    frame = await with_iframe(scope + '?ignore');
+    await wait_for_update(t, registration);
+
+    // Navigation should trigger update (respondWith called).
+    frame.src = scope + '?string';
+    await wait_for_update(t, registration);
+  }
+
+  try {
+    await run();
+  } finally {
+    await cleanup(frame, registration);
+  }
+}, 'Update should be triggered after a navigation (fetch event worker).');
+
+promise_test(async t => {
+  const script = 'resources/update_shell.py?filename=empty.js';
+  const scope = 'resources/';
+  let registration;
+  let frame;
+
+  async function run() {
+    registration = await service_worker_unregister_and_register(
+        t, script, scope);
+    await wait_for_state(t, registration.installing, 'activated');
+
+    // Navigation should trigger update. Don't use with_iframe as it waits for
+    // the onload event.
+    frame = document.createElement('iframe');
+    frame.src = 'resources/malformed-http-response.asis';
+    document.body.appendChild(frame);
+    await wait_for_update(t, registration);
+  }
+
+  try {
+    await run();
+  } finally {
+    await cleanup(frame, registration);
+  }
+}, 'Update should be triggered after a navigation (network error).');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-after-navigation-redirect.https.html b/test/fixtures/wpt/service-workers/service-worker/update-after-navigation-redirect.https.html
new file mode 100644
index 000000000000..6e821fe479f2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-after-navigation-redirect.https.html
@@ -0,0 +1,74 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: Update should be triggered after redirects during navigation</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(async t => {
+  // This test does a navigation that goes through a redirect chain. Each
+  // request in the chain has a service worker. Each service worker has no
+  // fetch event handler. The redirects are performed by redirect.py.
+  const script = 'resources/update-nocookie-worker.py';
+  const scope1 = 'resources/redirect.py?scope1';
+  const scope2 = 'resources/redirect.py?scope2';
+  const scope3 = 'resources/empty.html';
+  let registration1;
+  let registration2;
+  let registration3;
+  let frame;
+
+  async function cleanup() {
+    if (frame)
+      frame.remove();
+    if (registration1)
+      return registration1.unregister();
+    if (registration2)
+      return registration2.unregister();
+    if (registration3)
+      return registration3.unregister();
+  }
+
+  async function make_active_registration(scope) {
+    const registration =
+        await service_worker_unregister_and_register(t, script, scope);
+    await wait_for_state(t, registration.installing, 'activated');
+    return registration;
+  }
+
+  async function run() {
+    // Make the registrations.
+    registration1 = await make_active_registration(scope1);
+    registration2 = await make_active_registration(scope2);
+    registration3 = await make_active_registration(scope3);
+
+    // Make the promises that resolve on update.
+    const saw_update1 = wait_for_update(t, registration1);
+    const saw_update2 = wait_for_update(t, registration2);
+    const saw_update3 = wait_for_update(t, registration3);
+
+    // Create a URL for the redirect chain: scope1 -> scope2 -> scope3.
+    // Build the URL in reverse order.
+    let url = `${base_path()}${scope3}`;
+    url = `${base_path()}${scope2}&Redirect=${encodeURIComponent(url)}`
+    url = `${base_path()}${scope1}&Redirect=${encodeURIComponent(url)}`
+
+    // Navigate to the URL.
+    frame = await with_iframe(url);
+
+    // Each registration should update.
+    await saw_update1;
+    await saw_update2;
+    await saw_update3;
+  }
+
+  try {
+    await run();
+  } finally {
+    await cleanup();
+  }
+}, 'service workers are updated on redirects during navigation');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-after-oneday.https.html b/test/fixtures/wpt/service-workers/service-worker/update-after-oneday.https.html
new file mode 100644
index 000000000000..e7a8aa42d307
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-after-oneday.https.html
@@ -0,0 +1,51 @@
+<!DOCTYPE html>
+<!-- This test requires browser to treat all registrations are older than 24 hours.
+     Preference 'dom.serviceWorkers.testUpdateOverOneDay' should be enabled during
+     the execution of the test -->
+<title>Service Worker: Functional events should trigger update if last update time is over 24 hours</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(function(t) {
+    var script = 'resources/update-nocookie-worker.py';
+    var scope = 'resources/update/update-after-oneday.https.html';
+    var expected_url = normalizeURL(script);
+    var registration;
+    var frame;
+
+    return service_worker_unregister_and_register(t, expected_url, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          frame = f;
+          return wait_for_update(t, registration);
+        })
+      .then(function() {
+          assert_equals(registration.installing.scriptURL, expected_url,
+                        'new installing should be set after update resolves.');
+          assert_equals(registration.waiting, null,
+                        'waiting should still be null after update resolves.');
+          assert_equals(registration.active.scriptURL, expected_url,
+                        'active should still exist after update found.');
+          return wait_for_state(t, registration.installing, 'installed');
+        })
+      .then(function() {
+          // Trigger a non-navigation fetch event
+          frame.contentWindow.load_image(normalizeURL('resources/update/sample'));
+          return wait_for_update(t, registration);
+       })
+       .then(function() {
+          frame.remove();
+       })
+  }, 'Update should be triggered after a functional event when last update time is over 24 hours');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-bytecheck-cors-import.https.html b/test/fixtures/wpt/service-workers/service-worker/update-bytecheck-cors-import.https.html
new file mode 100644
index 000000000000..121a7378e358
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-bytecheck-cors-import.https.html
@@ -0,0 +1,92 @@
+<!doctype html>
+<meta charset=utf-8>
+<title></title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script>
+// Tests of updating a service worker. This file contains cors cases only.
+
+/*
+ * @param string main
+ *   Decide the content of the main script, where 'default' is for constant
+ *   content while 'time' is for time-variant content.
+ * @param string imported
+ *   Decide the content of the imported script, where 'default' is for constant
+ *   content while 'time' is for time-variant content.
+ */
+const settings = [{main: 'default', imported: 'default'},
+                  {main: 'default', imported: 'time'   },
+                  {main: 'time',    imported: 'default'},
+                  {main: 'time',    imported: 'time'   }];
+
+const host_info = get_host_info();
+settings.forEach(({main, imported}) => {
+  promise_test(async (t) => {
+    // Specify a cross origin path to load imported scripts from a cross origin.
+    const path = host_info.HTTPS_REMOTE_ORIGIN +
+                 '/service-workers/service-worker/resources/';
+    const script = 'resources/bytecheck-worker.py' +
+                   '?main=' + main +
+                   '&imported=' + imported +
+                   '&path=' + path +
+                   '&type=classic';
+    const scope = 'resources/blank.html';
+
+    // Register a service worker.
+    const swr = await service_worker_unregister_and_register(t, script, scope);
+    t.add_cleanup(() => swr.unregister());
+    const sw = await wait_for_update(t, swr);
+    await wait_for_state(t, sw, 'activated');
+    assert_array_equals([swr.active, swr.waiting, swr.installing],
+                        [sw, null, null]);
+
+    // Update the service worker registration.
+    await swr.update();
+
+    // If there should be a new service worker.
+    if (main === 'time' || imported === 'time') {
+      return wait_for_update(t, swr);
+    }
+    // Otherwise, make sure there is no newly created service worker.
+    assert_array_equals([swr.active, swr.waiting, swr.installing],
+                        [sw, null, null]);
+  }, `Test(main: ${main}, imported: ${imported})`);
+});
+
+settings.forEach(({main, imported}) => {
+  promise_test(async (t) => {
+    // Specify a cross origin path to load imported scripts from a cross origin.
+    const path = host_info.HTTPS_REMOTE_ORIGIN +
+                 '/service-workers/service-worker/resources/';
+    const script = 'resources/bytecheck-worker.py' +
+                   '?main=' + main +
+                   '&imported=' + imported +
+                   '&path=' + path +
+                   '&type=module';
+    const scope = 'resources/blank.html';
+
+    // Register a service worker.
+    const swr = await service_worker_unregister_and_register(t, script, scope, {type: 'module'});
+    t.add_cleanup(() => swr.unregister());
+    const sw = await wait_for_update(t, swr);
+    await wait_for_state(t, sw, 'activated');
+    assert_array_equals([swr.active, swr.waiting, swr.installing],
+                        [sw, null, null]);
+
+    // Update the service worker registration.
+    await swr.update();
+
+    // If there should be a new service worker.
+    if (main === 'time' || imported === 'time') {
+      return wait_for_update(t, swr);
+    }
+    // Otherwise, make sure there is no newly created service worker.
+    assert_array_equals([swr.active, swr.waiting, swr.installing],
+                        [sw, null, null]);
+  }, `Test module script(main: ${main}, imported: ${imported})`);
+});
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-bytecheck.https.html b/test/fixtures/wpt/service-workers/service-worker/update-bytecheck.https.html
new file mode 100644
index 000000000000..3e5a28bb67cb
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-bytecheck.https.html
@@ -0,0 +1,92 @@
+<!doctype html>
+<meta charset=utf-8>
+<title></title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script>
+// Tests of updating a service worker. This file contains non-cors cases only.
+
+/*
+ * @param string main
+ *   Decide the content of the main script, where 'default' is for constant
+ *   content while 'time' is for time-variant content.
+ * @param string imported
+ *   Decide the content of the imported script, where 'default' is for constant
+ *   content while 'time' is for time-variant content.
+ */
+const settings = [{main: 'default', imported: 'default'},
+                  {main: 'default', imported: 'time'   },
+                  {main: 'time',    imported: 'default'},
+                  {main: 'time',    imported: 'time'   }];
+
+const host_info = get_host_info();
+settings.forEach(({main, imported}) => {
+  promise_test(async (t) => {
+    // Empty path results in the same origin imported scripts.
+    const path = '';
+    const script = 'resources/bytecheck-worker.py' +
+                   '?main=' + main +
+                   '&imported=' + imported +
+                   '&path=' + path +
+                   '&type=classic';
+    const scope = 'resources/blank.html';
+
+    // Register a service worker.
+    const swr = await service_worker_unregister_and_register(t, script, scope);
+    t.add_cleanup(() => swr.unregister());
+    const sw = await wait_for_update(t, swr);
+    await wait_for_state(t, sw, 'activated');
+    assert_array_equals([swr.active, swr.waiting, swr.installing],
+                        [sw, null, null]);
+
+    // Update the service worker registration.
+    await swr.update();
+
+    // If there should be a new service worker.
+    if (main === 'time' || imported === 'time') {
+      return wait_for_update(t, swr);
+    }
+    // Otherwise, make sure there is no newly created service worker.
+    assert_array_equals([swr.active, swr.waiting, swr.installing],
+                        [sw, null, null]);
+  }, `Test(main: ${main}, imported: ${imported})`);
+});
+
+settings.forEach(({main, imported}) => {
+  promise_test(async (t) => {
+    // Empty path results in the same origin imported scripts.
+    const path = './';
+    const script = 'resources/bytecheck-worker.py' +
+                   '?main=' + main +
+                   '&imported=' + imported +
+                   '&path=' + path +
+                   '&type=module';
+    const scope = 'resources/blank.html';
+
+    // Register a module service worker.
+    const swr = await service_worker_unregister_and_register(t, script, scope,
+                                                            {type: 'module'});
+
+    t.add_cleanup(() => swr.unregister());
+    const sw = await wait_for_update(t, swr);
+    await wait_for_state(t, sw, 'activated');
+    assert_array_equals([swr.active, swr.waiting, swr.installing],
+                        [sw, null, null]);
+
+    // Update the service worker registration.
+    await swr.update();
+
+    // If there should be a new service worker.
+    if (main === 'time' || imported === 'time') {
+      return wait_for_update(t, swr);
+    }
+    // Otherwise, make sure there is no newly created service worker.
+    assert_array_equals([swr.active, swr.waiting, swr.installing],
+                        [sw, null, null]);
+  }, `Test module script(main: ${main}, imported: ${imported})`);
+});
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-import-scripts.https.html b/test/fixtures/wpt/service-workers/service-worker/update-import-scripts.https.html
new file mode 100644
index 000000000000..a2df529e90df
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-import-scripts.https.html
@@ -0,0 +1,135 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Tests for importScripts: import scripts ignored error</title>
+<script src="/common/utils.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+// This file contains tests to check if imported scripts appropriately updated.
+
+const SCOPE = 'resources/simple.txt';
+
+// Create a service worker (update-worker-from-file.py), which is initially
+// |initial_worker| and |updated_worker| later.
+async function prepare_ready_update_worker_from_file(
+    t, initial_worker, updated_worker) {
+  const key = token();
+  const worker_url = `resources/update-worker-from-file.py?` +
+      `First=${initial_worker}&Second=${updated_worker}&Key=${key}`;
+  const expected_url = normalizeURL(worker_url);
+
+  const registration = await service_worker_unregister_and_register(
+      t, worker_url, SCOPE);
+  await wait_for_state(t, registration.installing, 'activated');
+  assert_equals(registration.installing, null,
+                'prepare_ready: installing');
+  assert_equals(registration.waiting, null,
+                'prepare_ready: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'prepare_ready: active');
+  return [registration, expected_url];
+}
+
+// Create a service worker using the script under resources/.
+async function prepare_ready_normal_worker(t, filename, additional_params='') {
+  const key = token();
+  const worker_url = `resources/${filename}?Key=${key}&${additional_params}`;
+  const expected_url = normalizeURL(worker_url);
+
+  const registration = await service_worker_unregister_and_register(
+      t, worker_url, SCOPE);
+  await wait_for_state(t, registration.installing, 'activated');
+  assert_equals(registration.installing, null,
+                'prepare_ready: installing');
+  assert_equals(registration.waiting, null,
+                'prepare_ready: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'prepare_ready: active');
+  return [registration, expected_url];
+}
+
+function assert_installing_and_active(registration, expected_url) {
+  assert_equals(registration.installing.scriptURL, expected_url,
+                'assert_installing_and_active: installing');
+  assert_equals(registration.waiting, null,
+                'assert_installing_and_active: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'assert_installing_and_active: active');
+}
+
+function assert_waiting_and_active(registration, expected_url) {
+  assert_equals(registration.installing, null,
+                'assert_waiting_and_active: installing');
+  assert_equals(registration.waiting.scriptURL, expected_url,
+                'assert_waiting_and_active: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'assert_waiting_and_active: active');
+}
+
+function assert_active_only(registration, expected_url) {
+  assert_equals(registration.installing, null,
+                'assert_active_only: installing');
+  assert_equals(registration.waiting, null,
+                'assert_active_only: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'assert_active_only: active');
+}
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_update_worker_from_file(
+          t, 'empty.js', 'import-scripts-404.js');
+  t.add_cleanup(() => registration.unregister());
+
+  await promise_rejects_js(t, TypeError, registration.update());
+  assert_active_only(registration, expected_url);
+}, 'update() should fail when a new worker imports an unavailable script.');
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_update_worker_from_file(
+          t, 'import-scripts-404-after-update.js', 'empty.js');
+  t.add_cleanup(() => registration.unregister());
+
+  await Promise.all([registration.update(), wait_for_update(t, registration)]);
+  assert_installing_and_active(registration, expected_url);
+
+  await wait_for_state(t, registration.installing, 'installed');
+  assert_waiting_and_active(registration, expected_url);
+
+  await wait_for_state(t, registration.waiting, 'activated');
+  assert_active_only(registration, expected_url);
+}, 'update() should succeed when the old imported script no longer exist but ' +
+   "the new worker doesn't import it.");
+
+promise_test(async t => {
+  const [registration, expected_url] = await prepare_ready_normal_worker(
+    t, 'import-scripts-404-after-update.js');
+  t.add_cleanup(() => registration.unregister());
+
+  await registration.update();
+  assert_active_only(registration, expected_url);
+}, 'update() should treat 404 on imported scripts as no change.');
+
+promise_test(async t => {
+  const [registration, expected_url] = await prepare_ready_normal_worker(
+    t, 'import-scripts-404-after-update-plus-update-worker.js',
+       `AdditionalKey=${token()}`);
+  t.add_cleanup(() => registration.unregister());
+
+  await promise_rejects_js(t, TypeError, registration.update());
+  assert_active_only(registration, expected_url);
+}, 'update() should find an update in an imported script but update() should ' +
+   'result in failure due to missing the other imported script.');
+
+promise_test(async t => {
+  const [registration, expected_url] = await prepare_ready_normal_worker(
+    t, 'import-scripts-cross-origin-worker.sub.js');
+  t.add_cleanup(() => registration.unregister());
+  await registration.update();
+  assert_installing_and_active(registration, expected_url);
+}, 'update() should work with cross-origin importScripts.');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-missing-import-scripts.https.html b/test/fixtures/wpt/service-workers/service-worker/update-missing-import-scripts.https.html
new file mode 100644
index 000000000000..66e8bfac751e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-missing-import-scripts.https.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<title>Service Worker: update with missing importScripts</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/utils.js"></script>
+<body>
+<script>
+/**
+ * Test ServiceWorkerRegistration.update() when importScripts in a service worker
+ * script is no longer available (but was initially).
+ */
+let registration = null;
+
+promise_test(async (test) => {
+  const script = `resources/update-missing-import-scripts-main-worker.py?key=${token()}`;
+  const scope = 'resources/update-missing-import-scripts';
+
+  registration = await service_worker_unregister_and_register(test, script, scope);
+
+  add_completion_callback(() => { registration.unregister(); });
+
+  await wait_for_state(test, registration.installing, 'activated');
+}, 'Initialize global state');
+
+promise_test(test => {
+  return new Promise(resolve => {
+    registration.addEventListener('updatefound', resolve);
+    registration.update();
+  });
+}, 'Update service worker with new script that\'s missing importScripts()');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-module-request-mode.https.html b/test/fixtures/wpt/service-workers/service-worker/update-module-request-mode.https.html
new file mode 100644
index 000000000000..b3875d207bc2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-module-request-mode.https.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<meta name="timeout" content="long">
+<title>Test that mode is set to same-origin for a main module</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// Tests a main module service worker script fetch during an update check.
+// The fetch should have the mode set to 'same-origin'.
+//
+// The test works by registering a main module service worker. It then does an
+// update. The test server responds with an updated worker script that remembers
+// the http request. The updated worker reports back this request to the test
+// page.
+promise_test(async (t) => {
+  const script = "resources/test-request-mode-worker.py";
+  const scope = "resources/";
+
+  // Register the service worker.
+  await service_worker_unregister(t, scope);
+  const registration = await navigator.serviceWorker.register(
+      script, {scope, type: 'module'});
+  await wait_for_state(t, registration.installing, 'activated');
+
+  // Do an update.
+  await registration.update();
+
+  // Ask the new worker what the request was.
+  const newWorker = registration.installing;
+  const sawMessage = new Promise((resolve) => {
+    navigator.serviceWorker.onmessage = (event) => {
+      resolve(event.data);
+    };
+  });
+  newWorker.postMessage('getHeaders');
+  const result = await sawMessage;
+
+  // Test the result.
+  assert_equals(result['sec-fetch-mode'], 'same-origin');
+  assert_equals(result['origin'], undefined);
+
+}, 'headers of a main module script');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-no-cache-request-headers.https.html b/test/fixtures/wpt/service-workers/service-worker/update-no-cache-request-headers.https.html
new file mode 100644
index 000000000000..6ebad4b7b10b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-no-cache-request-headers.https.html
@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test that cache is being bypassed/validated in no-cache mode on update</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// Tests a service worker script fetch during an update check which
+// bypasses/validates the browser cache. The fetch should have the
+// 'if-none-match' request header.
+//
+// This tests the Update step:
+//  "Set request’s cache mode to "no-cache" if any of the following are true..."
+// https://w3c.github.io/ServiceWorker/#update-algorithm
+//
+// The test works by registering a service worker with |updateViaCache|
+// set to "none". It then does an update. The test server responds with
+// an updated worker script that remembers the http request headers.
+// The updated worker reports back these headers to the test page.
+promise_test(async (t) => {
+  const script = "resources/test-request-headers-worker.py";
+  const scope = "resources/";
+
+  // Register the service worker.
+  await service_worker_unregister(t, scope);
+  const registration = await navigator.serviceWorker.register(
+      script, {scope, updateViaCache: 'none'});
+  await wait_for_state(t, registration.installing, 'activated');
+
+  // Do an update.
+  await registration.update();
+
+  // Ask the new worker what the request headers were.
+  const newWorker = registration.installing;
+  const sawMessage = new Promise((resolve) => {
+    navigator.serviceWorker.onmessage = (event) => {
+      resolve(event.data);
+    };
+  });
+  newWorker.postMessage('getHeaders');
+  const result = await sawMessage;
+
+  // Test the result.
+  assert_equals(result['service-worker'], 'script');
+  assert_equals(result['if-none-match'], 'etag');
+}, 'headers in no-cache mode');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-not-allowed.https.html b/test/fixtures/wpt/service-workers/service-worker/update-not-allowed.https.html
new file mode 100644
index 000000000000..0a54aa935038
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-not-allowed.https.html
@@ -0,0 +1,140 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+function send_message_to_worker_and_wait_for_response(worker, message) {
+  return new Promise(resolve => {
+    // Use a dedicated channel for every request to avoid race conditions on
+    // concurrent requests.
+    const channel = new MessageChannel();
+    worker.postMessage(channel.port1, [channel.port1]);
+
+    let messageReceived = false;
+    channel.port2.onmessage = event => {
+      assert_false(messageReceived, 'Already received response for ' + message);
+      messageReceived = true;
+      resolve(event.data);
+    };
+    channel.port2.postMessage(message);
+  });
+}
+
+async function ensure_install_event_fired(worker) {
+  const response = await send_message_to_worker_and_wait_for_response(worker, 'awaitInstallEvent');
+  assert_equals('installEventFired', response);
+  assert_equals('installing', worker.state, 'Expected worker to be installing.');
+}
+
+async function finish_install(worker) {
+  await ensure_install_event_fired(worker);
+  const response = await send_message_to_worker_and_wait_for_response(worker, 'finishInstall');
+  assert_equals('installFinished', response);
+}
+
+async function activate_service_worker(t, worker) {
+  await finish_install(worker);
+  // By waiting for both states at the same time, the test fails
+  // quickly if the installation fails, avoiding a timeout.
+  await Promise.race([wait_for_state(t, worker, 'activated'),
+                      wait_for_state(t, worker, 'redundant')]);
+  assert_equals('activated', worker.state, 'Service worker should be activated.');
+}
+
+async function update_within_service_worker(worker) {
+  // This function returns a Promise that resolves when update()
+  // has been called but is not necessarily finished yet.
+  // Call finish() on the returned object to wait for update() settle.
+  const port = await send_message_to_worker_and_wait_for_response(worker, 'callUpdate');
+  let messageReceived = false;
+  return {
+    finish: () => {
+      return new Promise(resolve => {
+        port.onmessage = event => {
+          assert_false(messageReceived, 'Update already finished.');
+          messageReceived = true;
+          resolve(event.data);
+        };
+      });
+    },
+  };
+}
+
+async function update_from_client_and_await_installing_version(test, registration) {
+  const updatefound = wait_for_update(test, registration);
+  registration.update();
+  await updatefound;
+  return registration.installing;
+}
+
+async function spin_up_service_worker(test) {
+  const script = 'resources/update-during-installation-worker.py';
+  const scope = 'resources/blank.html';
+
+  const registration = await service_worker_unregister_and_register(test, script, scope);
+  test.add_cleanup(async () => {
+    if (registration.installing) {
+      // If there is an installing worker, we need to finish installing it.
+      // Otherwise, the tests fails with an timeout because unregister() blocks
+      // until the install-event-handler finishes.
+      const worker = registration.installing;
+      await send_message_to_worker_and_wait_for_response(worker, 'awaitInstallEvent');
+      await send_message_to_worker_and_wait_for_response(worker, 'finishInstall');
+    }
+    return registration.unregister();
+  });
+
+  return registration;
+}
+
+promise_test(async t => {
+  const registration = await spin_up_service_worker(t);
+  const worker = registration.installing;
+  await ensure_install_event_fired(worker);
+
+  const result = registration.update();
+  await activate_service_worker(t, worker);
+  return result;
+}, 'ServiceWorkerRegistration.update() from client succeeds while installing service worker.');
+
+promise_test(async t => {
+  const registration = await spin_up_service_worker(t);
+  const worker = registration.installing;
+  await ensure_install_event_fired(worker);
+
+  // Add event listener to fail the test if update() succeeds.
+  const updatefound = t.step_func(async () => {
+    registration.removeEventListener('updatefound', updatefound);
+    // Activate new worker so non-compliant browsers don't fail with timeout.
+    await activate_service_worker(t, registration.installing);
+    assert_unreached("update() should have failed");
+  });
+  registration.addEventListener('updatefound', updatefound);
+
+  const update = await update_within_service_worker(worker);
+  // Activate worker to ensure update() finishes and the test doesn't timeout
+  // in non-compliant browsers.
+  await activate_service_worker(t, worker);
+
+  const response = await update.finish();
+  assert_false(response.success, 'update() should have failed.');
+  assert_equals('InvalidStateError', response.exception, 'update() should have thrown InvalidStateError.');
+}, 'ServiceWorkerRegistration.update() from installing service worker throws.');
+
+promise_test(async t => {
+  const registration = await spin_up_service_worker(t);
+  const worker1 = registration.installing;
+  await activate_service_worker(t, worker1);
+
+  const worker2 = await update_from_client_and_await_installing_version(t, registration);
+  await ensure_install_event_fired(worker2);
+
+  const update = await update_within_service_worker(worker1);
+  // Activate the new version so that update() finishes and the test doesn't timeout.
+  await activate_service_worker(t, worker2);
+  const response = await update.finish();
+  assert_true(response.success, 'update() from active service worker should have succeeded.');
+}, 'ServiceWorkerRegistration.update() from active service worker succeeds while installing service worker.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-on-navigation.https.html b/test/fixtures/wpt/service-workers/service-worker/update-on-navigation.https.html
new file mode 100644
index 000000000000..5273420b90fc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-on-navigation.https.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title>Update on navigation</title>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='resources/test-helpers.sub.js'></script>
+<script>
+promise_test(async (t) => {
+    var script = 'resources/update-fetch-worker.py';
+    var scope = 'resources/trickle.py?ms=1000&count=1';
+
+    const registration = await service_worker_unregister_and_register(t, script, scope);
+    t.add_cleanup(() => registration.unregister());
+
+    if (registration.installing)
+        await wait_for_state(t, registration.installing, 'activated');
+
+    const frame = await with_iframe(scope);
+    t.add_cleanup(() => frame.remove());
+}, 'The active service worker in charge of a navigation load should not be terminated as part of updating the registration');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-recovery.https.html b/test/fixtures/wpt/service-workers/service-worker/update-recovery.https.html
new file mode 100644
index 000000000000..17608d2ef790
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-recovery.https.html
@@ -0,0 +1,73 @@
+<!DOCTYPE html>
+<title>Service Worker: recovery by navigation update</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var scope = 'resources/simple.txt';
+    var worker_url = 'resources/update-recovery-worker.py';
+    var expected_url = normalizeURL(worker_url);
+    var registration;
+
+    function with_bad_iframe(url) {
+      return new Promise(function(resolve, reject) {
+        var frame = document.createElement('iframe');
+
+        // There is no cross-browser event to listen for to detect an
+        // iframe that fails to load due to a bad interception.  Unfortunately
+        // we have to use a timeout.
+        var timeout = setTimeout(function() {
+          frame.remove();
+          resolve();
+        }, 5000);
+
+        // If we do get a load event, though, we know something went wrong.
+        frame.addEventListener('load', function() {
+          clearTimeout(timeout);
+          frame.remove();
+          reject('expected bad iframe should not fire a load event!');
+        });
+
+        frame.src = url;
+        document.body.appendChild(frame);
+      });
+    }
+
+    function with_update(t) {
+      return new Promise(function(resolve, reject) {
+        registration.addEventListener('updatefound', function onUpdate() {
+          registration.removeEventListener('updatefound', onUpdate);
+          wait_for_state(t, registration.installing, 'activated').then(function() {
+            resolve();
+          });
+        });
+      });
+    }
+
+    return service_worker_unregister_and_register(t, worker_url, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return Promise.all([
+            with_update(t),
+            with_bad_iframe(scope)
+          ]);
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          assert_equals(frame.contentWindow.navigator.serviceWorker.controller.scriptURL,
+                        expected_url);
+          frame.remove();
+        });
+  }, 'Recover from a bad service worker by updating after a failed navigation.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-registration-with-type.https.html b/test/fixtures/wpt/service-workers/service-worker/update-registration-with-type.https.html
new file mode 100644
index 000000000000..269e61b390bd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-registration-with-type.https.html
@@ -0,0 +1,208 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: Update the registration with a different script type.</title>
+<!-- common.js is for guid() -->
+<script src="/common/security-features/resources/common.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// The following two tests check that a registration is updated correctly
+// with different script type. At first Service Worker is registered as
+// classic script type, then it is re-registered as module script type,
+// and vice versa. A main script is also updated at the same time.
+promise_test(async t => {
+  const key = guid();
+  const script = `resources/update-registration-with-type.py?classic_first=1&key=${key}`;
+  const scope = 'resources/update-registration-with-type';
+  await service_worker_unregister(t, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  // Register with classic script type.
+  const firstRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'classic'
+  });
+  const firstWorker = firstRegistration.installing;
+  await wait_for_state(t, firstWorker, 'activated');
+  firstWorker.postMessage(' ');
+  let msgEvent = await new Promise(r => navigator.serviceWorker.onmessage = r);
+  assert_equals(msgEvent.data, 'A classic script.');
+
+  // Re-register with module script type.
+  const secondRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'module'
+  });
+  const secondWorker = secondRegistration.installing;
+  secondWorker.postMessage(' ');
+  msgEvent = await new Promise(r => navigator.serviceWorker.onmessage = r);
+  assert_equals(msgEvent.data, 'A module script.');
+
+  assert_not_equals(firstWorker, secondWorker);
+  assert_equals(firstRegistration, secondRegistration);
+}, 'Update the registration with a different script type (classic => module).');
+
+promise_test(async t => {
+  const key = guid();
+  const script = `resources/update-registration-with-type.py?classic_first=0&key=${key}`;
+  const scope = 'resources/update-registration-with-type';
+  await service_worker_unregister(t, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  // Register with module script type.
+  const firstRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'module'
+  });
+  const firstWorker = firstRegistration.installing;
+  await wait_for_state(t, firstWorker, 'activated');
+  firstWorker.postMessage(' ');
+  let msgEvent = await new Promise(r => navigator.serviceWorker.onmessage = r);
+  assert_equals(msgEvent.data, 'A module script.');
+
+  // Re-register with classic script type.
+  const secondRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'classic'
+  });
+  const secondWorker = secondRegistration.installing;
+  secondWorker.postMessage(' ');
+  msgEvent = await new Promise(r => navigator.serviceWorker.onmessage = r);
+  assert_equals(msgEvent.data, 'A classic script.');
+
+  assert_not_equals(firstWorker, secondWorker);
+  assert_equals(firstRegistration, secondRegistration);
+}, 'Update the registration with a different script type (module => classic).');
+
+// The following two tests change the script type while keeping
+// the script identical.
+promise_test(async t => {
+  const script = 'resources/empty-worker.js';
+  const scope = 'resources/update-registration-with-type';
+  await service_worker_unregister(t, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  // Register with classic script type.
+  const firstRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'classic'
+  });
+  const firstWorker = firstRegistration.installing;
+  await wait_for_state(t, firstWorker, 'activated');
+
+  // Re-register with module script type.
+  const secondRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'module'
+  });
+  const secondWorker = secondRegistration.installing;
+
+  assert_not_equals(firstWorker, secondWorker);
+  assert_equals(firstRegistration, secondRegistration);
+}, 'Update the registration with a different script type (classic => module) '
+    + 'and with a same main script.');
+
+promise_test(async t => {
+  const script = 'resources/empty-worker.js';
+  const scope = 'resources/update-registration-with-type';
+  await service_worker_unregister(t, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  // Register with module script type.
+  const firstRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'module'
+  });
+  const firstWorker = firstRegistration.installing;
+  await wait_for_state(t, firstWorker, 'activated');
+
+  // Re-register with classic script type.
+  const secondRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'classic'
+  });
+  const secondWorker = secondRegistration.installing;
+
+  assert_not_equals(firstWorker, secondWorker);
+  assert_equals(firstRegistration, secondRegistration);
+}, 'Update the registration with a different script type (module => classic) '
+    + 'and with a same main script.');
+
+// This test checks that a registration is not updated with the same script
+// type and the same main script.
+promise_test(async t => {
+  const script = 'resources/empty-worker.js';
+  const scope = 'resources/update-registration-with-type';
+  await service_worker_unregister(t, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  // Register with module script type.
+  const firstRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'module'
+  });
+  await wait_for_state(t, firstRegistration.installing, 'activated');
+
+  // Re-register with module script type.
+  const secondRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'module'
+  });
+  assert_equals(secondRegistration.installing, null);
+
+  assert_equals(firstRegistration, secondRegistration);
+}, 'Does not update the registration with the same script type and '
+    + 'the same main script.');
+
+// In the case (classic => module), a worker script contains importScripts()
+// that is disallowed on module scripts, so the second registration is
+// expected to fail script evaluation.
+promise_test(async t => {
+  const script = 'resources/classic-worker.js';
+  const scope = 'resources/update-registration-with-type';
+  await service_worker_unregister(t, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  // Register with classic script type.
+  const firstRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'classic'
+  });
+  assert_not_equals(firstRegistration.installing, null);
+  await wait_for_state(t, firstRegistration.installing, 'activated');
+
+  // Re-register with module script type and expect TypeError.
+  return promise_rejects_js(t, TypeError, navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'module'
+  }), 'Registering with invalid evaluation should be failed.');
+}, 'Update the registration with a different script type (classic => module) '
+    + 'and with a same main script. Expect evaluation failed.');
+
+// In the case (module => classic), a worker script contains static-import
+// that is disallowed on classic scripts, so the second registration is
+// expected to fail script evaluation.
+promise_test(async t => {
+  const script = 'resources/module-worker.js';
+  const scope = 'resources/update-registration-with-type';
+  await service_worker_unregister(t, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  // Register with module script type.
+  const firstRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'module'
+  });
+  assert_not_equals(firstRegistration.installing, null);
+  await wait_for_state(t, firstRegistration.installing, 'activated');
+
+  // Re-register with classic script type and expect TypeError.
+  return promise_rejects_js(t, TypeError, navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'classic'
+  }), 'Registering with invalid evaluation should be failed.');
+}, 'Update the registration with a different script type (module => classic) '
+    + 'and with a same main script. Expect evaluation failed.');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-result.https.html b/test/fixtures/wpt/service-workers/service-worker/update-result.https.html
new file mode 100644
index 000000000000..d8ed94f77665
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-result.https.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<title>Service Worker: update() should resolve a ServiceWorkerRegistration</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+promise_test(async function(t) {
+  const script = './resources/empty.js';
+  const scope = './resources/empty.html?update-result';
+
+  let reg = await navigator.serviceWorker.register(script, { scope });
+  t.add_cleanup(async _ => await reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  let result = await reg.update();
+  assert_true(result instanceof ServiceWorkerRegistration,
+              'update() should resolve a ServiceWorkerRegistration');
+}, 'ServiceWorkerRegistration.update() should resolve a registration object');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update.https.html b/test/fixtures/wpt/service-workers/service-worker/update.https.html
new file mode 100644
index 000000000000..f9fded3db49f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update.https.html
@@ -0,0 +1,164 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration update()</title>
+<meta name="timeout" content="long">
+<script src="/common/utils.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+const SCOPE = 'resources/simple.txt';
+
+// Create a service worker (update-worker.py). The response to update() will be
+// different based on the mode.
+async function prepare_ready_registration_with_mode(t, mode) {
+  const key = token();
+  const worker_url = `resources/update-worker.py?Key=${key}&Mode=${mode}`;
+  const expected_url = normalizeURL(worker_url);
+  const registration = await service_worker_unregister_and_register(
+      t, worker_url, SCOPE);
+  await wait_for_state(t, registration.installing, 'activated');
+  assert_equals(registration.installing, null,
+                'prepare_ready: installing');
+  assert_equals(registration.waiting, null,
+                'prepare_ready: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'prepare_ready: active');
+  return [registration, expected_url];
+}
+
+// Create a service worker (update-worker-from-file.py), which is initially
+// |initial_worker| and |updated_worker| later.
+async function prepare_ready_registration_with_file(
+    t, initial_worker, updated_worker) {
+  const key = token();
+  const worker_url = `resources/update-worker-from-file.py?` +
+      `First=${initial_worker}&Second=${updated_worker}&Key=${key}`;
+  const expected_url = normalizeURL(worker_url);
+
+  const registration = await service_worker_unregister_and_register(
+      t, worker_url, SCOPE);
+  await wait_for_state(t, registration.installing, 'activated');
+  assert_equals(registration.installing, null,
+                'prepare_ready: installing');
+  assert_equals(registration.waiting, null,
+                'prepare_ready: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'prepare_ready: active');
+  return [registration, expected_url];
+}
+
+function assert_installing_and_active(registration, expected_url) {
+  assert_equals(registration.installing.scriptURL, expected_url,
+                'assert_installing_and_active: installing');
+  assert_equals(registration.waiting, null,
+                'assert_installing_and_active: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'assert_installing_and_active: active');
+}
+
+function assert_waiting_and_active(registration, expected_url) {
+  assert_equals(registration.installing, null,
+                'assert_waiting_and_active: installing');
+  assert_equals(registration.waiting.scriptURL, expected_url,
+                'assert_waiting_and_active: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'assert_waiting_and_active: active');
+}
+
+function assert_active_only(registration, expected_url) {
+  assert_equals(registration.installing, null,
+                'assert_active_only: installing');
+  assert_equals(registration.waiting, null,
+                'assert_active_only: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'assert_active_only: active');
+}
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_registration_with_mode(t, 'normal');
+  t.add_cleanup(() => registration.unregister());
+
+  await Promise.all([registration.update(), wait_for_update(t, registration)]);
+  assert_installing_and_active(registration, expected_url);
+
+  await wait_for_state(t, registration.installing, 'installed');
+  assert_waiting_and_active(registration, expected_url);
+
+  await wait_for_state(t, registration.waiting, 'activated');
+  assert_active_only(registration, expected_url);
+}, 'update() should succeed when new script is available.');
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_registration_with_mode(t, 'bad_mime_type');
+  t.add_cleanup(() => registration.unregister());
+
+  await promise_rejects_dom(t, 'SecurityError', registration.update());
+  assert_active_only(registration, expected_url);
+}, 'update() should fail when mime type is invalid.');
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_registration_with_mode(t, 'redirect');
+  t.add_cleanup(() => registration.unregister());
+
+  await promise_rejects_js(t, TypeError, registration.update());
+  assert_active_only(registration, expected_url);
+}, 'update() should fail when a response for the main script is redirect.');
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_registration_with_mode(t, 'syntax_error');
+  t.add_cleanup(() => registration.unregister());
+
+  await promise_rejects_js(t, TypeError, registration.update());
+  assert_active_only(registration, expected_url);
+}, 'update() should fail when a new script contains a syntax error.');
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_registration_with_mode(t, 'throw_install');
+  t.add_cleanup(() => registration.unregister());
+
+  await Promise.all([registration.update(), wait_for_update(t, registration)]);
+  assert_installing_and_active(registration, expected_url);
+}, 'update() should resolve when the install event throws.');
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_registration_with_mode(t, 'normal');
+  t.add_cleanup(() => registration.unregister());
+
+  // We need to hold a client alive so that unregister() below doesn't remove
+  // the registration before update() has had a chance to look at the pending
+  // uninstall flag.
+  const frame = await with_iframe(SCOPE);
+  t.add_cleanup(() => frame.remove());
+
+  await promise_rejects_js(
+      t, TypeError,
+      Promise.all([registration.unregister(), registration.update()]));
+}, 'update() should fail when the pending uninstall flag is set.');
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_registration_with_file(
+        t,
+        'update-smaller-body-before-update-worker.js',
+        'update-smaller-body-after-update-worker.js');
+  t.add_cleanup(() => registration.unregister());
+
+  await Promise.all([registration.update(), wait_for_update(t, registration)]);
+  assert_installing_and_active(registration, expected_url);
+
+  await wait_for_state(t, registration.installing, 'installed');
+  assert_waiting_and_active(registration, expected_url);
+
+  await wait_for_state(t, registration.waiting, 'activated');
+  assert_active_only(registration, expected_url);
+}, 'update() should succeed when the script shrinks.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/waiting.https.html b/test/fixtures/wpt/service-workers/service-worker/waiting.https.html
new file mode 100644
index 000000000000..499e581eb353
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/waiting.https.html
@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<title>ServiceWorker: navigator.serviceWorker.waiting</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+const SCRIPT = 'resources/empty-worker.js';
+const SCOPE = 'resources/blank.html';
+
+promise_test(async t => {
+
+  t.add_cleanup(async() => {
+    if (frame)
+      frame.remove();
+    if (registration)
+      await registration.unregister();
+  });
+
+  await service_worker_unregister(t, SCOPE);
+  const frame = await with_iframe(SCOPE);
+  const registration =
+      await navigator.serviceWorker.register(SCRIPT, {scope: SCOPE});
+  await wait_for_state(t, registration.installing, 'installed');
+  const controller = frame.contentWindow.navigator.serviceWorker.controller;
+  assert_equals(controller, null, 'controller');
+  assert_equals(registration.active, null, 'registration.active');
+  assert_equals(registration.waiting.state, 'installed',
+                'registration.waiting');
+  assert_equals(registration.installing, null, 'registration.installing');
+}, 'waiting is set after installation');
+
+// Tests that the ServiceWorker objects returned from waiting attribute getter
+// that represent the same service worker are the same objects.
+promise_test(async t => {
+  const registration1 =
+      await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+  const registration2 = await navigator.serviceWorker.getRegistration(SCOPE);
+  assert_equals(registration1.waiting, registration2.waiting,
+                'ServiceWorkerRegistration.waiting should return the same ' +
+                'object');
+  await registration1.unregister();
+}, 'The ServiceWorker objects returned from waiting attribute getter that ' +
+   'represent the same service worker are the same objects');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/websocket-in-service-worker.https.html b/test/fixtures/wpt/service-workers/service-worker/websocket-in-service-worker.https.html
new file mode 100644
index 000000000000..cda9d6fe67e2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/websocket-in-service-worker.https.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<title>Service Worker: WebSockets can be created in a Service Worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    const SCRIPT = 'resources/websocket-worker.js?pipe=sub';
+    const SCOPE = 'resources/blank.html';
+    let registration;
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(r => {
+          add_completion_callback(() => { r.unregister(); });
+          registration = r;
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(() => {
+          return new Promise(resolve => {
+              navigator.serviceWorker.onmessage = t.step_func(msg => {
+                  assert_equals(msg.data, 'PASS');
+                  resolve();
+              });
+              registration.active.postMessage({});
+          });
+        });
+  }, 'Verify WebSockets can be created in a Service Worker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/websocket.https.html b/test/fixtures/wpt/service-workers/service-worker/websocket.https.html
new file mode 100644
index 000000000000..cbfed456a9dc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/websocket.https.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<title>Service Worker: WebSocket handshake channel is not intercepted</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+
+promise_test(function(t) {
+    var path = new URL(".", window.location).pathname
+    var url = 'resources/websocket.js';
+    var scope = 'resources/blank.html?websocket';
+    var host_info = get_host_info();
+    var frameURL = host_info['HTTPS_ORIGIN'] + path + scope;
+    var frame;
+
+    return service_worker_unregister_and_register(t, url, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(frameURL); })
+      .then(function(f) {
+          frame = f;
+          return websocket(t, frame);
+        })
+      .then(function() {
+          var channel = new MessageChannel();
+          return new Promise(function(resolve) {
+            channel.port1.onmessage = resolve;
+            frame.contentWindow.navigator.serviceWorker.controller.postMessage({port: channel.port2}, [channel.port2]);
+          });
+        })
+      .then(function(e) {
+          for (var url in e.data.urls) {
+            assert_equals(url.indexOf(get_websocket_url()), -1,
+                          "Observed an unexpected FetchEvent for the WebSocket handshake");
+          }
+          frame.remove();
+        });
+  }, 'Verify WebSocket handshake channel does not get intercepted');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/webvtt-cross-origin.https.html b/test/fixtures/wpt/service-workers/service-worker/webvtt-cross-origin.https.html
new file mode 100644
index 000000000000..9394ff75c4a5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/webvtt-cross-origin.https.html
@@ -0,0 +1,175 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>cross-origin webvtt returned by service worker is detected</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<body>
+<script>
+// This file tests responses for WebVTT text track from a service worker. It
+// creates an iframe with a <track> element, controlled by a service worker.
+// Each test tries to load a text track, the service worker intercepts the
+// requests and responds with opaque or non-opaque responses. As the
+// crossorigin attribute is not set, request's mode is always "same-origin",
+// and as specified in https://fetch.spec.whatwg.org/#http-fetch,
+// a response from a service worker whose type is neither "basic" nor
+// "default" is rejected.
+
+const host_info = get_host_info();
+const kScript = 'resources/fetch-rewrite-worker.js';
+// Add '?ignore' so the service worker falls back for the navigation.
+const kScope = 'resources/vtt-frame.html?ignore';
+let frame;
+
+function load_track(url) {
+  const track = frame.contentDocument.querySelector('track');
+  const result = new Promise((resolve, reject) => {
+      track.onload = (e => {
+          resolve('load event');
+        });
+      track.onerror = (e => {
+          resolve('error event');
+        });
+    });
+
+  track.src = url;
+  // Setting mode to hidden seems needed, or else the text track requests don't
+  // occur.
+  track.track.mode = 'hidden';
+  return result;
+}
+
+promise_test(t => {
+    return service_worker_unregister_and_register(t, kScript, kScope)
+      .then(registration => {
+          promise_test(() => {
+              frame.remove();
+              return registration.unregister();
+            }, 'restore global state');
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(() => {
+          return with_iframe(kScope);
+        })
+      .then(f => {
+          frame = f;
+        })
+  }, 'initialize global state');
+
+promise_test(t => {
+    let url = '/media/foo.vtt';
+    // Add '?url' and tell the service worker to fetch a same-origin URL.
+    url += '?url=' + host_info.HTTPS_ORIGIN + '/media/foo.vtt';
+    return load_track(url)
+      .then(result => {
+          assert_equals(result, 'load event');
+        });
+  }, 'same-origin text track should load');
+
+promise_test(t => {
+    let url = '/media/foo.vtt';
+    // Add '?url' and tell the service worker to fetch a cross-origin URL.
+    url += '?url=' + get_host_info().HTTPS_REMOTE_ORIGIN + '/media/foo.vtt';
+    return load_track(url)
+      .then(result => {
+          assert_equals(result, 'error event');
+        });
+  }, 'cross-origin text track with no-cors request should not load');
+
+promise_test(t => {
+    let url = '/media/foo.vtt';
+    // Add '?url' and tell the service worker to fetch a cross-origin URL that
+    // doesn't support CORS.
+    url += '?url=' + get_host_info().HTTPS_REMOTE_ORIGIN +
+        '/media/foo-no-cors.vtt';
+    // Add '&mode' to tell the service worker to do a CORS request.
+    url += '&mode=cors';
+    return load_track(url)
+      .then(result => {
+          assert_equals(result, 'error event');
+        });
+  }, 'cross-origin text track with rejected cors request should not load');
+
+promise_test(t => {
+    let url = '/media/foo.vtt';
+    // Add '?url' and tell the service worker to fetch a cross-origin URL.
+    url += '?url=' + get_host_info().HTTPS_REMOTE_ORIGIN + '/media/foo.vtt';
+    // Add '&mode' to tell the service worker to do a CORS request.
+    url += '&mode=cors';
+    // Add '&credentials=same-origin' to allow Access-Control-Allow-Origin=* so
+    // that CORS will succeed if the service approves it.
+    url += '&credentials=same-origin';
+    return load_track(url)
+      .then(result => {
+          assert_equals(result, 'error event');
+        });
+  }, 'cross-origin text track with approved cors request should not load');
+
+// Redirect tests.
+
+promise_test(t => {
+    let url = '/media/foo.vtt';
+    // Add '?url' and tell the service worker to fetch a same-origin URL that redirects...
+    redirector_url = host_info.HTTPS_ORIGIN + base_path() + 'resources/redirect.py?Redirect=';
+    // ... to a same-origin URL.
+    redirect_target = host_info.HTTPS_ORIGIN + '/media/foo.vtt';
+    url += '?url=' + encodeURIComponent(redirector_url + encodeURIComponent(redirect_target));
+    return load_track(url)
+      .then(result => {
+          assert_equals(result, 'load event');
+        });
+  }, 'same-origin text track that redirects same-origin should load');
+
+promise_test(t => {
+    let url = '/media/foo.vtt';
+    // Add '?url' and tell the service worker to fetch a same-origin URL that redirects...
+    redirector_url = host_info.HTTPS_ORIGIN + base_path() + 'resources/redirect.py?Redirect=';
+    // ... to a cross-origin URL.
+    redirect_target = host_info.HTTPS_REMOTE_ORIGIN + '/media/foo.vtt';
+    url += '?url=' + encodeURIComponent(redirector_url + encodeURIComponent(redirect_target));
+    return load_track(url)
+      .then(result => {
+          assert_equals(result, 'error event');
+        });
+  }, 'same-origin text track that redirects cross-origin should not load');
+
+
+promise_test(t => {
+    let url = '/media/foo.vtt';
+    // Add '?url' and tell the service worker to fetch a same-origin URL that redirects...
+    redirector_url = host_info.HTTPS_ORIGIN + base_path() + 'resources/redirect.py?Redirect=';
+    // ... to a cross-origin URL.
+    redirect_target = host_info.HTTPS_REMOTE_ORIGIN + '/media/foo-no-cors.vtt';
+    url += '?url=' + encodeURIComponent(redirector_url + encodeURIComponent(redirect_target));
+    // Add '&mode' to tell the service worker to do a CORS request.
+    url += '&mode=cors';
+    // Add '&credentials=same-origin' to allow Access-Control-Allow-Origin=* so
+    // that CORS will succeed if the server approves it.
+    url += '&credentials=same-origin';
+    return load_track(url)
+      .then(result => {
+          assert_equals(result, 'error event');
+        });
+  }, 'same-origin text track that redirects to a cross-origin text track with rejected cors should not load');
+
+promise_test(t => {
+    let url = '/media/foo.vtt';
+    // Add '?url' and tell the service worker to fetch a same-origin URL that redirects...
+    redirector_url = host_info.HTTPS_ORIGIN + base_path() + 'resources/redirect.py?Redirect=';
+    // ... to a cross-origin URL.
+    redirect_target = host_info.HTTPS_REMOTE_ORIGIN + '/media/foo.vtt';
+    url += '?url=' + encodeURIComponent(redirector_url + encodeURIComponent(redirect_target));
+    // Add '&mode' to tell the service worker to do a CORS request.
+    url += '&mode=cors';
+    // Add '&credentials=same-origin' to allow Access-Control-Allow-Origin=* so
+    // that CORS will succeed if the server approves it.
+    url += '&credentials=same-origin';
+    return load_track(url)
+      .then(result => {
+          assert_equals(result, 'error event');
+        });
+  }, 'same-origin text track that redirects to a cross-origin text track with approved cors should not load');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/windowclient-ancestorOrigins.sub.https.html b/test/fixtures/wpt/service-workers/service-worker/windowclient-ancestorOrigins.sub.https.html
new file mode 100644
index 000000000000..05f8cfc5308c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/windowclient-ancestorOrigins.sub.https.html
@@ -0,0 +1,37 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Client ancestorOrigins with iframe referrerpolicy</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+<script>
+const origins = {
+  A: window.origin,
+  B: "https://{{domains[www]}}:{{ports[https][0]}}",
+};
+const tests = [
+  {policy: "",            origin: 'A', expect: [origins.A]},
+  {policy: "no-referrer", origin: 'A', expect: ["null"]},
+  {policy: "same-origin", origin: 'A', expect: [origins.A]},
+  {policy: "same-origin", origin: 'B', expect: ["null"]},
+];
+for (const test of tests) {
+  promise_test(async (t) => {
+    const origin = origins[test.origin];
+    const iframe = document.createElement('iframe');
+    t.add_cleanup(() => { iframe.remove(); });
+    const id = `${test.policy},${origin}`;
+    iframe.name = id;
+    iframe.referrerPolicy = test.policy;
+    iframe.src = `${origin}/service-workers/service-worker/resources/ancestorOrigins.html?id=${id}`;
+    document.body.append(iframe);
+    const result = await new Promise(resolve => {
+      addEventListener('message', e => { resolve(e.data); }, {once: true});
+    });
+    assert_equals(result.id, id, 'id');
+    assert_array_equals(result.swAO, test.expect, 'windowClient.ancestorOrigins');
+    assert_true(result.sameObject, 'windowClient.ancestorOrigins is [SameObject]');
+    assert_array_equals(result.locationAO, test.expect, 'location.ancestorOrigins');
+  }, `iframe referrerpolicy="${test.policy}", origin ${test.origin}`);
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/windowclient-navigate.https.html b/test/fixtures/wpt/service-workers/service-worker/windowclient-navigate.https.html
new file mode 100644
index 000000000000..8c1dcad5b65d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/windowclient-navigate.https.html
@@ -0,0 +1,190 @@
+<!DOCTYPE html>
+<title>Service Worker: WindowClient.navigate() tests</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+'use strict';
+
+const SCOPE = 'resources/blank.html';
+const SCRIPT_URL = 'resources/windowclient-navigate-worker.js';
+const CROSS_ORIGIN_URL =
+  get_host_info()['HTTPS_REMOTE_ORIGIN'] + base_path() + 'resources/blank.html';
+
+navigateTest({
+  description: 'normal',
+  destUrl: 'blank.html?navigate',
+  expected: normalizeURL(SCOPE) + '?navigate',
+});
+
+navigateTest({
+  description: 'blank url',
+  destUrl: '',
+  expected: normalizeURL(SCRIPT_URL)
+});
+
+navigateTest({
+  description: 'in scope but not controlled test on installing worker',
+  destUrl: 'blank.html?navigate',
+  expected: 'TypeError',
+  waitState: 'installing',
+});
+
+navigateTest({
+  description: 'in scope but not controlled test on active worker',
+  destUrl: 'blank.html?navigate',
+  expected: 'TypeError',
+  controlled: false,
+});
+
+navigateTest({
+  description: 'out of scope',
+  srcUrl: '/common/blank.html',
+  destUrl: 'blank.html?navigate',
+  expected: 'TypeError',
+});
+
+navigateTest({
+  description: 'cross origin url',
+  destUrl: CROSS_ORIGIN_URL,
+  expected: null
+});
+
+navigateTest({
+  description: 'invalid url (http://[example.com])',
+  destUrl: 'http://[example].com',
+  expected: 'TypeError'
+});
+
+navigateTest({
+  description: 'invalid url (view-source://example.com)',
+  destUrl: 'view-source://example.com',
+  expected: 'TypeError'
+});
+
+navigateTest({
+  description: 'invalid url (file:///)',
+  destUrl: 'file:///',
+  expected: 'TypeError'
+});
+
+navigateTest({
+  description: 'invalid url (about:blank)',
+  destUrl: 'about:blank',
+  expected: 'TypeError'
+});
+
+navigateTest({
+  description: 'navigate on a top-level window client',
+  destUrl: 'blank.html?navigate',
+  srcUrl: 'resources/loaded.html',
+  scope: 'resources/loaded.html',
+  expected: normalizeURL(SCOPE) + '?navigate',
+  frameType: 'top-level'
+});
+
+async function createFrame(t, parameters) {
+  if (parameters.frameType === 'top-level') {
+    // Wait for window.open is completed.
+    await new Promise(resolve => {
+      const win = window.open(parameters.srcUrl);
+      t.add_cleanup(() => win.close());
+      window.addEventListener('message', (e) => {
+        if (e.data.type === 'LOADED') {
+          resolve();
+        }
+      });
+    });
+  }
+
+  if (parameters.frameType === 'nested') {
+    const frame = await with_iframe(parameters.srcUrl);
+    t.add_cleanup(() => frame.remove());
+  }
+}
+
+function navigateTest(overrideParameters) {
+  // default parameters
+  const parameters = {
+    description: null,
+    srcUrl: SCOPE,
+    destUrl: null,
+    expected: null,
+    waitState: 'activated',
+    scope: SCOPE,
+    controlled: true,
+    // `frameType` can be 'nested' for an iframe WindowClient or 'top-level' for
+    // a main frame WindowClient.
+    frameType: 'nested'
+  };
+
+  for (const key in overrideParameters)
+    parameters[key] = overrideParameters[key];
+
+  promise_test(async function(t) {
+    let pausedLifecyclePort;
+    let scriptUrl = SCRIPT_URL;
+
+    // For in-scope-but-not-controlled test on installing worker,
+    // if the waitState is "installing", then append the query to scriptUrl.
+    if (parameters.waitState === 'installing') {
+      scriptUrl += '?' + parameters.waitState;
+
+      navigator.serviceWorker.addEventListener('message', (event) => {
+        if (event.data.port) {
+          pausedLifecyclePort = event.data.port;
+        }
+      });
+    }
+
+    t.add_cleanup(() => {
+      // Some tests require that the worker remain in a given lifecycle phase.
+      // "Clean up" logic for these tests requires signaling the worker to
+      // release the hold; this allows the worker to be properly discarded
+      // prior to the execution of additional tests.
+      if (pausedLifecyclePort) {
+        // The value of the posted message is inconsequential. A string is
+        // specified here solely to aid in test debugging.
+        pausedLifecyclePort.postMessage('continue lifecycle');
+      }
+    });
+
+    // Create a frame that is not controlled by a service worker.
+    if (!parameters.controlled) {
+      await createFrame(t, parameters);
+    }
+
+    const registration = await service_worker_unregister_and_register(
+        t, scriptUrl, parameters.scope);
+    const serviceWorker = registration.installing;
+    await wait_for_state(t, serviceWorker, parameters.waitState);
+    t.add_cleanup(() => registration.unregister());
+
+    // Create a frame after a service worker is registered so that the frmae is
+    // controlled by an active service worker.
+    if (parameters.controlled) {
+      await createFrame(t, parameters);
+    }
+
+    const response = await new Promise(resolve => {
+      const channel = new MessageChannel();
+      channel.port1.onmessage = t.step_func(resolve);
+      serviceWorker.postMessage({
+        port: channel.port2,
+        url: parameters.destUrl,
+        clientUrl: new URL(parameters.srcUrl, location).toString(),
+        frameType: parameters.frameType,
+        expected: parameters.expected,
+        description: parameters.description,
+      }, [channel.port2]);
+    });
+
+    assert_equals(response.data, null);
+    await fetch_tests_from_worker(serviceWorker);
+  }, parameters.description);
+}
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/worker-client-id.https.html b/test/fixtures/wpt/service-workers/service-worker/worker-client-id.https.html
new file mode 100644
index 000000000000..4e4d31660bd5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/worker-client-id.https.html
@@ -0,0 +1,58 @@
+<!DOCTYPE html>
+<title>Service Worker: Workers should have their own unique client Id</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+// Get the iframe client ID by calling postMessage() on its controlling
+// worker.  This will cause the service worker to post back the
+// MessageEvent.source.id value.
+function getFrameClientId(frame) {
+  return new Promise(resolve => {
+    let mc = new MessageChannel();
+    frame.contentWindow.navigator.serviceWorker.controller.postMessage(
+      'echo-client-id', [mc.port2]);
+    mc.port1.onmessage = evt => {
+      resolve(evt.data);
+    };
+  });
+}
+
+// Get the worker client ID by creating a worker that performs an intercepted
+// fetch().  The synthetic fetch() response will contain the FetchEvent.clientId
+// value.  This is then posted back to here.
+function getWorkerClientId(frame) {
+  return new Promise(resolve => {
+    let w = new frame.contentWindow.Worker('worker-echo-client-id.js');
+    w.onmessage = evt => {
+      resolve(evt.data);
+    };
+  });
+}
+
+promise_test(async function(t) {
+  const script = './resources/worker-client-id-worker.js';
+  const scope = './resources/worker-client-id';
+  const frame = scope + '/frame.html';
+
+  let reg = await navigator.serviceWorker.register(script, { scope });
+  t.add_cleanup(async _ => await reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  let f = await with_iframe(frame);
+  t.add_cleanup(_ => f.remove());
+
+  let frameClientId = await getFrameClientId(f);
+  assert_not_equals(frameClientId, null, 'frame client id should exist');
+
+  let workerClientId = await getWorkerClientId(f);
+  assert_not_equals(workerClientId, null, 'worker client id should exist');
+
+  assert_not_equals(frameClientId, workerClientId,
+                    'frame and worker client ids should be different');
+}, 'Verify workers have a unique client id separate from their owning documents window');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/worker-in-sandboxed-iframe-by-csp-fetch-event.https.html b/test/fixtures/wpt/service-workers/service-worker/worker-in-sandboxed-iframe-by-csp-fetch-event.https.html
new file mode 100644
index 000000000000..c8480bf1be00
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/worker-in-sandboxed-iframe-by-csp-fetch-event.https.html
@@ -0,0 +1,132 @@
+<!DOCTYPE html>
+<title>ServiceWorker FetchEvent issued from workers in an iframe sandboxed via CSP HTTP response header.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+let lastCallbackId = 0;
+let callbacks = {};
+function doTest(frame, type) {
+  return new Promise(function(resolve) {
+    var id = ++lastCallbackId;
+    callbacks[id] = resolve;
+    frame.contentWindow.postMessage({id: id, type: type}, '*');
+  });
+}
+
+// Asks the service worker for data about requests and clients seen. The
+// worker posts a message back with |data| where:
+// |data.requests|: the requests the worker received FetchEvents for
+// |data.clients|: the URLs of all the worker's clients
+// The worker clears its data after responding.
+function getResultsFromWorker(worker) {
+  return new Promise(resolve => {
+    let channel = new MessageChannel();
+    channel.port1.onmessage = msg => {
+      resolve(msg.data);
+    };
+    worker.postMessage({port: channel.port2}, [channel.port2]);
+  });
+}
+
+window.onmessage = function (e) {
+  message = e.data;
+  let id = message['id'];
+  let callback = callbacks[id];
+  delete callbacks[id];
+  callback(message['result']);
+};
+
+const SCOPE = 'resources/sandboxed-iframe-fetch-event-iframe.py';
+const SCRIPT = 'resources/sandboxed-iframe-fetch-event-worker.js';
+const expected_base_url = new URL(SCOPE, location.href);
+// A service worker controlling |SCOPE|.
+let worker;
+// An iframe whose response header has
+// 'Content-Security-Policy: allow-scripts'.
+// This should NOT be controlled by a service worker.
+let sandboxed_frame_by_header;
+// An iframe whose response header has
+// 'Content-Security-Policy: allow-scripts allow-same-origin'.
+// This should be controlled by a service worker.
+let sandboxed_same_origin_frame_by_header;
+
+promise_test(t => {
+  return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+    .then(function(registration) {
+      add_completion_callback(() => registration.unregister());
+      worker = registration.installing;
+      return wait_for_state(t, registration.installing, 'activated');
+    });
+}, 'Prepare a service worker.');
+
+promise_test(t => {
+  const iframe_full_url = expected_base_url + '?sandbox=allow-scripts&' +
+                          'sandboxed-frame-by-header';
+  return with_iframe(iframe_full_url)
+    .then(f => {
+      sandboxed_frame_by_header = f;
+      add_completion_callback(() => f.remove());
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'Service worker should provide the response');
+      assert_equals(requests[0], iframe_full_url);
+      assert_false(data.clients.includes(iframe_full_url),
+                   'Service worker should NOT control the sandboxed page');
+    });
+}, 'Prepare an iframe sandboxed by CSP HTTP header with allow-scripts.');
+
+promise_test(t => {
+  const iframe_full_url =
+    expected_base_url + '?sandbox=allow-scripts%20allow-same-origin&' +
+    'sandboxed-iframe-same-origin-by-header';
+  return with_iframe(iframe_full_url)
+    .then(f => {
+      sandboxed_same_origin_frame_by_header = f;
+      add_completion_callback(() => f.remove());
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1);
+      assert_equals(requests[0], iframe_full_url);
+      assert_true(data.clients.includes(iframe_full_url));
+    })
+}, 'Prepare an iframe sandboxed by CSP HTTP header with allow-scripts and ' +
+   'allow-same-origin.');
+
+promise_test(t => {
+  let frame = sandboxed_frame_by_header;
+  return doTest(frame, 'fetch-from-worker')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+    });
+}, 'Fetch request from a worker in iframe sandboxed by CSP HTTP header ' +
+   'allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame_by_header;
+  return doTest(frame, 'fetch-from-worker')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The request should be handled by SW.');
+      assert_equals(requests[0], frame.src + '&test=fetch-from-worker');
+    });
+}, 'Fetch request from a worker in iframe sandboxed by CSP HTTP header ' +
+   'with allow-scripts and allow-same-origin flag');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/worker-interception-redirect.https.html b/test/fixtures/wpt/service-workers/service-worker/worker-interception-redirect.https.html
new file mode 100644
index 000000000000..8d566b9c15b1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/worker-interception-redirect.https.html
@@ -0,0 +1,212 @@
+<!DOCTYPE html>
+<title>Service Worker: controlling Worker/SharedWorker</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+// This tests service worker interception for worker clients, when the request
+// for the worker script goes through redirects. For example, a request can go
+// through a chain of URLs like A -> B -> C -> D and each URL might fall in the
+// scope of a different service worker, if any.
+// The two key questions are:
+// 1. Upon a redirect from A -> B, should a service worker for scope B
+//    intercept the request?
+// 2. After the final response, which service worker controls the resulting
+//    client?
+//
+// The standard prescribes the following:
+// 1. The service worker for scope B intercepts the redirect. *However*, once a
+//    request falls back to network (i.e., a service worker did not call
+//    respondWith()) and a redirect is then received from network, no service
+//    worker should intercept that redirect or any subsequent redirects.
+// 2. The final service worker that got a fetch event (or would have, in the
+//    case of a non-fetch-event worker) becomes the controller of the client.
+//
+// The standard may change later, see:
+// https://github.com/w3c/ServiceWorker/issues/1289
+//
+// The basic test setup is:
+// 1. Page registers service workers for scope1 and scope2.
+// 2. Page requests a worker from scope1.
+// 3. The request is redirected to scope2 or out-of-scope.
+// 4. The worker posts message to the page describing where the final response
+//   was served from (service worker or network).
+// 5. The worker does an importScripts() and fetch(), and posts back the
+//   responses, which describe where the responses where served from.
+
+// Globals for easier cleanup.
+const scope1 = 'resources/scope1';
+const scope2 = 'resources/scope2';
+let frame;
+
+function get_message_from_worker(port) {
+  return new Promise(resolve => {
+      port.onmessage = evt => {
+        resolve(evt.data);
+      }
+    });
+}
+
+async function cleanup() {
+  if (frame)
+    frame.remove();
+
+  const reg1 = await navigator.serviceWorker.getRegistration(scope1);
+  if (reg1)
+    await reg1.unregister();
+  const reg2 = await navigator.serviceWorker.getRegistration(scope2);
+  if (reg2)
+    await reg2.unregister();
+}
+
+// Builds the worker script URL, which encodes information about where
+// to redirect to. The URL falls in sw1's scope.
+//
+// - |redirector| is "network" or "serviceworker". If "serviceworker", sw1 will
+// respondWith() a redirect. Otherwise, it falls back to network and the server
+// responds with a redirect.
+// - |redirect_location| is "scope2" or "out-of-scope". If "scope2", the
+// redirect ends up in sw2's scope2. Otherwise it's out of scope.
+function build_worker_url(redirector, redirect_location) {
+  let redirect_path;
+  // Set path to redirect.py, a file on the server that serves
+  // a redirect. When sw1 sees this URL, it falls back to network.
+  if (redirector == 'network')
+    redirector_path = 'redirect.py';
+  // Set path to 'sw-redirect', to tell the service worker
+  // to respond with redirect.
+  else if (redirector == 'serviceworker')
+    redirector_path = 'sw-redirect';
+
+  let redirect_to = base_path() + 'resources/';
+  // Append "scope2/" to redirect_to, so the redirect falls in scope2.
+  // Otherwise no change is needed, as the parent "resources/" directory is
+  // used, and is out-of-scope.
+  if (redirect_location == 'scope2')
+    redirect_to += 'scope2/';
+  // Append the name of the file which serves the worker script.
+  redirect_to += 'worker_interception_redirect_webworker.py';
+
+  return `scope1/${redirector_path}?Redirect=${redirect_to}`
+}
+
+promise_test(async t => {
+  await cleanup();
+  const service_worker = 'resources/worker-interception-redirect-serviceworker.js';
+  const registration1 = await navigator.serviceWorker.register(service_worker, {scope: scope1});
+  await wait_for_state(t, registration1.installing, 'activated');
+  const registration2 = await navigator.serviceWorker.register(service_worker, {scope: scope2});
+  await wait_for_state(t, registration2.installing, 'activated');
+
+  promise_test(t => {
+    return cleanup();
+  }, 'cleanup global state');
+}, 'initialize global state');
+
+async function worker_redirect_test(worker_request_url,
+                              worker_expected_url,
+                              expected_main_resource_message,
+                              expected_import_scripts_message,
+                              expected_fetch_message,
+                              description) {
+  for (const workerType of ['DedicatedWorker', 'SharedWorker']) {
+    for (const type of ['classic', 'module']) {
+      promise_test(async t => {
+        // Create a frame to load the worker from. This way we can remove the
+        // frame to destroy the worker client when the test is done.
+        frame = await with_iframe('resources/blank.html');
+        t.add_cleanup(() => { frame.remove(); });
+
+        // Start the worker.
+        let w;
+        let port;
+        if (workerType === 'DedicatedWorker') {
+          w = new frame.contentWindow.Worker(worker_request_url, {type});
+          port = w;
+        } else {
+          w = new frame.contentWindow.SharedWorker(worker_request_url, {type});
+          port = w.port;
+          w.port.start();
+        }
+        w.onerror = t.unreached_func('Worker error');
+
+        // Expect a message from the worker indicating which service worker
+        // provided the response for the worker script request, if any.
+        const data = await get_message_from_worker(port);
+
+        // The worker does an importScripts(). Expect a message from the worker
+        // indicating which service worker provided the response for the
+        // importScripts(), if any.
+        const import_scripts_message = await get_message_from_worker(port);
+        test(() => {
+          if (type === 'classic') {
+            assert_equals(import_scripts_message,
+                          expected_import_scripts_message);
+          } else {
+            assert_equals(import_scripts_message, 'importScripts failed');
+          }
+        }, `${description} (${type} ${workerType}, importScripts())`);
+
+        // The worker does a fetch(). Expect a message from the worker
+        // indicating which service worker provided the response for the
+        // fetch(), if any.
+        const fetch_message = await get_message_from_worker(port);
+        test(() => {
+          assert_equals(fetch_message, expected_fetch_message);
+        }, `${description} (${type} ${workerType}, fetch())`);
+
+        // Expect a message from the worker indicating |self.location|.
+        const worker_actual_url = await get_message_from_worker(port);
+        test(() => {
+          assert_equals(
+            worker_actual_url,
+            (new URL(worker_expected_url, location.href)).toString(),
+            'location.href');
+        }, `${description} (${type} ${workerType}, location.href)`);
+
+        assert_equals(data, expected_main_resource_message);
+
+      }, `${description} (${type} ${workerType})`);
+    }
+  }
+}
+
+// request to sw1 scope gets network redirect to sw2 scope
+worker_redirect_test(
+    build_worker_url('network', 'scope2'),
+    'resources/scope2/worker_interception_redirect_webworker.py',
+    'the worker script was served from network',
+    'sw1 saw importScripts from the worker: /service-workers/service-worker/resources/scope2/import-scripts-echo.py',
+    'fetch(): sw1 saw the fetch from the worker: /service-workers/service-worker/resources/scope2/simple.txt',
+    'Case #1: network scope1->scope2');
+
+// request to sw1 scope gets network redirect to out-of-scope
+worker_redirect_test(
+    build_worker_url('network', 'out-scope'),
+    'resources/worker_interception_redirect_webworker.py',
+    'the worker script was served from network',
+    'sw1 saw importScripts from the worker: /service-workers/service-worker/resources/import-scripts-echo.py',
+    'fetch(): sw1 saw the fetch from the worker: /service-workers/service-worker/resources/simple.txt',
+    'Case #2: network scope1->out-scope');
+
+// request to sw1 scope gets service-worker redirect to sw2 scope
+worker_redirect_test(
+    build_worker_url('serviceworker', 'scope2'),
+    'resources/subdir/worker_interception_redirect_webworker.py?greeting=sw2%20saw%20the%20request%20for%20the%20worker%20script',
+    'sw2 saw the request for the worker script',
+    'sw2 saw importScripts from the worker: /service-workers/service-worker/resources/subdir/import-scripts-echo.py',
+    'fetch(): sw2 saw the fetch from the worker: /service-workers/service-worker/resources/subdir/simple.txt',
+    'Case #3: sw scope1->scope2');
+
+// request to sw1 scope gets service-worker redirect to out-of-scope
+worker_redirect_test(
+    build_worker_url('serviceworker', 'out-scope'),
+    'resources/worker_interception_redirect_webworker.py',
+    'the worker script was served from network',
+    'sw1 saw importScripts from the worker: /service-workers/service-worker/resources/import-scripts-echo.py',
+    'fetch(): sw1 saw the fetch from the worker: /service-workers/service-worker/resources/simple.txt',
+    'Case #4: sw scope1->out-scope');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/worker-interception.https.html b/test/fixtures/wpt/service-workers/service-worker/worker-interception.https.html
new file mode 100644
index 000000000000..27983d8352fe
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/worker-interception.https.html
@@ -0,0 +1,244 @@
+<!DOCTYPE html>
+<title>Service Worker: intercepting Worker script loads</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+// ========== Worker main resource interception tests ==========
+
+async function setup_service_worker(t, service_worker_url, scope) {
+  const r = await service_worker_unregister_and_register(
+      t, service_worker_url, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+  await wait_for_state(t, r.installing, 'activated');
+  return r.active;
+}
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-synthesized-worker.js?dedicated';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  const serviceWorker = await setup_service_worker(t, service_worker_url, scope);
+
+  const channels = new MessageChannel();
+  serviceWorker.postMessage({port: channels.port1}, [channels.port1]);
+
+  const clientId = await new Promise(resolve => channels.port2.onmessage = (e) => resolve(e.data.id));
+
+  const resultPromise =  new Promise(resolve => channels.port2.onmessage = (e) => resolve(e.data));
+
+  const w = new Worker(worker_url);
+  const data = await new Promise((resolve, reject) => {
+    w.onmessage = e => resolve(e.data);
+    w.onerror = e => reject(e.message);
+  });
+  assert_equals(data, 'worker loading intercepted by service worker');
+
+  const results = await resultPromise;
+  assert_equals(results.clientId, clientId);
+  assert_true(!!results.resultingClientId.length);
+
+  channels.port2.postMessage("done");
+}, `Verify a dedicated worker script request gets correct client Ids`);
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-synthesized-worker.js?dedicated';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  await setup_service_worker(t, service_worker_url, scope);
+  const w = new Worker(worker_url);
+  const data = await new Promise((resolve, reject) => {
+    w.onmessage = e => resolve(e.data);
+    w.onerror = e => reject(e.message);
+  });
+  assert_equals(data, 'worker loading intercepted by service worker');
+}, `Verify a dedicated worker script request issued from a uncontrolled ` +
+   `document is intercepted by worker's own service worker.`);
+
+promise_test(async t => {
+  const frame_url = 'resources/create-out-of-scope-worker.html';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = frame_url;
+
+  const registration = await service_worker_unregister_and_register(
+      t, service_worker_url, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const frame = await with_iframe(frame_url);
+  t.add_cleanup(_ => frame.remove());
+
+  assert_equals(
+    frame.contentWindow.navigator.serviceWorker.controller.scriptURL,
+    get_newest_worker(registration).scriptURL,
+    'the frame should be controlled by a service worker'
+  );
+
+  const result = await frame.contentWindow.getWorkerPromise();
+
+  assert_equals(result,
+                'worker loading was not intercepted by service worker');
+}, `Verify an out-of-scope dedicated worker script request issued from a ` +
+   `controlled document should not be intercepted by document's service ` +
+   `worker.`);
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-synthesized-worker.js?shared';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  await setup_service_worker(t, service_worker_url, scope);
+  const w = new SharedWorker(worker_url);
+  const data = await new Promise((resolve, reject) => {
+    w.port.onmessage = e => resolve(e.data);
+    w.onerror = e => reject(e.message);
+  });
+  assert_equals(data, 'worker loading intercepted by service worker');
+}, `Verify a shared worker script request issued from a uncontrolled ` +
+   `document is intercepted by worker's own service worker.`);
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-same-origin-worker.js?dedicated';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  await setup_service_worker(t, service_worker_url, scope);
+  const w = new Worker(worker_url);
+  const data = await new Promise((resolve, reject) => {
+    w.onmessage = e => resolve(e.data);
+    w.onerror = e => reject(e.message);
+  });
+  assert_equals(data, 'dedicated worker script loaded');
+}, 'Verify a same-origin worker script served by a service worker succeeds ' +
+   'in starting a dedicated worker.');
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-same-origin-worker.js?shared';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  await setup_service_worker(t, service_worker_url, scope);
+  const w = new SharedWorker(worker_url);
+  const data = await new Promise((resolve, reject) => {
+    w.port.onmessage = e => resolve(e.data);
+    w.onerror = e => reject(e.message);
+  });
+  assert_equals(data, 'shared worker script loaded');
+}, 'Verify a same-origin worker script served by a service worker succeeds ' +
+   'in starting a shared worker.');
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-cors-worker.js?dedicated';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  await setup_service_worker(t, service_worker_url, scope);
+  const w = new Worker(worker_url);
+  const watcher = new EventWatcher(t, w, ['message', 'error']);
+  await watcher.wait_for('error');
+}, 'Verify a cors worker script served by a service worker fails dedicated ' +
+   'worker start.');
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-cors-worker.js?shared';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  await setup_service_worker(t, service_worker_url, scope);
+  const w = new SharedWorker(worker_url);
+  const watcher = new EventWatcher(t, w, ['message', 'error']);
+  await watcher.wait_for('error');
+}, 'Verify a cors worker script served by a service worker fails shared ' +
+   'worker start.');
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-no-cors-worker.js?dedicated';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  await setup_service_worker(t, service_worker_url, scope);
+  const w = new Worker(worker_url);
+  const watcher = new EventWatcher(t, w, ['message', 'error']);
+  await watcher.wait_for('error');
+}, 'Verify a no-cors cross-origin worker script served by a service worker ' +
+   'fails dedicated worker start.');
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-no-cors-worker.js?shared';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  await setup_service_worker(t, service_worker_url, scope);
+  const w = new SharedWorker(worker_url);
+  const watcher = new EventWatcher(t, w, ['message', 'error']);
+  await watcher.wait_for('error');
+}, 'Verify a no-cors cross-origin worker script served by a service worker ' +
+   'fails shared worker start.');
+
+// ========== Worker subresource interception tests ==========
+
+const scope_for_subresource_interception = 'resources/load_worker.js';
+
+promise_test(async t => {
+  const service_worker_url = 'resources/worker-load-interceptor.js';
+  const r = await service_worker_unregister_and_register(
+      t, service_worker_url, scope_for_subresource_interception);
+  await wait_for_state(t, r.installing, 'activated');
+}, 'Register a service worker for worker subresource interception tests.');
+
+// Do not call this function multiple times without waiting for the promise
+// resolution because this sets new event handlers on |worker|.
+// TODO(nhiroki): To isolate multiple function calls, use MessagePort instead of
+// worker's onmessage event handler.
+async function request_on_worker(worker, resource_type) {
+  const data = await new Promise((resolve, reject) => {
+    if (worker instanceof Worker) {
+      worker.onmessage = e => resolve(e.data);
+      worker.onerror = e => reject(e);
+      worker.postMessage(resource_type);
+    } else if (worker instanceof SharedWorker) {
+      worker.port.onmessage = e => resolve(e.data);
+      worker.onerror = e => reject(e);
+      worker.port.postMessage(resource_type);
+    } else {
+      reject('Unexpected worker type!');
+    }
+  });
+  assert_equals(data, 'This load was successfully intercepted.');
+}
+
+async function subresource_test(worker) {
+  await request_on_worker(worker, 'xhr');
+  await request_on_worker(worker, 'fetch');
+  await request_on_worker(worker, 'importScripts');
+}
+
+promise_test(async t => {
+  await subresource_test(new Worker('resources/load_worker.js'));
+}, 'Requests on a dedicated worker controlled by a service worker.');
+
+promise_test(async t => {
+  await subresource_test(new SharedWorker('resources/load_worker.js'));
+}, 'Requests on a shared worker controlled by a service worker.');
+
+promise_test(async t => {
+  await subresource_test(new Worker('resources/nested_load_worker.js'));
+}, 'Requests on a dedicated worker nested in a dedicated worker and ' +
+       'controlled by a service worker');
+
+promise_test(async t => {
+  await subresource_test(new SharedWorker('resources/nested_load_worker.js'));
+}, 'Requests on a dedicated worker nested in a shared worker and controlled ' +
+       'by a service worker');
+
+promise_test(async t => {
+  await service_worker_unregister(t, scope_for_subresource_interception);
+}, 'Unregister a service worker for subresource interception tests.');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/xhr-content-length.https.window.js b/test/fixtures/wpt/service-workers/service-worker/xhr-content-length.https.window.js
new file mode 100644
index 000000000000..1ae320e9c3c5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/xhr-content-length.https.window.js
@@ -0,0 +1,55 @@
+// META: script=resources/test-helpers.sub.js
+
+let frame;
+
+promise_test(async (t) => {
+  const scope = "resources/empty.html";
+  const script = "resources/xhr-content-length-worker.js";
+  const registration = await service_worker_unregister_and_register(t, script, scope);
+  await wait_for_state(t, registration.installing, "activated");
+  frame = await with_iframe(scope);
+}, "Setup");
+
+promise_test(async t => {
+  const xhr = new frame.contentWindow.XMLHttpRequest();
+  xhr.open("GET", "test?type=no-content-length");
+  xhr.send();
+  const event = await new Promise(resolve => xhr.onload = resolve);
+  assert_equals(xhr.getResponseHeader("content-length"), null);
+  assert_false(event.lengthComputable);
+  assert_equals(event.total, 0);
+  assert_equals(event.loaded, xhr.responseText.length);
+}, `Synthetic response without Content-Length header`);
+
+promise_test(async t => {
+  const xhr = new frame.contentWindow.XMLHttpRequest();
+  xhr.open("GET", "test?type=larger-content-length");
+  xhr.send();
+  const event = await new Promise(resolve => xhr.onload = resolve);
+  assert_equals(xhr.getResponseHeader("content-length"), "10000");
+  assert_true(event.lengthComputable);
+  assert_equals(event.total, 10000);
+  assert_equals(event.loaded, xhr.responseText.length);
+}, `Synthetic response with Content-Length header with value larger than response body length`);
+
+promise_test(async t => {
+  const xhr = new frame.contentWindow.XMLHttpRequest();
+  xhr.open("GET", "test?type=double-content-length");
+  xhr.send();
+  const event = await new Promise(resolve => xhr.onload = resolve);
+  assert_equals(xhr.getResponseHeader("content-length"), "10000, 10000");
+  assert_true(event.lengthComputable);
+  assert_equals(event.total, 10000);
+  assert_equals(event.loaded, xhr.responseText.length);
+}, `Synthetic response with two Content-Length headers value larger than response body length`);
+
+promise_test(async t => {
+  const xhr = new frame.contentWindow.XMLHttpRequest();
+  xhr.open("GET", "test?type=bogus-content-length");
+  xhr.send();
+  const event = await new Promise(resolve => xhr.onload = resolve);
+  assert_equals(xhr.getResponseHeader("content-length"), "test");
+  assert_false(event.lengthComputable);
+  assert_equals(event.total, 0);
+  assert_equals(event.loaded, xhr.responseText.length);
+}, `Synthetic response with bogus Content-Length header`);
diff --git a/test/fixtures/wpt/service-workers/service-worker/xhr-response-url.https.html b/test/fixtures/wpt/service-workers/service-worker/xhr-response-url.https.html
new file mode 100644
index 000000000000..673ca52cc674
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/xhr-response-url.https.html
@@ -0,0 +1,103 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: XHR responseURL uses the response url</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const scope = 'resources/xhr-iframe.html';
+const script = 'resources/xhr-response-url-worker.js';
+let iframe;
+
+function build_url(options) {
+  const url = new URL('test', window.location);
+  const opts = options ? options : {};
+  if (opts.respondWith)
+    url.searchParams.set('respondWith', opts.respondWith);
+  if (opts.url)
+    url.searchParams.set('url', opts.url.href);
+  return url.href;
+}
+
+promise_test(async (t) => {
+  const registration =
+      await service_worker_unregister_and_register(t, script, scope);
+  await wait_for_state(t, registration.installing, 'activated');
+  iframe = await with_iframe(scope);
+}, 'global setup');
+
+// Test that XMLHttpRequest.responseURL uses the response URL from the service
+// worker.
+promise_test(async (t) => {
+  // Build a URL that tells the service worker to respondWith(fetch(|target|)).
+  const target = new URL('resources/sample.txt', window.location);
+  const url = build_url({
+    respondWith: 'fetch',
+    url: target
+  });
+
+  // Perform the XHR.
+  const xhr = await iframe.contentWindow.xhr(url);
+  assert_equals(xhr.responseURL, target.href, 'responseURL');
+}, 'XHR responseURL should be the response URL');
+
+// Same as above with a generated response.
+promise_test(async (t) => {
+  // Build a URL that tells the service worker to respondWith(new Response()).
+  const url = build_url({respondWith: 'string'});
+
+  // Perform the XHR.
+  const xhr = await iframe.contentWindow.xhr(url);
+  assert_equals(xhr.responseURL, url, 'responseURL');
+}, 'XHR responseURL should be the response URL (generated response)');
+
+// Test that XMLHttpRequest.responseXML is a Document whose URL is the
+// response URL from the service worker.
+promise_test(async (t) => {
+  // Build a URL that tells the service worker to respondWith(fetch(|target|)).
+  const target = new URL('resources/blank.html', window.location);
+  const url = build_url({
+    respondWith: 'fetch',
+    url: target
+  });
+
+  // Perform the XHR.
+  const xhr = await iframe.contentWindow.xhr(url, {responseType: 'document'});
+  assert_equals(xhr.responseURL, target.href, 'responseURL');
+
+  // The document's URL uses the response URL:
+  // "Set |document|’s URL to |response|’s url."
+  // https://xhr.spec.whatwg.org/#document-response
+  assert_equals(xhr.responseXML.URL, target.href, 'responseXML.URL');
+
+  // The document's base URL falls back to the document URL:
+  // https://html.spec.whatwg.org/multipage/urls-and-fetching.html#document-base-url
+  assert_equals(xhr.responseXML.baseURI, target.href, 'responseXML.baseURI');
+}, 'XHR Document should use the response URL');
+
+// Same as above with a generated response from the service worker.
+promise_test(async (t) => {
+  // Build a URL that tells the service worker to
+  // respondWith(new Response()) with a document response.
+  const url = build_url({respondWith: 'document'});
+
+  // Perform the XHR.
+  const xhr = await iframe.contentWindow.xhr(url, {responseType: 'document'});
+  assert_equals(xhr.responseURL, url, 'responseURL');
+
+  // The document's URL uses the response URL, which is the request URL:
+  // "Set |document|’s URL to |response|’s url."
+  // https://xhr.spec.whatwg.org/#document-response
+  assert_equals(xhr.responseXML.URL, url, 'responseXML.URL');
+
+  // The document's base URL falls back to the document URL:
+  // https://html.spec.whatwg.org/multipage/urls-and-fetching.html#document-base-url
+  assert_equals(xhr.responseXML.baseURI, url, 'responseXML.baseURI');
+}, 'XHR Document should use the response URL (generated response)');
+
+promise_test(async (t) => {
+  if (iframe)
+    iframe.remove();
+  await service_worker_unregister(t, scope);
+}, 'global cleanup');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/xsl-base-url.https.html b/test/fixtures/wpt/service-workers/service-worker/xsl-base-url.https.html
new file mode 100644
index 000000000000..1d3c36408a66
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/xsl-base-url.https.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: XSL's base URL must be the response URL</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+// This test loads an XML document which is controlled a service worker. The
+// document loads a stylesheet and a service worker responds with another URL.
+// The stylesheet imports a relative URL to test that the base URL is the
+// response URL from the service worker.
+promise_test(async (t) => {
+  const SCOPE = 'resources/xsl-base-url-iframe.xml';
+  const SCRIPT = 'resources/xsl-base-url-worker.js';
+  let worker;
+  let frame;
+
+  t.add_cleanup(() => {
+    if (frame)
+      frame.remove();
+    service_worker_unregister(t, SCOPE);
+  });
+
+  const registration = await service_worker_unregister_and_register(
+      t, SCRIPT, SCOPE);
+  worker = registration.installing;
+  await wait_for_state(t, worker, 'activated');
+
+  frame = await with_iframe(SCOPE);
+  assert_equals(frame.contentDocument.body.textContent, 'PASS');
+}, 'base URL when service worker does respondWith(fetch(responseUrl))');
+</script>
diff --git a/test/fixtures/wpt/streams/WEB_FEATURES.yml b/test/fixtures/wpt/streams/WEB_FEATURES.yml
index d10bbe4a7d70..54ea2128f328 100644
--- a/test/fixtures/wpt/streams/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/WEB_FEATURES.yml
@@ -1,5 +1,3 @@
-features:
-- name: streams
-  files:
-    # Top-level only. Subdirectories have their own mapping.
-    - "*"
+rules:
+# Top-level only. Subdirectories have their own mapping.
+- "*": [streams]
diff --git a/test/fixtures/wpt/streams/idlharness.any.js b/test/fixtures/wpt/streams/idlharness.any.js
index 0be03b2078f9..42a17da58c5a 100644
--- a/test/fixtures/wpt/streams/idlharness.any.js
+++ b/test/fixtures/wpt/streams/idlharness.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm-in-window
+// META: global=window,worker
 // META: script=/resources/WebIDLParser.js
 // META: script=/resources/idlharness.js
 // META: timeout=long
diff --git a/test/fixtures/wpt/streams/piping/WEB_FEATURES.yml b/test/fixtures/wpt/streams/piping/WEB_FEATURES.yml
index 8cf3517baf08..0f17f6b6b657 100644
--- a/test/fixtures/wpt/streams/piping/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/piping/WEB_FEATURES.yml
@@ -1,3 +1,2 @@
-features:
-- name: streams
-  files: "**"
+rules:
+- "**": [streams]
diff --git a/test/fixtures/wpt/streams/piping/abort.any.js b/test/fixtures/wpt/streams/piping/abort.any.js
index e813b017769c..f2e5429492e7 100644
--- a/test/fixtures/wpt/streams/piping/abort.any.js
+++ b/test/fixtures/wpt/streams/piping/abort.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/close-propagation-backward.any.js b/test/fixtures/wpt/streams/piping/close-propagation-backward.any.js
index 25bd475ed13e..5ea47ab85c0c 100644
--- a/test/fixtures/wpt/streams/piping/close-propagation-backward.any.js
+++ b/test/fixtures/wpt/streams/piping/close-propagation-backward.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/piping/close-propagation-forward.any.js b/test/fixtures/wpt/streams/piping/close-propagation-forward.any.js
index 0ec94f80abf0..71b6e2628400 100644
--- a/test/fixtures/wpt/streams/piping/close-propagation-forward.any.js
+++ b/test/fixtures/wpt/streams/piping/close-propagation-forward.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/error-propagation-backward.any.js b/test/fixtures/wpt/streams/piping/error-propagation-backward.any.js
index f786469d6c1d..ec74592f86ef 100644
--- a/test/fixtures/wpt/streams/piping/error-propagation-backward.any.js
+++ b/test/fixtures/wpt/streams/piping/error-propagation-backward.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/error-propagation-forward.any.js b/test/fixtures/wpt/streams/piping/error-propagation-forward.any.js
index e9260f9ea22c..482da2f8a88e 100644
--- a/test/fixtures/wpt/streams/piping/error-propagation-forward.any.js
+++ b/test/fixtures/wpt/streams/piping/error-propagation-forward.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/flow-control.any.js b/test/fixtures/wpt/streams/piping/flow-control.any.js
index e2318da375ab..09c4420f872a 100644
--- a/test/fixtures/wpt/streams/piping/flow-control.any.js
+++ b/test/fixtures/wpt/streams/piping/flow-control.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 // META: script=../resources/recording-streams.js
diff --git a/test/fixtures/wpt/streams/piping/general-addition.any.js b/test/fixtures/wpt/streams/piping/general-addition.any.js
index cf4aa9bea6a1..2562b7064338 100644
--- a/test/fixtures/wpt/streams/piping/general-addition.any.js
+++ b/test/fixtures/wpt/streams/piping/general-addition.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 promise_test(async t => {
diff --git a/test/fixtures/wpt/streams/piping/general.any.js b/test/fixtures/wpt/streams/piping/general.any.js
index f051d8102c2b..272b25a28e80 100644
--- a/test/fixtures/wpt/streams/piping/general.any.js
+++ b/test/fixtures/wpt/streams/piping/general.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/piping/multiple-propagation.any.js b/test/fixtures/wpt/streams/piping/multiple-propagation.any.js
index 9be828a23269..a78652fc0679 100644
--- a/test/fixtures/wpt/streams/piping/multiple-propagation.any.js
+++ b/test/fixtures/wpt/streams/piping/multiple-propagation.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/pipe-through.any.js b/test/fixtures/wpt/streams/piping/pipe-through.any.js
index 339cee199933..26b1cd26a3c8 100644
--- a/test/fixtures/wpt/streams/piping/pipe-through.any.js
+++ b/test/fixtures/wpt/streams/piping/pipe-through.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
diff --git a/test/fixtures/wpt/streams/piping/then-interception.any.js b/test/fixtures/wpt/streams/piping/then-interception.any.js
index fc48c3683114..543f916d940d 100644
--- a/test/fixtures/wpt/streams/piping/then-interception.any.js
+++ b/test/fixtures/wpt/streams/piping/then-interception.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/throwing-options.any.js b/test/fixtures/wpt/streams/piping/throwing-options.any.js
index 186f8ded1968..b9f906778f63 100644
--- a/test/fixtures/wpt/streams/piping/throwing-options.any.js
+++ b/test/fixtures/wpt/streams/piping/throwing-options.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 class ThrowingOptions {
diff --git a/test/fixtures/wpt/streams/piping/transform-streams.any.js b/test/fixtures/wpt/streams/piping/transform-streams.any.js
index e079bb637cad..caae9fbad884 100644
--- a/test/fixtures/wpt/streams/piping/transform-streams.any.js
+++ b/test/fixtures/wpt/streams/piping/transform-streams.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 promise_test(() => {
diff --git a/test/fixtures/wpt/streams/queuing-strategies.any.js b/test/fixtures/wpt/streams/queuing-strategies.any.js
index 9efc4570cf2e..fa959ebba283 100644
--- a/test/fixtures/wpt/streams/queuing-strategies.any.js
+++ b/test/fixtures/wpt/streams/queuing-strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const highWaterMarkConversions = new Map([
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/WEB_FEATURES.yml b/test/fixtures/wpt/streams/readable-byte-streams/WEB_FEATURES.yml
index a35508fc0dc6..e45d3ee347b3 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/readable-byte-streams/WEB_FEATURES.yml
@@ -1,3 +1,2 @@
-features:
-- name: readable-byte-streams
-  files: "**"
+rules:
+- "**": [readable-byte-streams]
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/bad-buffers-and-views.any.js b/test/fixtures/wpt/streams/readable-byte-streams/bad-buffers-and-views.any.js
index eae8dde03f6b..0f018d6d7819 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/bad-buffers-and-views.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/bad-buffers-and-views.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 promise_test(() => {
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/construct-byob-request.any.js b/test/fixtures/wpt/streams/readable-byte-streams/construct-byob-request.any.js
index a26f949ee29d..8d460a1c81b7 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/construct-byob-request.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/construct-byob-request.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/enqueue-with-detached-buffer.any.js b/test/fixtures/wpt/streams/readable-byte-streams/enqueue-with-detached-buffer.any.js
index 92bd0a26a0ec..d2b37f00a9d6 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/enqueue-with-detached-buffer.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/enqueue-with-detached-buffer.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 
 promise_test(async t => {
   const error = new Error('cannot proceed');
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/general.any.js b/test/fixtures/wpt/streams/readable-byte-streams/general.any.js
index 50f4f019ff22..6787ce1b474b 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/general.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/general.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/non-transferable-buffers.any.js b/test/fixtures/wpt/streams/readable-byte-streams/non-transferable-buffers.any.js
index 4bddaef5d647..a70bb6cb23c7 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/non-transferable-buffers.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/non-transferable-buffers.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 promise_test(async t => {
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/patched-global.any.js b/test/fixtures/wpt/streams/readable-byte-streams/patched-global.any.js
index ce2e9e9993ae..39aa40e591ec 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/patched-global.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/patched-global.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/read-min.any.js b/test/fixtures/wpt/streams/readable-byte-streams/read-min.any.js
index 4010e3750ce2..a5d6ad944be5 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/read-min.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/read-min.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/respond-after-enqueue.any.js b/test/fixtures/wpt/streams/readable-byte-streams/respond-after-enqueue.any.js
index e51efa061a65..b93cec97391e 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/respond-after-enqueue.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/respond-after-enqueue.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/tee.any.js b/test/fixtures/wpt/streams/readable-byte-streams/tee.any.js
index 60d82b9cf6a1..2ae7e35fcb6a 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/tee.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/tee.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
@@ -351,6 +351,39 @@ promise_test(async () => {
 
 }, 'ReadableStream teeing with byte source: canceling branch1 should finish when branch2 reads until end of stream');
 
+promise_test(async () => {
+
+  let controller;
+  const rs = new ReadableStream({
+    type: 'bytes',
+    start(c) {
+      controller = c;
+    }
+  });
+
+  const [branch1, branch2] = rs.tee();
+  const reader1 = branch1.getReader({ mode: 'byob' });
+  const reader2 = branch2.getReader({ mode: 'byob' });
+  const cancelPromise = reader1.cancel();
+
+  controller.enqueue(new Uint8Array([0x01]));
+
+  const read2 = await reader2.read(new Uint8Array(1));
+  assert_equals(read2.done, false, 'first read() from branch2 should not be done');
+  assert_typed_array_equals(read2.value, new Uint8Array([0x01]), 'first read() from branch2');
+
+  controller.close();
+
+  const read2b = await reader2.read(new Uint8Array(1));
+  assert_equals(read2b.done, true, 'second read() from branch2 should be done');
+
+  await Promise.all([
+    reader2.closed,
+    cancelPromise
+  ]);
+
+}, 'ReadableStream teeing with byte source: canceling branch1 should finish when branch2 reads with a BYOB reader until end of stream');
+
 promise_test(async t => {
 
   let controller;
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/templated.any.js b/test/fixtures/wpt/streams/readable-byte-streams/templated.any.js
index e4c10f768596..8438db50e9e6 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/templated.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/templated.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-test-templates.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/WEB_FEATURES.yml b/test/fixtures/wpt/streams/readable-streams/WEB_FEATURES.yml
index ad2cb549631f..46a402b60b27 100644
--- a/test/fixtures/wpt/streams/readable-streams/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/readable-streams/WEB_FEATURES.yml
@@ -1,14 +1,6 @@
-features:
-- name: streams
-  files:
-    - "*"
-    - "!async-iterator.any.js"
-    - "!from.any.js"
-    # 'owning' type is not yet standardized
-    - "!owning-type*"
-- name: async-iterable-streams
-  files:
-    - async-iterator.any.js
-- name: readablestream-from
-  files:
-    - from.any.js
+rules:
+- async-iterator.any.js: [async-iterable-streams]
+- from.any.js: [readablestream-from]
+# 'owning' type is not yet standardized
+- owning-type*: []
+- "*": [streams]
diff --git a/test/fixtures/wpt/streams/readable-streams/async-iterator.any.js b/test/fixtures/wpt/streams/readable-streams/async-iterator.any.js
index e192201b531d..d815e9d1a16b 100644
--- a/test/fixtures/wpt/streams/readable-streams/async-iterator.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/async-iterator.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
diff --git a/test/fixtures/wpt/streams/readable-streams/bad-strategies.any.js b/test/fixtures/wpt/streams/readable-streams/bad-strategies.any.js
index 49fa4bdbece5..409c63b8177e 100644
--- a/test/fixtures/wpt/streams/readable-streams/bad-strategies.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/bad-strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 test(() => {
diff --git a/test/fixtures/wpt/streams/readable-streams/bad-underlying-sources.any.js b/test/fixtures/wpt/streams/readable-streams/bad-underlying-sources.any.js
index 3d77b923d178..e9cf4c924930 100644
--- a/test/fixtures/wpt/streams/readable-streams/bad-underlying-sources.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/bad-underlying-sources.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 
diff --git a/test/fixtures/wpt/streams/readable-streams/cancel.any.js b/test/fixtures/wpt/streams/readable-streams/cancel.any.js
index d44222f1497f..8e186be586c1 100644
--- a/test/fixtures/wpt/streams/readable-streams/cancel.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/cancel.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/constructor.any.js b/test/fixtures/wpt/streams/readable-streams/constructor.any.js
index 0b995f0cb16b..608dc48cfa39 100644
--- a/test/fixtures/wpt/streams/readable-streams/constructor.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/constructor.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const error1 = new Error('error1');
diff --git a/test/fixtures/wpt/streams/readable-streams/count-queuing-strategy-integration.any.js b/test/fixtures/wpt/streams/readable-streams/count-queuing-strategy-integration.any.js
index a8c1b91d0068..02ac5bae5c2f 100644
--- a/test/fixtures/wpt/streams/readable-streams/count-queuing-strategy-integration.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/count-queuing-strategy-integration.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 test(() => {
diff --git a/test/fixtures/wpt/streams/readable-streams/crashtests/WEB_FEATURES.yml b/test/fixtures/wpt/streams/readable-streams/crashtests/WEB_FEATURES.yml
index f4eaacc3edb4..fb282ca004eb 100644
--- a/test/fixtures/wpt/streams/readable-streams/crashtests/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/readable-streams/crashtests/WEB_FEATURES.yml
@@ -1,7 +1,3 @@
-features:
-- name: streams
-  files:
-    - strategy-worker-terminate.html
-- name: readablestream-from
-  files:
-    - from-cross-realm.https.html
+rules:
+- strategy-worker-terminate.html: [streams]
+- from-cross-realm.https.html: [readablestream-from]
diff --git a/test/fixtures/wpt/streams/readable-streams/default-reader.any.js b/test/fixtures/wpt/streams/readable-streams/default-reader.any.js
index f92862719e47..59d7ab2f74db 100644
--- a/test/fixtures/wpt/streams/readable-streams/default-reader.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/default-reader.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/readable-streams/floating-point-total-queue-size.any.js b/test/fixtures/wpt/streams/readable-streams/floating-point-total-queue-size.any.js
index 8b88c21d7f0b..50cca3d951a9 100644
--- a/test/fixtures/wpt/streams/readable-streams/floating-point-total-queue-size.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/floating-point-total-queue-size.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 // Due to the limitations of floating-point precision, the calculation of desiredSize sometimes gives different answers
diff --git a/test/fixtures/wpt/streams/readable-streams/from.any.js b/test/fixtures/wpt/streams/readable-streams/from.any.js
index 2b28a05fee39..d8144c5f4c8a 100644
--- a/test/fixtures/wpt/streams/readable-streams/from.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/from.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 'use strict';
 
@@ -18,11 +18,6 @@ const iterableFactories = [
     return ['a', 'b'][Symbol.iterator]();
   }],
 
-  ['a string', () => {
-    // This iterates over the code points of the string.
-    return 'ab';
-  }],
-
   ['a Set', () => {
     return new Set(['a', 'b']);
   }],
@@ -81,6 +76,19 @@ const iterableFactories = [
     return iterable;
   }],
 
+  ['a sync iterable with a function iterator', () => {
+    const chunks = ['a', 'b'];
+    function functionIterator() {}
+    functionIterator.next = () => ({
+      done: chunks.length === 0,
+      value: chunks.shift()
+    });
+    const iterable = {
+      [Symbol.iterator]: () => functionIterator
+    };
+    return iterable;
+  }],
+
   ['an async iterable', () => {
     const chunks = ['a', 'b'];
     const asyncIterator = {
@@ -97,6 +105,19 @@ const iterableFactories = [
     return asyncIterable;
   }],
 
+  ['an async iterable with a function iterator', () => {
+    const chunks = ['a', 'b'];
+    function functionAsyncIterator() {}
+    functionAsyncIterator.next = () => Promise.resolve({
+      done: chunks.length === 0,
+      value: chunks.shift()
+    });
+    const asyncIterable = {
+      [Symbol.asyncIterator]: () => functionAsyncIterator
+    };
+    return asyncIterable;
+  }],
+
   ['a ReadableStream', () => {
     return new ReadableStream({
       start(c) {
@@ -144,6 +165,7 @@ const badIterables = [
   ['Object.create(null)', Object.create(null)],
   ['a function', () => 42],
   ['a symbol', Symbol()],
+  ['a string', 'ab'],
   ['an object with a non-callable @@iterator method', {
     [Symbol.iterator]: 42
   }],
diff --git a/test/fixtures/wpt/streams/readable-streams/garbage-collection.any.js b/test/fixtures/wpt/streams/readable-streams/garbage-collection.any.js
index abcb4cf21b89..907eb6006822 100644
--- a/test/fixtures/wpt/streams/readable-streams/garbage-collection.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/garbage-collection.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=/common/gc.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/general.any.js b/test/fixtures/wpt/streams/readable-streams/general.any.js
index eee3f62215ee..2a32b27943c8 100644
--- a/test/fixtures/wpt/streams/readable-streams/general.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/general.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/owning-type-message-port.any.js b/test/fixtures/wpt/streams/readable-streams/owning-type-message-port.tentative.any.js
similarity index 97%
rename from test/fixtures/wpt/streams/readable-streams/owning-type-message-port.any.js
rename to test/fixtures/wpt/streams/readable-streams/owning-type-message-port.tentative.any.js
index 282c1f411485..e9961ce04225 100644
--- a/test/fixtures/wpt/streams/readable-streams/owning-type-message-port.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/owning-type-message-port.tentative.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/owning-type-video-frame.any.js b/test/fixtures/wpt/streams/readable-streams/owning-type-video-frame.tentative.any.js
similarity index 100%
rename from test/fixtures/wpt/streams/readable-streams/owning-type-video-frame.any.js
rename to test/fixtures/wpt/streams/readable-streams/owning-type-video-frame.tentative.any.js
diff --git a/test/fixtures/wpt/streams/readable-streams/owning-type.any.js b/test/fixtures/wpt/streams/readable-streams/owning-type.tentative.any.js
similarity index 98%
rename from test/fixtures/wpt/streams/readable-streams/owning-type.any.js
rename to test/fixtures/wpt/streams/readable-streams/owning-type.tentative.any.js
index 34c2a55d5134..27a3dda894e4 100644
--- a/test/fixtures/wpt/streams/readable-streams/owning-type.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/owning-type.tentative.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/patched-global.any.js b/test/fixtures/wpt/streams/readable-streams/patched-global.any.js
index c208824c8644..a64a054a97f1 100644
--- a/test/fixtures/wpt/streams/readable-streams/patched-global.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/patched-global.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 // Tests which patch the global environment are kept separate to avoid
diff --git a/test/fixtures/wpt/streams/readable-streams/reentrant-strategies.any.js b/test/fixtures/wpt/streams/readable-streams/reentrant-strategies.any.js
index 8ae7b98e8d5e..b4988bc2433f 100644
--- a/test/fixtures/wpt/streams/readable-streams/reentrant-strategies.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/reentrant-strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
diff --git a/test/fixtures/wpt/streams/readable-streams/tee.any.js b/test/fixtures/wpt/streams/readable-streams/tee.any.js
index c2c2e4823072..00397932f4b6 100644
--- a/test/fixtures/wpt/streams/readable-streams/tee.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/tee.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
diff --git a/test/fixtures/wpt/streams/readable-streams/templated.any.js b/test/fixtures/wpt/streams/readable-streams/templated.any.js
index 4f2440c0880b..8fdb0176ceff 100644
--- a/test/fixtures/wpt/streams/readable-streams/templated.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/templated.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-test-templates.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/transferable/WEB_FEATURES.yml b/test/fixtures/wpt/streams/transferable/WEB_FEATURES.yml
index 4ecacf5edbc7..a21859368559 100644
--- a/test/fixtures/wpt/streams/transferable/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/transferable/WEB_FEATURES.yml
@@ -1,3 +1,2 @@
-features:
-- name: transferable-streams
-  files: "**"
+rules:
+- "**": [transferable-streams]
diff --git a/test/fixtures/wpt/streams/transferable/transform-stream-members.any.js b/test/fixtures/wpt/streams/transferable/transform-stream-members.any.js
index 05914e12ccbe..3679eb7b140a 100644
--- a/test/fixtures/wpt/streams/transferable/transform-stream-members.any.js
+++ b/test/fixtures/wpt/streams/transferable/transform-stream-members.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 const combinations = [
   (t => [t, t.readable])(new TransformStream()),
diff --git a/test/fixtures/wpt/streams/transform-streams/WEB_FEATURES.yml b/test/fixtures/wpt/streams/transform-streams/WEB_FEATURES.yml
index f39dc16de4c7..197d23a07ffa 100644
--- a/test/fixtures/wpt/streams/transform-streams/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/transform-streams/WEB_FEATURES.yml
@@ -1,8 +1,3 @@
-features:
-- name: streams
-  files:
-    - "*"
-    - "!cancel.any.js"
-- name: transformstream-transformer-cancel
-  files:
-    - cancel.any.js
+rules:
+- cancel.any.js: [transformstream-transformer-cancel]
+- "*": [streams]
diff --git a/test/fixtures/wpt/streams/transform-streams/backpressure.any.js b/test/fixtures/wpt/streams/transform-streams/backpressure.any.js
index 47a21fb7e71f..6befba41b795 100644
--- a/test/fixtures/wpt/streams/transform-streams/backpressure.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/backpressure.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/transform-streams/cancel.any.js b/test/fixtures/wpt/streams/transform-streams/cancel.any.js
index 9b369bfb7c68..fc5ef9570404 100644
--- a/test/fixtures/wpt/streams/transform-streams/cancel.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/cancel.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/transform-streams/errors.any.js b/test/fixtures/wpt/streams/transform-streams/errors.any.js
index bea060b65908..7efe894f4887 100644
--- a/test/fixtures/wpt/streams/transform-streams/errors.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/errors.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/transform-streams/flush.any.js b/test/fixtures/wpt/streams/transform-streams/flush.any.js
index c95d8ae11865..487de1c93b0f 100644
--- a/test/fixtures/wpt/streams/transform-streams/flush.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/flush.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/transform-streams/general.any.js b/test/fixtures/wpt/streams/transform-streams/general.any.js
index a40ef30843ec..dff2e7e8a70d 100644
--- a/test/fixtures/wpt/streams/transform-streams/general.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/general.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/transform-streams/lipfuzz.any.js b/test/fixtures/wpt/streams/transform-streams/lipfuzz.any.js
index e334705db443..f9f148aaf1c6 100644
--- a/test/fixtures/wpt/streams/transform-streams/lipfuzz.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/lipfuzz.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 class LipFuzzTransformer {
diff --git a/test/fixtures/wpt/streams/transform-streams/patched-global.any.js b/test/fixtures/wpt/streams/transform-streams/patched-global.any.js
index cc111eda452f..2d04e3b948b3 100644
--- a/test/fixtures/wpt/streams/transform-streams/patched-global.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/patched-global.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 // Tests which patch the global environment are kept separate to avoid
diff --git a/test/fixtures/wpt/streams/transform-streams/properties.any.js b/test/fixtures/wpt/streams/transform-streams/properties.any.js
index dbfd1aa372b9..02981b8bc76a 100644
--- a/test/fixtures/wpt/streams/transform-streams/properties.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/properties.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const transformerMethods = {
diff --git a/test/fixtures/wpt/streams/transform-streams/reentrant-strategies.any.js b/test/fixtures/wpt/streams/transform-streams/reentrant-strategies.any.js
index a6d459655856..306cce8fc8b7 100644
--- a/test/fixtures/wpt/streams/transform-streams/reentrant-strategies.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/reentrant-strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
diff --git a/test/fixtures/wpt/streams/transform-streams/strategies.any.js b/test/fixtures/wpt/streams/transform-streams/strategies.any.js
index 57e113e668ce..94055ad99dc9 100644
--- a/test/fixtures/wpt/streams/transform-streams/strategies.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/transform-streams/terminate.any.js b/test/fixtures/wpt/streams/transform-streams/terminate.any.js
index a959e70fe693..670006366db2 100644
--- a/test/fixtures/wpt/streams/transform-streams/terminate.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/terminate.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/WEB_FEATURES.yml b/test/fixtures/wpt/streams/writable-streams/WEB_FEATURES.yml
index 8cf3517baf08..0f17f6b6b657 100644
--- a/test/fixtures/wpt/streams/writable-streams/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/writable-streams/WEB_FEATURES.yml
@@ -1,3 +1,2 @@
-features:
-- name: streams
-  files: "**"
+rules:
+- "**": [streams]
diff --git a/test/fixtures/wpt/streams/writable-streams/aborting.any.js b/test/fixtures/wpt/streams/writable-streams/aborting.any.js
index 9d8e80b1de63..58362b766901 100644
--- a/test/fixtures/wpt/streams/writable-streams/aborting.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/aborting.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/bad-strategies.any.js b/test/fixtures/wpt/streams/writable-streams/bad-strategies.any.js
index a1ef0791168f..63fa443065ee 100644
--- a/test/fixtures/wpt/streams/writable-streams/bad-strategies.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/bad-strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const error1 = new Error('a unique string');
diff --git a/test/fixtures/wpt/streams/writable-streams/bad-underlying-sinks.any.js b/test/fixtures/wpt/streams/writable-streams/bad-underlying-sinks.any.js
index 3c434ffe60cc..d0b3467978ea 100644
--- a/test/fixtures/wpt/streams/writable-streams/bad-underlying-sinks.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/bad-underlying-sinks.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/byte-length-queuing-strategy.any.js b/test/fixtures/wpt/streams/writable-streams/byte-length-queuing-strategy.any.js
index eed86ee7004e..ce1962e8917f 100644
--- a/test/fixtures/wpt/streams/writable-streams/byte-length-queuing-strategy.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/byte-length-queuing-strategy.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 promise_test(t => {
diff --git a/test/fixtures/wpt/streams/writable-streams/close.any.js b/test/fixtures/wpt/streams/writable-streams/close.any.js
index 3b2c07cc3bfe..9c1bc93b011d 100644
--- a/test/fixtures/wpt/streams/writable-streams/close.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/close.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/constructor.any.js b/test/fixtures/wpt/streams/writable-streams/constructor.any.js
index bb382a33b8e0..ba54e39cdbc5 100644
--- a/test/fixtures/wpt/streams/writable-streams/constructor.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/constructor.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const error1 = new Error('error1');
diff --git a/test/fixtures/wpt/streams/writable-streams/count-queuing-strategy.any.js b/test/fixtures/wpt/streams/writable-streams/count-queuing-strategy.any.js
index 8211757530d3..064e16e81506 100644
--- a/test/fixtures/wpt/streams/writable-streams/count-queuing-strategy.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/count-queuing-strategy.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 test(() => {
diff --git a/test/fixtures/wpt/streams/writable-streams/error.any.js b/test/fixtures/wpt/streams/writable-streams/error.any.js
index d08c8a54863b..faf3fdd95214 100644
--- a/test/fixtures/wpt/streams/writable-streams/error.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/error.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const error1 = new Error('error1');
diff --git a/test/fixtures/wpt/streams/writable-streams/floating-point-total-queue-size.any.js b/test/fixtures/wpt/streams/writable-streams/floating-point-total-queue-size.any.js
index 20a14fc19a51..bd34cc53a695 100644
--- a/test/fixtures/wpt/streams/writable-streams/floating-point-total-queue-size.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/floating-point-total-queue-size.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 // Due to the limitations of floating-point precision, the calculation of desiredSize sometimes gives different answers
diff --git a/test/fixtures/wpt/streams/writable-streams/garbage-collection.any.js b/test/fixtures/wpt/streams/writable-streams/garbage-collection.any.js
index 5e39e7c60d2c..a5d935c9aa00 100644
--- a/test/fixtures/wpt/streams/writable-streams/garbage-collection.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/garbage-collection.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=/common/gc.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/writable-streams/general.any.js b/test/fixtures/wpt/streams/writable-streams/general.any.js
index 48f8eeb89e41..cede7fd0845b 100644
--- a/test/fixtures/wpt/streams/writable-streams/general.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/general.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 test(() => {
diff --git a/test/fixtures/wpt/streams/writable-streams/properties.any.js b/test/fixtures/wpt/streams/writable-streams/properties.any.js
index ae0549f0871b..c95bd7d0c080 100644
--- a/test/fixtures/wpt/streams/writable-streams/properties.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/properties.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const sinkMethods = {
diff --git a/test/fixtures/wpt/streams/writable-streams/reentrant-strategy.any.js b/test/fixtures/wpt/streams/writable-streams/reentrant-strategy.any.js
index 18ce9e84759a..eb05cc068043 100644
--- a/test/fixtures/wpt/streams/writable-streams/reentrant-strategy.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/reentrant-strategy.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/start.any.js b/test/fixtures/wpt/streams/writable-streams/start.any.js
index 17972b568ceb..82d869430dd7 100644
--- a/test/fixtures/wpt/streams/writable-streams/start.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/start.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/write.any.js b/test/fixtures/wpt/streams/writable-streams/write.any.js
index 20a2885bf351..f0246f6cad39 100644
--- a/test/fixtures/wpt/streams/writable-streams/write.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/write.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/url/resources/urltestdata.json b/test/fixtures/wpt/url/resources/urltestdata.json
index c4807f9e2cfc..aae7b1f65683 100644
--- a/test/fixtures/wpt/url/resources/urltestdata.json
+++ b/test/fixtures/wpt/url/resources/urltestdata.json
@@ -7581,6 +7581,18 @@
     "hash": ""
   },
   "# IPv6 tests",
+  "IPv4 pieces embedded in IPv6 addresses must not have leading zeroes",
+  {
+    "input": "https://[0:1:2:3:4:5:192.0.02.1]/",
+    "base": null,
+    "failure": true
+  },
+  "An embedded IPv4 address must end the IPv6 address",
+  {
+    "input": "https://[192.0.2.1::]/",
+    "base": null,
+    "failure": true
+  },
   {
     "input": "http://[1:0::]",
     "base": "http://example.net/",
diff --git a/test/fixtures/wpt/versions.json b/test/fixtures/wpt/versions.json
index e04c397be444..fa3732a0e9fd 100644
--- a/test/fixtures/wpt/versions.json
+++ b/test/fixtures/wpt/versions.json
@@ -52,7 +52,7 @@
     "path": "html/webappapis/timers"
   },
   "interfaces": {
-    "commit": "a8392bd0210378dda13278eeccf2c2602278e214",
+    "commit": "3f15e5c09448b8e917c9128d3b07cc78f044c83a",
     "path": "interfaces"
   },
   "performance-timeline": {
@@ -67,12 +67,16 @@
     "commit": "6a2f32237615d7ea9c1eb1e30453066b5555c603",
     "path": "resources"
   },
+  "service-workers": {
+    "commit": "b7ed7c8dcd260f0f80879577752c68f042a7d054",
+    "path": "service-workers"
+  },
   "streams": {
-    "commit": "f8f26a372f357370846226ff64db1f9cc98a1edb",
+    "commit": "4832db47614f5f48cc57374cbf5c1f70937fad48",
     "path": "streams"
   },
   "url": {
-    "commit": "4832db47614f5f48cc57374cbf5c1f70937fad48",
+    "commit": "c23755a1449cc9c5a9131378c13ecf073c0885c6",
     "path": "url"
   },
   "urlpattern": {
@@ -100,7 +104,7 @@
     "path": "WebCryptoAPI"
   },
   "webidl": {
-    "commit": "63ca529a021fec15b2996db82fd7dd04c11abe85",
+    "commit": "65bbe07908e5c19e8a6c7ff8701cc2a722cd215e",
     "path": "webidl"
   },
   "webidl/ecmascript-binding/es-exceptions": {
@@ -114,5 +118,9 @@
   "webstorage": {
     "commit": "1d2c5fb36a6e477c8f915bde7eca027be6abe792",
     "path": "webstorage"
+  },
+  "workers": {
+    "commit": "4832db47614f5f48cc57374cbf5c1f70937fad48",
+    "path": "workers"
   }
 }
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/allow-shared.https.html b/test/fixtures/wpt/webidl/ecmascript-binding/allow-shared.https.html
new file mode 100644
index 000000000000..b4cd1e37fd94
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/allow-shared.https.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>WebIDL [AllowShared] semantics</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#AllowShared">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/sab.js"></script>
+<script>
+  "use strict";
+
+  test(t => {
+    // Create a standard SharedArrayBuffer (safe even without COOP/COEP headers)
+    const sab = createBuffer('SharedArrayBuffer', 128);
+    const arr = new Uint8Array(sab);
+    arr.fill(42);
+    assert_equals(sab.constructor.name, 'SharedArrayBuffer');
+    new ImageDecoder({
+      data: arr,
+      // We don't really need encoding to succeed, just for argument conversion before the native call.
+      type: "invalid"
+    });
+
+    assert_throws_js(TypeError, () => {
+      new MIDIMessageEvent('message', { data: arr });
+    }, "An attempt to pass a view backed by a shared array buffer should throw");
+
+  }, "APIs without [AllowShared] do not accept SharedArrayBuffer-backed views with pre-existing wrapper");
+
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js
index 9b6978783723..856d13681e60 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js
index 011521652654..ca0fc84fc66a 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 test(function() {
     assert_own_property(self, "DOMException", "property of global");
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js
index c4ddabdafd45..10aad220b917 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js
index d1c86930d4cd..467bf054c3a9 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 "use strict";
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js
index 6f3097b222ed..dc39c978217b 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js
new file mode 100644
index 000000000000..24f6fd486bdc
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js
@@ -0,0 +1,80 @@
+// META: global=window,dedicatedworker
+
+// https://tc39.es/proposal-error-stack-accessor/
+// https://github.com/whatwg/webidl/pull/1421
+
+"use strict";
+
+test(() => {
+  const e = new DOMException("some message", "SyntaxError");
+  assert_equals(typeof e.stack, "string", "stack must be a string");
+}, "new DOMException() has a stack property that is a string");
+
+test(() => {
+  const e = new DOMException();
+  assert_equals(typeof e.stack, "string", "stack must be a string");
+}, "new DOMException() with no arguments has a stack property that is a string");
+
+if (typeof document !== "undefined") {
+  test(() => {
+    let caught;
+    try {
+      document.createElement("");
+    } catch (e) {
+      caught = e;
+    }
+    assert_true(caught instanceof DOMException, "must be a DOMException");
+    assert_equals(typeof caught.stack, "string", "stack must be a string");
+  }, "thrown DOMException from DOM API has a stack property that is a string");
+}
+
+test(() => {
+  const e = new DOMException("some message", "SyntaxError");
+  assert_false(e.hasOwnProperty("stack"), "stack must not be an own property of the instance");
+}, "DOMException instance does not have an own stack property");
+
+test(() => {
+  assert_false(DOMException.prototype.hasOwnProperty("stack"),
+    "DOMException.prototype must not have an own stack property");
+}, "DOMException.prototype does not have an own stack property");
+
+test(() => {
+  const desc = Object.getOwnPropertyDescriptor(Error.prototype, "stack");
+  assert_not_equals(desc, undefined, "Error.prototype must have a stack property descriptor");
+  assert_equals(typeof desc.get, "function", "stack must have a getter");
+  assert_equals(typeof desc.set, "function", "stack must have a setter");
+  assert_false(desc.enumerable, "stack must not be enumerable");
+  assert_true(desc.configurable, "stack must be configurable");
+}, "Error.prototype.stack is an accessor property with correct attributes");
+
+test(() => {
+  const getter = Object.getOwnPropertyDescriptor(Error.prototype, "stack").get;
+  const e = new DOMException("some message", "SyntaxError");
+  const stack = getter.call(e);
+  assert_equals(typeof stack, "string", "getter must return a string for DOMException");
+  assert_equals(stack, e.stack, "getter result must match e.stack");
+}, "Error.prototype.stack getter works on DOMException instances");
+
+test(() => {
+  const setter = Object.getOwnPropertyDescriptor(Error.prototype, "stack").set;
+  const e = new DOMException("some message", "SyntaxError");
+  setter.call(e, "custom stack");
+  assert_true(e.hasOwnProperty("stack"), "after setter, stack must be an own property");
+  assert_equals(e.stack, "custom stack", "own stack property must have the set value");
+
+  const desc = Object.getOwnPropertyDescriptor(e, "stack");
+  assert_equals(desc.value, "custom stack", "must be a data property");
+  assert_true(desc.writable, "must be writable");
+  assert_true(desc.enumerable, "must be enumerable");
+  assert_true(desc.configurable, "must be configurable");
+}, "Error.prototype.stack setter installs own data property on DOMException instances");
+
+test(() => {
+  const setter = Object.getOwnPropertyDescriptor(Error.prototype, "stack").set;
+  // SetterThatIgnoresPrototypeProperties should not install a property on Error.prototype itself
+  const originalStack = Object.getOwnPropertyDescriptor(Error.prototype, "stack");
+  setter.call(Error.prototype, "custom stack");
+  const afterStack = Object.getOwnPropertyDescriptor(Error.prototype, "stack");
+  assert_equals(typeof afterStack.get, "function",
+    "Error.prototype.stack must still be an accessor after calling setter on it");
+}, "Error.prototype.stack setter ignores Error.prototype itself");
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/global-mutable-prototype.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/global-mutable-prototype.any.js
deleted file mode 100644
index eba96e9adf46..000000000000
--- a/test/fixtures/wpt/webidl/ecmascript-binding/global-mutable-prototype.any.js
+++ /dev/null
@@ -1,27 +0,0 @@
-// META: global=shadowrealm
-// META: title=Mutability of the global prototype chain
-
-const objects = [];
-setup(() => {
-  for (let object = self; object; object = Object.getPrototypeOf(object)) {
-    objects.push(object);
-  }
-});
-
-test(() => {
-  for (const object of objects) {
-    const proto = Object.getPrototypeOf(object);
-    const plainObject = {};
-    Object.setPrototypeOf(object, plainObject);
-    assert_equals(Object.getPrototypeOf(object), plainObject);
-    Object.setPrototypeOf(object, proto);
-  }
-}, "Setting to a different prototype");
-
-test(() => {
-  for (const object of objects) {
-    const expected = Object.getPrototypeOf(object);
-    Object.setPrototypeOf(object, expected);
-    assert_equals(Object.getPrototypeOf(object), expected);
-  }
-}, "Setting to the same prototype");
diff --git a/test/fixtures/wpt/webidl/idlharness.any.js b/test/fixtures/wpt/webidl/idlharness.any.js
index f8b285c485c4..164fa0e65c8d 100644
--- a/test/fixtures/wpt/webidl/idlharness.any.js
+++ b/test/fixtures/wpt/webidl/idlharness.any.js
@@ -1,6 +1,6 @@
 // META: script=/resources/WebIDLParser.js
 // META: script=/resources/idlharness.js
-// META: global=window,dedicatedworker,shadowrealm-in-window
+// META: global=window,dedicatedworker
 
 "use strict";
 
diff --git a/test/fixtures/wpt/workers/META.yml b/test/fixtures/wpt/workers/META.yml
new file mode 100644
index 000000000000..b5b28235ce15
--- /dev/null
+++ b/test/fixtures/wpt/workers/META.yml
@@ -0,0 +1,5 @@
+spec: https://html.spec.whatwg.org/multipage/workers.html
+suggested_reviewers:
+  - caitp
+  - jdm
+  - annevk
diff --git a/test/fixtures/wpt/workers/README.md b/test/fixtures/wpt/workers/README.md
new file mode 100644
index 000000000000..58ee7cca1ab3
--- /dev/null
+++ b/test/fixtures/wpt/workers/README.md
@@ -0,0 +1,140 @@
+# Worker WPT tests
+
+These are the workers (`Worker`, `SharedWorker`) tests for the
+[Web workers chapter of the HTML Standard](https://html.spec.whatwg.org/multipage/workers.html).
+
+See also
+[testharness.js API > Web Workers](https://web-platform-tests.org/writing-tests/testharness-api.html#web-workers).
+
+Note that because workers are defined in the HTML Standard, the idlharness.js
+tests are in [/html/dom]([/html/dom) instead of here.
+
+## Writing `*.any.js`
+
+The easiest and most recommended way to write tests for workers
+is to create .any.js-style tests.
+
+Official doc:
+[WPT > File Name Flags > Test Features](https://web-platform-tests.org/writing-tests/file-names.html#test-features).
+
+- Standard `testharness.js`-style can be used (and is enforced).
+- The same test can be run on window and many types of workers.
+- All glue code are automatically generated.
+- No need to care about how to create and communicate with each type of workers,
+  thanks to `fetch_tests_from_worker` in `testharness.js`.
+
+Converting existing tests into `.any.js`-style also has benefits:
+
+- Multiple tests can be merged into one.
+- Tests written for window can be run on workers
+  with a very low development cost.
+
+### How to write tests
+
+If you write `testharness.js`-based tests in `foo.any.js` and
+specify types of workers to be tested,
+the test can run on any of dedicated, shared and service workers.
+
+See `examples/general.any.js` for example.
+
+Even for testing specific features in a specific type of workers
+(e.g. shared worker's `onconnect`), `.any.js`-style tests can be used.
+
+See `examples/onconnect.any.js` for example.
+
+### How to debug tests
+
+Whether each individual test passed or failed,
+and its assertion failures (if any) are all reported in the final results.
+
+`console.log()` might not appear in the test results and
+thus might not be useful for printf debugging.
+For example, in Chromium, this message
+
+- Appears (in stderr) on a window or a dedicated worker, but
+- Does NOT appear on a shared worker or a service worker.
+
+### How it works
+
+`.any.js`-style tests use
+`fetch_tests_from_worker` functionality of `testharness.js`.
+
+The WPT test server generates necessary glue code
+(including generated Document HTML and worker top-level scripts).
+See
+[serve.py](https://github.com/web-platform-tests/wpt/blob/master/tools/serve/serve.py)
+for the actual glue code.
+
+Note that `.any.js` file is not the worker top-level script,
+and currently we cannot set response headers to the worker top-level script,
+e.g. to set Referrer Policy of the workers.
+
+## Writing `*.worker.js`
+
+Similar to `.any.js`, you can also write `.worker.js`
+for tests only for dedicated workers.
+Almost the same as `.any.js`, except for the things listed below.
+
+Official doc:
+[WPT > File Name Flags > Test Features](https://web-platform-tests.org/writing-tests/file-names.html#test-features).
+
+### How to write tests
+
+You have to write two things manually (which is generated in `.any.js` tests):
+
+- `importScripts("/resources/testharness.js");` at the beginning.
+- `done();` at the bottom.
+
+Note: Even if you write `async_test()` or `promise_test()`,
+this global `done()` is always needed
+(this is different from async_test's `done()`)
+for dedicated workers and shared workers.
+See official doc:
+[testharness.js API > Determining when all tests are complete](https://web-platform-tests.org/writing-tests/testharness-api.html#determining-when-all-tests-are-complete).
+
+See `examples/general.worker.js` for example.
+
+### How it works
+
+`.worker.js`-style tests also use
+`fetch_tests_from_worker` functionality of `testharness.js`.
+
+The WPT test server generates glue code in Document HTML-side,
+but not for worker top-level scripts.
+This is why you have to manually write `importScripts()` etc.
+See
+[serve.py](https://github.com/web-platform-tests/wpt/blob/master/tools/serve/serve.py)
+for the actual glue code.
+
+Unlike `*.any.js` cases, the `*.worker.js` is the worker top-level script.
+
+## Using `fetch_tests_from_worker`
+
+If you need more flexibility,
+writing tests using `fetch_tests_from_worker` is the way to go.
+For example, when
+
+- Additional processing is needed on the parent Document.
+- Workers should be created in a specific way.
+- You are writing non-WPT tests using `testharness.js`.
+
+You have to write the main HTMLs and the worker scripts,
+but most of the glue code needed for running tests on workers
+are provided by `fetch_tests_from_worker`.
+
+### How to write tests
+
+See
+
+- `examples/fetch_tests_from_worker.html` and
+  `examples/fetch_tests_from_worker.js`.
+
+## Writing the whole tests manually
+
+If `fetch_tests_from_worker` isn't suitable for your specific case
+(which should be rare but might be still possible),
+you have to write the whole tests,
+including the main Document HTML, worker scripts,
+and message passing code between them.
+
+TODO: Supply the templates for writing this kind of tests.
diff --git a/test/fixtures/wpt/workers/SharedWorker-MessageEvent-source.any.js b/test/fixtures/wpt/workers/SharedWorker-MessageEvent-source.any.js
new file mode 100644
index 000000000000..e47fd0653550
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-MessageEvent-source.any.js
@@ -0,0 +1,6 @@
+// META: global=sharedworker
+const t = async_test("Make sure that MessageEvent.source is properly set in connect event.");
+onconnect = t.step_func_done((event) => {
+  assert_equals(Object.getPrototypeOf(event), MessageEvent.prototype);
+  assert_equals(event.source, event.ports[0]);
+});
diff --git a/test/fixtures/wpt/workers/SharedWorker-constructor.html b/test/fixtures/wpt/workers/SharedWorker-constructor.html
new file mode 100644
index 000000000000..6298dd934e11
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-constructor.html
@@ -0,0 +1,60 @@
+<!DOCTYPE html>
+<title>Test SharedWorker constructor functionality.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+test(() => {
+  assert_throws_js(Error,
+                   function() {
+                     new SharedWorker({toString:function(){throw new Error()}}, "name") },
+                   "toString exception not propagated");
+}, "Test toString exception propagated correctly.");
+
+test(() => {
+  assert_throws_js(RangeError,
+                   function() {
+                     var foo = {toString:function(){new Worker(foo)}}
+                     new SharedWorker(foo, name); },
+                   "Trying to create workers recursively did not result in an exception.");
+}, "Test recursive worker creation results in exception.");
+
+test(() => {
+  assert_throws_js(TypeError,
+                   function() { new SharedWorker(); },
+                   "Invoking SharedWorker constructor without arguments did not result in an exception.");
+}, "Test SharedWorker creation without arguments results in exception.");
+
+test(() => {
+  try {
+    var worker = new SharedWorker("support/SharedWorker-common.js");
+  } catch (ex) {
+    assert_unreached("Constructor failed when no name is passed: (" + ex + ")");
+  }
+}, "Test SharedWorker constructor without a name does not result in an exception.");
+
+test(() => {
+  try {
+    var worker = new SharedWorker("support/SharedWorker-common.js", null);
+  } catch (ex) {
+    assert_unreached("Constructor failed when null name is passed: (" + ex + ")");
+  }
+}, "Test SharedWorker constructor with null name does not result in an exception.");
+
+test(() => {
+  try {
+    var worker = new SharedWorker("support/SharedWorker-common.js", undefined);
+  } catch (ex) {
+    assert_unreached("Constructor failed when undefined name is passed: (" + ex + ")");
+  }
+}, "Test SharedWorker constructor with undefined name does not result in an exception.");
+
+test(() => {
+  try {
+    var worker = new SharedWorker("support/SharedWorker-common.js", "name");
+  } catch (ex) {
+    assert_unreached("Invoking SharedWorker constructor resulted in an exception: (" + ex + ")");
+  }
+}, "Test SharedWorker constructor suceeds.");
+
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-detach-frame-in-error-event.html b/test/fixtures/wpt/workers/SharedWorker-detach-frame-in-error-event.html
new file mode 100644
index 000000000000..7363265fbc3c
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-detach-frame-in-error-event.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<title>Test frame detach in shared worker's error handler</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+<iframe id="frame"></iframe>
+</body>
+<script>
+promise_test(t => {
+  const frame = document.getElementById('frame');
+
+  const promise = new Promise(resolve => {
+    window.detachFrame = () => {
+      frame.remove();
+      resolve();
+    };
+  });
+
+  // Start a new worker with an invalid script in the frame, and detach the
+  // frame in the worker's error handler. This shouldn't crash.
+  const s = frame.contentWindow.document.createElement('script');
+  s.innerHTML = "const worker = new SharedWorker('error');" +
+                "worker.onerror = () => { window.parent.detachFrame(); };";
+  frame.contentWindow.document.body.appendChild(s);
+
+  return promise;
+});
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-exception-propagation.html b/test/fixtures/wpt/workers/SharedWorker-exception-propagation.html
new file mode 100644
index 000000000000..5823a19a4bfa
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-exception-propagation.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<title>Uncaught error in shared worker should not propagate to window</title>
+<link rel="help" href="https://html.spec.whatwg.org/multipage/workers.html#runtime-script-errors-2">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/SharedWorker-create-common.js"></script>
+<script>
+// Suppress the default handling of the error event so that a failure
+// manifests as a failed test and not a harness error.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+    addEventListener("error", t.unreached_func("error event fired"));
+    var worker = createWorker();
+    worker.postMessage("throw");
+    worker.postMessage("ping");
+    var pongs = 0;
+    worker.onmessage = function(evt) {
+        // Wait for response from ping - that's how we know we have thrown the exception.
+        if (evt.data == "PASS: Received ping message") {
+            pongs++;
+            if (pongs == 1) {
+                // Send another "ping" message and wait for the response before
+                // ending the test, so that any error propagation that is now
+                // in flight will have finished.
+                worker.postMessage("ping");
+            } else {
+                t.done();
+            }
+        }
+    };
+});
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-exception.html b/test/fixtures/wpt/workers/SharedWorker-exception.html
new file mode 100644
index 000000000000..28b858485727
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-exception.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<title>This test checks whether exceptions in SharedWorkers are logged to the parent document. An exception should be logged to the error console.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/SharedWorker-create-common.js"></script>
+<script>
+// Ignore any error event fired on window in this test. This is tested
+// separately in SharedWorker-exception-propagation.html.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+    var worker = createWorker();
+    worker.postMessage("throw");
+    worker.postMessage("ping");
+    worker.onmessage = function(evt) {
+        // Wait for response from ping - that's how we know we have thrown the exception.
+        if (evt.data == "PASS: Received ping message") {
+            t.done();
+        }
+    };
+});
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-blob.html b/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-blob.html
new file mode 100644
index 000000000000..5a3945c59185
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-blob.html
@@ -0,0 +1,71 @@
+<!DOCTYPE html>
+<title>SharedWorker extendedLifetime (Blob URL)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/utils.js"></script>
+<script src="/common/dispatcher/dispatcher.js"></script>
+<script>
+
+const createBlobWorkerAndStore = async (uuid) => {
+  const script = `
+    let stored_data = null;
+    self.onconnect = e => {
+      const port = e.ports[0];
+      port.onmessage = msg => {
+        if (msg.data.op === 'store') {
+          stored_data = msg.data.data;
+          port.postMessage({status: 'OK', reqid: msg.data.reqid});
+        } else if (msg.data.op === 'load') {
+          port.postMessage({status: 'OK', data: stored_data, reqid: msg.data.reqid});
+        }
+      };
+    };
+  `;
+  const blob = new Blob([script], {type: 'application/javascript'});
+  const url = URL.createObjectURL(blob);
+  window.worker = new SharedWorker(url, {extendedLifetime: true});
+  worker.port.start();
+  await new Promise(resolve => {
+    const listener = e => {
+      if (e.data.reqid === 1) {
+        worker.port.removeEventListener('message', listener);
+        resolve(e.data);
+      }
+    };
+    worker.port.addEventListener('message', listener);
+    worker.port.postMessage({op: 'store', data: uuid, reqid: 1});
+  });
+  return url;
+};
+
+const connectAndLoad = async (url) => {
+  window.worker = new SharedWorker(url, {extendedLifetime: true});
+  worker.port.start();
+  return new Promise(resolve => {
+    const listener = e => {
+      if (e.data.reqid === 2) {
+        worker.port.removeEventListener('message', listener);
+        resolve(e.data);
+      }
+    };
+    worker.port.addEventListener('message', listener);
+    worker.port.postMessage({op: 'load', reqid: 2});
+  });
+};
+
+promise_test(async t => {
+  const uuid = token();
+  const ctx = new RemoteContext(token());
+  const popup = window.open(remoteExecutorUrl(ctx.context_id));
+  const blobUrl = await ctx.execute_script(createBlobWorkerAndStore, [uuid]);
+  popup.close();
+
+  // The blob URL might be revoked in the popup's context upon close,
+  // but the SharedWorker should survive because of extendedLifetime.
+  // A new connection from this page should still match the existing worker.
+  const response = await connectAndLoad(blobUrl);
+  assert_equals(response.status, 'OK');
+  assert_equals(response.data, uuid);
+}, "Blob URL SharedWorker should survive across navigations with extendedLifetime");
+
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-data.html b/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-data.html
new file mode 100644
index 000000000000..96e45c4af50c
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-data.html
@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<title>SharedWorker extendedLifetime (Data URL)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/utils.js"></script>
+<script src="/common/dispatcher/dispatcher.js"></script>
+<script>
+
+const dataUrl = "data:application/javascript," + encodeURIComponent(`
+  let stored_data = null;
+  self.onconnect = e => {
+    const port = e.ports[0];
+    port.onmessage = msg => {
+      if (msg.data.op === 'store') {
+        stored_data = msg.data.data;
+        port.postMessage({status: 'OK', reqid: msg.data.reqid});
+      } else if (msg.data.op === 'load') {
+        port.postMessage({status: 'OK', data: stored_data, reqid: msg.data.reqid});
+      }
+    };
+  };
+`);
+
+const createDataWorkerAndStore = async (uuid, dataUrl) => {
+  window.worker = new SharedWorker(dataUrl, {extendedLifetime: true});
+  worker.port.start();
+  await new Promise(resolve => {
+    const listener = e => {
+      if (e.data.reqid === 1) {
+        worker.port.removeEventListener('message', listener);
+        resolve(e.data);
+      }
+    };
+    worker.port.addEventListener('message', listener);
+    worker.port.postMessage({op: 'store', data: uuid, reqid: 1});
+  });
+};
+
+const connectAndLoad = async (dataUrl) => {
+  window.worker = new SharedWorker(dataUrl, {extendedLifetime: true});
+  worker.port.start();
+  return new Promise(resolve => {
+    const listener = e => {
+      if (e.data.reqid === 2) {
+        worker.port.removeEventListener('message', listener);
+        resolve(e.data);
+      }
+    };
+    worker.port.addEventListener('message', listener);
+    worker.port.postMessage({op: 'load', reqid: 2});
+  });
+};
+
+promise_test(async t => {
+  const uuid = token();
+  const ctx = new RemoteContext(token());
+  const popup = window.open(remoteExecutorUrl(ctx.context_id));
+  await ctx.execute_script(createDataWorkerAndStore, [uuid, dataUrl]);
+  popup.close();
+
+  // The SharedWorker created with data: URL should survive because of extendedLifetime.
+  const response = await connectAndLoad(dataUrl);
+  assert_equals(response.status, 'OK');
+  assert_equals(response.data, uuid);
+}, "Data URL SharedWorker should survive across navigations with extendedLifetime");
+
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-named-module.html b/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-named-module.html
new file mode 100644
index 000000000000..543c5b24933f
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-named-module.html
@@ -0,0 +1,69 @@
+<!DOCTYPE html>
+<title>SharedWorker extendedLifetime (Named and Module)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/utils.js"></script>
+<script src="/common/dispatcher/dispatcher.js"></script>
+<script>
+
+const connectToSharedWorker = async (options) => {
+  window.worker = new SharedWorker(
+    '/workers/resources/shared-worker-memory.js', options);
+  worker.port.start();
+};
+
+const postAndWait = async (data) => {
+  return new Promise(resolve => {
+    const listener = event => {
+      if (event.data.reqid !== data.reqid) {
+        return;
+      }
+      worker.port.removeEventListener('message', listener);
+      resolve(event.data);
+    };
+    worker.port.addEventListener('message', listener);
+    worker.port.postMessage(data);
+  });
+};
+
+promise_test(async t => {
+  const uuid = token();
+  const options = {name: 'named-worker', extendedLifetime: true};
+
+  const ctx = new RemoteContext(token());
+  const popup = window.open(remoteExecutorUrl(ctx.context_id));
+  await ctx.execute_script(connectToSharedWorker, [options]);
+  await ctx.execute_script(postAndWait, [{reqid: 1, op: 'store', data: uuid}]);
+  popup.close();
+
+  // Wait for potential worker teardown (if extendedLifetime were not working)
+  await new Promise(resolve => setTimeout(resolve, 100));
+
+  const ctx2 = new RemoteContext(token());
+  const popup2 = window.open(remoteExecutorUrl(ctx2.context_id));
+  await ctx2.execute_script(connectToSharedWorker, [options]);
+  const response = await ctx2.execute_script(postAndWait, [{reqid: 2, op: 'load'}]);
+  assert_equals(response.data, uuid);
+}, "Named SharedWorker should survive across navigations with extendedLifetime");
+
+promise_test(async t => {
+  const uuid = token();
+  const options = {type: 'module', extendedLifetime: true};
+
+  const ctx = new RemoteContext(token());
+  const popup = window.open(remoteExecutorUrl(ctx.context_id));
+  await ctx.execute_script(connectToSharedWorker, [options]);
+  await ctx.execute_script(postAndWait, [{reqid: 10, op: 'store', data: uuid}]);
+  popup.close();
+
+  // Wait for potential worker teardown
+  await new Promise(resolve => setTimeout(resolve, 100));
+
+  const ctx2 = new RemoteContext(token());
+  const popup2 = window.open(remoteExecutorUrl(ctx2.context_id));
+  await ctx2.execute_script(connectToSharedWorker, [options]);
+  const response = await ctx2.execute_script(postAndWait, [{reqid: 11, op: 'load'}]);
+  assert_equals(response.data, uuid);
+}, "Module SharedWorker should survive across navigations with extendedLifetime");
+
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-extendedLifetime.html b/test/fixtures/wpt/workers/SharedWorker-extendedLifetime.html
new file mode 100644
index 000000000000..a0fb0a007b7d
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-extendedLifetime.html
@@ -0,0 +1,51 @@
+<!DOCTYPE html>
+<title>SharedWorker extendedLifetime</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/utils.js"></script>
+<script src="/common/dispatcher/dispatcher.js"></script>
+<script>
+
+/**
+ * Connects to a SharedWorker and performs a single message exchange.
+ * Used both in the main window and in the popup via execute_script.
+ */
+const connectAndOperate = async (url, data) => {
+  const worker = new SharedWorker(url, {extendedLifetime: true});
+  worker.port.start();
+  return new Promise(resolve => {
+    const listener = event => {
+      if (event.data.reqid === data.reqid) {
+        worker.port.removeEventListener('message', listener);
+        resolve(event.data);
+      }
+    };
+    worker.port.addEventListener('message', listener);
+    worker.port.postMessage(data);
+  });
+};
+
+promise_test(async t => {
+  const uuid = token();
+  const worker_url = '/workers/resources/shared-worker-memory.js?' + token();
+  const ctx = new RemoteContext(token());
+  const popup = window.open(remoteExecutorUrl(ctx.context_id));
+  t.add_cleanup(() => popup.close());
+
+  // 1. Store data from the popup side.
+  const popup_response = await ctx.execute_script(connectAndOperate, [
+    worker_url, {op: 'store', data: uuid, reqid: 1}
+  ]);
+  assert_equals(popup_response.status, 'OK');
+  popup.close();
+
+  // Wait to ensure the worker survives across the client's disappearance.
+  await new Promise(resolve => setTimeout(resolve, 1000));
+
+  // 2. Load data from the main window side.
+  const response = await connectAndOperate(worker_url, {op: 'load', reqid: 2});
+
+  assert_equals(response.status, 'OK');
+  assert_equals(response.data, uuid);
+}, "SharedWorker lifetime should be extended with extendedLifetime");
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-replace-EventHandler.any.js b/test/fixtures/wpt/workers/SharedWorker-replace-EventHandler.any.js
new file mode 100644
index 000000000000..90c7d2d08d17
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-replace-EventHandler.any.js
@@ -0,0 +1,15 @@
+// META: global=sharedworker
+// https://crbug.com/239669
+const t = async_test("Tests that repeatedly setting 'onerror' within a shared worker doesnt crash.");
+onconnect = t.step_func_done((event) => {
+  function update() {
+    onerror = undefined;
+  }
+  try {
+    for (var i = 0; i < 8; ++i) {
+      update();
+    }
+  } catch (ex) {
+    assert_unreached("FAIL: unexpected exception (" + ex + ") received while updating onerror event handler.");
+  }
+});
diff --git a/test/fixtures/wpt/workers/SharedWorker-script-error.html b/test/fixtures/wpt/workers/SharedWorker-script-error.html
new file mode 100644
index 000000000000..3c93cc038f27
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-script-error.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<title>Test SharedWorker script error handling functionality.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(t => {
+    let worker;
+
+    return new Promise((resolve) => {
+        worker = new SharedWorker("support/SharedWorker-script-error.js");
+        // Shared workers should only invoke onerror for loading errors.
+        worker.onerror = function(evt) {
+            assert_unreached("FAIL: onerror invoked for a script error.");
+        };
+        worker.port.postMessage("unhandledError");
+        worker.port.onmessage = resolve;
+    }).then(e => {
+        assert_equals(e.data, "SUCCESS: unhandled error generated");
+    });
+}, 'Test script error unhandled.')
+
+promise_test(t => {
+    let worker;
+
+    return new Promise((resolve) => {
+        worker = new SharedWorker("support/SharedWorker-script-error.js");
+        // Shared workers should only invoke onerror for loading errors.
+        worker.onerror = function(evt) {
+            assert_unreached("FAIL: onerror invoked for a script error.");
+        };
+        worker.port.postMessage("handledError");
+        worker.port.onmessage = resolve;
+    }).then(e => {
+        assert_equals(e.data, "SUCCESS: error handled via onerror");
+    });
+}, 'Test script error handled.')
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-simple.html b/test/fixtures/wpt/workers/SharedWorker-simple.html
new file mode 100644
index 000000000000..7cd3f4f3be65
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-simple.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<title>Test simple shared worker construction case.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(t => {
+    let worker;
+
+    return new Promise(resolve => {
+        worker = new SharedWorker('support/SharedWorker-common.js', 'name');
+        worker.port.postMessage("ping");
+        worker.port.onmessage = resolve;
+    }).then(e => {
+        assert_equals(e.data, "PASS: Received ping message");
+    });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorkerPerformanceNow.html b/test/fixtures/wpt/workers/SharedWorkerPerformanceNow.html
new file mode 100644
index 000000000000..be5b5e3488c6
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorkerPerformanceNow.html
@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>window.performance.now in shared workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+</head>
+<body>
+<script>
+async_test(function(t) {
+    const worker = new SharedWorker('support/WorkerSendingPerformanceNow.js');
+    worker.port.onmessage = t.step_func(event => {
+        const results = event.data;
+        assert_equals(results.length, 4);
+        assert_equals(results[0], 'undefined',
+          'workerStart not defined on the Worker object');
+        assert_equals(results[1], 'object', 'self.performance is defined');
+        assert_equals(results[2], 'function', 'self.performance.now is defined');
+        assert_greater_than_equal(results[3], 0, 'Time in the worker should be non-negative');
+        assert_greater_than(window.performance.now(), results[3], 'Time in the worker should be before the current time in the main document');
+        setupIframe();
+    });
+    window.iframeStartTime = 0;
+    window.test_iframe = function(event) {
+        const workerTime = event.data[3];
+        assert_greater_than(workerTime, window.iframeStartTime,
+            'Time since origin time should be greater in the shared worker than the iframe');
+        t.done();
+    }
+    function setupIframe() {
+        const iframe = document.createElement('iframe');
+        document.body.appendChild(iframe);
+        const script = iframe.contentWindow.document.createElement('script');
+        script.innerHTML =
+            'window.top.iframeStartTime = window.performance.now();' +
+            'const worker = new SharedWorker("support/WorkerSendingPerformanceNow.js");' +
+            'worker.port.onmessage = function(event) {' +
+            '    window.top.test_iframe(event);' +
+            '};' +
+            'worker.port.postMessage("");';
+        iframe.contentWindow.document.body.appendChild(script);
+    }
+    worker.port.postMessage('');
+}, 'performance.now() exists in shared workers and reports reasonable times');
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/workers/SharedWorker_blobUrl.html b/test/fixtures/wpt/workers/SharedWorker_blobUrl.html
new file mode 100644
index 000000000000..e5b1c673c060
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker_blobUrl.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<title>Shared Worker: Blob URL passed over message port</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+</body>
+<script>
+
+promise_test(t => {
+  let worker;
+  let blob;
+  let blobUrl;
+  let blobText = 'Blob URL test';
+
+  return new Promise(function(resolve) {
+      worker = new SharedWorker('support/WorkerFetchURL.js');
+      blob = new Blob([blobText]);
+      blobUrl = URL.createObjectURL(blob);
+      worker.port.postMessage(blobUrl);
+      worker.port.onmessage = resolve;
+    })
+  .then(e => {
+    assert_equals(e.data, 'Worker reply:' + blobText);
+    URL.revokeObjectURL(blobUrl);
+  });
+}, 'Blob URL shared by document on SharedWorker');
+
+</script>
+</html>
+
diff --git a/test/fixtures/wpt/workers/SharedWorker_dataUrl.html b/test/fixtures/wpt/workers/SharedWorker_dataUrl.html
new file mode 100644
index 000000000000..c1dec27d49f8
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker_dataUrl.html
@@ -0,0 +1,63 @@
+<!DOCTYPE html>
+<title>Shared Worker: Data URL cross-origin checks</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+</body>
+<script>
+
+function dirname(path) {
+  return path.replace(/\/[^\/]*$/, '/');
+}
+
+promise_test(t => {
+  return new Promise(function(resolve) {
+    let count = 0;
+    onmessage = e => {
+      assert_equals(e.data, 1);
+      if (++count == 2) {
+        resolve(true);
+      }
+    };
+
+    let iframeA = document.createElement('iframe');
+    document.body.appendChild(iframeA);
+    iframeA.src =  get_host_info().HTTP_REMOTE_ORIGIN +
+                   dirname(location.pathname) +
+                   "support/iframe_sw_dataUrl.html";
+
+    let iframeB = document.createElement('iframe');
+    document.body.appendChild(iframeB);
+    iframeB.src =  get_host_info().HTTPS_REMOTE_ORIGIN +
+                   dirname(location.pathname) +
+                   "support/iframe_sw_dataUrl.html";
+  });
+}, 'Data URL not shared by cross-origin SharedWorkers');
+
+promise_test(t => {
+  return new Promise(function(resolve) {
+    let count = 0;
+    onmessage = e => {
+      assert_equals(e.data, ++count);
+      if (count == 2) {
+        resolve(true);
+      }
+    };
+
+    let iframeA = document.createElement('iframe');
+    document.body.appendChild(iframeA);
+    iframeA.src =  get_host_info().HTTP_ORIGIN +
+                   dirname(location.pathname) +
+                   "support/iframe_sw_dataUrl.html";
+
+    let iframeB = document.createElement('iframe');
+    document.body.appendChild(iframeB);
+    iframeB.src =  get_host_info().HTTP_ORIGIN +
+                   dirname(location.pathname) +
+                   "support/iframe_sw_dataUrl.html";
+  });
+}, 'Data URLs shared by same-origin SharedWorkers');
+
+</script>
+</html>
diff --git a/test/fixtures/wpt/workers/WEB_FEATURES.yml b/test/fixtures/wpt/workers/WEB_FEATURES.yml
new file mode 100644
index 000000000000..40ba4aa99ea0
--- /dev/null
+++ b/test/fixtures/wpt/workers/WEB_FEATURES.yml
@@ -0,0 +1,16 @@
+rules:
+- WorkerNavigator-hardware-concurrency.any.js: [hardware-concurrency]
+- WorkerGlobalScope_requestAnimationFrame.worker.js: [request-animation-frame-workers]
+- WorkerGlobalScope_setInterval.htm: [setinterval]
+- WorkerGlobalScope_setTimeout.htm: [settimeout]
+- WorkerNavigator_userAgentData.http.html: [ua-client-hints]
+- WorkerNavigator_userAgentData.https.html: [ua-client-hints]
+- WorkerNavigator_onLine.htm: [online]
+- Worker-postMessage-happens-in-parallel.https.html: [postmessage]
+- postMessage_*: [postmessage]
+- WorkerNavigator_userAgent.htm: [user-agent-sniffing]
+- data-url-shared.html: [shared-workers]
+- SharedWorker-*: [shared-workers]
+- shared-worker-*: [shared-workers]
+- "*.any.*": []
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/Worker-base64.any.js b/test/fixtures/wpt/workers/Worker-base64.any.js
new file mode 100644
index 000000000000..6a46b477848c
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-base64.any.js
@@ -0,0 +1,5 @@
+// META: global=worker
+test(() => {
+  assert_equals(typeof atob, 'function');
+  assert_equals(typeof btoa, 'function');
+}, 'Tests that atob() / btoa() functions are exposed to workers');
diff --git a/test/fixtures/wpt/workers/Worker-call.worker.js b/test/fixtures/wpt/workers/Worker-call.worker.js
new file mode 100644
index 000000000000..ba07498880cb
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-call.worker.js
@@ -0,0 +1,12 @@
+importScripts("/resources/testharness.js");
+test(() => {
+  try {
+    postMessage("SUCCESS: postMessage() called directly");
+    postMessage.call(null, "SUCCESS: postMessage() invoked via postMessage.call()");
+    var saved = postMessage;
+    saved("SUCCESS: postMessage() called via intermediate variable");
+  } catch (ex) {
+    assert_unreached("FAIL: unexpected exception (" + ex + ") received while calling functions from the worker context.");
+  }
+}, 'Test calling functions from WorkerContext.');
+done();
diff --git a/test/fixtures/wpt/workers/Worker-constructor-proto.any.js b/test/fixtures/wpt/workers/Worker-constructor-proto.any.js
new file mode 100644
index 000000000000..297fe6c58b47
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-constructor-proto.any.js
@@ -0,0 +1,7 @@
+//META: global=worker
+test(() => {
+  const proto = {};
+  assert_equals(String(Object.getPrototypeOf(WorkerLocation)).replace(/\n/g, " ").replace(/\s\s+/g, " "), "function () { [native code] }");
+  Object.setPrototypeOf(WorkerLocation, proto);
+  assert_equals(Object.getPrototypeOf(WorkerLocation), proto);
+}, 'Tests that setting the proto of a built in constructor is not reset.');
diff --git a/test/fixtures/wpt/workers/Worker-creation-happens-in-parallel.https.html b/test/fixtures/wpt/workers/Worker-creation-happens-in-parallel.https.html
new file mode 100644
index 000000000000..887d95f3df68
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-creation-happens-in-parallel.https.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<title>Test that creation of a "new Worker()" will occur in parallel to the main JS thread performing other computation, and can be joined with.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(t => {
+  return new Promise(resolve => {
+    let worker = new Worker("support/Worker-creation-happens-in-parallel.js");
+    let sab = new Uint8Array(new SharedArrayBuffer(16));
+    window.sab = sab;
+    worker.postMessage(sab);
+    let end = performance.now() + 10*1000;
+    while(sab[0] != 1 && performance.now() < end) /*wait to join with the result*/;
+    assert_true(sab[0] == 1);
+    resolve();
+  });
+}, 'Tests that creation of a "new Worker()" will occur in parallel');
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-creation-happens-in-parallel.https.html.headers b/test/fixtures/wpt/workers/Worker-creation-happens-in-parallel.https.html.headers
new file mode 100644
index 000000000000..4b06ac7cc63e
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-creation-happens-in-parallel.https.html.headers
@@ -0,0 +1,2 @@
+Cross-Origin-Opener-Policy:same-origin
+Cross-Origin-Embedder-Policy:require-corp
diff --git a/test/fixtures/wpt/workers/Worker-custom-event.any.js b/test/fixtures/wpt/workers/Worker-custom-event.any.js
new file mode 100644
index 000000000000..d7e983aaddc5
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-custom-event.any.js
@@ -0,0 +1,8 @@
+// META: global=worker
+async_test(t => {
+  var target = self;
+  target.addEventListener('custom-event', t.step_func_done());
+
+  var event = new Event('custom-event');
+  target.dispatchEvent(event);
+}, 'Test CustomEvents on workers.');
diff --git a/test/fixtures/wpt/workers/Worker-formdata.any.js b/test/fixtures/wpt/workers/Worker-formdata.any.js
new file mode 100644
index 000000000000..a07f194bd24e
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-formdata.any.js
@@ -0,0 +1,19 @@
+// META: global=dedicatedworker
+test(() => {
+  assert_own_property(self, 'FormData');
+  assert_equals(FormData.length, 0);
+
+  var formData = new FormData();
+  assert_not_equals(formData, null);
+  assert_own_property(FormData.prototype, 'append');
+  formData.append('key', 'value');
+
+  var blob = new Blob([]);
+  assert_not_equals(blob, null);
+  formData.append('key', blob);
+  formData.append('key', blob, 'filename');
+
+  assert_throws_dom("DataCloneError",
+                    function() { postMessage(formData) },
+                    "Trying to clone formdata inside a postMessage results in an exception." );
+},'Test FormData interface object');
diff --git a/test/fixtures/wpt/workers/Worker-location.sub.any.js b/test/fixtures/wpt/workers/Worker-location.sub.any.js
new file mode 100644
index 000000000000..c05bb1750f71
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-location.sub.any.js
@@ -0,0 +1,14 @@
+// META: global=dedicatedworker,sharedworker
+test(() => {
+  assert_equals(String(WorkerLocation).replace(/\n/g, " ").replace(/\s\s+/g, " "), "function WorkerLocation() { [native code] }");
+  assert_true(location instanceof Object);
+  assert_equals(location.href, 'http://{{host}}:{{ports[http][0]}}/workers/Worker-location.sub.any.worker.js');
+  assert_equals(location.origin, "http://{{host}}:{{ports[http][0]}}");
+  assert_equals(location.protocol, "http:");
+  assert_equals(location.host, "{{host}}:{{ports[http][0]}}");
+  assert_equals(location.hostname, "{{host}}");
+  assert_equals(location.port, "{{ports[http][0]}}");
+  assert_equals(location.pathname, "/workers/Worker-location.sub.any.worker.js");
+  assert_equals(location.search, "");
+  assert_equals(location.hash, "");
+}, 'Test WorkerLocation properties.');
diff --git a/test/fixtures/wpt/workers/Worker-messageport.html b/test/fixtures/wpt/workers/Worker-messageport.html
new file mode 100644
index 000000000000..f7734b2543fc
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-messageport.html
@@ -0,0 +1,69 @@
+<!DOCTYPE html>
+<title>Test that pages and workers can send MessagePorts to one another.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(function(t) {
+  var worker = new Worker("support/Worker-messageport.js");
+
+  // Send messages with and without ports to the worker to make sure it gets them.
+  worker.postMessage("noport");
+  worker.onmessage = t.step_func_done(evt => {
+    assert_equals(evt.data, "PASS: evt.ports = [] as expected");
+  });
+}, 'Test sending messages to workers with no port.');
+
+async_test(function(t) {
+  var worker = new Worker("support/Worker-messageport.js");
+  var channel = new MessageChannel();
+
+  worker.postMessage("port", [channel.port1]);
+  worker.onmessage = t.step_func(evt => {
+    assert_equals(evt.data, "PASS: Received message port");
+  });
+
+  // Send a message on the new port to make sure it gets to the worker.
+  channel.port2.postMessage("ping");
+
+  // Wait for the response.
+  channel.port2.onmessage = t.step_func_done(evt => {
+    assert_equals(evt.data, "pong");
+  });
+  channel.port2.start();
+}, 'Test sending message to a worker on a port.');
+
+async_test(function(t) {
+  var worker = new Worker("support/Worker-messageport.js");
+  var channel = new MessageChannel();
+
+  worker.onmessage = t.step_func(evt => {
+    assert_equals(evt.data, "port");
+    assert_equals(String(evt.ports), "[object MessagePort]");
+    assert_equals(evt.ports.length, 1);
+    evt.ports[0].postMessage("ping");
+    evt.ports[0].onmessage = t.step_func_done(evt => {
+      assert_equals(evt.data, "pong");
+    });
+    evt.ports[0].start();
+  });
+  worker.postMessage("getport");
+}, 'Test getting messages from a worker on a port.');
+
+async_test(function(t) {
+  var worker = new Worker("support/Worker-messageport.js");
+  var channel = new MessageChannel();
+  worker.onmessage = t.step_func(evt => { gotSpam(channel.port1); });
+  worker.postMessage("spam", [channel.port2]);
+
+  function gotSpam(port) {
+    var spamCount = 0;
+    port.onmessage = t.step_func(evt => {
+      assert_equals(evt.data, spamCount);
+      spamCount++;
+      if (spamCount == 1000) {
+        t.done();
+      }
+    });
+  }
+}, 'Test sending many messages to workers using ports.');
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-multi-port.html b/test/fixtures/wpt/workers/Worker-multi-port.html
new file mode 100644
index 000000000000..587176e9fc10
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-multi-port.html
@@ -0,0 +1,86 @@
+<!DOCTYPE html>
+<title>Test sending multiple ports through Worker.postMessage.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(function(t) {
+  var worker = new Worker("support/Worker-thread-multi-port.js");
+  worker.onmessage = t.step_func_done(function(evt) {
+    assert_true(evt.data.startsWith('PASS'));
+  });
+  worker.postMessage("noport");
+}, 'Test postMessage with no port.');
+
+async_test(function(t) {
+  var worker = new Worker("support/Worker-thread-multi-port.js");
+  worker.onmessage = t.step_func_done(function(evt) {
+    assert_true(evt.data.startsWith('PASS'));
+  });
+  worker.postMessage("noargs");
+}, 'Test postMessage with no arguments.');
+
+async_test(function(t) {
+  var worker = new Worker("support/Worker-thread-multi-port.js");
+  worker.onmessage = t.step_func_done(function(evt) {
+    assert_true(evt.data.startsWith('PASS'));
+  });
+  worker.postMessage("zero ports", []);
+}, 'Test postMessage with no ports and empty array.');
+
+async_test(function(t) {
+  var worker = new Worker("support/Worker-thread-multi-port.js");
+  var channel = new MessageChannel();
+  worker.onmessage = t.step_func_done(function(evt) {
+    assert_true(evt.data.startsWith('PASS'));
+  });
+  worker.postMessage("two ports", [channel.port1, channel.port2]);
+}, 'Test postMessage with two ports.');
+
+test(() => {
+  var worker = new Worker("support/Worker-thread-multi-port.js");
+  assert_throws_js(TypeError,
+                   function() { worker.postMessage(); },
+                   'Empty postMessage should throw exception.');
+}, 'Test empty postMessage throws exception.');
+
+test(() => {
+  var worker = new Worker("support/Worker-thread-multi-port.js");
+  var channel = new MessageChannel();
+  assert_throws_js(TypeError,
+                   function() { worker.postMessage("null port",
+                                                   [channel.port1, null,
+                                                    channel.port2]); },
+                   'postMessage with null ports should throw exception.');
+}, 'Test postMessage with null ports throws exception.');
+
+test(() => {
+  var worker = new Worker("support/Worker-thread-multi-port.js")
+  var channel = new MessageChannel();
+  assert_throws_dom('DataCloneError',
+                    function() { worker.postMessage("notAPort",
+                                                    [channel.port1, {},
+                                                     channel.port2]); },
+                    'postMessage with incorrect ports should throw exception.');
+}, 'Test postMessage with incorrect ports throws exception');
+
+test(() => {
+  var worker = new Worker("support/Worker-thread-multi-port.js");
+  assert_throws_dom('DataCloneError',
+                    function() { worker.postMessage("notASequence", [{length: 3}]) },
+                    'postMessage without sequence should throw exception.');
+}, 'Test postMessage without sequence throws exception');
+
+async_test(function(t) {
+  var worker = new Worker("support/Worker-thread-multi-port.js");
+  var channel = new MessageChannel();
+  assert_throws_dom('DataCloneError',
+                    function() { worker.postMessage("notAPort",
+                                                    [channel.port1, {},
+                                                     channel.port2]); },
+                    'postMessage with incorrect ports should throw exception.');
+  worker.onmessage = t.step_func_done(function(evt) {
+    assert_true(evt.data.startsWith('PASS'));
+  });
+  worker.postMessage("failed ports", [channel.port1, channel.port2]);
+}, 'Test postMessage on channel with previous failed postMessage calls.');
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-nested-importScripts-error.html b/test/fixtures/wpt/workers/Worker-nested-importScripts-error.html
new file mode 100644
index 000000000000..bd96c835df92
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-nested-importScripts-error.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<title>This tests that errors from nested importScripts have the expected provenance.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(t => {
+  let worker;
+
+  return new Promise((resolve) => {
+    worker = new Worker("support/importScripts-1.js");
+    worker.onerror = resolve;
+  }).then(e => {
+    assert_equals(e.type, "error");
+    assert_true(e.filename.indexOf('invalidScript.js') >= 0);
+    e.preventDefault();
+  });
+}, 'Tests that errors from the import scripts come from the expected file.')
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-postMessage-happens-in-parallel.https.html b/test/fixtures/wpt/workers/Worker-postMessage-happens-in-parallel.https.html
new file mode 100644
index 000000000000..3b8683f79dcd
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-postMessage-happens-in-parallel.https.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title>Test that calling "worker.postMessage()" will occur truly in parallel to the main JS thread performing other computation.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(t => {
+  return new Promise(resolve => {
+    let worker = new Worker("support/Worker-postMessage-happens-in-parallel.js");
+    worker.postMessage('init');
+    worker.onmessage = () => {
+      let sab = new Uint8Array(new SharedArrayBuffer(16));
+      worker.postMessage(sab);
+      let end = performance.now() + 30*1000;
+      while(sab[0] != 1 && performance.now() < end) /*wait to join with the result*/;
+      assert_true(sab[0] == 1);
+      resolve();
+    };
+  });
+}, 'Tests that calling "worker.postMessage()" will occur truly in parallel to the main JS thread');
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-postMessage-happens-in-parallel.https.html.headers b/test/fixtures/wpt/workers/Worker-postMessage-happens-in-parallel.https.html.headers
new file mode 100644
index 000000000000..4b06ac7cc63e
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-postMessage-happens-in-parallel.https.html.headers
@@ -0,0 +1,2 @@
+Cross-Origin-Opener-Policy:same-origin
+Cross-Origin-Embedder-Policy:require-corp
diff --git a/test/fixtures/wpt/workers/Worker-replace-event-handler.any.js b/test/fixtures/wpt/workers/Worker-replace-event-handler.any.js
new file mode 100644
index 000000000000..ff7c764f2bdd
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-replace-event-handler.any.js
@@ -0,0 +1,11 @@
+// META: global=worker
+// This is a regression test for a crash bug in Chrome: http://crbug.com/239669
+function update() {
+  onmessage = undefined;
+}
+
+test(() => {
+  for (var i = 0; i < 8; ++i) {
+    update();
+  }
+}, "Tests that repeatedly setting 'onmessage' within a worker doesn't crash.");
diff --git a/test/fixtures/wpt/workers/Worker-replace-global-constructor.any.js b/test/fixtures/wpt/workers/Worker-replace-global-constructor.any.js
new file mode 100644
index 000000000000..d724c6c8ec6d
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-replace-global-constructor.any.js
@@ -0,0 +1,9 @@
+// META: global=worker
+test(() => {
+  try {
+    self.MessageEvent = 'PASS';
+    assert_equals(self.MessageEvent, 'PASS');
+  } catch (ex) {
+    assert_unreached("FAIL: unexpected exception (" + ex + ") received while replacing global constructor MessageEvent.");
+  }
+}, 'Test replacing global constructors in a worker context.');
diff --git a/test/fixtures/wpt/workers/Worker-replace-self.any.js b/test/fixtures/wpt/workers/Worker-replace-self.any.js
new file mode 100644
index 000000000000..513fd4a257f4
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-replace-self.any.js
@@ -0,0 +1,9 @@
+// META: global=worker
+test(() => {
+  try {
+    self = 'PASS';
+    assert_true(self instanceof WorkerGlobalScope);
+  } catch (ex) {
+    assert_unreached("FAIL: unexpected exception (" + ex + ") received while replacing self.");
+  }
+}, 'Test that self is not replaceable.');
diff --git a/test/fixtures/wpt/workers/Worker-simultaneous-errors.html b/test/fixtures/wpt/workers/Worker-simultaneous-errors.html
new file mode 100644
index 000000000000..4339f2e33436
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-simultaneous-errors.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<title>Test simultaneous errors on workers.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(t => {
+    var workers = 4;
+    var promises = [];
+
+    for (i = 0; i < workers; ++i) {
+        var worker = new Worker('support/throw-on-message-Worker.js');
+        promises.push(new Promise(function(resolve, reject) {
+            var error = 0;
+            worker.onmessage = function(event) {
+                if (event.data === 'second')
+                    resolve(error);
+                else if (event.data === 'error')
+                    ++error;
+            }
+        }));
+        worker.postMessage('first');
+        worker.postMessage('second');
+    }
+
+    return Promise.all(promises).then(e => {
+        var sum = 0;
+        for (var key in e) {
+            sum += e[key]
+        }
+        assert_equals(sum, workers);
+    });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-structure-message.html b/test/fixtures/wpt/workers/Worker-structure-message.html
new file mode 100644
index 000000000000..9eb12dc6c55b
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-structure-message.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<title>Test that pages and workers can send Structure Message to one another.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(t => {
+  let worker;
+
+  return new Promise(resolve => {
+    worker = new Worker("support/Worker-structure-message.js");
+    worker.onmessage = resolve;
+    worker.postMessage({
+      operation: 'find-edges',
+      input: new ArrayBuffer(20),
+      threshold: 0.6
+    });
+  }).then(evt => {
+    assert_false(evt.data.startsWith('FAIL'));
+    return new Promise(resolve => worker.onmessage = resolve);
+  }).then(evt => {
+    assert_equals(evt.data.operation, 'find-edges');
+    assert_true(ArrayBuffer.prototype.isPrototypeOf(evt.data.input));
+    assert_equals(evt.data.input.byteLength, 20);
+    assert_equals(evt.data.threshold, 0.6);
+  });
+}, 'Tests sending structure message to/from worker.');
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-terminate-forever-during-evaluation.html b/test/fixtures/wpt/workers/Worker-terminate-forever-during-evaluation.html
new file mode 100644
index 000000000000..ab66f29289f2
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-terminate-forever-during-evaluation.html
@@ -0,0 +1,69 @@
+<!DOCTYPE html>
+<title>Test Worker.terminate() for a worker that tries to run forever after top-level script evaluation is started.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+// The tests here are to provide execution coverage for the code paths for
+// forcible worker termination.
+// Expectation here is:
+// - Not to crash, not to cause assertion failures
+// - No WorkerGlobalScope error events and thus Worker error events are fired
+//   (#report-the-exception is not called when a script is terminated during
+//   #run-a-classic-script/#run-a-module-script according to the spec)
+// - Nothing after infinte loop, promise resolusion/rejection etc. occurs.
+
+for (const test of [
+  {
+    url: 'support/Worker-run-forever.js',
+    description: 'Worker is terminated during top-level script evaluation'
+  },
+  {
+    url: 'support/Worker-run-forever.js',
+    options: {type: 'module'},
+    description: 'Worker is terminated during top-level script evaluation (module)'
+  },
+  {
+    url: 'support/Worker-run-forever-during-importScripts.js',
+    description: 'Worker is terminated during importScripts() call'
+  },
+  {
+    url: 'support/Worker-run-forever-during-nested-importScripts.js',
+    description: 'Worker is terminated during nested importScripts() call'
+  },
+  {
+    url: 'support/Worker-run-forever-during-dynamic-import.js',
+    description: 'Worker is terminated during dynamic import()'
+  },
+  {
+    url: 'support/Worker-run-forever-during-dynamic-import.js',
+    options: {type: 'module'},
+    description: 'Worker is terminated during dynamic import() (module)'
+  },
+  {
+    url: 'support/Worker-run-forever-during-top-level-await.js',
+    options: {type: 'module'},
+    description: 'Worker is terminated during top-level await'
+  }
+]) {
+  async_test((t) => {
+    const worker = new Worker(test.url, test.options);
+    worker.onerror = t.step_func(e => {
+      // Calls preventDefault() to prevent this event from being considered
+      // as an uncaught exception.
+      e.preventDefault();
+      assert_unreached('onerror');
+    });
+    worker.onmessage = t.step_func((e) => {
+      if (e.data === 'start') {
+        worker.terminate();
+        // To make the worker forcibly terminated, because in Chromium worker is
+        // forcibly terminated after 2 seconds.
+        t.step_timeout(function() { t.done(); }, 4000);
+      }
+      else {
+        assert_unreached('Unexpected message received: ' + e.data);
+      }
+    });
+  }, test.description);
+}
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-terminate-forever.html b/test/fixtures/wpt/workers/Worker-terminate-forever.html
new file mode 100644
index 000000000000..3528bb6246dd
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-terminate-forever.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<title>Test Worker.terminate() for a worker that tries to run forever.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test((t) => {
+  var worker = new Worker('support/Worker-run-forever.js');
+  worker.terminate();
+  t.step_timeout(function() { t.done(); }, 500);
+}, 'Tests terminating a worker that is trying to run forever.');
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-termination-with-port-messages.html b/test/fixtures/wpt/workers/Worker-termination-with-port-messages.html
new file mode 100644
index 000000000000..bc19784adae8
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-termination-with-port-messages.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<title>This test terminates a worker when there are many undelivered MessagePort messages still waiting to be dispatched into the Worker Context. This causes termination of JS execution and test should not try to dispatch the remaining messages. Test succeeds if it does not hang or crash (if worker thread is running in the separate process, that process could hang or crash).</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(function(t) {
+    var worker = new Worker("support/Worker-termination-with-port-messages.js");
+    var channel = new MessageChannel();
+
+    channel.port2.onmessage = function(evt)
+    {
+        // On first message back from worker, terminate it.
+        worker.terminate();
+        t.done();
+    }
+    channel.port2.start();
+
+    worker.postMessage("", [channel.port1]);
+    for (i = 0; i < 1000; i++)
+        channel.port2.postMessage("message to worker");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-timeout-cancel-order.html b/test/fixtures/wpt/workers/Worker-timeout-cancel-order.html
new file mode 100644
index 000000000000..78d930df783b
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-timeout-cancel-order.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<title>Test setTimeOut,cancelTimeout in Web Workers.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(t => {
+  let worker
+
+  return new Promise(resolve => {
+    worker = new Worker('support/Worker-timeout-cancel-order.js');
+    worker.postMessage('start');
+    worker.onmessage = resolve;
+  }).then(evt => {
+    assert_equals(evt.data, 2, 'Timeout not canceled');
+  });
+}, 'Tests setting and canceling timeout in workers.');
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-timeout-decreasing-order.html b/test/fixtures/wpt/workers/Worker-timeout-decreasing-order.html
new file mode 100644
index 000000000000..f459461ec061
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-timeout-decreasing-order.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<title>Test setTimeOut,fired in decreasing order in Web Workers.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test (t => {
+  let worker;
+
+  return new Promise(resolve => {
+    worker = new Worker('support/Worker-timeout-decreasing-order.js');
+    worker.postMessage('start');
+    worker.onmessage = resolve;
+  }).then(evt => {
+    assert_equals(evt.data, 1);
+    return (new Promise(resolve => worker.onmessage = resolve));
+  }).then(evt => {
+    assert_equals(evt.data, 2);
+    return (new Promise(resolve => worker.onmessage = resolve));
+  }).then(evt => {
+    assert_equals(evt.data, 3);
+  });
+}, 'Tests timeouts on the worker are fired in decreasing order.');
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-timeout-increasing-order.html b/test/fixtures/wpt/workers/Worker-timeout-increasing-order.html
new file mode 100644
index 000000000000..34b029466bb2
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-timeout-increasing-order.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<title>Test setTimeOut,fired in increasing order in Web Workers.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test (t => {
+  let worker;
+
+  return new Promise(resolve => {
+    worker = new Worker('support/Worker-timeout-increasing-order.js');
+    worker.postMessage('start');
+    worker.onmessage = resolve;
+  }).then(evt => {
+    assert_equals(evt.data, 1);
+    return (new Promise(resolve => worker.onmessage = resolve));
+  }).then(evt => {
+    assert_equals(evt.data, 2);
+    return (new Promise(resolve => worker.onmessage = resolve));
+  }).then(evt => {
+    assert_equals(evt.data, 3);
+  });
+}, 'Tests timeouts on the worker are fired in increasing order.');
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope-close.html b/test/fixtures/wpt/workers/WorkerGlobalScope-close.html
new file mode 100644
index 000000000000..08ab1ca515c6
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope-close.html
@@ -0,0 +1,81 @@
+<!DOCTYPE html>
+<title>Test WorkerGlobalScope.close functionality.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var worker = new Worker('support/WorkerGlobalScope-close.js');
+  worker.postMessage("typeofClose");
+    worker.onmessage = t.step_func_done(function(evt) {
+    assert_equals(evt.data, "typeof close: function");
+    });
+}, 'Test type of close function.');
+
+async_test(function(t) {
+  var worker = new Worker('support/WorkerGlobalScope-close.js');
+  worker.postMessage("ping");
+  worker.onmessage = t.step_func(function(evt) {
+    assert_equals(evt.data, "pong");
+    // Tell the worker to close, then send a followup message.
+    worker.postMessage("close");
+
+    // The worker may or may not be closing/closed by this call. If it is, the
+    // message won't be enqueued on the worker's event loop. If it isn't, the
+    // message will be enqueued but shouldn't be handled by the worker because
+    // the prior postMessage will cause the worker to close. In either case,
+    // the worker shouldn't postMessage back "pong".
+    //
+    // This also means that at this point we can't confidently test
+    // postMessage-ing a worker that will close nor a worker that is already
+    // closing/closed.
+    worker.postMessage("ping");
+
+    worker.onmessage = t.step_func(function(evt) {
+      assert_not_equals(evt.data, "pong");
+
+      // The worker should definitely be closed by now, so we can confidently
+      // test postMessage-ing a closed worker. This postMessage shouldn't throw
+      // or cause the worker to postMessage back "pong" (it shouldn't receive
+      // any events after closing).
+      worker.postMessage("ping");
+
+      t.step_timeout(function() { t.done(); }, 500);
+    });
+  });
+}, 'Test sending a message after closing.');
+
+async_test(function(t) {
+  var worker = new Worker('support/WorkerGlobalScope-close.js');
+  worker.postMessage("closeWithError");
+  worker.onerror = function(event) {
+    t.done()
+  };
+}, 'Test errors are delivered after close.');
+
+async_test(function(t) {
+  var worker = new Worker('support/WorkerGlobalScope-close.js');
+  worker.postMessage("closeWithPendingEvents");
+  worker.onmessage = t.step_func(function(evt) {
+    assert_unreached("Pending events should not fire: " + evt.data);
+  });
+  worker.onerror = t.step_func(function(evt) {
+    assert_unreached("Pending events should not fire:" + evt.message);
+  });
+  t.step_timeout(function() { t.done(); }, 500);
+}, 'Test workers do not deliver pending events.');
+
+async_test(function(t) {
+  var worker = new Worker('support/WorkerGlobalScope-close.js');
+  worker.postMessage("close");
+  worker.onmessage = function(evt) {
+    assert_equals(evt.data, "Should be delivered");
+    // Give worker a chance to close first, then terminate it.
+    t.step_timeout(function() {
+      worker.terminate();
+      t.done();
+    }, 500);
+  };
+}, 'Test terminating a worker after close.');
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_colno.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_colno.htm
new file mode 100644
index 000000000000..793d6c1807b2
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_colno.htm
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<title> WorkerGlobalScope onerror event handler argument: col </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(typeof e.data.colno, "number");
+  });
+  worker.postMessage("Error Message");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_filename.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_filename.htm
new file mode 100644
index 000000000000..e165a23f418e
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_filename.htm
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title> WorkerGlobalScope onerror event handler argument: location </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    var href = location.href;
+    var expected = href.substring(0, href.lastIndexOf('/')) + '/support/ErrorEvent.js';
+    assert_equals(e.data.filename, expected);
+  });
+  worker.postMessage("Error Message");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_lineno.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_lineno.htm
new file mode 100644
index 000000000000..dfbc51467da5
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_lineno.htm
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<title> WorkerGlobalScope onerror event handler argument: line </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.lineno, 3);
+  });
+  worker.postMessage("Error Message");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_message.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_message.htm
new file mode 100644
index 000000000000..27d4dda5114c
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_message.htm
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title> WorkerGlobalScope onerror event handler argument: message </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var message = 'Error Message';
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_greater_than(e.data.message.indexOf(message), -1);
+  });
+  worker.onerror = e => e.preventDefault();
+  worker.postMessage(message);
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts.htm
new file mode 100644
index 000000000000..1a3616df98bc
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts.htm
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<title> WorkerGlobalScope API: importScripts() </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/ImportScripts.js");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data, "Pass");
+  });
+  worker.postMessage("ping");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts_NetworkErr.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts_NetworkErr.htm
new file mode 100644
index 000000000000..36fe6e0b2d3a
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts_NetworkErr.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> importScripts() with non-existent script file </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/ImportScriptsNetworkErr.js");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data, "Pass");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts_NosniffErr.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts_NosniffErr.htm
new file mode 100644
index 000000000000..d99cecdc6a51
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts_NosniffErr.htm
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<title> importScripts() with nosniff X-Content-Type-Options </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+fetch_tests_from_worker(new Worker('./support/ImportScriptsNosniffErr.js'));
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_requestAnimationFrame.worker.js b/test/fixtures/wpt/workers/WorkerGlobalScope_requestAnimationFrame.worker.js
new file mode 100644
index 000000000000..e1b0b9f15a69
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_requestAnimationFrame.worker.js
@@ -0,0 +1,19 @@
+importScripts("/resources/testharness.js");
+
+async_test(t => {
+  const res = [];
+  requestAnimationFrame(t.step_func(dt => {
+    res.push(dt);
+    requestAnimationFrame(t.step_func(dt => {
+      res.push(dt);
+      requestAnimationFrame(t.step_func_done(dt => {
+        res.push(dt);
+        assert_equals(res.length, 3);
+        assert_less_than(res[0], res[1]);
+        assert_less_than(res[1], res[2]);
+      }));
+    }));
+  }));
+});
+
+done();
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_setInterval.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_setInterval.htm
new file mode 100644
index 000000000000..4e147fbf60f1
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_setInterval.htm
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title> WorkerGlobalScope API: setInterval() </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var result = [];
+  var worker = new Worker('./support/Timer.js');
+  worker.onmessage = t.step_func(function(e) {
+    result.push(e.data);
+    if (result.length == 3) {
+      assert_array_equals(result, ["hello", "worker", "worker"]);
+      worker.onmessage = t.unreached_func('Unexpected message event');
+      setTimeout(t.step_func_done(), 100);
+    }
+  });
+  worker.postMessage("IntervalHandler");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_setTimeout.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_setTimeout.htm
new file mode 100644
index 000000000000..89fdf3d740a8
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_setTimeout.htm
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title> WorkerGlobalScope API: setTimeout() </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var result = [];
+  var worker = new Worker('./support/Timer.js');
+  worker.onmessage = t.step_func(function(e) {
+    result.push(e.data);
+    if (result.length == 3) {
+      assert_array_equals(result, ["hello", "worker", "worker"]);
+      worker.onmessage = t.unreached_func('Unexpected message event');
+      setTimeout(t.step_func_done(), 100);
+    }
+  });
+  worker.postMessage("TimeoutHandler");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation-origin.sub.window.js b/test/fixtures/wpt/workers/WorkerLocation-origin.sub.window.js
new file mode 100644
index 000000000000..7e808105dd79
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation-origin.sub.window.js
@@ -0,0 +1,11 @@
+async_test(t => {
+  const frame = document.createElement("iframe"),
+        asciiOrigin = location.protocol + "//{{domains[天気の良い日]}}:" + location.port,
+        path = new URL("support/WorkerLocation-origin.html", location).pathname;
+  frame.src = asciiOrigin + path;
+  self.onmessage = t.step_func_done(e => {
+    assert_equals(e.data.origin, asciiOrigin);
+  });
+  document.body.appendChild(frame);
+  t.add_cleanup(() => frame.remove());
+}, "workerLocation.origin must use ASCII code points");
diff --git a/test/fixtures/wpt/workers/WorkerLocation.htm b/test/fixtures/wpt/workers/WorkerLocation.htm
new file mode 100644
index 000000000000..a74f13a8b48b
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation.htm
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<title> WorkerLocation object </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    var href = window.location.href;
+    var ExpectedResult = href.substring(0, href.lastIndexOf('/')) + '/support/WorkerLocation.js';
+    assert_equals(e.data.location, ExpectedResult);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_hash.htm b/test/fixtures/wpt/workers/WorkerLocation_hash.htm
new file mode 100644
index 000000000000..74a424efc3c4
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_hash.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation URL decomposition IDL attribute: hash </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerLocation.js#HashString");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.hash, "#HashString");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_hash_encoding.htm b/test/fixtures/wpt/workers/WorkerLocation_hash_encoding.htm
new file mode 100644
index 000000000000..b2a171a092a6
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_hash_encoding.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation.hash with url encoding string </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerLocation.js#question%3f");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.hash, "#question%3f");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_hash_nonexist.htm b/test/fixtures/wpt/workers/WorkerLocation_hash_nonexist.htm
new file mode 100644
index 000000000000..2d898c075c38
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_hash_nonexist.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation.hash with no &lt;fragment&gt; component </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.hash, "");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_host.htm b/test/fixtures/wpt/workers/WorkerLocation_host.htm
new file mode 100644
index 000000000000..53286ddfc539
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_host.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation URL decomposition IDL attribute: host </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.host, location.host);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_hostname.htm b/test/fixtures/wpt/workers/WorkerLocation_hostname.htm
new file mode 100644
index 000000000000..97250805c9f8
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_hostname.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation URL decomposition IDL attribute: hostname </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.hostname, location.hostname);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_href.htm b/test/fixtures/wpt/workers/WorkerLocation_href.htm
new file mode 100644
index 000000000000..3ed1dbd4f519
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_href.htm
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<title> WorkerLocation href attribute </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerLocation.js?srch%20#hash");
+  worker.onmessage = t.step_func_done(function(e) {
+    var href = location.href;
+    var expected = href.substring(0, href.lastIndexOf('/')) + "/support/WorkerLocation.js?srch%20#hash";
+    assert_equals(e.data.href, expected);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_pathname.htm b/test/fixtures/wpt/workers/WorkerLocation_pathname.htm
new file mode 100644
index 000000000000..346984511553
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_pathname.htm
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<title> WorkerLocation URL decomposition IDL attribute: pathname </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    var pathname = location.pathname;
+    var expected = pathname.substring(0, pathname.lastIndexOf('/')) + '/support/WorkerLocation.js';
+    assert_equals(e.data.pathname, expected);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_port.htm b/test/fixtures/wpt/workers/WorkerLocation_port.htm
new file mode 100644
index 000000000000..ef86cfacb615
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_port.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation URL decomposition IDL attribute: port </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.port, location.port);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_protocol.htm b/test/fixtures/wpt/workers/WorkerLocation_protocol.htm
new file mode 100644
index 000000000000..f792dee51568
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_protocol.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation URL decomposition IDL attribute: protocol </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.protocol, location.protocol);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_search.htm b/test/fixtures/wpt/workers/WorkerLocation_search.htm
new file mode 100644
index 000000000000..bc6add8768ae
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_search.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation URL decomposition IDL attribute: search </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js?SearchString');
+  worker.onmessage = t.step_func_done(function(e) {
+      assert_equals(e.data.search, '?SearchString');
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_search_empty.htm b/test/fixtures/wpt/workers/WorkerLocation_search_empty.htm
new file mode 100644
index 000000000000..a32d4309128d
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_search_empty.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation.search with empty &lt;query&gt; </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerLocation.js?");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.search, "");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_search_fragment.htm b/test/fixtures/wpt/workers/WorkerLocation_search_fragment.htm
new file mode 100644
index 000000000000..3ec4cffa6b5d
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_search_fragment.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation.search with &lt;fragment&gt; in &lt;query&gt; </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js?test#');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.search, "?test");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_search_nonexist.htm b/test/fixtures/wpt/workers/WorkerLocation_search_nonexist.htm
new file mode 100644
index 000000000000..9907e6473c2d
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_search_nonexist.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation.search  with no &lt;query&gt; component </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.search, "");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerNavigator-hardware-concurrency.any.js b/test/fixtures/wpt/workers/WorkerNavigator-hardware-concurrency.any.js
new file mode 100644
index 000000000000..49db7503ffb1
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator-hardware-concurrency.any.js
@@ -0,0 +1,4 @@
+// META: global=worker
+test(() => {
+  assert_true(navigator.hardwareConcurrency > 0);
+}, 'Test worker navigator hardware concurrency.');
diff --git a/test/fixtures/wpt/workers/WorkerNavigator.any.js b/test/fixtures/wpt/workers/WorkerNavigator.any.js
new file mode 100644
index 000000000000..a9542af79aa3
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator.any.js
@@ -0,0 +1,12 @@
+// META: global=worker
+test(() => {
+  assert_equals(typeof navigator, "object");
+  assert_true(navigator instanceof WorkerNavigator);
+  assert_equals(navigator.appName, "Netscape");
+  assert_true(navigator.appVersion.indexOf('WebKit') != 0);
+  assert_equals(typeof navigator.platform, "string");
+  assert_true(navigator.userAgent.indexOf('WebKit') != 0);
+  assert_equals(typeof navigator.onLine, "boolean");
+  assert_equals(navigator.appCodeName, 'Mozilla');
+  assert_equals(navigator.product, 'Gecko');
+}, "Testing Navigator properties on workers.");
diff --git a/test/fixtures/wpt/workers/WorkerNavigator_appName.htm b/test/fixtures/wpt/workers/WorkerNavigator_appName.htm
new file mode 100644
index 000000000000..832c46ff5e21
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator_appName.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerNavigator appName </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerNavigator.js");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.appName, navigator.appName);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerNavigator_appVersion.htm b/test/fixtures/wpt/workers/WorkerNavigator_appVersion.htm
new file mode 100644
index 000000000000..7deaa4256af2
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator_appVersion.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerNavigator appVersion </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerNavigator.js");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.appVersion, navigator.appVersion);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerNavigator_onLine.htm b/test/fixtures/wpt/workers/WorkerNavigator_onLine.htm
new file mode 100644
index 000000000000..f9e819b8aaba
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator_onLine.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerNavigator.onLine </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerNavigator.js");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.onLine, navigator.onLine);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerNavigator_platform.htm b/test/fixtures/wpt/workers/WorkerNavigator_platform.htm
new file mode 100644
index 000000000000..3a6de80eb96d
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator_platform.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerNavigator.platform </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerNavigator.js");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.platform, navigator.platform);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerNavigator_userAgent.htm b/test/fixtures/wpt/workers/WorkerNavigator_userAgent.htm
new file mode 100644
index 000000000000..8a34fb480ac5
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator_userAgent.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerNavigator.userAgent </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerNavigator.js");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.userAgent, navigator.userAgent);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerNavigator_userAgentData.http.html b/test/fixtures/wpt/workers/WorkerNavigator_userAgentData.http.html
new file mode 100644
index 000000000000..4e8ca34eebcc
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator_userAgentData.http.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<title> WorkerNavigator.userAgentData </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+  promise_test(async () => {
+    const e = await new Promise((resolve, reject) => {
+      const worker = new Worker("./support/WorkerNavigator.js");
+      worker.onmessage = resolve;
+    });
+
+    assert_equals(e.data.brands, undefined);
+    assert_equals(e.data.mobile, undefined);
+    assert_equals(e.data.getHighEntropyValues, undefined);
+  }, "Test that userAgentData is not available in workers in non-secure contexts");
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerNavigator_userAgentData.https.html b/test/fixtures/wpt/workers/WorkerNavigator_userAgentData.https.html
new file mode 100644
index 000000000000..8ca73df3e8cd
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator_userAgentData.https.html
@@ -0,0 +1,65 @@
+<!DOCTYPE html>
+<title> WorkerNavigator.userAgentData </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+  promise_test(async () => {
+    const e = await new Promise((resolve, reject) => {
+      const worker = new Worker("./support/WorkerNavigator.js");
+      worker.onmessage = resolve;
+    });
+
+    assert_equals(e.data.brands.length, navigator.userAgentData.brands.length);
+    for (let i = 0; i < e.data.brands.length; ++i) {
+      const workerUA = e.data.brands[i];
+      const windowUA = navigator.userAgentData.brands[i];
+      assert_equals(workerUA.brand, windowUA.brand);
+      assert_equals(workerUA.version, windowUA.version);
+    }
+    assert_equals(e.data.mobile, navigator.userAgentData.mobile);
+    assert_equals(e.data.platform, navigator.userAgentData.platform);
+    const highEntropyValues = await navigator.userAgentData.getHighEntropyValues([
+      "architecture", "bitness", "fullVersionList", "model",
+      "platformVersion", "uaFullVersion", "wow64", "formFactors",
+    ]);
+
+    assert_equals(e.data.fullVersionList.length,
+                  highEntropyValues.fullVersionList.length);
+    for (let i = 0; i < e.data.fullVersionList.length; ++i) {
+      const workerFV = e.data.fullVersionList[i];
+      const windowFV = highEntropyValues.fullVersionList[i];
+      assert_equals(workerFV.brand, windowFV.brand);
+      assert_equals(workerFV.version, windowFV.version);
+    }
+
+    assert_equals(e.data.architecture, highEntropyValues.architecture);
+    assert_equals(e.data.bitness, highEntropyValues.bitness);
+    assert_equals(e.data.model, highEntropyValues.model);
+    assert_equals(e.data.platformVersion, highEntropyValues.platformVersion);
+    assert_equals(e.data.uaFullVersion, highEntropyValues.uaFullVersion);
+    assert_equals(e.data.wow64, highEntropyValues.wow64);
+    assert_equals(e.data.formFactors.join(','), highEntropyValues.formFactors.join(','));
+    assert_equals(e.data.NavigatorUADataExposed, true);
+
+    // Architecture should be one of two permitted values.
+    assert_true(["x86", "arm"].some(arch => arch == e.data.architecture))
+  }, "Test that userAgentData is available in workers in secure contexts");
+
+  promise_test(async () => {
+    const e = await new Promise((resolve) => {
+      const worker = new Worker("./support/WorkerNavigator.js");
+      worker.onmessage = resolve;
+    });
+    const highEntropyValues = await navigator.userAgentData.getHighEntropyValues([
+      "platformVersion", "wow64"
+    ]);
+
+    if (["Fuchsia", "Linux"].includes(navigator.userAgentData.platform)) {
+      assert_true(e.data.platformVersion === "");
+      assert_equals(e.data.wow64, false);
+      assert_true(highEntropyValues.platformVersion === "");
+      assert_equals(highEntropyValues.wow64, false);
+    }
+  }, "Platform version and wow64-ness on Linux and Fuchsia should contain fixed values");
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerPerformanceNow.html b/test/fixtures/wpt/workers/WorkerPerformanceNow.html
new file mode 100644
index 000000000000..286832fd9471
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerPerformanceNow.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>performance.now in dedicated workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+</head>
+<body>
+<script>
+async_test(function(t) {
+  const worker = new Worker('support/WorkerSendingPerformanceNow.js');
+  worker.onmessage = t.step_func_done(event => {
+    const results = event.data;
+    assert_equals(results.length, 4);
+    assert_equals(results[0], 'undefined',
+      'workerStart not defined on the Worker object');
+    assert_equals(results[1], 'object', "self.performance is defined");
+    assert_equals(results[2], 'function', "self.performance.now is defined");
+    assert_greater_than(results[3], 0, "Time in the worker should be positive");
+    assert_greater_than(window.performance.now(), results[3], "Time in the worker should be before the current time in the main document");
+  });
+  worker.postMessage('');
+}, 'performance.now() exists in dedicated workers and reports reasonable times');
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/workers/Worker_ErrorEvent_bubbles_cancelable.htm b/test/fixtures/wpt/workers/Worker_ErrorEvent_bubbles_cancelable.htm
new file mode 100644
index 000000000000..4619ee7b5312
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_ErrorEvent_bubbles_cancelable.htm
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Web Workers: Worker ErrorEvent - bubbles, cancelable</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onerror = t.step_func_done(function(e) {
+    assert_false(e.bubbles, "onerror on worker doesn't bubble");
+    assert_true(e.cancelable, "onerror on worker is cancelable");
+  });
+  worker.postMessage("Error Message");
+}, "ErrorEvent on worker doesn't bubble and is cancelable");
+
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_ErrorEvent_error.htm b/test/fixtures/wpt/workers/Worker_ErrorEvent_error.htm
new file mode 100644
index 000000000000..bb7cea12e040
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_ErrorEvent_error.htm
@@ -0,0 +1,32 @@
+<!doctype html>
+<meta charset=utf-8>
+<title></title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+var t1 = async_test("Error handler outside the worker should not see the error value");
+var t2 = async_test("Error handlers inside a worker should see the error value");
+
+test(function() {
+  var worker = new Worker("support/ErrorEvent-error.js");
+  worker.onerror = t1.step_func_done(function(e) {
+    assert_true(/hello/.test(e.message));
+    assert_equals(e.error, null);
+  });
+
+  var messages = 0;
+  worker.onmessage = t2.step_func(function(e) {
+    ++messages;
+    var data = e.data;
+    assert_in_array(data.source, ["onerror", "event listener"]);
+    assert_equals(data.value, "hello");
+    if (messages == 2) {
+      t2.done();
+    }
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_ErrorEvent_filename.htm b/test/fixtures/wpt/workers/Worker_ErrorEvent_filename.htm
new file mode 100644
index 000000000000..0faef6fea2a8
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_ErrorEvent_filename.htm
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title> AbstractWorker ErrorEvent.filename </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onerror = t.step_func_done(function(e) {
+    var href = location.href;
+    var expected = href.substring(0, href.lastIndexOf('/')) + '/support/ErrorEvent.js';
+    assert_equals(e.filename, expected);
+  });
+  worker.postMessage("Error Message");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_ErrorEvent_lineno.htm b/test/fixtures/wpt/workers/Worker_ErrorEvent_lineno.htm
new file mode 100644
index 000000000000..ad98172960f6
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_ErrorEvent_lineno.htm
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<title> AbstractWorker ErrorEvent.lineno </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onerror = t.step_func_done(function(e) {
+    assert_equals(e.lineno, 3);
+  });
+  worker.postMessage("Error Message");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_ErrorEvent_message.htm b/test/fixtures/wpt/workers/Worker_ErrorEvent_message.htm
new file mode 100644
index 000000000000..5602d9bc02d9
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_ErrorEvent_message.htm
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<title> AbstractWorker ErrorEvent.message </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var message = 'Error Message';
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onerror = t.step_func_done(function(e) {
+    assert_greater_than(e.message.indexOf(message), -1);
+  });
+  worker.postMessage(message);
+});
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_ErrorEvent_type.htm b/test/fixtures/wpt/workers/Worker_ErrorEvent_type.htm
new file mode 100644
index 000000000000..3a0f85ad9b6b
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_ErrorEvent_type.htm
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<title> AbstractWorker ErrorEvent.type </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onerror = t.step_func_done(function(e) {
+    assert_class_string(e, 'ErrorEvent');
+    assert_equals(e.type, 'error');
+  });
+  worker.postMessage("Error Message");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_NosniffErr.htm b/test/fixtures/wpt/workers/Worker_NosniffErr.htm
new file mode 100644
index 000000000000..11d4b7c290ad
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_NosniffErr.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> Worker with nosniff X-Content-Type-Options header </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/nosiniff-error-worker.py");
+  worker.onerror = t.step_func_done(function(e) {
+    assert_equals(e.type, 'error');
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_basic.htm b/test/fixtures/wpt/workers/Worker_basic.htm
new file mode 100644
index 000000000000..d2b57b4918b0
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_basic.htm
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<title> Web Workers Basic Tests </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+function create_worker() {
+  return new Worker('./support/WorkerBasic.js');
+}
+
+test(function() {
+  var worker = create_worker();
+  assert_class_string(worker, "Worker");
+}, "Worker constructor");
+
+async_test(function(t) {
+  var worker = create_worker();
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data, "Pass");
+  });
+  worker.postMessage("start");
+}, "MessageEvent.data");
+
+async_test(function(t) {
+  var worker = create_worker();
+  worker.addEventListener("message", t.step_func_done(function(e) {
+    assert_equals(e.type, "message");
+  }), true);
+  worker.postMessage("start");
+}, "MessageEvent.type");
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_cross_origin_security_err.htm b/test/fixtures/wpt/workers/Worker_cross_origin_security_err.htm
new file mode 100644
index 000000000000..a3e49df79ad4
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_cross_origin_security_err.htm
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<title>Worker cross-origin URL</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+    var w = new Worker("ftp://example.org/support/WorkerBasic.js");
+    w.onerror = t.step_func_done(function(e) {
+      assert_true(e instanceof Event);
+    });
+ }, "Cross-origin classic workers should fail to fetch");
+
+async_test(function(t) {
+    var w = new Worker("ftp://example.org/support/WorkerBasic.js", {type: "module"});
+    w.onerror = t.step_func_done(function(e) {
+      assert_true(e instanceof Event);
+    });
+}, "Cross-origin module workers should fail to fetch");
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_dispatchEvent_ErrorEvent.htm b/test/fixtures/wpt/workers/Worker_dispatchEvent_ErrorEvent.htm
new file mode 100644
index 000000000000..7ba56b89ecf1
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_dispatchEvent_ErrorEvent.htm
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<title> ErrorEvent and Worker.dispatchEvent() </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var event = "error";
+  var filename = './support/ErrorEvent.js';
+  var message = 'Hello Worker';
+  var lineno = 5;
+  var colno = 6;
+  var error = new Error("test");
+  var worker = new Worker(filename);
+  worker.addEventListener(event, t.step_func_done(function(e) {
+    assert_equals(e.type, event, 'type');
+    assert_equals(e.message, message, 'message');
+    assert_equals(e.filename, filename, 'filename');
+    assert_equals(e.lineno, lineno, 'lineno');
+    assert_equals(e.colno, colno, 'colno');
+    assert_equals(e.error, error, 'error');
+  }), true);
+  var e = new ErrorEvent(event, {bubbles:true, cancelable:true, message:message, filename:filename, lineno:lineno, colno:colno, error:error});
+  worker.dispatchEvent(e);
+});
+
+test(function() {
+  var e = new ErrorEvent("error");
+  assert_false("initErrorEvent" in e, "should not be supported");
+}, "initErrorEvent");
+
+test(function() {
+  assert_throws_js(
+    TypeError,
+    () => ErrorEvent(''),
+    "Calling ErrorEvent constructor without 'new' must throw"
+  );
+}, "ErrorEvent constructor called as normal function");
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_script_mimetype.htm b/test/fixtures/wpt/workers/Worker_script_mimetype.htm
new file mode 100644
index 000000000000..d2278d3717c2
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_script_mimetype.htm
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<title>Worker constructor with wrong MIME type scripts</title>
+<meta charset="utf-8">
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<script>
+async_test(t => {
+  const worker = new Worker('./support/WorkerText.txt');
+  worker.onmessage = t.unreached_func("Worker should not receive messages");
+  worker.onerror = () => t.done();
+}, "HTTP(S) URLs which respond with text/plain MIME type must not work");
+
+async_test(t => {
+  const worker = new SharedWorker('./support/WorkerText.txt');
+  worker.onmessage = t.unreached_func("Worker should not receive messages");
+  worker.onerror = () => t.done();
+}, "HTTP(S) URLs which respond with text/plain MIME type must not work on SharedWorkers");
+
+async_test(t => {
+  const url = URL.createObjectURL(new Blob(['postMessage("PASS")'])); // no MIME type parameter
+  const worker = new Worker(url);
+  worker.onmessage = () => t.done();
+  worker.onerror = t.unreached_func("Worker should not error");
+}, "blob: URLs should load, despite no MIME type for the backing Blob");
+
+async_test(t => {
+  const url = URL.createObjectURL(new Blob(['postMessage("PASS")'], { type: 'text/plain' }));
+  const worker = new Worker(url);
+  worker.onmessage = () => t.done();
+  worker.onerror = t.unreached_func("Worker should not error");
+}, "blob: URLs should load, despite the wrong MIME type for the backing Blob");
+
+async_test(t => {
+  const url = `data:text/plain,postMessage("PASS");`
+  const worker = new Worker(url);
+  worker.onmessage = () => t.done();
+  worker.onerror = t.unreached_func("Worker should not error");
+}, "data: URLs should load, despite the wrong MIME type");
+
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_terminate_event_queue.htm b/test/fixtures/wpt/workers/Worker_terminate_event_queue.htm
new file mode 100644
index 000000000000..e4f106ad3a86
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_terminate_event_queue.htm
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<title> AbstractWorker terminate(): clear event queue </title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var testResult;
+  var worker = new Worker('./support/WorkerTerminate.js');
+  worker.onmessage = this.step_func(function(e) {
+    testResult = e.data;
+    if (testResult >= 10000) {
+      worker.terminate();
+      worker.onmessage = this.unreached_func('Unexpected message event');
+      setTimeout(this.step_func_done(function() {
+        assert_equals(testResult, 10000);
+      }), 100);
+    }
+  });
+  worker.postMessage("ping");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/abrupt-completion.html b/test/fixtures/wpt/workers/abrupt-completion.html
new file mode 100644
index 000000000000..6c09ae4419cc
--- /dev/null
+++ b/test/fixtures/wpt/workers/abrupt-completion.html
@@ -0,0 +1,63 @@
+<!doctype html>
+<meta charset=utf-8>
+<title></title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script>
+
+// Tests that a {Dedicated,Shared}Worker keeps running even if its script
+// evaluation results in an abrupt completion. This corresponds to the "run a
+// worker" algorithm disregarding the return value of "run the {classic,module}
+// script" in its step 24:
+//
+// "If script is a classic script, then run the classic script script.
+// Otherwise, it is a module script; run the module script script."
+
+promise_test(async t => {
+  const worker = new Worker("support/abrupt-completion.js");
+
+  await new Promise(resolve => {
+    worker.onerror = e => {
+      assert_not_equals(e.message.search("uncaught-exception"), -1,
+                        "Correct uncaught exception thrown by worker");
+
+      // Suppress the exception.
+      e.preventDefault();
+
+      resolve();
+    }
+  });
+
+  return new Promise(resolve => {
+    const channel = new MessageChannel();
+
+    channel.port1.onmessage = e => {
+      assert_equals(e.data, "handler-before-throw", "Correct message handler.");
+      resolve();
+    };
+
+    worker.postMessage("", [channel.port2]);
+  });
+}, "DedicatedWorker should correctly handle abrupt completion");
+
+promise_test(async t => {
+  const worker = new SharedWorker("support/abrupt-completion.js");
+
+  // Per spec, runtime errors in shared workers do not propagate to
+  // SharedWorker.onerror (only parse errors do).
+  worker.onerror = t.unreached_func(
+      'onerror should not fire for runtime errors in shared workers');
+
+  return new Promise(resolve => {
+    const channel = new MessageChannel();
+
+    channel.port1.onmessage = e => {
+      assert_equals(e.data, "handler-before-throw", "Correct message handler.");
+      resolve();
+    };
+
+    worker.port.postMessage("", [channel.port2]);
+  });
+}, "SharedWorker should correctly handle abrupt completion");
+
+</script>
diff --git a/test/fixtures/wpt/workers/baseurl/alpha/WEB_FEATURES.yml b/test/fixtures/wpt/workers/baseurl/alpha/WEB_FEATURES.yml
new file mode 100644
index 000000000000..2d1787baf9a1
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/alpha/WEB_FEATURES.yml
@@ -0,0 +1,3 @@
+rules:
+- importScripts-in-sharedworker.html: [shared-workers]
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/baseurl/alpha/import-in-moduleworker.html b/test/fixtures/wpt/workers/baseurl/alpha/import-in-moduleworker.html
new file mode 100644
index 000000000000..2c75dec9ce76
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/alpha/import-in-moduleworker.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Base URL in module dedicated workers: import</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(function() {
+  var worker = new Worker("../beta/import.py", {type: "module"});
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, "gamma/script-module.js");
+  });
+  worker.onerror = this.unreached_func("Got error event");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/baseurl/alpha/importScripts-in-sharedworker.html b/test/fixtures/wpt/workers/baseurl/alpha/importScripts-in-sharedworker.html
new file mode 100644
index 000000000000..6a4111c6c052
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/alpha/importScripts-in-sharedworker.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Base URL in classic shared workers: importScripts</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+fetch_tests_from_worker(new SharedWorker("../beta/importScripts.py"));
+</script>
diff --git a/test/fixtures/wpt/workers/baseurl/alpha/importScripts-in-worker.html b/test/fixtures/wpt/workers/baseurl/alpha/importScripts-in-worker.html
new file mode 100644
index 000000000000..55907bf4238d
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/alpha/importScripts-in-worker.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Base URL in classic dedicated workers: importScripts</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+fetch_tests_from_worker(new Worker("../beta/importScripts.py"));
+</script>
diff --git a/test/fixtures/wpt/workers/baseurl/alpha/worker-in-worker.html b/test/fixtures/wpt/workers/baseurl/alpha/worker-in-worker.html
new file mode 100644
index 000000000000..284425ed3407
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/alpha/worker-in-worker.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Base URL in workers: new Worker()</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(function() {
+  var worker = new Worker("../beta/worker.py");
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, "gamma");
+  });
+  worker.onerror = this.unreached_func("Got error event");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-moduleworker.html b/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-moduleworker.html
new file mode 100644
index 000000000000..7597a1357d1d
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-moduleworker.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Base URL in module dedicated workers: XHR</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(function() {
+  var worker = new Worker("../beta/xhr.py", {type: "module"});
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, "gamma\n");
+  });
+  worker.onerror = this.unreached_func("Got error event");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-sharedworker.html b/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-sharedworker.html
new file mode 100644
index 000000000000..43921b898dcd
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-sharedworker.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Base URL in classic shared workers: XHR</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+fetch_tests_from_worker(new SharedWorker("../beta/xhr-worker.py"));
+</script>
diff --git a/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-worker.html b/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-worker.html
new file mode 100644
index 000000000000..bc58b9b2dd18
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-worker.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Base URL in classic dedicated workers: XHR</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+fetch_tests_from_worker(new Worker("../beta/xhr-worker.py"));
+</script>
diff --git a/test/fixtures/wpt/workers/baseurl/beta/script.js b/test/fixtures/wpt/workers/baseurl/beta/script.js
new file mode 100644
index 000000000000..bef771ff9eba
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/beta/script.js
@@ -0,0 +1 @@
+var result = 'beta/script.js';
diff --git a/test/fixtures/wpt/workers/baseurl/beta/subsharedworker.js b/test/fixtures/wpt/workers/baseurl/beta/subsharedworker.js
new file mode 100644
index 000000000000..de6a8cacaf80
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/beta/subsharedworker.js
@@ -0,0 +1,3 @@
+onconnect = function(e) {
+  e.source.postMessage('beta');
+}
diff --git a/test/fixtures/wpt/workers/baseurl/beta/subworker.js b/test/fixtures/wpt/workers/baseurl/beta/subworker.js
new file mode 100644
index 000000000000..997cecd6ced2
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/beta/subworker.js
@@ -0,0 +1 @@
+postMessage("beta");
diff --git a/test/fixtures/wpt/workers/baseurl/beta/test.txt b/test/fixtures/wpt/workers/baseurl/beta/test.txt
new file mode 100644
index 000000000000..65b2df87f7df
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/beta/test.txt
@@ -0,0 +1 @@
+beta
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/import.js b/test/fixtures/wpt/workers/baseurl/gamma/import.js
new file mode 100644
index 000000000000..1246913a84b7
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/import.js
@@ -0,0 +1,2 @@
+import r from "./script-module.js";
+postMessage(r);
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/importScripts.js b/test/fixtures/wpt/workers/baseurl/gamma/importScripts.js
new file mode 100644
index 000000000000..13820380a83e
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/importScripts.js
@@ -0,0 +1,6 @@
+importScripts('/resources/testharness.js');
+importScripts("script.js");
+test(() => {
+  assert_equals(result, "gamma/script.js");
+});
+done();
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/script-module.js b/test/fixtures/wpt/workers/baseurl/gamma/script-module.js
new file mode 100644
index 000000000000..88d5f82db3e3
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/script-module.js
@@ -0,0 +1 @@
+export default 'gamma/script-module.js';
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/script.js b/test/fixtures/wpt/workers/baseurl/gamma/script.js
new file mode 100644
index 000000000000..0f9ce8eacf4a
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/script.js
@@ -0,0 +1 @@
+var result = 'gamma/script.js';
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/subworker.js b/test/fixtures/wpt/workers/baseurl/gamma/subworker.js
new file mode 100644
index 000000000000..44407358e612
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/subworker.js
@@ -0,0 +1 @@
+postMessage("gamma");
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/test.txt b/test/fixtures/wpt/workers/baseurl/gamma/test.txt
new file mode 100644
index 000000000000..af17f6cc87e4
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/test.txt
@@ -0,0 +1 @@
+gamma
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/worker.js b/test/fixtures/wpt/workers/baseurl/gamma/worker.js
new file mode 100644
index 000000000000..8cfbcaef3129
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/worker.js
@@ -0,0 +1,4 @@
+var worker = new Worker("subworker.js");
+worker.onmessage = function(e) {
+  postMessage(e.data);
+}
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/xhr-worker.js b/test/fixtures/wpt/workers/baseurl/gamma/xhr-worker.js
new file mode 100644
index 000000000000..a9d77827d951
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/xhr-worker.js
@@ -0,0 +1,8 @@
+importScripts('/resources/testharness.js');
+test(t => {
+  var x = new XMLHttpRequest();
+  x.open("GET", "test.txt", false);
+  x.send();
+  assert_equals(x.response, "gamma\n");
+});
+done();
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/xhr.js b/test/fixtures/wpt/workers/baseurl/gamma/xhr.js
new file mode 100644
index 000000000000..70f331565aa6
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/xhr.js
@@ -0,0 +1,4 @@
+var x = new XMLHttpRequest();
+x.open("GET", "test.txt", false);
+x.send();
+postMessage(x.response);
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/1 b/test/fixtures/wpt/workers/constructors/SharedWorker/1
new file mode 100644
index 000000000000..831434e63990
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/1
@@ -0,0 +1,3 @@
+onconnect = e => {
+  e.ports[0].postMessage(['1', self.name]);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/1.headers b/test/fixtures/wpt/workers/constructors/SharedWorker/1.headers
new file mode 100644
index 000000000000..e7ec0d6699d0
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/1.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity b/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity
new file mode 100644
index 000000000000..d4c921c5658e
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity
@@ -0,0 +1,3 @@
+onconnect = e => {
+  e.ports[0].postMessage(['Infinity', self.name]);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity-arguments.html b/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity-arguments.html
new file mode 100644
index 000000000000..b38e55dc6bae
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity-arguments.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<title>Infinity as arguments</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker(Infinity, Infinity);
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data[0], 'Infinity', 'first arg (script name)');
+    assert_equals(e.data[1], 'Infinity', 'second arg (worker name)');
+  });
+}, 'Test constructing a shared worker with Infinity');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity.headers b/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity.headers
new file mode 100644
index 000000000000..6805c323df5a
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript; charset=utf-8
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/NaN b/test/fixtures/wpt/workers/constructors/SharedWorker/NaN
new file mode 100644
index 000000000000..1d06329788c3
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/NaN
@@ -0,0 +1,3 @@
+onconnect = e => {
+  e.ports[0].postMessage(['NaN', self.name]);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/NaN-arguments.html b/test/fixtures/wpt/workers/constructors/SharedWorker/NaN-arguments.html
new file mode 100644
index 000000000000..8a4578a965a3
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/NaN-arguments.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<title>NaN as arguments</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker(NaN, NaN);
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data[0], 'NaN', 'first arg (script name)');
+    assert_equals(e.data[1], 'NaN', 'second arg (worker name)');
+  });
+}, 'Test constructing a shared worker with NaN');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/NaN.headers b/test/fixtures/wpt/workers/constructors/SharedWorker/NaN.headers
new file mode 100644
index 000000000000..6805c323df5a
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/NaN.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript; charset=utf-8
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/SharedWorker-constructor.html b/test/fixtures/wpt/workers/constructors/SharedWorker/SharedWorker-constructor.html
new file mode 100644
index 000000000000..7909eb536953
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/SharedWorker-constructor.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<title>Test SharedWorker constructor functionality.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  assert_throws_js(Error,
+                   function() {
+                     new SharedWorker({toString:function(){throw new Error()}})},
+                   'toString exception should be propagated');
+}, 'Test toString propagation exception.');
+
+test(() => {
+  assert_throws_js(TypeError,
+                   function() { new SharedWorker(); },
+                   'invoking SharedWorker constructor without arguments should result ' +
+                   'in an exception.')
+}, 'Test Sharedworker creation with no arguments');
+
+
+test(() => {
+  assert_throws_dom("SyntaxError",
+                    function() { var Sharedworker = new SharedWorker('http://invalid:123$'); },
+                    'Invoking SharedWorker constructor with invalid script URL should ' +
+                    'result in an exception.');
+}, 'Test invalid script URL.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/URLMismatchError.htm b/test/fixtures/wpt/workers/constructors/SharedWorker/URLMismatchError.htm
new file mode 100644
index 000000000000..683d201ad3a0
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/URLMismatchError.htm
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Web Workers: SharedWorker - same name, different URL</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+setup({ single_test: true });
+
+let counter = 0
+const maybeDone = () => {
+  if(counter) {
+    done()
+  }
+  counter++
+}
+
+const worker = new SharedWorker('shared-worker.js', 'name');
+worker.port.postMessage("trigger a response")
+worker.port.onmessage = e => {
+  assert_equals(e.data, "ping")
+  maybeDone()
+}
+
+// This used to throw "URLMismatchError", but the standard changed
+const worker2 = new SharedWorker('1', 'name');
+worker2.port.onmessage = e => {
+  assert_array_equals(e.data, ["1", "name"])
+  maybeDone()
+}
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/WEB_FEATURES.yml b/test/fixtures/wpt/workers/constructors/SharedWorker/WEB_FEATURES.yml
new file mode 100644
index 000000000000..73744331853b
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [shared-workers]
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/connect-event.html b/test/fixtures/wpt/workers/constructors/SharedWorker/connect-event.html
new file mode 100644
index 000000000000..0ab41d25c906
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/connect-event.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>connect event</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker('connect-event.js');
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_true(e.data[0], "e.data === ''");
+    assert_true(e.data[1], "e instanceof MessageEvent");
+    assert_true(e.data[2], "e.ports.length == 1");
+  });
+}, 'Test connect event for a shared worker');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/connect-event.js b/test/fixtures/wpt/workers/constructors/SharedWorker/connect-event.js
new file mode 100644
index 000000000000..2cf26a723e8e
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/connect-event.js
@@ -0,0 +1,3 @@
+onconnect = e => {
+  e.ports[0].postMessage([e.data === '', e instanceof MessageEvent, e.ports.length == 1]);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/dummy-name.html b/test/fixtures/wpt/workers/constructors/SharedWorker/dummy-name.html
new file mode 100644
index 000000000000..25277042e21b
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/dummy-name.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<title>creating a dummy shared worker with name "foo"</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-sharedworker">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  const worker = new SharedWorker('empty.js', 'foo');
+});
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/dummy-shared-worker.html b/test/fixtures/wpt/workers/constructors/SharedWorker/dummy-shared-worker.html
new file mode 100644
index 000000000000..59a449ad7d87
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/dummy-shared-worker.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<title>creating a dummy shared worker</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-sharedworker">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  const worker = new SharedWorker('dummy-shared-worker.js');
+});
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/dummy-shared-worker.js b/test/fixtures/wpt/workers/constructors/SharedWorker/dummy-shared-worker.js
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/empty-name.html b/test/fixtures/wpt/workers/constructors/SharedWorker/empty-name.html
new file mode 100644
index 000000000000..94771d27c9eb
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/empty-name.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<title>creating a dummy shared worker with explicit name ""</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-sharedworker">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  const worker = new SharedWorker('empty.js', '');
+});
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/empty.js b/test/fixtures/wpt/workers/constructors/SharedWorker/empty.js
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/global-members.html b/test/fixtures/wpt/workers/constructors/SharedWorker/global-members.html
new file mode 100644
index 000000000000..2da4fc1cee6e
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/global-members.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<title>members of SharedWorkerGlobalScope</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker('global-members.js');
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data, '');
+  });
+}, 'Test if global members exist in a shared worker');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/global-members.js b/test/fixtures/wpt/workers/constructors/SharedWorker/global-members.js
new file mode 100644
index 000000000000..453da6aae514
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/global-members.js
@@ -0,0 +1,9 @@
+const expected = 'self location close onerror importScripts navigator addEventListener removeEventListener dispatchEvent name onconnect setTimeout clearTimeout setInterval clearInterval'.split(' ');
+let log = '';
+for (let i = 0; i < expected.length; ++i) {
+  if (!(expected[i] in self))
+    log += expected[i] + ' did not exist\n';
+}
+onconnect = e => {
+  e.ports[0].postMessage(log);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/interface-objects.html b/test/fixtures/wpt/workers/constructors/SharedWorker/interface-objects.html
new file mode 100644
index 000000000000..a8f69981687a
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/interface-objects.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<title>expected interface objects/constructors</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const expected = 'XMLHttpRequest WebSocket EventSource MessageChannel Worker'.split(' ');
+  const supported = [];
+  for (let i = 0; i < expected.length; ++i) {
+  if (expected[i] in window)
+     supported.push(expected[i]);
+  }
+  const worker = new SharedWorker('interface-objects.js');
+  worker.port.start();
+  worker.port.postMessage(supported);
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data, 'These were missing: ');
+  });
+}, 'Test if interface objects exist in a shared worker');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/interface-objects.js b/test/fixtures/wpt/workers/constructors/SharedWorker/interface-objects.js
new file mode 100644
index 000000000000..2a7aaee687a4
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/interface-objects.js
@@ -0,0 +1,13 @@
+let prt;
+const handleCall = e => {
+  const log = [];
+  for (let i = 0; i < e.data.length; ++i) {
+    if (!(e.data[i] in self))
+      log.push(e.data[i]);
+  }
+  prt.postMessage('These were missing: '+log.join(', '));
+};
+onconnect = e => {
+  prt = e.ports[0];
+  prt.onmessage = handleCall;
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/name.html b/test/fixtures/wpt/workers/constructors/SharedWorker/name.html
new file mode 100644
index 000000000000..4531cb1b800b
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/name.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<title>self.name</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker('name.js', 'hello');
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data, 'hello');
+  });
+}, 'Test self.name in a shared worker');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/name.js b/test/fixtures/wpt/workers/constructors/SharedWorker/name.js
new file mode 100644
index 000000000000..2bc2a4b18b50
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/name.js
@@ -0,0 +1,3 @@
+onconnect = e => {
+  e.ports[0].postMessage(self.name);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/no-arguments-ctor.html b/test/fixtures/wpt/workers/constructors/SharedWorker/no-arguments-ctor.html
new file mode 100644
index 000000000000..5a1231d7b596
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/no-arguments-ctor.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<title>no arguments</title>
+<link rel=help href="http://www.whatwg.org/html/#sharedworker">
+<link rel=help href="http://dev.w3.org/2006/webapi/WebIDL/#es-interface-call">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  assert_throws_js(TypeError, () => {
+    const worker = new SharedWorker();
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/null b/test/fixtures/wpt/workers/constructors/SharedWorker/null
new file mode 100644
index 000000000000..16f02d513161
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/null
@@ -0,0 +1,3 @@
+onconnect = e => {
+  e.ports[0].postMessage(['null', self.name]);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/null-arguments.html b/test/fixtures/wpt/workers/constructors/SharedWorker/null-arguments.html
new file mode 100644
index 000000000000..dd5e5773edbb
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/null-arguments.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<title>null as arguments</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker(null, null);
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data[0], 'null', 'first arg (script name)');
+    assert_equals(e.data[1], '', 'second arg (worker name)');
+  });
+}, 'Test constructing a shared worker with null');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/null.headers b/test/fixtures/wpt/workers/constructors/SharedWorker/null.headers
new file mode 100644
index 000000000000..e7ec0d6699d0
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/null.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/number-arguments.html b/test/fixtures/wpt/workers/constructors/SharedWorker/number-arguments.html
new file mode 100644
index 000000000000..8f90baa89854
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/number-arguments.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<title>1 as arguments</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker(1, 1);
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data[0], '1', 'first arg (script name)');
+    assert_equals(e.data[1], '1', 'second arg (worker name)');
+  });
+}, 'Test constructing a shared worker with 1');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/port-onmessage.html b/test/fixtures/wpt/workers/constructors/SharedWorker/port-onmessage.html
new file mode 100644
index 000000000000..706420c5e4a3
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/port-onmessage.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<title>worker.port.onmessage</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker('port-onmessage.js', '');
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_true(e.data);
+  });
+}, 'Test SharedWorker.port.onmessage');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/port-onmessage.js b/test/fixtures/wpt/workers/constructors/SharedWorker/port-onmessage.js
new file mode 100644
index 000000000000..64ef84df15a3
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/port-onmessage.js
@@ -0,0 +1,3 @@
+onconnect = e => {
+  e.ports[0].postMessage(true);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/port-properties.html b/test/fixtures/wpt/workers/constructors/SharedWorker/port-properties.html
new file mode 100644
index 000000000000..e2a1d5b2a8f4
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/port-properties.html
@@ -0,0 +1,19 @@
+<!doctype html>
+<title>worker.port</title>
+<link rel=help href="http://www.whatwg.org/html/#sharedworker">
+<link rel=help href="http://www.whatwg.org/html/#messageport">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  const worker = new SharedWorker('empty.js', '');
+  assert_true('port' in worker, "port");
+  assert_true('postMessage' in worker.port, "postMessage");
+  assert_true('start' in worker.port, "start");
+  assert_true('close' in worker.port, "close");
+  assert_true('onmessage' in worker.port, "onmessage");
+  assert_true('addEventListener' in worker.port, "addEventListener");
+  assert_true('removeEventListener' in worker.port, "removeEventListener");
+  assert_true('dispatchEvent' in worker.port, "dispatchEvent");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/port-readonly.html b/test/fixtures/wpt/workers/constructors/SharedWorker/port-readonly.html
new file mode 100644
index 000000000000..cfb5f3afa514
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/port-readonly.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>setting worker.port</title>
+<link rel=help href="http://www.whatwg.org/html/#sharedworker">
+<link rel=help href="http://dev.w3.org/2006/webapi/WebIDL/#dfn-attribute-setter">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  const worker = new SharedWorker('empty.js', '');
+  const x = worker.port;
+  worker.port = 1;
+  assert_equals(worker.port, x);
+});
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/same-origin.html b/test/fixtures/wpt/workers/constructors/SharedWorker/same-origin.html
new file mode 100644
index 000000000000..4f1b62a6605b
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/same-origin.html
@@ -0,0 +1,62 @@
+<!doctype html>
+<title>same-origin checks</title>
+<meta name="timeout" content="long">
+<link rel=help href="https://html.spec.whatwg.org/multipage/workers.html#dom-sharedworker">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+// Needed to prevent a race condition if a worker throws an exception that may or may
+// not propogate to the window before the tests finish
+setup({allow_uncaught_exception: true});
+
+testSharedWorkerHelper = (t, script) => {
+  const worker = new SharedWorker(script, '');
+  worker.onerror = t.step_func_done(e => {
+    assert_true(e instanceof Event);
+  });
+}
+
+test(() => {
+  assert_throws_dom("SyntaxError", () => { new SharedWorker('https://test:test', ''); });
+}, "non-parsable URL");
+
+async_test(t => {
+  // Parses fine as a URL, fails to fetch according to Fetch
+  testSharedWorkerHelper(t, 'unsupported:');
+}, "unsupported_scheme");
+
+async_test(t => {
+  const worker = new SharedWorker('data:,onconnect = e => { e.ports[0].postMessage(1); }', '');
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data, 1);
+  });
+}, "data_url");
+
+async_test(t => {
+  testSharedWorkerHelper(t, 'javascript:""');
+}, "javascript_url");
+
+async_test(t => {
+  testSharedWorkerHelper(t, 'about:blank');
+}, "about_blank");
+
+async_test(t => {
+  testSharedWorkerHelper(t, 'http://www.opera.com/');
+}, "opera_com");
+
+async_test(t => {
+  testSharedWorkerHelper(t, location.protocol+'//'+location.hostname+':81/');
+}, "port_81");
+
+async_test(t => {
+  testSharedWorkerHelper(t, 'https://'+location.hostname+':80/');
+}, "https_port_80");
+
+async_test(t => {
+  testSharedWorkerHelper(t, 'https://'+location.hostname+':8000/');
+}, "https_port_8000");
+
+async_test(t => {
+  testSharedWorkerHelper(t, 'http://'+location.hostname+':8012/');
+}, "http_port_8012");
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/setting-port-members.html b/test/fixtures/wpt/workers/constructors/SharedWorker/setting-port-members.html
new file mode 100644
index 000000000000..0c53474ff076
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/setting-port-members.html
@@ -0,0 +1,53 @@
+<!doctype html>
+<title>setting members of worker.port</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+setup(() => {
+  window.worker = new SharedWorker('#', '');
+});
+test(() => {
+  worker.port.postMessage = 1;
+  assert_equals(worker.port.postMessage, 1);
+}, 'postMessage');
+test(() => {
+  worker.port.start = 1;
+  assert_equals(worker.port.start, 1);
+}, 'start');
+test(() => {
+  worker.port.close = 1;
+  assert_equals(worker.port.close, 1);
+}, 'close');
+test(() => {
+  const f = () => {};
+  worker.port.onmessage = f;
+  assert_equals(worker.port.onmessage, f, '() => {}');
+  worker.port.onmessage = 1;
+  assert_equals(worker.port.onmessage, null, '1');
+  worker.port.onmessage = f;
+  worker.port.onmessage = ';';
+  assert_equals(worker.port.onmessage, null, '";"');
+  worker.port.onmessage = f;
+  const handler = {handleEvent:() => {}};
+  worker.port.onmessage = handler;
+  assert_equals(worker.port.onmessage, handler, '{handleEvent:() => {}}');
+  worker.port.onmessage = f;
+  worker.port.onmessage = null;
+  assert_equals(worker.port.onmessage, null, 'null');
+  worker.port.onmessage = f;
+  worker.port.onmessage = undefined;
+  assert_equals(worker.port.onmessage, null, 'undefined');
+}, 'onmessage');
+test(() => {
+  worker.port.addEventListener = 1;
+  assert_equals(worker.port.addEventListener, 1);
+}, 'addEventListener');
+test(() => {
+  worker.port.removeEventListener = 1;
+  assert_equals(worker.port.removeEventListener, 1);
+}, 'removeEventListener');
+test(() => {
+  worker.port.despatchEvent = 1;
+  assert_equals(worker.port.despatchEvent, 1);
+}, 'despatchEvent');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/shared-worker.js b/test/fixtures/wpt/workers/constructors/SharedWorker/shared-worker.js
new file mode 100644
index 000000000000..b6d18855da51
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/shared-worker.js
@@ -0,0 +1,6 @@
+onconnect = e => {
+  const port = e.ports[0];
+  port.onmessage = e => {
+    port.postMessage('ping');
+  }
+}
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/undefined b/test/fixtures/wpt/workers/constructors/SharedWorker/undefined
new file mode 100644
index 000000000000..b8462f19118b
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/undefined
@@ -0,0 +1,3 @@
+onconnect = e => {
+  e.ports[0].postMessage(['undefined', self.name]);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/undefined-arguments.html b/test/fixtures/wpt/workers/constructors/SharedWorker/undefined-arguments.html
new file mode 100644
index 000000000000..cd4c86e84ab1
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/undefined-arguments.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<title>undefined as arguments</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker(undefined, undefined);
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data[0], 'undefined', 'first arg (script name)');
+    assert_equals(e.data[1], '', 'second arg (worker name)');
+  });
+}, 'Test constructing a shared worker with undefined');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/undefined.headers b/test/fixtures/wpt/workers/constructors/SharedWorker/undefined.headers
new file mode 100644
index 000000000000..e7ec0d6699d0
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/undefined.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/unexpected-global-properties.html b/test/fixtures/wpt/workers/constructors/SharedWorker/unexpected-global-properties.html
new file mode 100644
index 000000000000..522d31ff56bf
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/unexpected-global-properties.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<title>unexpected members/interface objects/constructors</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker('unexpected-global-properties.js');
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data, '');
+  });
+}, 'Test unexpected properties are not in global scope');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/unexpected-global-properties.js b/test/fixtures/wpt/workers/constructors/SharedWorker/unexpected-global-properties.js
new file mode 100644
index 000000000000..0af893582142
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/unexpected-global-properties.js
@@ -0,0 +1,9 @@
+const unexpected = 'open print stop getComputedStyle getSelection releaseEvents captureEvents alert confirm prompt addEventStream removeEventStream back forward attachEvent detachEvent navigate DOMParser XMLSerializer XPathEvaluator XSLTProcessor opera Image Option frames Audio SVGUnitTypes SVGZoomAndPan java netscape sun Packages ByteArray closed defaultStatus document event frameElement history innerHeight innerWidth opener outerHeight outerWidth pageXOffset pageYOffset parent screen screenLeft screenTop screenX screenY status top window length'.split(' '); // iterated window in opera and removed expected ones
+let log = '';
+for (let i = 0; i < unexpected.length; ++i) {
+  if (unexpected[i] in self)
+    log += unexpected[i] + ' ';
+}
+onconnect = e => {
+  e.ports[0].postMessage(log);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/unresolvable-url.html b/test/fixtures/wpt/workers/constructors/SharedWorker/unresolvable-url.html
new file mode 100644
index 000000000000..c68968d77dd9
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/unresolvable-url.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<title>resolving broken url</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-sharedworker">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  assert_throws_dom("SyntaxError", () => {
+    const worker = new SharedWorker('http://foo bar');
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/Worker/1 b/test/fixtures/wpt/workers/constructors/Worker/1
new file mode 100644
index 000000000000..ea0b7c8f4ccb
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/1
@@ -0,0 +1 @@
+postMessage('1');
diff --git a/test/fixtures/wpt/workers/constructors/Worker/1.headers b/test/fixtures/wpt/workers/constructors/Worker/1.headers
new file mode 100644
index 000000000000..e7ec0d6699d0
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/1.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript
diff --git a/test/fixtures/wpt/workers/constructors/Worker/AbstractWorker.onerror.html b/test/fixtures/wpt/workers/constructors/Worker/AbstractWorker.onerror.html
new file mode 100644
index 000000000000..b27f278bff8e
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/AbstractWorker.onerror.html
@@ -0,0 +1,37 @@
+<!doctype html>
+<title>AbstractWorker.onerror</title>
+<link rel=help href="https://html.spec.whatwg.org/multipage/#runtime-script-errors-2">
+<link rel=help href="https://html.spec.whatwg.org/multipage/#report-the-error">
+<link rel=help href="https://html.spec.whatwg.org/multipage/#the-event-handler-processing-algorithm">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+setup({allow_uncaught_exception:true});
+async_test(function() {
+  var worker = new Worker('AbstractWorker.onerror.js');
+  var error;
+  worker.onerror = this.step_func(function(a, b, c) {
+    error = a;
+    assert_equals('' + a, '[object ErrorEvent]');
+    assert_true("message" in a, 'ErrorEvent.message');
+    assert_equals(typeof a.message, "string", 'ErrorEvent.message');
+    assert_equals(a.filename, document.URL.replace('.html', '.js'), 'ErrorEvent.filename');
+    assert_true("lineno" in a, 'ErrorEvent.lineno');
+    assert_equals(typeof a.lineno, "number", 'ErrorEvent.lineno');
+    assert_equals(b, undefined, 'unexpected second argument to onerror');
+    assert_equals(c, undefined, 'unexpected third argument to onerror');
+  });
+  worker.onmessage = this.step_func(function(e) {
+    assert_unreached('onmessage was invoked but worker script shouldn\'t have compiled');
+  });
+  window.onerror = this.step_func_done(function(a, b, c, d, e, f) {
+    assert_equals(a, error.message, 'message');
+    assert_equals(b, error.filename, 'filename');
+    assert_equals(c, error.lineno, 'lineno');
+    assert_equals(d, error.colno, 'colno');
+    assert_equals(e, error.error, 'error');
+    assert_equals(f, undefined, 'unexpected sixth argument to onerror');
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/constructors/Worker/AbstractWorker.onerror.js b/test/fixtures/wpt/workers/constructors/Worker/AbstractWorker.onerror.js
new file mode 100644
index 000000000000..1594decd3709
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/AbstractWorker.onerror.js
@@ -0,0 +1,5 @@
+// Throw a runtime error, the UA must report the error for that script.
+// https://html.spec.whatwg.org/#runtime-script-errors-2
+for (;;)
+  throw new Error("error from onerror.js");
+postMessage(1); // shouldn't do anything since the script doesn't compile
diff --git a/test/fixtures/wpt/workers/constructors/Worker/Blob-url.html b/test/fixtures/wpt/workers/constructors/Worker/Blob-url.html
new file mode 100644
index 000000000000..168fc91ae1d0
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/Blob-url.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Web Workers: Worker - Blob url</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+
+  async_test(function(t) {
+    var blob = new Blob(["onmessage = function(event) { postMessage(event.data); }"], {type: "text/plain"});
+    var worker = new Worker(window.URL.createObjectURL(blob));
+    var data = "Blob URL";
+    worker.postMessage(data);
+    worker.onmessage = t.step_func(function(event) {
+      assert_equals(event.data, data, "event.data");
+      t.done();
+    });
+  }, "Worker supports Blob url");
+
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/Worker/DedicatedWorkerGlobalScope-members.worker.js b/test/fixtures/wpt/workers/constructors/Worker/DedicatedWorkerGlobalScope-members.worker.js
new file mode 100644
index 000000000000..2ef466ccdc30
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/DedicatedWorkerGlobalScope-members.worker.js
@@ -0,0 +1,18 @@
+importScripts("/resources/testharness.js");
+
+var expected = [
+  'postMessage', 'onmessage', /* DedicatedWorkerGlobalScope */
+  'self', 'location', 'close', 'onerror', 'onoffline', 'ononline', /* WorkerGlobalScope */
+  'addEventListener', 'removeEventListener', 'dispatchEvent', /* EventListener */
+  'importScripts', 'navigator', /* WorkerUtils */
+  'setTimeout', 'clearTimeout', 'setInterval', 'clearInterval', /* WindowTimers */
+  'btoa', 'atob' /* WindowBase64 */
+];
+for (var i = 0; i < expected.length; ++i) {
+  var property = expected[i];
+  test(function() {
+    assert_true(property in self);
+  }, "existence of " + property);
+}
+
+done();
diff --git a/test/fixtures/wpt/workers/constructors/Worker/WEB_FEATURES.yml b/test/fixtures/wpt/workers/constructors/Worker/WEB_FEATURES.yml
new file mode 100644
index 000000000000..a489fa783e57
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/WEB_FEATURES.yml
@@ -0,0 +1,3 @@
+rules:
+- use-base-url.html: [base]
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/constructors/Worker/Worker-constructor.html b/test/fixtures/wpt/workers/constructors/Worker/Worker-constructor.html
new file mode 100644
index 000000000000..6d6843b77b69
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/Worker-constructor.html
@@ -0,0 +1,60 @@
+<!DOCTYPE html>
+<title>Test Worker constructor functionality.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+test(() => {
+  assert_throws_js(Error,
+                   function() {
+                     new Worker({toString:function(){throw new Error()}})},
+                   'toString exception should be propagated');
+}, 'Test toString propagation exception.');
+
+test(() => {
+  try {
+    var foo = {toString:function(){new Worker(foo)}};
+    new Worker(foo);
+  } catch(ex) {
+    assert_true(true, 'trying to create workers recursively should result in an: ' +
+                ex + 'exception.')
+  }
+}, 'Test recursive Worker creation.');
+
+test(() => {
+  assert_throws_js(TypeError,
+                   function() { new Worker(); },
+                   'invoking Worker constructor without arguments should result ' +
+                   'in an exception.')
+}, 'Test worker creation with no arguments');
+
+async_test(t => {
+  var worker = new Worker('');
+  worker.onerror = function(e) {
+    e.preventDefault();
+    t.done();
+  }
+}, 'Test Worker creation with empty script URL.');
+
+test(() => {
+  assert_throws_dom("SyntaxError",
+                    function() { var worker = new Worker('http://invalid:123$'); },
+                    'Invoking Worker constructor with invalid script URL should ' +
+                    'result in an exception.');
+}, 'Test invalid script URL.');
+
+async_test(t => {
+  var worker = new Worker('does-not-exist.js');
+  worker.onerror = function(e) {
+    t.done();
+  }
+}, 'Test not existent script URL.');
+
+test(() => {
+  var worker = new Worker('../../support/Worker-common.js');
+  assert_true('postMessage' in worker,
+              'worker.postMessage did not exist.');
+  assert_true('addEventListener' in worker,
+              'worker.addEventListener did not exist.');
+}, 'Test the Worker object defines postMessage() and addEventListener().');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/Worker/constructor-utf16-bom.html b/test/fixtures/wpt/workers/constructors/Worker/constructor-utf16-bom.html
new file mode 100644
index 000000000000..0e423922feaf
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/constructor-utf16-bom.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Worker constructor: UTF-16 BOM should trigger error</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+function test_utf16_bom(url, title) {
+    async_test(t => {
+        const worker = new Worker(url);
+
+        worker.onmessage = t.unreached_func(`${title} should result to a compile error`);
+
+        worker.onerror = t.step_func_done(e => {
+            assert_true(true);
+        });
+    }, title);
+}
+
+test_utf16_bom("script-utf16be.js", "Worker with UTF-16BE BOM");
+test_utf16_bom("script-utf16le.js", "Worker with UTF-16LE BOM");
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/constructors/Worker/ctor-1.html b/test/fixtures/wpt/workers/constructors/Worker/ctor-1.html
new file mode 100644
index 000000000000..bd865261fc6e
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/ctor-1.html
@@ -0,0 +1,23 @@
+<!--
+postMessage('FAIL');
+/*
+-->
+<!doctype html>
+<title>1 as argument</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-worker">
+<link rel=help href="http://dev.w3.org/2006/webapi/WebIDL/#es-DOMString">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+var t = async_test();
+t.step(function() {
+  var worker = new Worker(1);
+  worker.addEventListener('message', t.step_func_done(function(e) {
+    assert_equals(e.data, '1')
+  }), false);
+});
+</script>
+<!--
+*/
+//-->
diff --git a/test/fixtures/wpt/workers/constructors/Worker/ctor-null.html b/test/fixtures/wpt/workers/constructors/Worker/ctor-null.html
new file mode 100644
index 000000000000..94ab71aeff62
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/ctor-null.html
@@ -0,0 +1,23 @@
+<!--
+postMessage('FAIL');
+/*
+-->
+<!doctype html>
+<title>null as argument</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-worker">
+<link rel=help href="http://dev.w3.org/2006/webapi/WebIDL/#es-DOMString">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+var t = async_test();
+t.step(function() {
+  var worker = new Worker(null);
+  worker.addEventListener('message', t.step_func_done(function(e) {
+    assert_equals(e.data, 'null')
+  }), false);
+});
+</script>
+<!--
+*/
+//-->
diff --git a/test/fixtures/wpt/workers/constructors/Worker/ctor-undefined.html b/test/fixtures/wpt/workers/constructors/Worker/ctor-undefined.html
new file mode 100644
index 000000000000..2d9eb6e65637
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/ctor-undefined.html
@@ -0,0 +1,23 @@
+<!--
+postMessage('FAIL');
+/*
+-->
+<!doctype html>
+<title>undefined as argument</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-worker">
+<link rel=help href="http://dev.w3.org/2006/webapi/WebIDL/#es-DOMString">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+var t = async_test();
+t.step(function() {
+  var worker = new Worker(undefined);
+  worker.addEventListener('message', t.step_func_done(function(e) {
+    assert_equals(e.data, 'undefined')
+  }), false);
+});
+</script>
+<!--
+*/
+//-->
diff --git a/test/fixtures/wpt/workers/constructors/Worker/expected-self-properties.worker.js b/test/fixtures/wpt/workers/constructors/Worker/expected-self-properties.worker.js
new file mode 100644
index 000000000000..72edf495eb67
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/expected-self-properties.worker.js
@@ -0,0 +1,11 @@
+importScripts("/resources/testharness.js");
+
+var expected = ['XMLHttpRequest', 'WebSocket', 'EventSource', 'MessageChannel', 'Worker'];
+for (var i = 0; i < expected.length; ++i) {
+  var property = expected[i];
+  test(function() {
+    assert_true(property in self);
+  }, "existence of " + property);
+}
+
+done();
diff --git a/test/fixtures/wpt/workers/constructors/Worker/null b/test/fixtures/wpt/workers/constructors/Worker/null
new file mode 100644
index 000000000000..6d079b514cf5
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/null
@@ -0,0 +1 @@
+postMessage('null');
diff --git a/test/fixtures/wpt/workers/constructors/Worker/null.headers b/test/fixtures/wpt/workers/constructors/Worker/null.headers
new file mode 100644
index 000000000000..e7ec0d6699d0
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/null.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript
diff --git a/test/fixtures/wpt/workers/constructors/Worker/same-origin.html b/test/fixtures/wpt/workers/constructors/Worker/same-origin.html
new file mode 100644
index 000000000000..56dbfe3b3f3a
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/same-origin.html
@@ -0,0 +1,65 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>same-origin checks; the script is in a script element</title>
+<meta name="timeout" content="long">
+<link rel=help href="https://html.spec.whatwg.org/multipage/workers.html#dom-worker">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+// Needed to prevent a race condition if a worker throws an exception that may or may
+// not propogate to the window before the tests finish
+setup({allow_uncaught_exception: true});
+
+function testWorkerHelper(t, script) {
+  var worker = new Worker(script);
+  worker.onerror = t.step_func_done(function(e) {
+    assert_true(e instanceof Event);
+  });
+}
+
+test(function() {
+  assert_throws_dom("SyntaxError", function() { new Worker('https://test:test'); });
+}, "non-parsable URL");
+
+async_test(function(t) {
+  // Parses fine as a URL, fails to fetch according to Fetch
+  testWorkerHelper(t, 'unsupported:');
+}, "unsupported_scheme");
+
+async_test(function() {
+  var worker = new Worker('data:,postMessage(1);');
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, 1);
+  });
+}, "data_url");
+
+async_test(function(t) {
+  testWorkerHelper(t, 'about:blank');
+}, "about_blank");
+
+async_test(function(t) {
+  testWorkerHelper(t, 'http://www.example.invalid/');
+}, "example_invalid");
+
+async_test(function(t) {
+  testWorkerHelper(t, location.protocol+'//'+location.hostname+':81/');
+}, "port_81");
+
+async_test(function(t) {
+  testWorkerHelper(t, 'https://'+location.hostname+':80/');
+}, "https_port_80");
+
+async_test(function(t) {
+  testWorkerHelper(t, 'https://'+location.hostname+':8000/');
+}, "https_port_8000");
+
+async_test(function(t) {
+  testWorkerHelper(t, 'http://'+location.hostname+':8012/');
+}, "http_post_8012");
+
+async_test(function(t) {
+  testWorkerHelper(t,'javascript:""');
+}, "javascript_url");
+
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/Worker/sample_worker/worker.js b/test/fixtures/wpt/workers/constructors/Worker/sample_worker/worker.js
new file mode 100644
index 000000000000..19bbea58e767
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/sample_worker/worker.js
@@ -0,0 +1 @@
+onmessage = function(event) { postMessage(event.data); }
diff --git a/test/fixtures/wpt/workers/constructors/Worker/script-utf16be.js b/test/fixtures/wpt/workers/constructors/Worker/script-utf16be.js
new file mode 100644
index 000000000000..fa15f44bd0a6
Binary files /dev/null and b/test/fixtures/wpt/workers/constructors/Worker/script-utf16be.js differ
diff --git a/test/fixtures/wpt/workers/constructors/Worker/script-utf16le.js b/test/fixtures/wpt/workers/constructors/Worker/script-utf16le.js
new file mode 100644
index 000000000000..6253e4ceac25
Binary files /dev/null and b/test/fixtures/wpt/workers/constructors/Worker/script-utf16le.js differ
diff --git a/test/fixtures/wpt/workers/constructors/Worker/terminate.html b/test/fixtures/wpt/workers/constructors/Worker/terminate.html
new file mode 100644
index 000000000000..b9af76e2fb1b
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/terminate.html
@@ -0,0 +1,34 @@
+<!doctype html>
+<title>terminate()</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-worker-terminate">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+var t = async_test();
+t.step(function() {
+  var worker = new Worker('terminate.js');
+  var i = 0;
+  var expected;
+
+  worker.onmessage = t.step_func(function() {
+    i++;
+  });
+
+  setTimeout(t.step_func(function() {
+    expected = i;
+    start_time = Date.now();
+    //Hang the main thread for a bit to give the worker the chance to post some more messages
+    while(Date.now() - start_time < 500) {
+      //pass
+    }
+    worker.terminate();
+
+    setTimeout(t.step_func(function() {
+      assert_equals(i, expected);
+      t.done();
+    }), 100);
+
+  }), 100);
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/constructors/Worker/terminate.js b/test/fixtures/wpt/workers/constructors/Worker/terminate.js
new file mode 100644
index 000000000000..e6349c3320ee
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/terminate.js
@@ -0,0 +1,4 @@
+(function f() {
+  postMessage(1);
+  setTimeout(f, 0);
+})();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/constructors/Worker/undefined b/test/fixtures/wpt/workers/constructors/Worker/undefined
new file mode 100644
index 000000000000..bc7f482e94ad
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/undefined
@@ -0,0 +1 @@
+postMessage('undefined');
diff --git a/test/fixtures/wpt/workers/constructors/Worker/undefined.headers b/test/fixtures/wpt/workers/constructors/Worker/undefined.headers
new file mode 100644
index 000000000000..e7ec0d6699d0
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/undefined.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript
diff --git a/test/fixtures/wpt/workers/constructors/Worker/unexpected-self-properties.worker.js b/test/fixtures/wpt/workers/constructors/Worker/unexpected-self-properties.worker.js
new file mode 100644
index 000000000000..acdd0eb303b4
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/unexpected-self-properties.worker.js
@@ -0,0 +1,11 @@
+importScripts("/resources/testharness.js");
+
+var unexpected = ['open', 'print', 'stop', 'getComputedStyle', 'getSelection', 'releaseEvents', 'captureEvents', 'alert', 'confirm', 'prompt', 'addEventStream', 'removeEventStream', 'back', 'forward', 'attachEvent', 'detachEvent', 'navigate', 'DOMParser', 'XMLSerializer', 'XPathEvaluator', 'XSLTProcessor', 'opera', 'Image', 'Option', 'frames', 'Audio', 'SVGUnitTypes', 'SVGZoomAndPan', 'java', 'netscape', 'sun', 'Packages', 'ByteArray', 'closed', 'defaultStatus', 'document', 'event', 'frameElement', 'history', 'innerHeight', 'innerWidth', 'opener', 'outerHeight', 'outerWidth', 'pageXOffset', 'pageYOffset', 'parent', 'screen', 'screenLeft', 'screenTop', 'screenX', 'screenY', 'status', 'top', 'window', 'length', 'SharedWorker']; // iterated window in opera and removed expected ones
+for (var i = 0; i < unexpected.length; ++i) {
+  var property = unexpected[i];
+  test(function() {
+    assert_false(property in self);
+  }, "existence of " + property);
+}
+
+done();
diff --git a/test/fixtures/wpt/workers/constructors/Worker/use-base-url.html b/test/fixtures/wpt/workers/constructors/Worker/use-base-url.html
new file mode 100644
index 000000000000..94ce2a71f142
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/use-base-url.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Use the document base url when resolving worker URLs</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<base href="/workers/constructors/Worker/sample_worker/">
+<script>
+    async_test(function(t) {
+        var worker = new Worker('worker.js');
+        var data = "foo";
+        worker.postMessage(data);
+        worker.onmessage = t.step_func_done(function(event) {
+            assert_equals(event.data, data, "event.data does not match expected data");
+        });
+        worker.onerror = t.unreached_func("received error event");
+    }, "Use the document base url when resolving worker URLs");
+</script>
diff --git a/test/fixtures/wpt/workers/data-url-shared-window.html b/test/fixtures/wpt/workers/data-url-shared-window.html
new file mode 100644
index 000000000000..7459f592861b
--- /dev/null
+++ b/test/fixtures/wpt/workers/data-url-shared-window.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<head>
+<title>data URL shared worker</title>
+</head>
+<body>
+<script>
+onmessage = event => {
+  const port = event.ports[0];
+  // This shared worker counts the total number of connected documents and
+  // notifies the connector of it.
+  const kScript =
+      "onconnect = e => {" +
+      "  if (self.count === undefined)" +
+      "    self.count = 0;" +
+      "  self.count++;" +
+      "  e.ports[0].postMessage(self.count);" +
+      "};";
+  const worker = new SharedWorker('data:application/javascript,' + kScript);
+  worker.port.onmessage = e => port.postMessage(e.data);
+};
+
+window.opener.postMessage('LOADED', '*');
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/workers/data-url-shared.html b/test/fixtures/wpt/workers/data-url-shared.html
new file mode 100644
index 000000000000..aae76d46cd7a
--- /dev/null
+++ b/test/fixtures/wpt/workers/data-url-shared.html
@@ -0,0 +1,78 @@
+<!DOCTYPE html>
+<title>data URL shared workers</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+function assert_worker_sends_pass(test_desc, mime_type, worker_code) {
+  async_test(function(t) {
+    var w = new SharedWorker(`data:${mime_type},onconnect = function(e) { port = e.ports[0]; ${worker_code}}`);
+    w.port.onmessage = t.step_func_done(function(e) {
+      assert_equals(e.data, 'PASS');
+    });
+    w.port.postMessage('SEND_PASS');
+  }, test_desc);
+}
+
+function assert_worker_throws(test_desc, worker_code) {
+  assert_worker_sends_pass(test_desc, '', `try { ${worker_code}; port.postMessage("FAIL"); } catch (e) { port.postMessage("PASS"); }`);
+}
+
+// Any MIME type allowed
+assert_worker_sends_pass('application/javascript MIME allowed', 'application/javascript', 'port.postMessage("PASS")');
+assert_worker_sends_pass('text/plain MIME allowed', 'text/plain', 'port.postMessage("PASS")');
+assert_worker_sends_pass('empty MIME allowed', '', 'port.postMessage("PASS")');
+
+// Communications goes both ways
+assert_worker_sends_pass('communication goes both ways', 'application/javascript', 'port.onmessage = function(e) { port.postMessage("PASS"); }');
+
+// test access to storage APIs
+
+// https://w3c.github.io/IndexedDB/#dom-idbfactory-open
+assert_worker_sends_pass('indexedDB is present', '', 'port.postMessage("indexedDB" in self ? "PASS" : "FAIL")');
+assert_worker_throws('indexedDB is inaccessible', 'self.indexedDB.open("someDBName")');
+// Other standardized storage APIs are either not exposed to workers
+// (e.g. window.localStorage, window.sessionStorage), or are [SecureContext]
+// (e.g. self.caches).
+
+// 'data:' workers are cross-origin
+assert_worker_sends_pass('cross-origin worker', '', 'fetch("/").then(() => port.postMessage("FAIL"), () => port.postMessage("PASS"))');
+
+// 'data:' workers have opaque origin
+assert_worker_sends_pass('worker has opaque origin', 'application/javascript', 'port.postMessage(self.location.origin == "null" ?  "PASS" : "FAIL")');
+
+function openWindow(url) {
+  return new Promise(resolve => {
+    const win = window.open(url, '_blank');
+    add_completion_callback(() => win.close());
+    window.onmessage = e => {
+      assert_equals(e.data, 'LOADED');
+      resolve(win);
+    };
+  });
+}
+
+promise_test(() => {
+  const kWindowURL = 'data-url-shared-window.html';
+  const kRemoteWindowURL = get_host_info().HTTP_REMOTE_ORIGIN +
+                           '/workers/data-url-shared-window.html';
+  return openWindow(kWindowURL)
+    .then(win => {
+        const channel = new MessageChannel;
+        win.postMessage(channel.port1, '*', [channel.port1]);
+        return new Promise(resolve => channel.port2.onmessage = resolve);
+      })
+    .then(msg_event => {
+        assert_equals(msg_event.data, 1);
+        return openWindow(kRemoteWindowURL);
+      })
+    .then(win => {
+        const channel = new MessageChannel;
+        win.postMessage(channel.port1, '*', [channel.port1]);
+        return new Promise(resolve => channel.port2.onmessage = resolve);
+      })
+    .then(msg_event => assert_equals(msg_event.data, 1));
+}, 'A data: URL shared worker should not be shared among origins.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/data-url.html b/test/fixtures/wpt/workers/data-url.html
new file mode 100644
index 000000000000..f8fe65e520c4
--- /dev/null
+++ b/test/fixtures/wpt/workers/data-url.html
@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<title>data URL dedicated workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+// Helper assert functions -START-
+function assert_worker_sends_pass(test_desc, mime_type, worker_code) {
+  async_test(function(t) {
+    var w = new Worker(`data:${mime_type},${worker_code}`);
+    w.onmessage = t.step_func_done(function(e) {
+      assert_equals(e.data, 'PASS');
+    });
+    w.postMessage('SEND_PASS');
+  }, test_desc);
+}
+
+function assert_worker_throws(test_desc, worker_code) {
+  assert_worker_sends_pass(test_desc, '', `try { ${worker_code}; self.postMessage("FAIL"); } catch (e) { self.postMessage("PASS"); }`);
+}
+
+function assert_worker_construction_fails(test_desc, mime_type, worker_code) {
+  async_test(function(t) {
+    var w = new Worker(`data:${mime_type},${worker_code};postMessage("PASS")`);
+    w.onmessage = t.step_func_done(function(e) {
+      assert_unreached('Should not receive any message back.');
+    });
+    w.onerror = t.step_func_done(function(e) {
+      assert_true(true, 'Should throw ' + e.message);
+      // Stop the error from being propagated to the WPT test harness
+      e.preventDefault();
+    });
+  }, test_desc);
+}
+// Helper assert functions -END-
+
+// Actual tests -START-
+
+// Any MIME type allowed
+assert_worker_sends_pass('application/javascript MIME allowed', 'application/javascript', 'self.postMessage("PASS")');
+assert_worker_sends_pass('text/plain MIME allowed', 'text/plain', 'self.postMessage("PASS")');
+assert_worker_sends_pass('empty MIME allowed', '', 'self.postMessage("PASS")');
+
+// Communications goes both ways
+assert_worker_sends_pass('communication goes both ways', 'application/javascript', 'onmessage = function(e) { self.postMessage("PASS"); }');
+
+// test access to storage APIs
+
+// https://w3c.github.io/IndexedDB/#dom-idbfactory-open
+assert_worker_sends_pass('indexedDB is present', '', 'self.postMessage("indexedDB" in self ? "PASS" : "FAIL")');
+assert_worker_throws('indexedDB is inaccessible', 'self.indexedDB.open("someDBName")');
+
+// Other standardized storage APIs are either not exposed to workers
+// (e.g. window.localStorage, window.sessionStorage), or are [SecureContext]
+// (e.g. self.caches).
+
+// 'data:' workers are cross-origin
+assert_worker_sends_pass('cross-origin worker', '', 'fetch("/").then(() => self.postMessage("FAIL"), () => self.postMessage("PASS"))');
+
+// 'data:' workers have opaque origin
+assert_worker_sends_pass('worker has opaque origin', 'application/javascript', 'if (self.location.origin == "null") {postMessage("PASS");} else {postMessage("FAIL");}');
+
+setup({allow_uncaught_exception:true});
+// invalid javascript will trigger an ErrorEvent
+assert_worker_construction_fails('invalid javascript produces error', 'application/javascript', '}x=3');
+
+// Actual tests -END-
+</script>
diff --git a/test/fixtures/wpt/workers/dedicated-worker-from-blob-url.window.js b/test/fixtures/wpt/workers/dedicated-worker-from-blob-url.window.js
new file mode 100644
index 000000000000..61a1c06c246a
--- /dev/null
+++ b/test/fixtures/wpt/workers/dedicated-worker-from-blob-url.window.js
@@ -0,0 +1,47 @@
+function message_from_port(port) {
+  return new Promise((resolve, reject) => {
+    port.onmessage = e => resolve(e.data);
+    port.onerror = e => reject(e);
+  });
+}
+
+promise_test(async t => {
+  const run_result = 'worker_OK';
+  const blob_contents = 'self.postMessage("' + run_result + '");';
+  const blob = new Blob([blob_contents]);
+  const url = URL.createObjectURL(blob);
+
+  const worker = new Worker(url);
+  const reply = await message_from_port(worker);
+  assert_equals(reply, run_result);
+}, 'Creating a dedicated worker from a blob URL works.');
+
+promise_test(async t => {
+  const run_result = 'worker_OK';
+  const blob_contents = 'self.postMessage("' + run_result + '");';
+  const blob = new Blob([blob_contents]);
+  const url = URL.createObjectURL(blob);
+
+  const worker = new Worker(url);
+  URL.revokeObjectURL(url);
+  const reply = await message_from_port(worker);
+  assert_equals(reply, run_result);
+}, 'Creating a dedicated worker from a blob URL works immediately before revoking.');
+
+promise_test(async t => {
+  const run_result = false;
+  const blob_contents = `
+let constructedRequest = false;
+try {
+  new Request("./file.js");
+  constructedRequest = true;
+} catch (e) {}
+self.postMessage(constructedRequest);
+`;
+  const blob = new Blob([blob_contents]);
+  const url = URL.createObjectURL(blob);
+
+  const worker = new Worker(url);
+  const reply = await message_from_port(worker);
+  assert_equals(reply, run_result, "Should not be able to resolve request with relative file path in blob");
+}, 'Blob URLs should not resolve relative to document base URL.');
diff --git a/test/fixtures/wpt/workers/dedicated-worker-in-data-url-context.window.js b/test/fixtures/wpt/workers/dedicated-worker-in-data-url-context.window.js
new file mode 100644
index 000000000000..124914012dbb
--- /dev/null
+++ b/test/fixtures/wpt/workers/dedicated-worker-in-data-url-context.window.js
@@ -0,0 +1,111 @@
+// META: title=data URL dedicated worker in data URL context
+// META: script=/service-workers/service-worker/resources/test-helpers.sub.js
+const mimeType = 'application/javascript';
+
+// Tests creating a dedicated worker in a data URL iframe.
+promise_test(async t => {
+  const nestedWorkerScriptURL =
+      new URL('/workers/support/post-message-on-load-worker.js', location.href);
+
+  // This code will be executed in a data URL iframe. The iframe tries to create
+  // a dedicated worker from |nestedWorkerScriptURL|, but that should result in
+  // a failure. This is because the data URL iframe has an opaque origin, and
+  // script fetch is handled as a cross-origin request.
+  const frameCode = `
+      <script>
+      try {
+        const worker = new Worker('${nestedWorkerScriptURL}');
+        worker.onmessage = e => {
+          window.parent.postMessage(
+              'Worker construction unexpectedly succeeded', '*');
+        };
+        worker.onerror = e => window.parent.postMessage('PASS', '*');
+      } catch (e) {
+        // Cross-origin request should asynchronously fail during worker script
+        // fetch because its request mode is 'same-origin'.
+        window.parent.postMessage(
+            'Worker construction unexpectedly synchronously failed', '*');
+      }
+      </script>
+  `;
+
+  const p = new Promise(r => window.onmessage = e => r(e.data));
+  const frame = await with_iframe(`data:text/html;base64,${btoa(frameCode)}`);
+  const result = await p;
+  assert_equals(result, 'PASS');
+}, 'Create a dedicated worker in a data url frame');
+
+// Tests creating a dedicated worker in a data URL dedicated worker (i.e.,
+// nested dedicated worker).
+promise_test(async t => {
+  const nestedWorkerScriptURL =
+      new URL('/workers/support/post-message-on-load-worker.js', location.href);
+
+  // This code will be executed in a data URL dedicated worker. The worker tries
+  // to create a nested dedicated worker from |nestedWorkerScriptURL|, but that
+  // should result in a failure. This is because the data URL dedicated worker
+  // has an opaque origin, and script fetch is handled as a cross-origin
+  // request.
+  const workerCode = `
+      try {
+        const worker = new Worker('${nestedWorkerScriptURL}');
+        worker.onmessage =
+            e => postMessage('Worker construction unexpectedly succeeded');
+        worker.onerror = e => postMessage('PASS');
+      } catch (e) {
+        // Cross-origin request should asynchronously fail during worker script
+        // fetch because its request mode is 'same-origin'.
+        postMessage('Worker construction unexpectedly synchronously failed');
+      }
+  `;
+
+  const result = await new Promise((resolve, reject) => {
+    const worker = new Worker(`data:${mimeType};base64,${btoa(workerCode)}`);
+    worker.onmessage = e => resolve(e.data);
+    worker.onerror = e => reject(e.message);
+  });
+  assert_equals(result, 'PASS');
+}, 'Create a dedicated worker in a data url dedicated worker');
+
+// Tests creating a data URL dedicated worker in a data URL iframe.
+promise_test(async t => {
+  // This code will be executed in a data URL iframe. The iframe tries to create
+  // a data URL dedicated worker. Fetching a data URL from the data URL iframe
+  // whose origin is opaque is allowed, so the worker construction should
+  // succeed. The iframe posts the result to the parent frame.
+  const frameCode = `
+      <script>
+      const worker = new Worker('data:${mimeType},postMessage("PASS");');
+      worker.onmessage = e => window.parent.postMessage(e.data, '*');
+      worker.onerror = e => {
+        window.parent.postMessage('FAIL: ' + e.message, '*');
+      };
+      </script>
+  `;
+
+  const p = new Promise(r => window.onmessage = e => r(e.data));
+  const frame = await with_iframe(`data:text/html;base64,${btoa(frameCode)}`);
+  const result = await p;
+  assert_equals(result, 'PASS');
+}, 'Create a data url dedicated worker in a data url frame');
+
+// Tests creating a data URL dedicated worker in a data URL dedicated worker
+// (i.e., nested dedicated worker).
+promise_test(async t => {
+  // This code will be executed in a data URL dedicated worker. The worker tries
+  // to create a nested data URL dedicated worker. Fetching a data URL from the
+  // data URL dedicated worker is allowed, so the worker construction should
+  // succeed. The worker posts the result to the parent frame.
+  const workerCode = `
+      const worker = new Worker('data:${mimeType},postMessage("PASS");');
+      worker.onmessage = e => postMessage(e.data);
+      worker.onerror = e => postMessage('FAIL: ' + e.message);
+  `;
+
+  const result = await new Promise((resolve, reject) => {
+    const worker = new Worker(`data:${mimeType};base64,${btoa(workerCode)}`);
+    worker.onmessage = e => resolve(e.data);
+    worker.onerror = e => reject(e.message);
+  });
+  assert_equals(result, 'PASS');
+}, 'Create a data url dedicated worker in a data url dedicated worker');
diff --git a/test/fixtures/wpt/workers/dedicated-worker-parse-error-failure.html b/test/fixtures/wpt/workers/dedicated-worker-parse-error-failure.html
new file mode 100644
index 000000000000..ed475dab105f
--- /dev/null
+++ b/test/fixtures/wpt/workers/dedicated-worker-parse-error-failure.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: parse error failure</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script> setup({allow_uncaught_exception: true}); </script>
+<script src="./support/check-error-arguments.js"></script>
+<script>
+
+promise_test(async () => {
+  const scriptURL = 'modules/resources/syntax-error.js';
+  const worker = new Worker(scriptURL, { type: 'classic' });
+  const args = await new Promise(resolve =>
+      worker.onerror = (...args) => resolve(args));
+  window.checkErrorArguments(args);
+}, 'Classic worker construction for script with syntax error should dispatch ' +
+   'an event named error.');
+
+promise_test(async () => {
+  const scriptURL = 'modules/resources/static-import-worker.js';
+  const worker = new Worker(scriptURL, { type: 'classic' });
+  worker.postMessage('Send message for tests from main script.');
+  const args = await new Promise(resolve =>
+      worker.onerror = (...args) => resolve(args));
+  window.checkErrorArguments(args);
+}, 'Static import on classic worker should dispatch an event named error.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/dedicated-worker-runtime-error-is-not-parse-error.html b/test/fixtures/wpt/workers/dedicated-worker-runtime-error-is-not-parse-error.html
new file mode 100644
index 000000000000..94e470c5dc0d
--- /dev/null
+++ b/test/fixtures/wpt/workers/dedicated-worker-runtime-error-is-not-parse-error.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: runtime errors are not parse errors</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+promise_test(async () => {
+  const worker = new Worker('support/eval-syntax-error.js');
+  const event = await new Promise(resolve => {
+    worker.onerror = e => { e.preventDefault(); resolve(e); };
+  });
+  assert_true(event instanceof ErrorEvent,
+      'eval() syntax error should dispatch ErrorEvent, not Event');
+}, 'eval() with syntax error dispatches ErrorEvent at Worker');
+
+promise_test(async () => {
+  const worker = new Worker('support/json-parse-error.js');
+  const event = await new Promise(resolve => {
+    worker.onerror = e => { e.preventDefault(); resolve(e); };
+  });
+  assert_true(event instanceof ErrorEvent,
+      'JSON.parse() error should dispatch ErrorEvent, not Event');
+}, 'JSON.parse() error dispatches ErrorEvent at Worker');
+
+promise_test(async () => {
+  const worker = new Worker('modules/resources/syntax-error.js', { type: 'classic' });
+  const event = await new Promise(resolve => {
+    worker.onerror = e => { e.preventDefault(); resolve(e); };
+  });
+  assert_equals(event.constructor, Event,
+      'Script parse error should dispatch Event, not ErrorEvent');
+  assert_false(event instanceof ErrorEvent,
+      'Script parse error should not be an ErrorEvent');
+}, 'Script parse error dispatches plain Event at Worker');
+
+</script>
diff --git a/test/fixtures/wpt/workers/examples/fetch_tests_from_worker.html b/test/fixtures/wpt/workers/examples/fetch_tests_from_worker.html
new file mode 100644
index 000000000000..5ac765c7eeae
--- /dev/null
+++ b/test/fixtures/wpt/workers/examples/fetch_tests_from_worker.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<!--
+  This file is an example of a hand-written test using
+  fetch_tests_from_worker().
+  Unlike *.any.js or *.worker.js tests, fetch_tests_from_worker.html/js files
+  are manually written and no generated glue code are involved.
+-->
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+fetch_tests_from_worker(new Worker("fetch_tests_from_worker.js"));
+
+// If you want to test on SharedWorker,
+// fetch_tests_from_worker(new SharedWorker("fetch_tests_from_worker.js"));
+
+// See ServiceWorkersHandler in
+// https://github.com/web-platform-tests/wpt/blob/master/tools/serve/serve.py
+// for the generated snippet used in .any.js for service workers.
+// Note: when testing service workers, also add ".https." file flag in the
+// main HTML's file name to run the test on HTTPS.
+</script>
diff --git a/test/fixtures/wpt/workers/examples/fetch_tests_from_worker.js b/test/fixtures/wpt/workers/examples/fetch_tests_from_worker.js
new file mode 100644
index 000000000000..01ba12a622f3
--- /dev/null
+++ b/test/fixtures/wpt/workers/examples/fetch_tests_from_worker.js
@@ -0,0 +1,28 @@
+// This file is an example of a hand-written test using
+// fetch_tests_from_worker().
+// Unlike *.any.js or *.worker.js tests, fetch_tests_from_worker.html/js files
+// are manually written and no generated glue code are involved.
+
+// fetch_tests_from_worker() requires testharness.js both on the parent
+// document and on the worker.
+importScripts("/resources/testharness.js");
+
+// ============================================================================
+
+// Test body.
+test(() => {
+    assert_equals(1, 1, "1 == 1");
+  },
+  "Test that should pass"
+);
+
+// ============================================================================
+
+// `done()` is always needed at the bottom for dedicated workers and shared
+// workers, even if you write `async_test()` or `promise_test()`.
+// `async_test()` and `promise_test()` called before this `done()`
+// will continue and assertions/failures after this `done()` are not ignored.
+// See
+// https://web-platform-tests.org/writing-tests/testharness-api.html#determining-when-all-tests-are-complete
+// for details.
+done();
diff --git a/test/fixtures/wpt/workers/examples/general.any.js b/test/fixtures/wpt/workers/examples/general.any.js
new file mode 100644
index 000000000000..cb5d61eafbec
--- /dev/null
+++ b/test/fixtures/wpt/workers/examples/general.any.js
@@ -0,0 +1,34 @@
+// META: global=worker
+
+// See
+// https://web-platform-tests.org/writing-tests/testharness.html#multi-global-tests
+// for how to specify in which global scopes to run this tests,
+// how to specify additional scripts needed, etc.
+
+// testharness.js is imported (via importScripts()) by generated glue code by
+// WPT server.
+// See ClassicWorkerHandler in
+// https://github.com/web-platform-tests/wpt/blob/master/tools/serve/serve.py.
+
+// ============================================================================
+
+// Test body.
+// .any.js tests are always testharness.js-based.
+test(() => {
+    assert_equals(1, 1, "1 == 1");
+  },
+  "Test that should pass"
+);
+
+test(() => {
+    // This file is "general.any.js" but the worker top-level script is
+    // "general.any.worker.js", which is generated by the WPT server.
+    assert_equals(location.pathname, "/workers/examples/general.any.worker.js");
+  },
+  "Worker top-level script is a generated script."
+);
+
+// done() is NOT needed in .any.js tests, as it is called by generated
+// glue code by the WPT server.
+// See ClassicWorkerHandler in
+// https://github.com/web-platform-tests/wpt/blob/master/tools/serve/serve.py.
diff --git a/test/fixtures/wpt/workers/examples/general.worker.js b/test/fixtures/wpt/workers/examples/general.worker.js
new file mode 100644
index 000000000000..aeca236781bf
--- /dev/null
+++ b/test/fixtures/wpt/workers/examples/general.worker.js
@@ -0,0 +1,35 @@
+// This file is an example of a test using *.worker.js mechanism.
+// The parent document that calls fetch_tests_from_worker() is auto-generated
+// but there are no generated code in the worker side.
+
+// fetch_tests_from_worker() requires testharness.js both on the parent
+// document and on the worker.
+importScripts("/resources/testharness.js");
+
+// ============================================================================
+
+// Test body.
+test(() => {
+    assert_equals(1, 1, "1 == 1");
+  },
+  "Test that should pass"
+);
+
+test(() => {
+    // This file is "general.worker.js" and this file itself is the worker
+    // top-level script (which is different from the .any.js case).
+    assert_equals(location.pathname, "/workers/examples/general.worker.js");
+  },
+  "Worker top-level script is the .worker.js file itself."
+);
+
+// ============================================================================
+
+// `done()` is always needed at the bottom for dedicated workers and shared
+// workers, even if you write `async_test()` or `promise_test()`.
+// `async_test()` and `promise_test()` called before this `done()`
+// will continue and assertions/failures after this `done()` are not ignored.
+// See
+// https://web-platform-tests.org/writing-tests/testharness-api.html#determining-when-all-tests-are-complete
+// for details.
+done();
diff --git a/test/fixtures/wpt/workers/examples/onconnect.any.js b/test/fixtures/wpt/workers/examples/onconnect.any.js
new file mode 100644
index 000000000000..d43a9921833d
--- /dev/null
+++ b/test/fixtures/wpt/workers/examples/onconnect.any.js
@@ -0,0 +1,4 @@
+// META: global=sharedworker
+const t = async_test("onconnect is called");
+onconnect = t.step_func_done((event) => {
+});
diff --git a/test/fixtures/wpt/workers/importscripts_mime.any.js b/test/fixtures/wpt/workers/importscripts_mime.any.js
new file mode 100644
index 000000000000..bfdfc191fd3e
--- /dev/null
+++ b/test/fixtures/wpt/workers/importscripts_mime.any.js
@@ -0,0 +1,52 @@
+// META: global=worker
+//
+// Tentative test for https://github.com/whatwg/html/issues/3255
+
+let test_cases = [
+  // Supported mimetypes:
+  ["text/javascript", true],
+  ["application/javascript", true],
+  ["text/ecmascript", true],
+
+  // Blocked mimetpyes:
+  ["image/png", false],
+  ["text/csv", false],
+  ["video/mpeg", false],
+
+  // Legacy mimetypes:
+  ["text/html", false],
+  ["text/plain", false],
+  ["application/xml", false],
+  ["application/octet-stream", false],
+
+  // Potato mimetypes:
+  ["text/potato", false],
+  ["potato/text", false],
+  ["aaa/aaa", false],
+  ["zzz/zzz", false],
+
+  // Parameterized mime types:
+  ["text/javascript; charset=utf-8", true],
+  ["text/javascript;charset=utf-8", true],
+  ["text/javascript;bla;bla", true],
+  ["text/csv; charset=utf-8", false],
+  ["text/csv;charset=utf-8", false],
+  ["text/csv;bla;bla", false],
+
+  // Funky capitalization:
+  ["Text/html", false],
+  ["text/Html", false],
+  ["TeXt/HtMl", false],
+  ["TEXT/HTML", false],
+];
+
+for (const [mimeType, isScriptType] of test_cases) {
+  test(t => {
+    let import_url = "/workers/support/imported_script.py?mime=" + mimeType;
+    if (isScriptType) {
+      assert_equals(undefined, importScripts(import_url));
+    } else {
+      assert_throws_dom("NetworkError", _ => { importScripts(import_url) })
+    }
+  }, "importScripts() requires scripty MIME types: " + mimeType + " is " + (isScriptType ? "allowed" : "blocked") + ".");
+}
diff --git a/test/fixtures/wpt/workers/importscripts_mime_local.any.js b/test/fixtures/wpt/workers/importscripts_mime_local.any.js
new file mode 100644
index 000000000000..62d690d8af0e
--- /dev/null
+++ b/test/fixtures/wpt/workers/importscripts_mime_local.any.js
@@ -0,0 +1,66 @@
+// META: global=dedicatedworker,sharedworker
+//
+// Tests for https://github.com/whatwg/html/issues/8869
+
+importScripts("/resources/testharness.js");
+
+let test_cases = [
+  // Supported mimetypes:
+  ["text/javascript", true],
+  ["application/javascript", true],
+  ["text/ecmascript", true],
+
+  // Blocked mimetpyes:
+  ["image/png", false],
+  ["text/csv", false],
+  ["video/mpeg", false],
+
+  // Legacy mimetypes:
+  ["text/html", false],
+  ["text/plain", false],
+  ["application/xml", false],
+  ["application/octet-stream", false],
+
+  // Potato mimetypes:
+  ["text/potato", false],
+  ["potato/text", false],
+  ["aaa/aaa", false],
+  ["zzz/zzz", false],
+
+  // Parameterized mime types:
+  ["text/javascript; charset=utf-8", true],
+  ["text/javascript;charset=utf-8", true],
+  ["text/javascript;bla;bla", true],
+  ["text/csv; charset=utf-8", false],
+  ["text/csv;charset=utf-8", false],
+  ["text/csv;bla;bla", false],
+
+  // Funky capitalization:
+  ["Text/html", false],
+  ["text/Html", false],
+  ["TeXt/HtMl", false],
+  ["TEXT/HTML", false],
+];
+
+for (const [mimeType, isScriptType] of test_cases) {
+  test(t => {
+    let import_url = `data:${ mimeType },`;
+    if (isScriptType) {
+      assert_equals(undefined, importScripts(import_url));
+    } else {
+      assert_throws_dom("NetworkError", _ => { importScripts(import_url) })
+    }
+  }, "importScripts() requires scripty MIME types for data: URLs: " + mimeType + " is " + (isScriptType ? "allowed" : "blocked") + ".");
+}
+
+for (const [mimeType, isScriptType] of test_cases) {
+  test(t => {
+    let import_url = URL.createObjectURL(new Blob([""], { type: mimeType }));
+    if (isScriptType) {
+      assert_equals(undefined, importScripts(import_url));
+    } else {
+      assert_throws_dom("NetworkError", _ => { importScripts(import_url) })
+    }
+  }, "importScripts() requires scripty MIME types for blob: URLs: " + mimeType + " is " + (isScriptType ? "allowed" : "blocked") + ".");
+}
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/EventTarget.worker.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/EventTarget.worker.js
new file mode 100644
index 000000000000..954c46c07eca
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/EventTarget.worker.js
@@ -0,0 +1,23 @@
+importScripts("/resources/testharness.js");
+
+test(function(t) {
+    var i = 0;
+    addEventListener("message", function listener(evt) {
+        t.step(function() {
+            ++i;
+            removeEventListener("message", listener, true);
+        });
+    }, true);
+    self.dispatchEvent(new Event("message"));
+    self.dispatchEvent(new Event("message"));
+    assert_equals(i, 1);
+}, "removeEventListener");
+
+test(function() {
+    addEventListener("message", this.step_func(function(evt) {
+        assert_equals(evt.target, self);
+    }), true);
+    self.dispatchEvent(new Event("message"));
+}, "target");
+
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/WEB_FEATURES.yml
new file mode 100644
index 000000000000..b4d9c5323522
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/onmessage.worker.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/onmessage.worker.js
new file mode 100644
index 000000000000..6f285caac385
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/onmessage.worker.js
@@ -0,0 +1,40 @@
+importScripts("/resources/testharness.js");
+
+test(function() {
+  self.onmessage = 1;
+  assert_equals(self.onmessage, null,
+                "attribute should return null after being set to a primitive");
+}, "Setting onmessage to 1");
+
+test(function() {
+  var object = {
+    handleEvent: this.unreached_func()
+  };
+  self.onmessage = object;
+  assert_equals(self.onmessage, object,
+                "attribute should return the object it was set to.");
+
+  self.dispatchEvent(new Event("message"));
+}, "Setting onmessage to an object");
+
+test(function() {
+  var triggered = false;
+  var f = function(e) { triggered = true; };
+  self.onmessage = f;
+  assert_equals(self.onmessage, f,
+                "attribute should return the function it was set to.");
+
+  self.dispatchEvent(new Event("message"));
+  assert_true(triggered, "event handler should have been triggered");
+}, "Setting onmessage to a function");
+
+
+test(function() {
+  assert_not_equals(self.onmessage, null,
+                    "attribute should not return null after being set to a function");
+  self.onmessage = 1;
+  assert_equals(self.onmessage, null,
+                "attribute should return null after being set to a primitive");
+}, "Setting onmessage to 1 (again)");
+
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/WEB_FEATURES.yml
new file mode 100644
index 000000000000..6eea69ad8a80
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [postmessage]
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/event-ports-dedicated.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/event-ports-dedicated.html
new file mode 100644
index 000000000000..be89478786b6
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/event-ports-dedicated.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<title>e.ports in dedicated worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+(async_test()).step(function() {
+  var worker = new Worker('event-ports-dedicated.js');
+  worker.postMessage(1);
+  worker.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/event-ports-dedicated.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/event-ports-dedicated.js
new file mode 100644
index 000000000000..c5cc9f8d9f58
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/event-ports-dedicated.js
@@ -0,0 +1,3 @@
+onmessage = function(e) {
+  postMessage(e.ports instanceof Array && e.ports.length === 0);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/imagedata-cloned-canvas-in-array.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/imagedata-cloned-canvas-in-array.html
new file mode 100644
index 000000000000..7c019a999348
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/imagedata-cloned-canvas-in-array.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<title>posting an imagedata (from a cloned canvas) in an array</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+(async_test()).step(function() {
+  var worker = new Worker('imagedata-cloned-canvas-in-array.js');
+  var canvas = document.createElement('canvas');
+  var clone = canvas.cloneNode(true);
+  var ctx = clone.getContext('2d');
+  var imagedata = ctx.getImageData(0, 0, 300, 150);
+  worker.postMessage([imagedata]);
+  worker.onmessage = this.step_func(function(e) {
+    var pixeldata = e.data.data;
+    for (var i = 0; i < pixeldata.length; i++) {
+      assert_equals(pixeldata[i], (i % 4 == 0) ? 128 : 0);
+    }
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/imagedata-cloned-canvas-in-array.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/imagedata-cloned-canvas-in-array.js
new file mode 100644
index 000000000000..76eaee366c78
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/imagedata-cloned-canvas-in-array.js
@@ -0,0 +1,10 @@
+onmessage = function(e) {
+  function processPixels(imagedata) {
+    var pixeldata = imagedata.data;
+    for (var i = 0; i < pixeldata.length; i = i+4) {
+      pixeldata[i] = 128;
+    }
+    postMessage(imagedata);
+  }
+  processPixels(e.data[0]);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/message-event.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/message-event.html
new file mode 100644
index 000000000000..91ec632685f3
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/message-event.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<title>'message' event properties</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-dedicatedworkerglobalscope-postmessage">
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<div id=log></div>
+<script>
+async_test("Properties of the 'message' event").step(function() {
+  var worker = new Worker("message-event.js");
+  worker.onmessage = this.step_func_done(function (evt) {
+    assert_class_string(evt, "MessageEvent");
+    assert_equals(evt.type, "message");
+    assert_false(evt.bubbles, "bubbles should be false");
+    assert_false(evt.cancelable, "cancelable should be false");
+    assert_equals(evt.data, "test");
+    assert_equals(evt.origin, "", "origin");
+    assert_equals(evt.lastEventId, "", "lastEventId");
+    assert_equals(evt.source, null, "source");
+    assert_array_equals(evt.ports, [], "ports");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/message-event.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/message-event.js
new file mode 100644
index 000000000000..54a250005e8d
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/message-event.js
@@ -0,0 +1 @@
+postMessage("test");
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/return-value.worker.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/return-value.worker.js
new file mode 100644
index 000000000000..521251699a08
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/return-value.worker.js
@@ -0,0 +1,8 @@
+importScripts("/resources/testharness.js");
+
+test(function() {
+  var rv = postMessage(1);
+  assert_equals(rv, undefined);
+}, "return value of postMessage");
+
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-dictionary.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-dictionary.html
new file mode 100644
index 000000000000..1749644908f2
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-dictionary.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<title>Using dictionary as postMessage's second argument</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+(async_test()).step(function() {
+  var worker = new Worker('second-argument-dictionary.js');
+  var ab = new ArrayBuffer(1);
+  worker.postMessage(ab, {transfer: [ab]});
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data.byteLength, 1);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-dictionary.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-dictionary.js
new file mode 100644
index 000000000000..0cb80f8faeb1
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-dictionary.js
@@ -0,0 +1,7 @@
+onmessage = (event) => {
+  try {
+    postMessage(event.data, {transfer: [event.data]});
+  } catch(e) {
+    postMessage(''+e);
+  }
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null-in-array.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null-in-array.html
new file mode 100644
index 000000000000..8db06b411642
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null-in-array.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>Using [null] in postMessage's second argument</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+(async_test()).step(function() {
+  var worker = new Worker('second-argument-null-in-array.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null-in-array.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null-in-array.js
new file mode 100644
index 000000000000..95a094234b7f
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null-in-array.js
@@ -0,0 +1,5 @@
+try {
+  postMessage(false, [null]);
+} catch(e) {
+  postMessage(e instanceof TypeError);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null.html
new file mode 100644
index 000000000000..68d9caabc50e
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>Using null in postMessage's second argument</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+(async_test()).step(function() {
+  var worker = new Worker('second-argument-null.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(1, e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null.js
new file mode 100644
index 000000000000..6f6f9e799ff1
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null.js
@@ -0,0 +1,5 @@
+try {
+  postMessage(1, null);
+} catch(e) {
+  postMessage(e instanceof TypeError);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-undefined.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-undefined.html
new file mode 100644
index 000000000000..c7dcb3c5c0f3
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-undefined.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>Using undefined in postMessage's second argument</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+(async_test()).step(function() {
+  var worker = new Worker('second-argument-undefined.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 1);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-undefined.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-undefined.js
new file mode 100644
index 000000000000..6f11443c4a88
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-undefined.js
@@ -0,0 +1,5 @@
+try {
+  postMessage(1, undefined);
+} catch(e) {
+  postMessage(''+e);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/setting-postMessage.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/setting-postMessage.html
new file mode 100644
index 000000000000..5b3e014e1e08
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/setting-postMessage.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>setting postMessage</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+(async_test()).step(function() {
+  var worker = new Worker('setting-postMessage.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/setting-postMessage.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/setting-postMessage.js
new file mode 100644
index 000000000000..5426ebde0d4c
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/setting-postMessage.js
@@ -0,0 +1,3 @@
+var x = postMessage;
+postMessage = 1;
+x(postMessage == 1);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-imagedata.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-imagedata.html
new file mode 100644
index 000000000000..c7fbb0f9560d
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-imagedata.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<title>structured clone of ImageData</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+(async_test()).step(function() {
+  var worker = new Worker('structured-clone-imagedata.js');
+  var ctx = document.createElement('canvas').getContext('2d');
+  var imagedata = ctx.getImageData(0, 0, 300, 150);
+  worker.postMessage(imagedata);
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(''+e.data, '[object ImageData]');
+    assert_equals(e.data.data[0], 128);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-imagedata.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-imagedata.js
new file mode 100644
index 000000000000..04cd7eea5ba8
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-imagedata.js
@@ -0,0 +1,5 @@
+onmessage = function(e) {
+  var imagedata = e.data;
+  imagedata.data[0] = 128;
+  postMessage(imagedata);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-message.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-message.html
new file mode 100644
index 000000000000..edf4fb7e0e5c
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-message.html
@@ -0,0 +1,38 @@
+<!doctype html>
+<title>structured clone of message</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+var wrapper_test = async_test();
+var tests = [
+      {test:async_test('undefined'), check:function(e) { assert_equals(e.data, undefined); }},
+      {test:async_test('null'), check:function(e) { assert_equals(e.data, null); }},
+      {test:async_test('false'), check:function(e) { assert_false(e.data); }},
+      {test:async_test('true'), check:function(e) { assert_true(e.data); }},
+      {test:async_test('1'), check:function(e) { assert_equals(e.data, 1); }},
+      {test:async_test('NaN'), check:function(e) { assert_equals(e.data, NaN); }},
+      {test:async_test('Infinity'), check:function(e) { assert_equals(e.data, Infinity); }},
+      {test:async_test('string'), check:function(e) { assert_equals(e.data, 'foo'); }},
+      {test:async_test('date'), check:function(e) { assert_equals(e.data instanceof Date, true); }},
+      {test:async_test('regexp'), check:function(e) { assert_equals('' + e.data, '/foo/'); assert_equals(e.data instanceof RegExp, true, 'e.data instanceof RegExp'); }},
+      {test:async_test('self'), check:function(e) { assert_equals(e.data, null); }},
+      {test:async_test('array'), check:function(e) { assert_array_equals(e.data, [undefined, null, false, true, 1, NaN, Infinity, 'foo', null, null]); }},
+      {test:async_test('object'), check:function(e) { assert_object_equals(e.data, {a:undefined, b:null, c:false, d:true, e:1, f:NaN, g:Infinity, h:'foo', k:null, n:null}); }},
+      {test:async_test('error'), check:function(e) { assert_equals(e.data, null, 'new Error()'); }},
+      {test:wrapper_test, check:function(e) { assert_unreached(); }}
+];
+// make wrapper_test pass after 500ms
+setTimeout(tests[tests.length-1].test.step_func(function() {
+  this.done();
+}), 500);
+
+wrapper_test.step(function() {
+  var worker = new Worker('structured-clone-message.js');
+  var i = 0;
+  worker.onmessage = function(e) {
+    tests[i].test.step(function() { tests[i].check(e); this.done(); });
+    i++;
+  };
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-message.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-message.js
new file mode 100644
index 000000000000..db456e1fbaec
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-message.js
@@ -0,0 +1,14 @@
+var err = new Error('foo');
+var date = new Date();
+// commented out bits are either tested elsewhere or not supported yet. or uncloneable.
+var tests = [undefined, null, false, true, 1, NaN, Infinity, 'foo', date, /foo/, /* ImageData, File, FileData, FileList,*/ null/*self*/,
+              [undefined, null, false, true, 1, NaN, Infinity, 'foo', /*date, /foo/,*/ null/*self*/, /*[], {},*/ null/*err*/],
+              {a:undefined, b:null, c:false, d:true, e:1, f:NaN, g:Infinity, h:'foo', /*i:date, j:/foo/,*/ k:null/*self*/, /*l:[], m:{},*/ n:null/*err*/},
+            null/*err*/];
+for (var i = 0; i < tests.length; ++i) {
+  try {
+    postMessage(tests[i]);
+  } catch(e) {
+    postMessage(''+e);
+  }
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/WEB_FEATURES.yml
new file mode 100644
index 000000000000..73744331853b
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [shared-workers]
diff --git a/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/getting.html b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/getting.html
new file mode 100644
index 000000000000..c3a52d12e8a3
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/getting.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>getting name</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+var tests = [['getting.js#1', ''], ['getting.js#2', 'a'], ['getting.js#3', -0]];
+tests.forEach(function(t) {
+  async_test(function() {
+    var w = new SharedWorker(t[0], t[1]);
+    w.port.onmessage = this.step_func(function(e) {
+      assert_true(e.data);
+      this.done();
+    });
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/getting.js b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/getting.js
new file mode 100644
index 000000000000..acf89ca6f678
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/getting.js
@@ -0,0 +1,9 @@
+addEventListener('connect', function(e) {
+  var passed;
+  switch (location.hash) {
+    case '#1': passed = name == ''; break;
+    case '#2': passed = name == 'a'; break;
+    case '#3': passed = name == '0'; break;
+  }
+  e.ports[0].postMessage(passed);
+}, false);
diff --git a/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/setting.html b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/setting.html
new file mode 100644
index 000000000000..ddd856971019
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/setting.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<title>setting name</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var w1 = new SharedWorker('setting.js#1', 'x');
+  w1.port.addEventListener('message', this.step_func(function(e) {
+    assert_equals(e.data, 1);
+    this.done();
+  }), false);
+  w1.port.start();
+});
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/setting.js b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/setting.js
new file mode 100644
index 000000000000..c705e9c40a6d
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/setting.js
@@ -0,0 +1,4 @@
+addEventListener('connect', function(e) {
+  name = 1;
+  e.ports[0].postMessage(name);
+}, false);
diff --git a/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/onconnect.html b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/onconnect.html
new file mode 100644
index 000000000000..8a0f103d40e1
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/onconnect.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>onconnect</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var w1 = new SharedWorker('onconnect.js', '');
+  w1.port.addEventListener('message', this.step_func(function(e) {
+    assert_array_equals(e.data, ['null', 'null', 'function', '']);
+  }), false);
+  w1.port.start();
+});
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/onconnect.js b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/onconnect.js
new file mode 100644
index 000000000000..34a2be51fc47
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/onconnect.js
@@ -0,0 +1,19 @@
+var results = [];
+try {
+  self.onconnect = 1;
+  results.push(String(onconnect));
+} catch(e) {
+  results.push(''+e);
+}
+try {
+  self.onconnect = {handleEvent:function(){}};
+  results.push(String(onconnect));
+} catch(e) {
+  results.push(''+e);
+}
+var f = function(e) {
+  results.push(e.data);
+  e.ports[0].postMessage(results);
+};
+onconnect = f;
+results.push(typeof onconnect);
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/WEB_FEATURES.yml
new file mode 100644
index 000000000000..bb8d27860d8d
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/WEB_FEATURES.yml
@@ -0,0 +1,4 @@
+rules:
+- setInterval.html: [setinterval]
+- setTimeout.html: [settimeout]
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/incoming-message.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/incoming-message.html
new file mode 100644
index 000000000000..0905d07661da
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/incoming-message.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<title>close() and incoming message</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+setup({ single_test: true });
+
+var worker = new Worker('incoming-message.js');
+worker.onmessage = function(e) {
+  assert_unreached("Got message");
+};
+worker.onerror = function(e) {
+  assert_unreached("Got error");
+};
+worker.postMessage(1);
+setTimeout(done, 2000);
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/incoming-message.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/incoming-message.js
new file mode 100644
index 000000000000..b4f7e7fc0555
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/incoming-message.js
@@ -0,0 +1,5 @@
+onmessage = function(e) {
+  postMessage(1);
+  throw new Error();
+}
+close();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/sending-messages.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/sending-messages.html
new file mode 100644
index 000000000000..da7da66d25b8
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/sending-messages.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<title>close() and sending messages</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('sending-messages.js');
+  var i = 0;
+  worker.onmessage = this.step_func(function(e) {
+    i++;
+    assert_equals(e.data, i);
+    if (i == 2) {
+      this.done();
+    }
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/sending-messages.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/sending-messages.js
new file mode 100644
index 000000000000..2e0a89828880
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/sending-messages.js
@@ -0,0 +1,3 @@
+postMessage(1);
+close();
+postMessage(2);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setInterval.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setInterval.html
new file mode 100644
index 000000000000..2f0ba176d494
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setInterval.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>close() and setInterval</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+setup({ single_test: true });
+
+var worker = new Worker('setInterval.js');
+worker.onmessage = function(e) {
+  assert_unreached("Got message");
+};
+worker.onerror = function(e) {
+  assert_unreached("Got error");
+};
+setTimeout(done, 2000);
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setInterval.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setInterval.js
new file mode 100644
index 000000000000..d165d20eab47
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setInterval.js
@@ -0,0 +1,11 @@
+var interval1 = setInterval(function() {
+  clearInterval(interval1);
+  postMessage(1);
+  throw new Error();
+}, 10);
+close();
+var interval2 = setInterval(function() {
+  clearInterval(interval2);
+  postMessage(1);
+  throw new Error();
+}, 10);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setTimeout.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setTimeout.html
new file mode 100644
index 000000000000..2bddc0947f63
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setTimeout.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>close() and setTimeout</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+setup({ single_test: true });
+
+var worker = new Worker('setTimeout.js');
+worker.onmessage = function(e) {
+  assert_unreached("Got message");
+};
+worker.onerror = function(e) {
+  assert_unreached("Got error");
+};
+setTimeout(done, 2000);
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setTimeout.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setTimeout.js
new file mode 100644
index 000000000000..55eecb05570f
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setTimeout.js
@@ -0,0 +1,7 @@
+function x() {
+  postMessage(1);
+  throw new Error();
+}
+setTimeout(x, 0);
+close();
+setTimeout(x, 0);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/WEB_FEATURES.yml
new file mode 100644
index 000000000000..05c5abb31004
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/WEB_FEATURES.yml
@@ -0,0 +1,3 @@
+rules:
+- redirect-sharedworker.html: [shared-workers]
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/members.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/members.html
new file mode 100644
index 000000000000..3da6b7484d89
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/members.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<title>members of WorkerLocation</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('members.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data[0], null);
+    assert_equals(e.data[1], location.href.replace('.html', '.js'), 'href');
+    assert_equals(e.data[2], location.protocol, 'protocol');
+    assert_equals(e.data[3], location.host, 'host');
+    assert_equals(e.data[4], location.hostname, 'hostname');
+    assert_equals(e.data[5], location.port, 'port');
+    assert_equals(e.data[6], location.pathname.replace('.html', '.js'), 'pathname');
+    assert_equals(e.data[7], location.search, 'search');
+    assert_equals(e.data[8], '', 'hash');
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/members.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/members.js
new file mode 100644
index 000000000000..37235eac8319
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/members.js
@@ -0,0 +1,3 @@
+postMessage([null, location.href, location.protocol, location.host,
+             location.hostname, location.port, location.pathname,
+             location.search, location.hash]);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/post-location-members.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/post-location-members.js
new file mode 100644
index 000000000000..e850b76b6e5f
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/post-location-members.js
@@ -0,0 +1,8 @@
+postMessage([location.href,
+             location.protocol,
+             location.host,
+             location.hostname,
+             location.port,
+             location.pathname,
+             location.search,
+             location.hash]);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect-module.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect-module.html
new file mode 100644
index 000000000000..b1a14be8f751
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect-module.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<title>WorkerLocation with redirects: module dedicated workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('helper-redirect.py?fail', {type: 'module'});
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data[0], location.href.replace(/\/[^\/]+$/, '/post-location-members.js?a'));
+    assert_equals(e.data[1], location.protocol);
+    assert_equals(e.data[2], location.host);
+    assert_equals(e.data[3], location.hostname);
+    assert_equals(e.data[4], location.port);
+    assert_equals(e.data[5], location.pathname.replace(/\/[^\/]+$/, '/post-location-members.js'));
+    assert_equals(e.data[6], '?a');
+    assert_equals(e.data[7], '');
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect-sharedworker.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect-sharedworker.html
new file mode 100644
index 000000000000..978a99ac8c4e
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect-sharedworker.html
@@ -0,0 +1,9 @@
+<!doctype html>
+<title>WorkerLocation with redirects: classic shared workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+fetch_tests_from_worker(
+    new SharedWorker('/common/redirect.py?location=/workers/interfaces/WorkerGlobalScope/location/redirect.js?a'));
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect.html
new file mode 100644
index 000000000000..98a0e5476027
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect.html
@@ -0,0 +1,28 @@
+<!--
+/*
+-->
+<!doctype html>
+<title>WorkerLocation with redirects: classic dedicated workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('helper-redirect.py?fail');
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data[0], location.href.replace(/\/[^\/]+$/, '/post-location-members.js?a'));
+    assert_equals(e.data[1], location.protocol);
+    assert_equals(e.data[2], location.host);
+    assert_equals(e.data[3], location.hostname);
+    assert_equals(e.data[4], location.port);
+    assert_equals(e.data[5], location.pathname.replace(/\/[^\/]+$/, '/post-location-members.js'));
+    assert_equals(e.data[6], '?a');
+    assert_equals(e.data[7], '');
+  });
+});
+</script>
+<!--
+*/
+//-->
+
+
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect.js
new file mode 100644
index 000000000000..2db48544a2d7
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect.js
@@ -0,0 +1,7 @@
+importScripts('/resources/testharness.js');
+test(t => {
+    assert_equals(location.pathname, '/workers/interfaces/WorkerGlobalScope/location/redirect.js');
+    assert_equals(location.search, '?a');
+    assert_equals(location.hash, '');
+});
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/returns-same-object.any.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/returns-same-object.any.js
new file mode 100644
index 000000000000..dd3560f040cd
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/returns-same-object.any.js
@@ -0,0 +1,5 @@
+// META: global=worker
+
+test(function() {
+  assert_equals(location, location);
+}, 'location === location');
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/setting-members.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/setting-members.html
new file mode 100644
index 000000000000..7ea79b689704
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/setting-members.html
@@ -0,0 +1,23 @@
+<!doctype html>
+<title>setting members of WorkerLocation</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('setting-members.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data[0], null);
+    assert_equals(e.data[1], location.href.replace('.html', '.js'), 'href');
+    assert_equals(e.data[2], location.protocol, 'protocol');
+    assert_equals(e.data[3], location.host, 'host');
+    assert_equals(e.data[4], location.hostname, 'hostname');
+    assert_equals(e.data[5], location.port, 'port');
+    assert_equals(e.data[6], location.pathname.replace('.html', '.js'), 'pathname');
+    assert_equals(e.data[7], location.search, 'search');
+    assert_equals(e.data[8], '', 'hash');
+    assert_array_equals(e.data[9], [], 'number of exceptions');
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/setting-members.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/setting-members.js
new file mode 100644
index 000000000000..4c5c8a35ae88
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/setting-members.js
@@ -0,0 +1,13 @@
+var exceptions = [];
+try { location.href = 1; } catch(e) { exceptions.push('href'); }
+try { location.protocol = 1; } catch(e) { exceptions.push('protocol'); }
+try { location.host = 1; } catch(e) { exceptions.push('host'); }
+try { location.hostname = 1; } catch(e) { exceptions.push('hostname');}
+try { location.port = 1; } catch(e) { exceptions.push('port'); }
+try { location.pathname = 1; } catch(e) { exceptions.push('pathname'); }
+try { location.search = 1; } catch(e) { exceptions.push('search'); }
+try { location.hash = 1; } catch(e) { exceptions.push('hash'); }
+
+postMessage([null, location.href, location.protocol, location.host,
+             location.hostname, location.port, location.pathname,
+             location.search, location.hash, exceptions]);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/worker-separate-file.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/worker-separate-file.html
new file mode 100644
index 000000000000..ac8e64dcc886
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/worker-separate-file.html
@@ -0,0 +1,28 @@
+<!--
+/*
+-->
+<!doctype html>
+<title>location with a worker in separate file</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('post-location-members.js?a#b?c');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data[0], location.href.replace(/\/[^\/]+$/, '/post-location-members.js?a#b?c'));
+    assert_equals(e.data[1], location.protocol);
+    assert_equals(e.data[2], location.host);
+    assert_equals(e.data[3], location.hostname);
+    assert_equals(e.data[4], location.port);
+    assert_equals(e.data[5], location.pathname.replace(/\/[^\/]+$/, '/post-location-members.js'));
+    assert_equals(e.data[6], '?a');
+    assert_equals(e.data[7], '#b?c');
+    this.done();
+  });
+});
+</script>
+<!--
+*/
+//-->
+
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/WEB_FEATURES.yml
new file mode 100644
index 000000000000..b16862ba1c01
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/exception-in-onerror.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/exception-in-onerror.html
new file mode 100644
index 000000000000..5f3999db66a7
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/exception-in-onerror.html
@@ -0,0 +1,91 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+// 1. Exception is thrown somewhere in a Worker.
+//    Various contexts are tested: from worker initialization,
+//    from setTimeout, from event handlers, etc.
+// 2. WorkerGlobalScope.onerror event handler is called.
+//    (i.e. `onerror` in the worker script)
+// 3. From the event handler, another exception is thrown.
+// 4. Each of Worker.onerror handler (on the parent Document) and
+//            Worker error event listener should be called twice:
+//    once for each of the exceptions thrown in Step 1 and 2, respectively.
+//    (We don't check the ordering of two Worker.onerror calls, because
+//    browsers fires them in different orders)
+
+function prepareHandler(t, messages) {
+  const fired = {};
+  let fired_count = 0;
+  t.step_timeout(() => {
+    if (fired_count < messages.length) {
+      let error_description = 'Worker.onerror not fired for:';
+      for (const message of messages) {
+        if (!fired[message]) {
+          error_description += ' ';
+          error_description += message;
+        }
+      }
+      assert_unreached(error_description);
+    }
+  }, 2000);
+  return t.step_func(e => {
+      e.preventDefault();
+      for (const message of messages) {
+        if (!fired[message] && e.message.indexOf(message) >= 0) {
+          fired[message] = true;
+          ++fired_count;
+          if (fired_count === messages.length) {
+            // Worker.onerror is fired for all messages.
+            t.done();
+          }
+          return;
+        }
+      }
+      assert_unreached("Unexpected worker.onerror message: " + e.message);
+    });
+}
+
+function expectErrors(worker, title, messages) {
+  async_test(t => {
+      worker.addEventListener('error', prepareHandler(t, messages));
+    }, title+ ': listener');
+  async_test(t => {
+      worker.onerror = prepareHandler(t, messages);
+    }, title + ': handler');
+}
+
+for (const type of ['classic', 'module']) {
+  const workerOptions = type === 'module' ? {type: 'module'}: {};
+
+  const worker1 = new Worker(
+      'throw.js?throw-in-toplevel&throw-in-onerror',
+      workerOptions);
+  expectErrors(
+      worker1,
+      'Throw in worker initialization: ' + type,
+      ['Throw in toplevel', 'Throw in error handler']);
+
+  const worker2 = new Worker(
+      'throw.js?throw-in-setTimeout-function&throw-in-onerror', workerOptions);
+  expectErrors(
+      worker2,
+      'Throw in setTimeout(function): ' + type,
+      ['Throw in setTimeout function', 'Throw in error handler']);
+
+  const worker3 = new Worker(
+      'throw.js?throw-in-setTimeout-string&throw-in-onerror', workerOptions);
+  expectErrors(
+      worker3,
+      'Throw in setTimeout(string): ' + type,
+      ['Throw in setTimeout string', 'Throw in error handler']);
+
+  const worker4 = new Worker('throw.js?throw-in-onerror', workerOptions);
+  worker4.postMessage('foo');
+  expectErrors(
+      worker4,
+      'Throw in message handler: ' + type,
+      ['Throw in message handler', 'Throw in error handler']);
+
+}
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/handled.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/handled.html
new file mode 100644
index 000000000000..7d4b03c6cd35
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/handled.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<title>onerror, "handled"</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('handled.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(typeof e.data[0], 'string', 'first argument');
+    assert_equals(e.data[1], document.URL.replace('.html', '.js'), 'second argument');
+    assert_equals(typeof e.data[2], 'number', 'third argument');
+    assert_equals(typeof e.data[3], 'number', 'fourth argument');
+    setTimeout(this.step_func(function() {
+      this.done();
+    }), 100);
+  });
+  worker.onerror = this.step_func(function(e) {
+    assert_unreached();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/handled.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/handled.js
new file mode 100644
index 000000000000..e58fa4a51521
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/handled.js
@@ -0,0 +1,8 @@
+onerror = function(a, b, c, d) {
+  postMessage([a, b, c, d]);
+  return true; // the error is "handled"
+}
+function x() {
+  y();
+}
+x();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-classic-DOMException.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-classic-DOMException.html
new file mode 100644
index 000000000000..df8c85147509
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-classic-DOMException.html
@@ -0,0 +1,7 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./message-helper.js"></script>
+<script>
+runTest('classic', 'DOMException-TypeError');
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-classic-Error.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-classic-Error.html
new file mode 100644
index 000000000000..e026b6ebf09f
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-classic-Error.html
@@ -0,0 +1,7 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./message-helper.js"></script>
+<script>
+runTest('classic', 'Error');
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-helper.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-helper.js
new file mode 100644
index 000000000000..6271329b0314
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-helper.js
@@ -0,0 +1,61 @@
+// The error's `message` values in Worker error event handlers are tested.
+// While not explicitly specified in the HTML spec, we expect some information
+// about thrown errors (e.g. original message, the string "TypeError", etc.)
+// to appear in the `message`.
+
+function prepareHandler(t, error, expectedCount) {
+  let count = 0;
+  return t.step_func(e => {
+      e.preventDefault();
+
+      assert_regexp_match(
+          e.message,
+          /Throw in/,
+          'e.message should contain the message of the thrown error');
+
+      if (error === 'DOMException-TypeError') {
+        assert_regexp_match(e.message, /TypeError/);
+      }
+
+      ++count;
+      if (count >= expectedCount) {
+        t.done();
+      }
+    });
+}
+
+function expectErrors(worker, error, expectedCount, title) {
+  async_test(t => {
+      worker.addEventListener('error',
+                              prepareHandler(t, error, expectedCount));
+    }, title+ ': listener');
+  async_test(t => {
+      worker.onerror = prepareHandler(t, error, expectedCount);
+    }, title + ': handler');
+}
+
+function runTest(type, error) {
+  for (const location of ['toplevel',
+                          'setTimeout-function',
+                          'setTimeout-string',
+                          'onmessage',
+                          'onerror']) {
+    const worker = new Worker(
+        'throw.js?throw-in-' + location + '&error=' + error,
+        {type});
+    let expectedCount = 1;
+    if (location === 'onmessage') {
+      // This makes the worker's message handler to throw an error.
+      worker.postMessage('foo');
+    }
+    if (location === 'onerror') {
+      // This makes the worker's message handler to throw an error,
+      // AND worker's error handler to throw another error.
+      // Therefore we expect two errors here.
+      worker.postMessage('foo');
+      expectedCount = 2;
+    }
+    expectErrors(worker, error, expectedCount,
+        'Throw ' + error + ' in ' + location + ': ' + type);
+  }
+}
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-module-DOMException.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-module-DOMException.html
new file mode 100644
index 000000000000..8ed873bc3227
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-module-DOMException.html
@@ -0,0 +1,7 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./message-helper.js"></script>
+<script>
+runTest('module', 'DOMException-TypeError');
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-module-Error.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-module-Error.html
new file mode 100644
index 000000000000..046ff969d6bd
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-module-Error.html
@@ -0,0 +1,7 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./message-helper.js"></script>
+<script>
+runTest('module', 'Error');
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/not-handled.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/not-handled.html
new file mode 100644
index 000000000000..11d03d728b15
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/not-handled.html
@@ -0,0 +1,28 @@
+<!doctype html>
+<title>onerror, "not handled"</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+function createHandler(t) {
+  return t.step_func(function(e) {
+    assert_true(e instanceof ErrorEvent, 'e instanceof ErrorEvent');
+    assert_equals(typeof e.message, 'string', 'typeof e.message');
+    assert_equals(e.filename, document.URL.replace('.html', '.js'), 'e.filename');
+    assert_equals(typeof e.lineno, 'number', 'typeof e.lineno');
+    assert_equals(typeof e.colno, 'number', 'typeof e.column');
+    e.preventDefault(); // "handled"
+    t.done();
+  });
+}
+
+async_test(function(t) {
+  var worker = new Worker('not-handled.js');
+  worker.onerror = createHandler(t);
+}, 'Not handled evaluation error => Worker.onerror handler');
+
+async_test(function(t) {
+  var worker = new Worker('not-handled.js');
+  worker.addEventListener('error', createHandler(t));
+}, 'Not handled evaluation error => Worker error listener');
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/not-handled.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/not-handled.js
new file mode 100644
index 000000000000..c3254b0ba7e1
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/not-handled.js
@@ -0,0 +1,7 @@
+onerror = function(a, b, c, d) {
+  return false; // the error is "not handled"
+}
+function x() {
+  y();
+}
+x();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/propagate-to-window-onerror.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/propagate-to-window-onerror.html
new file mode 100644
index 000000000000..b3be77267971
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/propagate-to-window-onerror.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<title>onerror, "not handled" with only window.onerror defined</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+setup({
+  allow_uncaught_exception: true,
+});
+async_test(function() {
+  var worker = new Worker('propagate-to-window-onerror.js');
+  window.onerror = this.step_func(function(a, b, c, d) {
+    assert_equals(typeof a, 'string', 'first argument');
+    assert_equals(b, document.URL.replace('.html', '.js'), 'second argument');
+    assert_equals(typeof c, 'number', 'third argument');
+    assert_equals(typeof d, 'number', 'fourth argument');
+    this.done();
+    return true; // "handled"
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/propagate-to-window-onerror.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/propagate-to-window-onerror.js
new file mode 100644
index 000000000000..0daf488d6f52
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/propagate-to-window-onerror.js
@@ -0,0 +1,4 @@
+function x() {
+  y();
+}
+x();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/throw.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/throw.js
new file mode 100644
index 000000000000..704098a6d868
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/throw.js
@@ -0,0 +1,34 @@
+const params = new URL(self.location.href).searchParams;
+
+self.createError = (message) => {
+  if (params.get('error') === 'DOMException-TypeError') {
+    return new DOMException(message, 'TypeError');
+  } else {
+    return new Error(message);
+  }
+};
+
+onerror = function() {
+  if (params.has('throw-in-onerror')) {
+    throw createError('Throw in error handler');
+  }
+  return false;
+};
+onmessage = function() {
+  throw createError('Throw in message handler');
+  return false;
+};
+
+if (params.has('throw-in-toplevel')) {
+  throw createError('Throw in toplevel');
+}
+
+// We don't use step_timeout() here, because we have to test the behavior of
+// setTimeout() without wrappers.
+if (params.has('throw-in-setTimeout-function')) {
+  setTimeout(() => { throw createError('Throw in setTimeout function') }, 0);
+}
+
+if (params.has('throw-in-setTimeout-string')) {
+  setTimeout("throw createError('Throw in setTimeout string')", 0);
+}
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/self.any.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/self.any.js
new file mode 100644
index 000000000000..64b4ee2faefb
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/self.any.js
@@ -0,0 +1,19 @@
+// META: global=worker
+
+test(function() {
+  assert_equals(self, self);
+}, 'self === self');
+
+test(function() {
+  assert_true(self instanceof WorkerGlobalScope);
+}, 'self instanceof WorkerGlobalScope');
+
+test(function() {
+  assert_true('self' in self);
+}, '\'self\' in self');
+
+test(function() {
+  var x = self;
+  self = 1;
+  assert_equals(self, x);
+}, 'self = 1');
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/001.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/001.html
new file mode 100644
index 000000000000..9fe5e2b1bc7b
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/001.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>setTimeout</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('001.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 1);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/001.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/001.js
new file mode 100644
index 000000000000..bd5b7c4071c2
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/001.js
@@ -0,0 +1 @@
+setTimeout(function() { postMessage(1) }, 10);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/002.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/002.html
new file mode 100644
index 000000000000..1a10b3d0bb8d
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/002.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<title>clearTimeout</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('002.js');
+  var gotMessage = false;
+  worker.onmessage = function() { gotMessage = true; };
+  setTimeout(this.step_func(function() { assert_false(gotMessage); this.done(); }), 100);
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/002.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/002.js
new file mode 100644
index 000000000000..a96c08844202
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/002.js
@@ -0,0 +1,2 @@
+var t = setTimeout(function() { postMessage(1); }, 10);
+clearTimeout(t);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/003.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/003.html
new file mode 100644
index 000000000000..119d109b5fd2
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/003.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>setInterval</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('003.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 1);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/003.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/003.js
new file mode 100644
index 000000000000..e64e4e2179f0
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/003.js
@@ -0,0 +1 @@
+setInterval(function() { postMessage(1); }, 10);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/004.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/004.html
new file mode 100644
index 000000000000..83d7bf915fb6
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/004.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<title>clearInterval</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('004.js');
+  var i = 0;
+  worker.onmessage = function() { i++; }
+  setTimeout(this.step_func(function() { assert_equals(i, 0); this.done(); }), 100);
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/004.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/004.js
new file mode 100644
index 000000000000..e80d79a8e51b
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/004.js
@@ -0,0 +1,4 @@
+var t = setInterval(function() {
+  postMessage(1);
+}, 10);
+clearInterval(t);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/005.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/005.html
new file mode 100644
index 000000000000..2a181d55d0d9
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/005.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>setInterval when closing</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('005.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 1);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/005.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/005.js
new file mode 100644
index 000000000000..125c224e7bcf
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/005.js
@@ -0,0 +1,3 @@
+self.close();
+var t = setInterval(function() {}, 10);
+postMessage(t);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/WEB_FEATURES.yml
new file mode 100644
index 000000000000..54493da00f91
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/WEB_FEATURES.yml
@@ -0,0 +1,6 @@
+rules:
+- 003.html: [setinterval]
+- 004.html: [setinterval]
+- 005.html: [setinterval]
+- 001.html: [settimeout]
+- 002.html: [settimeout]
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/001.worker.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/001.worker.js
new file mode 100644
index 000000000000..aa86c8ef1779
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/001.worker.js
@@ -0,0 +1,7 @@
+importScripts("/resources/testharness.js");
+
+test(function() {
+  importScripts();
+});
+
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/002.worker.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/002.worker.js
new file mode 100644
index 000000000000..1cacee5ccb5e
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/002.worker.js
@@ -0,0 +1,11 @@
+importScripts("/resources/testharness.js");
+
+test(function() {
+  var ran = false;
+  assert_throws_dom("SyntaxError", function() {
+    importScripts('data:text/javascript,ran=true','http://foo bar');
+  });
+  assert_false(ran, 'first argument to importScripts ran');
+});
+
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/003.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/003.html
new file mode 100644
index 000000000000..5dcd08aa1546
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/003.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>importScripts running scripts</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('003.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, "abc");
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/003.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/003.js
new file mode 100644
index 000000000000..6e378ef20fff
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/003.js
@@ -0,0 +1,8 @@
+var x = 'a';
+try {
+  importScripts('data:text/javascript,x+="b"',
+                'data:text/javascript,x+="c"');
+} catch(e) {
+  x += "d"
+}
+postMessage(x);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/004.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/004.html
new file mode 100644
index 000000000000..62537e088814
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/004.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<title>importScripts broken script</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('004.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data[0], "first script successful. ");
+    assert_true(e.data[1], 'expected SyntaxError');
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/004.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/004.js
new file mode 100644
index 000000000000..98040d0d48df
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/004.js
@@ -0,0 +1,13 @@
+var x = '';
+var exception;
+try {
+  importScripts('data:text/javascript,x+="first script successful. "',
+                'data:text/javascript,x+="FAIL (second script). "; for(;) break;', // doesn't compile
+                'data:text/javascript,x+="FAIL (third script)"');
+} catch(ex) {
+  if (ex instanceof SyntaxError)
+    exception = true;
+  else
+    exception = String(ex);
+}
+postMessage([x, exception]);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/005.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/005.html
new file mode 100644
index 000000000000..7ebbc1be5594
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/005.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<title>importScripts separate scripts</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('005.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data[0], undefined);
+    assert_true(e.data[1]);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/005.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/005.js
new file mode 100644
index 000000000000..18c534efa9c9
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/005.js
@@ -0,0 +1,9 @@
+var x;
+var y;
+try {
+  importScripts('data:text/javascript,x={',
+                'data:text/javascript,}');
+} catch(e) {
+  y = true;
+}
+postMessage([x, y]);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/006.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/006.html
new file mode 100644
index 000000000000..aec2fb148330
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/006.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>importScripts uncaught exception</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('006.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data[0], 1);
+    assert_equals(e.data[1], 2);
+    assert_equals(e.data[2], undefined);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/006.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/006.js
new file mode 100644
index 000000000000..fc170f790c74
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/006.js
@@ -0,0 +1,11 @@
+var x;
+var y;
+var z;
+try {
+  importScripts('data:text/javascript,x=1',
+                'data:text/javascript,throw 2',
+                'data:text/javascript,z=3');
+} catch(e) {
+  y = e;
+}
+postMessage([x, y, z]);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/007.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/007.html
new file mode 100644
index 000000000000..37e888365f70
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/007.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>postMessage in importScripts</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('007.js');
+  var i = 0;
+  worker.onmessage = this.step_func(function(e) {
+    i++;
+    assert_equals(e.data, i);
+    if (i == 2)
+      this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/007.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/007.js
new file mode 100644
index 000000000000..dc85216f3df7
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/007.js
@@ -0,0 +1,2 @@
+importScripts('data:text/javascript,postMessage(1)');
+postMessage(2);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/008.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/008.html
new file mode 100644
index 000000000000..f72b79939c07
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/008.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>variables and functions crossing importScripts boundary</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('008.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/008.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/008.js
new file mode 100644
index 000000000000..c957fcd63538
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/008.js
@@ -0,0 +1,3 @@
+var log = postMessage;
+importScripts('data:text/javascript,function run() { log(true) }');
+run();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/009.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/009.html
new file mode 100644
index 000000000000..e0eb5488c2e7
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/009.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<title>variables and functions crossing importScripts boundary, take 2</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('009.js');
+  var i = 0;
+  worker.onmessage = this.step_func(function(e) {
+    i++;
+    if (i == 1) {
+      assert_true(e.data);
+    } else {
+      assert_equals(e.data, 1);
+      this.done();
+    }
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/009.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/009.js
new file mode 100644
index 000000000000..4b86f8c30308
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/009.js
@@ -0,0 +1,3 @@
+var log = postMessage;
+importScripts('data:text/javascript,function run() { for(var i = 0; i < 1000; ++i) { if (i == 500) log(true); } return 1; }');
+postMessage(run());
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/010.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/010.html
new file mode 100644
index 000000000000..a6db49c4be94
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/010.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>importScripts(undefined)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('010.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 'undefined');
+    this.done();
+  })
+  worker.onerror = this.step_func(function(e) {
+    assert_unreached(e.message);
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/010.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/010.js
new file mode 100644
index 000000000000..4ec4a3b8c753
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/010.js
@@ -0,0 +1,11 @@
+// prevent recursion
+if ('beenThere' in self) {
+  throw 'undefined stringified to the empty string';
+}
+beenThere = true;
+try {
+  importScripts(undefined);
+  postMessage(got);
+} catch(ex) {
+  postMessage(String(ex));
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/011.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/011.html
new file mode 100644
index 000000000000..1bfb23349756
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/011.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>importScripts(null)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('011.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 'null');
+    this.done();
+  });
+  worker.onerror = this.step_func(function(e) {
+    assert_unreached(e.message);
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/011.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/011.js
new file mode 100644
index 000000000000..bd6fed5c0a37
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/011.js
@@ -0,0 +1,11 @@
+// prevent recursion
+if ('beenThere' in self) {
+  throw 'null stringified to the empty string';
+}
+beenThere = true;
+try {
+  importScripts(null);
+  postMessage(got);
+} catch(ex) {
+  postMessage(String(ex));
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/012.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/012.html
new file mode 100644
index 000000000000..ab0778d0c71f
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/012.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>importScripts(1)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('012.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '1');
+    this.done();
+  });
+  worker.onerror = this.step_func(function(e) {
+    assert_unreached(e.message);
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/012.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/012.js
new file mode 100644
index 000000000000..f4c887f7df4a
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/012.js
@@ -0,0 +1,11 @@
+// prevent recursion
+if ('beenThere' in self) {
+  throw '1 stringified to the empty string';
+}
+beenThere = true;
+try {
+  importScripts(1);
+  postMessage(got);
+} catch(ex) {
+  postMessage(String(ex));
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/1 b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/1
new file mode 100644
index 000000000000..18cea4ff0f4b
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/1
@@ -0,0 +1 @@
+var got = '1';
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/1.headers b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/1.headers
new file mode 100644
index 000000000000..a17a9a3a12ce
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/1.headers
@@ -0,0 +1 @@
+Content-Type: application/javascript
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/WEB_FEATURES.yml
new file mode 100644
index 000000000000..4ab206cd6d13
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/WEB_FEATURES.yml
@@ -0,0 +1,3 @@
+rules:
+- "*.any.js": []
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/blob-url.worker.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/blob-url.worker.js
new file mode 100644
index 000000000000..71603bf314f2
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/blob-url.worker.js
@@ -0,0 +1,40 @@
+importScripts("/resources/testharness.js");
+
+function objectUrlFromScript(script) {
+  const blob = new Blob([script], { type: "text/javascript" });
+  return URL.createObjectURL(blob);
+}
+
+test((t) => {
+  self.run = false;
+  const blobScriptUrl = objectUrlFromScript(`self.run = true;`);
+  t.add_cleanup(() => URL.revokeObjectURL(blobScriptUrl));
+
+  importScripts(blobScriptUrl);
+  assert_true(self.run);
+}, "Blob URLs work on importScripts");
+
+test(() => {
+  self.run = false;
+  const blobScriptUrl = objectUrlFromScript(`self.run = true;`);
+
+  URL.revokeObjectURL(blobScriptUrl);
+
+  assert_throws_dom("NetworkError", () => {
+    importScripts(blobScriptUrl);
+  });
+  assert_false(self.run);
+}, "A revoked blob URL will fail");
+
+test(() => {
+  self.run = false;
+  const runScriptUrl = objectUrlFromScript(`self.run = true;`);
+  const revokeScriptUrl = objectUrlFromScript(
+    `URL.revokeObjectURL(${JSON.stringify(runScriptUrl)});`
+  );
+
+  importScripts(revokeScriptUrl, runScriptUrl);
+  assert_true(self.run);
+}, "Revoking a blob URL in an earlier script will not fail");
+
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/catch.sub.any.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/catch.sub.any.js
new file mode 100644
index 000000000000..52da60be91f6
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/catch.sub.any.js
@@ -0,0 +1,47 @@
+// META: global=worker
+
+const crossOrigin = "https://{{hosts[alt][]}}:{{ports[https][0]}}";
+const redirectToCrossOrigin = "/common/redirect.py?location=" + crossOrigin;
+
+test(function() {
+  assert_throws_js(SyntaxError, function() {
+    importScripts("/workers/modules/resources/syntax-error.js");
+  });
+}, "Same-origin syntax error");
+
+test(function() {
+  assert_throws_js(Error, function() {
+    importScripts("/workers/modules/resources/throw.js");
+  });
+}, "Same-origin throw");
+
+// https://html.spec.whatwg.org/C/#run-a-classic-script
+// Step 8.2. If rethrow errors is true and script's muted errors is true, then:
+// Step 8.2.2. Throw a "NetworkError" DOMException.
+test(function() {
+  assert_throws_dom("NetworkError", function() {
+    importScripts(crossOrigin +
+                  "/workers/modules/resources/syntax-error.js");
+  });
+}, "Cross-origin syntax error");
+
+test(function() {
+  assert_throws_dom("NetworkError", function() {
+    importScripts(crossOrigin +
+                  "/workers/modules/resources/throw.js");
+  });
+}, "Cross-origin throw");
+
+test(function() {
+  assert_throws_dom("NetworkError", function() {
+    importScripts(redirectToCrossOrigin +
+                  "/workers/modules/resources/syntax-error.js");
+  });
+}, "Redirect-to-cross-origin syntax error");
+
+test(function() {
+  assert_throws_dom("NetworkError", function() {
+    importScripts(redirectToCrossOrigin +
+                  "/workers/modules/resources/throw.js");
+  });
+}, "Redirect-to-Cross-origin throw");
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/null b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/null
new file mode 100644
index 000000000000..8e54b66c50ec
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/null
@@ -0,0 +1 @@
+var got = 'null';
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/null.headers b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/null.headers
new file mode 100644
index 000000000000..a17a9a3a12ce
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/null.headers
@@ -0,0 +1 @@
+Content-Type: application/javascript
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-cross-origin.sub.any.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-cross-origin.sub.any.js
new file mode 100644
index 000000000000..4fd8914856b5
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-cross-origin.sub.any.js
@@ -0,0 +1,8 @@
+// META: global=dedicatedworker,sharedworker
+// META: script=report-error-helper.js
+const crossOrigin = "https://{{hosts[alt][]}}:{{ports[https][0]}}";
+runTest(
+  crossOrigin + "/workers/modules/resources/syntax-error.js",
+  false,
+  "NetworkError"
+);
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-helper.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-helper.js
new file mode 100644
index 000000000000..7fc6d0dd64bc
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-helper.js
@@ -0,0 +1,80 @@
+setup({ allow_uncaught_exception:true });
+
+// For SyntaxError, the line in doImportScripts() is expected to be reported
+// as `e.lineno` etc. below.
+// doImportScripts() is introduced here to prevent the line number from being
+// affected by changes in runTest(), use of setTimeout(), etc.
+function doImportScripts(url) {
+  importScripts(url);
+}
+
+const t0 = async_test("WorkerGlobalScope error event: error");
+const t1 = async_test("WorkerGlobalScope error event: message");
+const t2 = async_test("WorkerGlobalScope error event: filename");
+const t3 = async_test("WorkerGlobalScope error event: lineno");
+
+function runTest(importScriptUrl, shouldUseSetTimeout, expected) {
+  self.addEventListener("error", e => {
+    if (expected === "NetworkError") {
+      t0.step_func_done(() => {
+        assert_equals(e.error.constructor, DOMException,
+            "e.error should be a DOMException")
+        assert_equals(e.error.name, "NetworkError");
+      })();
+
+      t1.step_func_done(() => {
+        assert_not_equals(e.message, "Script error.",
+            "e.message should not be muted to 'Script error.'");
+      })();
+
+      // filename, lineno etc. should NOT point to the location within
+      // `syntax-error.js` (otherwise parse errors to be muted are
+      // leaked to JavaScript).
+      // we expect they point to the caller of `importScripts()`,
+      // while this is not explicitly stated in the spec.
+      t2.step_func_done(() => {
+        assert_equals(e.filename, self.location.origin +
+            '/workers/interfaces/WorkerUtils/importScripts/report-error-helper.js');
+      })();
+      t3.step_func_done(() => {
+        assert_equals(e.lineno, 8);
+      })();
+      // We don't check `e.colno` for now, because browsers set different
+      // `colno` values.
+    } else if (expected === "SyntaxError") {
+      t0.step_func_done(() => {
+        assert_equals(e.error.constructor, SyntaxError);
+        assert_equals(e.error.name, "SyntaxError");
+      })();
+
+      t1.step_func_done(() => {
+        assert_not_equals(e.message, "Script error.",
+            "e.message should not be muted to 'Script error.'");
+      })();
+
+      // filename, lineno etc. are expected to point to the location within
+      // `syntax-error.js` because it is same-origin,
+      // while this is not explicitly stated in the spec.
+      t2.step_func_done(() => {
+        assert_equals(e.filename, self.location.origin +
+            '/workers/modules/resources/syntax-error.js');
+      })();
+      t3.step_func_done(() => {
+        assert_equals(e.lineno, 1);
+      })();
+      // We don't check `e.colno` for now, because browsers set different
+      // `colno` values.
+    }
+
+    // Because importScripts() throws, we call done() here.
+    done();
+  });
+
+  if (shouldUseSetTimeout) {
+    setTimeout(
+      () => doImportScripts(importScriptUrl),
+      0);
+  } else {
+    doImportScripts(importScriptUrl);
+  }
+}
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-redirect-to-cross-origin.sub.any.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-redirect-to-cross-origin.sub.any.js
new file mode 100644
index 000000000000..2b9600973fb8
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-redirect-to-cross-origin.sub.any.js
@@ -0,0 +1,9 @@
+// META: global=dedicatedworker,sharedworker
+// META: script=report-error-helper.js
+const crossOrigin = "https://{{hosts[alt][]}}:{{ports[https][0]}}";
+runTest(
+  "/common/redirect.py?location=" + crossOrigin +
+      "/workers/modules/resources/syntax-error.js",
+  false,
+  "NetworkError"
+);
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-same-origin.sub.any.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-same-origin.sub.any.js
new file mode 100644
index 000000000000..f7de416e1170
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-same-origin.sub.any.js
@@ -0,0 +1,7 @@
+// META: global=dedicatedworker,sharedworker
+// META: script=report-error-helper.js
+runTest(
+  "/workers/modules/resources/syntax-error.js",
+  false,
+  "SyntaxError"
+);
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-cross-origin.sub.any.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-cross-origin.sub.any.js
new file mode 100644
index 000000000000..a1bbef7bc45a
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-cross-origin.sub.any.js
@@ -0,0 +1,8 @@
+// META: global=dedicatedworker,sharedworker
+// META: script=report-error-helper.js
+const crossOrigin = "https://{{hosts[alt][]}}:{{ports[https][0]}}";
+runTest(
+  crossOrigin + "/workers/modules/resources/syntax-error.js",
+  true,
+  "NetworkError"
+);
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-redirect-to-cross-origin.sub.any.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-redirect-to-cross-origin.sub.any.js
new file mode 100644
index 000000000000..2755b337d3da
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-redirect-to-cross-origin.sub.any.js
@@ -0,0 +1,9 @@
+// META: global=dedicatedworker,sharedworker
+// META: script=report-error-helper.js
+const crossOrigin = "https://{{hosts[alt][]}}:{{ports[https][0]}}";
+runTest(
+  "/common/redirect.py?location=" + crossOrigin +
+      "/workers/modules/resources/syntax-error.js",
+  true,
+  "NetworkError"
+);
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-same-origin.sub.any.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-same-origin.sub.any.js
new file mode 100644
index 000000000000..c4f70ebec973
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-same-origin.sub.any.js
@@ -0,0 +1,7 @@
+// META: global=dedicatedworker,sharedworker
+// META: script=report-error-helper.js
+runTest(
+  "/workers/modules/resources/syntax-error.js",
+  true,
+  "SyntaxError"
+);
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/undefined b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/undefined
new file mode 100644
index 000000000000..f99ba4be744c
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/undefined
@@ -0,0 +1 @@
+var got = 'undefined';
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/undefined.headers b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/undefined.headers
new file mode 100644
index 000000000000..a17a9a3a12ce
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/undefined.headers
@@ -0,0 +1 @@
+Content-Type: application/javascript
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/002.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/002.html
new file mode 100644
index 000000000000..4c76e2b69908
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/002.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>navigator.appName</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('002.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, navigator.appName);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/002.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/002.js
new file mode 100644
index 000000000000..a5af348ef107
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/002.js
@@ -0,0 +1 @@
+postMessage(navigator.appName);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/003.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/003.html
new file mode 100644
index 000000000000..86ab5aee4896
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/003.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>navigator.appVersion</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('003.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, navigator.appVersion);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/003.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/003.js
new file mode 100644
index 000000000000..ff92f8aadb8d
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/003.js
@@ -0,0 +1 @@
+postMessage(navigator.appVersion);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/004.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/004.html
new file mode 100644
index 000000000000..93eee0095712
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/004.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>navigator.platform</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('004.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, navigator.platform);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/004.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/004.js
new file mode 100644
index 000000000000..c1b575e43c99
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/004.js
@@ -0,0 +1 @@
+postMessage(navigator.platform);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/005.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/005.html
new file mode 100644
index 000000000000..ad2899e62ead
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/005.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>navigator.userAgent</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('005.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, navigator.userAgent);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/005.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/005.js
new file mode 100644
index 000000000000..d62252d39b21
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/005.js
@@ -0,0 +1 @@
+postMessage(navigator.userAgent);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/006.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/006.html
new file mode 100644
index 000000000000..e0f7386af31c
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/006.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>navigator.onLine</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('006.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, navigator.onLine);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/006.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/006.js
new file mode 100644
index 000000000000..325fd0fbdec3
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/006.js
@@ -0,0 +1 @@
+postMessage(navigator.onLine);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/007.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/007.html
new file mode 100644
index 000000000000..8f9d38dd857a
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/007.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>readonlyness of members of Navigator</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('007.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '');
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/007.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/007.js
new file mode 100644
index 000000000000..38849bc8abc6
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/007.js
@@ -0,0 +1,11 @@
+var log = [];
+var neverEncounteredValue = "This is not the value you are looking for.";
+for (x in navigator) {
+  // skip functions, as they are writable
+  if (typeof navigator[x] === 'function') continue;
+  // this should silently fail and not throw per webidl
+  navigator[x] = neverEncounteredValue;
+  if (navigator[x] === neverEncounteredValue)
+    log.push(x);
+}
+postMessage(log.join(', '));
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/008.worker.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/008.worker.js
new file mode 100644
index 000000000000..e539d85d763d
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/008.worker.js
@@ -0,0 +1,12 @@
+"use strict";
+importScripts("/resources/testharness.js");
+test(function () {
+  for (const x in navigator) {
+    // skip functions, as they are settable
+    if (typeof navigator[x] === "function") continue;
+    assert_throws_js(TypeError, () => {
+      navigator[x] = "";
+    }, `navigator.${x} is read-only`);
+  }
+}, "navigator properties are read-only");
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/WEB_FEATURES.yml
new file mode 100644
index 000000000000..6a7232bd7f27
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/WEB_FEATURES.yml
@@ -0,0 +1,5 @@
+rules:
+- 006.html: [online, dedicated-workers]
+- 005.html: [user-agent-sniffing]
+- language.html: [language, dedicated-workers]
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/language.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/language.html
new file mode 100644
index 000000000000..535ab3a7cb98
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/language.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>navigator.language</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('language.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, navigator.language);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/language.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/language.js
new file mode 100644
index 000000000000..e94ba4dfcf16
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/language.js
@@ -0,0 +1 @@
+postMessage(navigator.language);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/modules/WEB_FEATURES.yml b/test/fixtures/wpt/workers/modules/WEB_FEATURES.yml
new file mode 100644
index 000000000000..6399a3a20323
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/WEB_FEATURES.yml
@@ -0,0 +1,3 @@
+rules:
+- dedicated-worker-*: [js-modules-workers]
+- shared-worker-*: [js-modules-shared-workers]
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-import-blob-url.any.js b/test/fixtures/wpt/workers/modules/dedicated-worker-import-blob-url.any.js
new file mode 100644
index 000000000000..e5d79add7366
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-import-blob-url.any.js
@@ -0,0 +1,26 @@
+// META: script=/workers/modules/resources/import-test-cases.js
+
+// Imports |testCase.scriptURL| on a dedicated worker loaded from a blob URL,
+// and waits until the list of imported modules is sent from the worker. Passes
+// if the list is equal to |testCase.expectation|.
+function import_blob_url_test(testCase) {
+  promise_test(async () => {
+    const importURL = new URL(testCase.scriptURL, location.href);
+    const blob = new Blob([`import "${importURL}";`],
+                          { type: 'text/javascript' });
+    const blobURL = URL.createObjectURL(blob);
+    const worker = new Worker(blobURL, { type: 'module'});
+    worker.postMessage('Send message for tests from main script.');
+    const msgEvent = await new Promise((resolve, reject) => {
+      worker.onmessage = resolve;
+      worker.onerror = error => {
+        const msg = error instanceof ErrorEvent ? error.message
+                                                : 'unknown error';
+        reject(msg);
+      };
+    });
+    assert_array_equals(msgEvent.data, testCase.expectation);
+  }, testCase.description);
+}
+
+testCases.forEach(import_blob_url_test);
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-import-csp.html b/test/fixtures/wpt/workers/modules/dedicated-worker-import-csp.html
new file mode 100644
index 000000000000..6e0051aa14ed
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-import-csp.html
@@ -0,0 +1,138 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: CSP for ES Modules</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+async function openWindow(url) {
+  const win = window.open(url, '_blank');
+  add_result_callback(() => win.close());
+  const msg_event = await new Promise(resolve => window.onmessage = resolve);
+  assert_equals(msg_event.data, 'LOADED');
+  return win;
+}
+
+function import_csp_test(
+    cspHeader, importType, expectedImportedModules, description) {
+  // Append CSP header to windowURL for static import tests since static import
+  // scripts should obey Window's CSP.
+  const windowURL = `resources/new-worker-window.html` +
+      `${importType === 'static'
+          ? '?pipe=header(Content-Security-Policy, ' + cspHeader + ')'
+          : ''}`;
+  // Append CSP header to scriptURL for dynamic import tests since dynamic
+  // import scripts should obey Worker script's response's CSP.
+  const scriptURL = `${importType}-import-remote-origin-script-worker.sub.js` +
+      `${importType === 'dynamic'
+          ? '?pipe=header(Content-Security-Policy, ' + cspHeader + ')'
+          : ''}`;
+  promise_test(async () => {
+    const win = await openWindow(windowURL);
+    // Ask the window to start a dedicated worker.
+    win.postMessage(scriptURL, '*');
+    const msg_event = await new Promise(resolve => window.onmessage = resolve);
+    assert_array_equals(msg_event.data, expectedImportedModules);
+  }, description);
+}
+
+// Tests for static import.
+//
+// Static import should obey the worker-src directive and the script-src
+// directive. If the both directives are specified, the worker-src directive
+// should be prioritized.
+//
+// Step 1: "If the result of executing 6.6.1.11 Get the effective directive for
+// request on request is "worker-src", and policy contains a directive whose
+// name is "worker-src", return "Allowed"."
+// "Note: If worker-src is present, we’ll defer to it when handling worker
+// requests."
+// https://w3c.github.io/webappsec-csp/#script-src-pre-request
+
+import_csp_test(
+    "worker-src 'self' 'unsafe-inline'",
+    "static",
+    ['ERROR'],
+    "worker-src 'self' directive should disallow cross origin static import.");
+
+import_csp_test(
+    "worker-src * 'unsafe-inline'",
+    "static",
+    ["export-on-load-script.js"],
+    "worker-src * directive should allow cross origin static import.")
+
+import_csp_test(
+    "script-src 'self' 'unsafe-inline'",
+    "static",
+    ['ERROR'],
+    "script-src 'self' directive should disallow cross origin static import.");
+
+import_csp_test(
+    "script-src * 'unsafe-inline'",
+    "static",
+    ["export-on-load-script.js"],
+    "script-src * directive should allow cross origin static import.")
+
+import_csp_test(
+    "worker-src *; script-src 'self' 'unsafe-inline'",
+    "static",
+    ["export-on-load-script.js"],
+    "worker-src * directive should override script-src 'self' directive and " +
+        "allow cross origin static import.");
+
+import_csp_test(
+    "worker-src 'self'; script-src * 'unsafe-inline'",
+    "static",
+    ['ERROR'],
+    "worker-src 'self' directive should override script-src * directive and " +
+        "disallow cross origin static import.");
+
+// For static imports on workers, the effective directive should be 'worker-src'.
+// https://w3c.github.io/webappsec-csp/#effective-directive-for-a-request
+//
+// The directive fallback list of 'worker-src' doesn't contain 'script-src-elem'
+// https://w3c.github.io/webappsec-csp/#directive-fallback-list
+import_csp_test(
+    "script-src-elem 'self' 'unsafe-inline'",
+    "static",
+    ["export-on-load-script.js"],
+    "script-src-elem 'self' directive should not take effect on static import.");
+
+// Tests for dynamic import.
+//
+// Dynamic import should obey the script-src directive instead of the worker-src
+// directive according to the specs:
+//
+// Dynamic import has the "script" destination.
+// Step 2.4: "Fetch a module script graph given url, ..., "script", ..."
+// https://html.spec.whatwg.org/multipage/webappapis.html#hostimportmoduledynamically(referencingscriptormodule,-specifier,-promisecapability)
+//
+// The "script" destination should obey the script-src CSP directive.
+// Step 2: "If request's destination is script-like:"
+// https://w3c.github.io/webappsec-csp/#script-src-pre-request
+
+import_csp_test(
+    "script-src 'self' 'unsafe-inline'",
+    "dynamic",
+    ['ERROR'],
+    "script-src 'self' directive should disallow cross origin dynamic import.");
+
+// For dynamic imports, the effective directive should be 'script-src-elem'.
+// https://w3c.github.io/webappsec-csp/#effective-directive-for-a-request
+import_csp_test(
+    "script-src-elem 'self' 'unsafe-inline'",
+    "dynamic",
+    ['ERROR'],
+    "script-src-elem 'self' directive should disallow cross origin dynamic import.");
+
+import_csp_test(
+    "script-src * 'unsafe-inline'",
+    "dynamic",
+    ["export-on-load-script.js"],
+    "script-src * directive should allow cross origin dynamic import.")
+
+import_csp_test(
+    "worker-src 'self' 'unsafe-inline'",
+    "dynamic",
+    ["export-on-load-script.js"],
+    "worker-src 'self' directive should not take effect on dynamic import.");
+</script>
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-import-data-url-cross-origin.html b/test/fixtures/wpt/workers/modules/dedicated-worker-import-data-url-cross-origin.html
new file mode 100644
index 000000000000..2f790a06a5cd
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-import-data-url-cross-origin.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: ES modules for data URL workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+const import_from_data_url_worker_test = (importType, isDataURL, expectation) => {
+  promise_test(async () => {
+    const importURL = new URL(`resources/${importType}-import-` +
+        `${isDataURL ? 'data-url' : 'script'}-block-cross-origin.js`,
+        location.href) + '?pipe=header(Access-Control-Allow-Origin, *)';
+    const dataURL = `data:text/javascript,import "${importURL}";`;
+    const worker = new Worker(dataURL, { type: 'module' });
+    worker.postMessage('Send message for tests from main script.');
+    const msgEvent = await new Promise((resolve, reject) =>{
+        worker.onmessage = resolve;
+        worker.onerror = reject;
+    }).catch(e => assert_true(false));
+    assert_array_equals(msgEvent.data,
+        expectation === 'blocked' ? ['ERROR']
+                                  : ['export-block-cross-origin.js']);
+  }, `${importType} import ${isDataURL ? 'data url' : 'script'} from data: ` +
+     `URL should be ${expectation}.`);
+}
+
+// Static import should obey the outside settings.
+// SecurityOrigin of the outside settings is decided by Window.
+import_from_data_url_worker_test('static', true, 'allowed');
+import_from_data_url_worker_test('static', false, 'allowed');
+
+
+// Dynamic import should obey the inside settings.
+// SecurityOrigin of the inside settings is a unique opaque origin.
+//
+// Data url script is cross-origin to the inside settings' SecurityOrigin, but
+// dynamic importing it is allowed.
+// https://fetch.spec.whatwg.org/#concept-main-fetch
+// Step 5: request’s current URL’s scheme is "data" [spec text]
+import_from_data_url_worker_test('dynamic', true, 'allowed');
+
+// Non-data url script is cross-origin to the inside settings' SecurityOrigin.
+// It should be blocked.
+import_from_data_url_worker_test('dynamic', false, 'blocked');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-import-data-url.any.js b/test/fixtures/wpt/workers/modules/dedicated-worker-import-data-url.any.js
new file mode 100644
index 000000000000..b837ad67da62
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-import-data-url.any.js
@@ -0,0 +1,25 @@
+// META: script=/workers/modules/resources/import-test-cases.js
+
+// Imports |testCase.scriptURL| on a dedicated worker loaded from a data URL,
+// and waits until the list of imported modules is sent from the worker. Passes
+// if the list is equal to |testCase.expectation|.
+function import_data_url_test(testCase) {
+  promise_test(async () => {
+    // The Access-Control-Allow-Origin header is necessary because a worker
+    // loaded from a data URL has a null origin and import() on the worker
+    // without the header is blocked.
+    const importURL = new URL(testCase.scriptURL, location.href) +
+        '?pipe=header(Access-Control-Allow-Origin, *)';
+    const dataURL = `data:text/javascript,import "${importURL}";`;
+
+    const worker = new Worker(dataURL, { type: 'module'});
+    worker.postMessage('Send message for tests from main script.');
+    const msgEvent = await new Promise((resolve, reject) =>{
+        worker.onmessage = resolve;
+        worker.onerror = reject;
+    }).catch(e => assert_true(false));
+    assert_array_equals(msgEvent.data, testCase.expectation);
+  }, testCase.description);
+}
+
+testCases.forEach(import_data_url_test);
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-import-failure.html b/test/fixtures/wpt/workers/modules/dedicated-worker-import-failure.html
new file mode 100644
index 000000000000..8c6beb35d36d
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-import-failure.html
@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: import failure</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script> setup({allow_uncaught_exception: true}); </script>
+<script>
+
+promise_test(async () => {
+  const scriptURL = 'resources/import-scripts-worker.js';
+  const worker = new Worker(scriptURL, { type: 'module' });
+  const msg_event = await new Promise(resolve => worker.onmessage = resolve);
+  assert_equals(msg_event.data, 'TypeError');
+}, 'importScripts() on module worker should throw an exception.');
+
+promise_test(() => {
+  const scriptURL = 'resources/non-existent-worker.js';
+  const worker = new Worker(scriptURL, { type: 'module' });
+  return new Promise(resolve => worker.onerror = resolve);
+}, 'Worker construction for non-existent script should dispatch an ' +
+   'ErrorEvent.');
+
+promise_test(() => {
+  const scriptURL = 'resources/static-import-non-existent-script-worker.js';
+  const worker = new Worker(scriptURL, { type: 'module' });
+  return new Promise(resolve => worker.onerror = resolve);
+}, 'Static import for non-existent script should dispatch an ErrorEvent.');
+
+promise_test(async () => {
+  const scriptURL = './non-existent-worker.js';
+  const worker = new Worker('resources/dynamic-import-given-url-worker.js',
+                            { type: 'module' });
+  worker.postMessage(scriptURL);
+  const msg_event = await new Promise((resolve, reject) => {
+    worker.onmessage = resolve;
+    worker.onerror = error => {
+      const msg = error instanceof ErrorEvent ? error.message
+                                              : 'unknown error';
+      reject(msg);
+    };
+  });
+  assert_equals(msg_event.data, 'TypeError');
+}, 'Dynamic import for non-existent script should throw an exception.');
+
+test(() => {
+  const scriptURL = 'http://invalid:123$';
+  assert_throws_dom('SyntaxError', () => new Worker(scriptURL, { type: 'module' }));
+}, 'Worker construction for an invalid URL should throw an exception.');
+
+async_test((t) => {
+  const scriptURL = 'file:///static-import-worker.js';
+  const worker = new Worker(scriptURL, { type: 'module' });
+  worker.onerror = t.step_func_done(function(e) {
+    assert_true(e instanceof Event);
+  });
+}, 'Worker construction for a file URL should fail');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-import-meta.html b/test/fixtures/wpt/workers/modules/dedicated-worker-import-meta.html
new file mode 100644
index 000000000000..97a5da870f8d
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-import-meta.html
@@ -0,0 +1,59 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: import.meta</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+promise_test(() => {
+  const script_url = 'resources/import-meta-url-worker.js';
+  const worker = new Worker(script_url, { type: 'module' });
+  return new Promise((resolve, reject) => {
+        worker.onmessage = resolve;
+        worker.onerror = error => {
+          const msg = error instanceof ErrorEvent ? error.message
+                                                  : 'unknown error';
+          reject(msg);
+        };
+      })
+      .then(msg_event => assert_true(msg_event.data.endsWith(script_url)));
+}, 'Test import.meta.url on the top-level module script.');
+
+promise_test(() => {
+  const script_url = 'import-meta-url-export.js';
+  const worker = new Worker('resources/dynamic-import-given-url-worker.js',
+                            { type: 'module' });
+  worker.postMessage('./' + script_url);
+  return new Promise((resolve, reject) => {
+        worker.onmessage = resolve;
+        worker.onerror = error => {
+          const msg = error instanceof ErrorEvent ? error.message
+                                                  : 'unknown error';
+          reject(msg);
+        };
+      })
+      .then(msg_event => assert_true(msg_event.data.endsWith(script_url)));
+}, 'Test import.meta.url on the imported module script.');
+
+promise_test(() => {
+  const script_url = 'import-meta-url-export.js';
+  const worker = new Worker('resources/dynamic-import-given-url-worker.js',
+                            { type: 'module' });
+  worker.postMessage('./' + script_url);
+
+  return new Promise((resolve, reject) => {
+        worker.onmessage = resolve;
+        worker.onerror = error => {
+          const msg = error instanceof ErrorEvent ? error.message
+                                                  : 'unknown error';
+          reject(msg);
+        };
+      })
+      .then(msg_event => assert_true(msg_event.data.endsWith(script_url)))
+      .then(() => {
+        worker.postMessage('./' + script_url + '#1');
+        return new Promise(resolve => worker.onmessage = resolve);
+      })
+      .then(msg_event => assert_true(msg_event.data.endsWith(script_url + "#1")));
+}, 'Test import.meta.url on the imported module script with a fragment.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-import-referrer.html b/test/fixtures/wpt/workers/modules/dedicated-worker-import-referrer.html
new file mode 100644
index 000000000000..855df6219436
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-import-referrer.html
@@ -0,0 +1,244 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: Referrer</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+async function openWindow(url) {
+  const win = window.open(url, '_blank');
+  add_result_callback(() => win.close());
+  const msg_event = await new Promise(resolve => window.onmessage = resolve);
+  assert_equals(msg_event.data, 'LOADED');
+  return win;
+}
+
+// Removes URL parameters from the given URL string and returns it.
+function removeParams(url_string) {
+  if (!url_string)
+    return url_string;
+  let url = new URL(url_string);
+  for (var key of url.searchParams.keys())
+    url.searchParams.delete(key);
+  return url.href;
+}
+
+// Generates a referrer given a fetchType, referrer policy, and a request URL
+// (used to determine whether request is remote-origin or not). This function
+// is used to generate expected referrers.
+function generateExpectedReferrer(referrerURL, referrerPolicy, requestURL) {
+  let generatedReferrer = "";
+  if (referrerPolicy === 'no-referrer')
+    generatedReferrer = "";
+  else if (referrerPolicy === 'origin')
+    generatedReferrer = new URL('resources/' + referrerURL, location.href).origin + '/';
+  else if (referrerPolicy === 'same-origin')
+    generatedReferrer = requestURL.includes('remote') ? "" : new URL('resources/' + referrerURL, location.href).href;
+  else
+    generatedReferrer = new URL('resources/' + referrerURL, location.href).href;
+
+  return generatedReferrer;
+}
+
+// Runs a referrer policy test with the given settings. This opens a new window
+// that starts a dedicated worker.
+//
+// |settings| has options as follows:
+//
+//   settings = {
+//     scriptURL: 'resources/referrer-checker.sub.js',
+//     windowReferrerPolicy: 'no-referrer',
+//     workerReferrerPolicy: 'same-origin',
+//     fetchType: 'top-level' or 'descendant-static' or 'descendant-dynamic'
+//   };
+//
+// - |scriptURL| is used for starting a new worker.
+// - |windowReferrerPolicy| is to set the ReferrerPolicy HTTP header of the
+//   window. This policy should be applied to top-level worker module script
+//   loading and static imports.
+// - |workerReferrerPolicy| is to set the ReferrerPolicy HTTP header of the
+//   worker. This policy should be applied to dynamic imports.
+// - |fetchType| indicates a script whose referrer will be tested.
+function import_referrer_test(settings, description) {
+  promise_test(async () => {
+    let windowURL = 'resources/new-worker-window.html';
+    if (settings.windowReferrerPolicy) {
+      windowURL +=
+          `?pipe=header(Referrer-Policy, ${settings.windowReferrerPolicy})`;
+    }
+
+    let scriptURL = settings.scriptURL;
+    if (settings.workerReferrerPolicy) {
+      // 'sub' is necessary even if the |scriptURL| contains the '.sub'
+      // extension because the extension doesn't work with the 'pipe' parameter.
+      // See an issue on the WPT's repository:
+      // https://github.com/web-platform-tests/wpt/issues/9345
+      scriptURL +=
+          `?pipe=sub|header(Referrer-Policy, ${settings.workerReferrerPolicy})`;
+    }
+
+    const win = await openWindow(windowURL);
+    win.postMessage(scriptURL, '*');
+    const msgEvent = await new Promise(resolve => window.onmessage = resolve);
+
+    // Generate the expected referrer, given:
+    //   - The fetchType of the test
+    //   - Referrer URL to be used
+    //   - Relevant referrer policy
+    //   - Request URL
+    let expectedReferrer;
+    if (settings.fetchType === 'top-level') {
+      // Top-level worker requests have their outgoing referrers set given their
+      // containing window's URL and referrer policy.
+      expectedReferrer = generateExpectedReferrer('new-worker-window.html', settings.windowReferrerPolicy, settings.scriptURL);
+    } else if (settings.fetchType === 'descendant-static') {
+      // Static descendant script requests from a worker have their outgoing
+      // referrer set given their containing script's URL and containing
+      // window's referrer policy.
+
+      // In the below cases, the referrer URL and the request URLs are the same
+      // because the initial request (for the top-level worker script) should
+      // act as the referrer for future descendant requests.
+      expectedReferrer = generateExpectedReferrer(settings.scriptURL, settings.windowReferrerPolicy, settings.scriptURL);
+    } else if (settings.fetchType === 'descendant-dynamic') {
+      // Dynamic descendant script requests from a worker have their outgoing
+      // referrer set given their containing script's URL and referrer policy.
+      expectedReferrer = generateExpectedReferrer(settings.scriptURL, settings.workerReferrerPolicy, settings.scriptURL);
+    }
+
+    // Delete query parameters from the actual referrer to make it easy to match
+    // it with the expected referrer.
+    const actualReferrer = removeParams(msgEvent.data);
+
+    assert_equals(actualReferrer, expectedReferrer);
+  }, description);
+}
+
+// Tests for top-level worker module script loading.
+//
+// Top-level worker module scripts should inherit the containing window's
+// referrer policy when using the containing window's URL as the referrer.
+//
+// [Current document]
+// --(open)--> [Window] whose referrer policy is |windowReferrerPolicy|.
+//   --(new Worker)--> [Worker] should respect [windowReferrerPolicy| when
+//                     using [Window]'s URL as the referrer.
+
+import_referrer_test(
+    { scriptURL: 'postmessage-referrer-checker.py',
+      windowReferrerPolicy: 'no-referrer',
+      fetchType: 'top-level' },
+    'Same-origin top-level module script loading with "no-referrer" referrer ' +
+        'policy');
+
+import_referrer_test(
+    { scriptURL: 'postmessage-referrer-checker.py',
+      windowReferrerPolicy: 'origin',
+      fetchType: 'top-level' },
+    'Same-origin top-level module script loading with "origin" referrer ' +
+        'policy');
+
+import_referrer_test(
+    { scriptURL: 'postmessage-referrer-checker.py',
+      windowReferrerPolicy: 'same-origin',
+      fetchType: 'top-level' },
+    'Same-origin top-level module script loading with "same-origin" referrer ' +
+        'policy');
+
+// Tests for static imports.
+//
+// Static imports should inherit the containing window's referrer policy when
+// using the containing module script's URL as the referrer.
+// Note: This is subject to change in the future; see
+// https://github.com/w3c/webappsec-referrer-policy/issues/111.
+//
+// [Current document]
+// --(open)--> [Window] whose referrer policy is |windowReferrerPolicy|.
+//   --(new Worker)--> [Worker]
+//     --(static import)--> [Script] should respect |windowReferrerPolicy| when
+//                          using [Worker]'s URL as the referrer.
+
+import_referrer_test(
+    { scriptURL: 'static-import-same-origin-referrer-checker-worker.js',
+      windowReferrerPolicy: 'no-referrer',
+      fetchType: 'descendant-static' },
+    'Same-origin static import with "no-referrer" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-same-origin-referrer-checker-worker.js',
+      windowReferrerPolicy: 'origin',
+      fetchType: 'descendant-static' },
+    'Same-origin static import with "origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-same-origin-referrer-checker-worker.js',
+      windowReferrerPolicy: 'same-origin',
+      fetchType: 'descendant-static' },
+    'Same-origin static import with "same-origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-remote-origin-referrer-checker-worker.sub.js',
+      windowReferrerPolicy: 'no-referrer',
+      fetchType: 'descendant-static' },
+    'Cross-origin static import with "no-referrer" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-remote-origin-referrer-checker-worker.sub.js',
+      windowReferrerPolicy: 'origin',
+      fetchType: 'descendant-static' },
+    'Cross-origin static import with "origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-remote-origin-referrer-checker-worker.sub.js',
+      windowReferrerPolicy: 'same-origin',
+      fetchType: 'descendant-static' },
+    'Cross-origin static import with "same-origin" referrer policy.');
+
+// Tests for dynamic imports.
+//
+// Dynamic imports should inherit the containing script's referrer policy if
+// set, and use the default referrer policy otherwise, when using the
+// containing script's URL as the referrer.
+//
+// [Current document]
+// --(open)--> [Window]
+//   --(new Worker)--> [Worker] whose referrer policy is |workerReferrerPolicy|.
+//     --(dynamic import)--> [Script] should respect |workerReferrerPolicy| when
+//                           using [Worker]'s URL as the referrer.
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-same-origin-referrer-checker-worker.js',
+      workerReferrerPolicy: 'no-referrer',
+      fetchType: 'descendant-dynamic' },
+    'Same-origin dynamic import with "no-referrer" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-same-origin-referrer-checker-worker.js',
+      workerReferrerPolicy: 'origin',
+      fetchType: 'descendant-dynamic' },
+    'Same-origin dynamic import with "origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-same-origin-referrer-checker-worker.js',
+      workerReferrerPolicy: 'same-origin',
+      fetchType: 'descendant-dynamic' },
+    'Same-origin dynamic import with "same-origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-remote-origin-referrer-checker-worker.sub.js',
+      workerReferrerPolicy: 'no-referrer',
+      fetchType: 'descendant-dynamic' },
+    'Cross-origin dynamic import with "no-referrer" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-remote-origin-referrer-checker-worker.sub.js',
+      workerReferrerPolicy: 'origin',
+      fetchType: 'descendant-dynamic' },
+    'Cross-origin dynamic import with "origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-remote-origin-referrer-checker-worker.sub.js',
+      workerReferrerPolicy: 'same-origin',
+      fetchType: 'descendant-dynamic' },
+    'Cross-origin dynamic import with "same-origin" referrer policy.');
+</script>
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-import.any.js b/test/fixtures/wpt/workers/modules/dedicated-worker-import.any.js
new file mode 100644
index 000000000000..d5bb6cccbe21
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-import.any.js
@@ -0,0 +1,22 @@
+// META: script=/workers/modules/resources/import-test-cases.js
+
+// Starts a dedicated worker for |testCase.scriptURL| and waits until the list
+// of imported modules is sent from the worker. Passes if the list is equal to
+// |testCase.expectation|.
+function import_test(testCase) {
+  promise_test(async () => {
+    const worker = new Worker(testCase.scriptURL, { type: 'module' });
+    worker.postMessage('Send message for tests from main script.');
+    const msgEvent = await new Promise((resolve, reject) => {
+      worker.onmessage = resolve;
+      worker.onerror = error => {
+        const msg = error instanceof ErrorEvent ? error.message
+                                                : 'unknown error';
+        reject(msg);
+      };
+    });
+    assert_array_equals(msgEvent.data, testCase.expectation);
+  }, testCase.description);
+}
+
+testCases.forEach(import_test);
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-options-credentials.html b/test/fixtures/wpt/workers/modules/dedicated-worker-options-credentials.html
new file mode 100644
index 000000000000..94916d7ff5d6
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-options-credentials.html
@@ -0,0 +1,304 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: WorkerOptions 'credentials'</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script>
+host_info = get_host_info();
+
+// Determines the expected cookie value to be reported by a dedicated worker
+// based on the given option. The worker reports an empty string as the actual
+// cookie value if the cookie wasn't sent to the server. Otherwise, it's the
+// value set by the headers file:
+// "dedicated-worker-options-credentials.html.headers"
+function DetermineExpectedCookieValue(options, config) {
+  // Valid WorkerOptions and test config checking.
+  if (config.origin !== 'same' && config.origin !== 'remote')
+    assert_unreached('Invalid config.origin was specified: ' + config.origin);
+  if (options.credentials && options.credentials !== 'omit' &&
+      options.credentials !== 'same-origin' &&
+      options.credentials !== 'include') {
+    assert_unreached('Invalid credentials option was specified: ' +
+                      options.credentials);
+  }
+  if (options.type !== 'classic' && options.type !== 'module')
+    assert_unreached('Invalid type option was specified: ' + options.type);
+
+  if (options.type === 'classic')
+    return (config.origin === 'same') ? '1' : '';
+
+  if (options.credentials === 'omit')
+    return '';
+  else if (options.credentials === 'include')
+    return '1';
+  else
+    return (config.origin === 'same') ? '1' : '';
+}
+
+// Runs a credentials test with the given WorkerOptions.
+//
+// |options| is a WorkerOptions dict.
+// |config| has options as follows:
+//
+//   config = {
+//     fetchType: 'top-level' or 'descendant-static' or 'descendant-dynamic'
+//     origin: 'remote' or 'same'
+//   };
+//
+// - |config.fetchType| indicates the type of script to load for the test.
+// - |config.origin| indicates same-origin-ness of the script to load.
+function credentials_test(options, config, description) {
+  promise_test(async () => {
+    let workerURL, origin = config.origin;
+    if (config.fetchType === 'top-level') {
+      workerURL = 'resources/postmessage-credentials.py';
+    } else if (config.fetchType === 'descendant-static') {
+      workerURL =
+        `resources/static-import-${origin}-origin-credentials-checker-worker.${origin === 'same' ? '' : 'sub.'}js`;
+    } else if (config.fetchType === 'descendant-dynamic') {
+      workerURL =
+        `resources/dynamic-import-${origin}-origin-credentials-checker-worker.${origin === 'same' ? '' : 'sub.'}js`;
+    } else {
+      assert_unreached('Invalid config.fetchType: ' + config.fetchType);
+    }
+
+    const worker = new Worker(workerURL, options);
+
+    // Wait until the worker sends the actual cookie value.
+    const msg_event = await new Promise(resolve => worker.onmessage = resolve);
+
+    const expectedCookieValue = DetermineExpectedCookieValue(options, config);
+    assert_equals(msg_event.data, expectedCookieValue);
+  }, description);
+}
+
+function init() {
+  // Same-origin cookie is set up in the .headers file in this directory.
+  promise_test(async () => {
+    return fetch(
+      `${host_info.HTTP_REMOTE_ORIGIN}/cookies/resources/set-cookie.py?name=COOKIE_NAME&path=/workers/modules/`,
+      {
+        mode: 'no-cors',
+        credentials: 'include'
+      });
+  }, 'Test initialization: setting up cross-origin cookie');
+}
+
+init();
+
+// Tests for module workers.
+
+credentials_test(
+    { type: 'module' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new Worker() with type=module and default credentials option should ' +
+    'behave as credentials=same-origin and send the credentials');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new Worker() with type=module and credentials=omit should not send the ' +
+    'credentials');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new Worker() with type=module and credentials=same-origin should send ' +
+    'the credentials');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new Worker() with type=module and credentials=include should send the ' +
+    'credentials');
+
+// Tests for module worker static imports.
+
+credentials_test(
+    { type: 'module' },
+    { fetchType: 'descendant-static', origin: 'same' },
+    'new Worker() with type=module and default credentials option should ' +
+    'behave as credentials=same-origin and send the credentials for ' +
+    'same-origin static imports');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'same' },
+    'new Worker() with type=module and credentials=omit should not send the ' +
+    'credentials for same-origin static imports');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'same' },
+    'new Worker() with type=module and credentials=same-origin should send ' +
+    'the credentials for same-origin static imports');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'same' },
+    'new Worker() with type=module and credentials=include should send the ' +
+    'credentials for same-origin static imports');
+
+credentials_test(
+    { type: 'module' },
+    { fetchType: 'descendant-static', origin: 'remote' },
+    'new Worker() with type=module and default credentials option should ' +
+    'behave as credentials=same-origin and not send the credentials for ' +
+    'cross-origin static imports');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'remote' },
+    'new Worker() with type-module credentials=omit should not send the ' +
+    'credentials for cross-origin static imports');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'remote' },
+    'new Worker() with type=module and credentials=same-origin should not ' +
+    'send the credentials for cross-origin static imports');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'remote' },
+    'new Worker() with type=module and credentials=include should send the ' +
+    'credentials for cross-origin static imports');
+
+// Tests for module worker dynamic imports.
+
+credentials_test(
+    { type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new Worker() with type=module and default credentials option should ' +
+    'behave as credentials=same-origin and send the credentials for ' +
+    'same-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new Worker() with type=module and credentials=omit should not send the ' +
+    'credentials for same-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new Worker() with type=module and credentials=same-origin should send ' +
+    'the credentials for same-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new Worker() with type=module and credentials=include should send the ' +
+    'credentials for same-origin dynamic imports');
+
+credentials_test(
+    { type: 'module'},
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new Worker() with type=module and default credentials option should ' +
+    'behave as credentials=same-origin and not send the credentials for ' +
+    'cross-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new Worker() with type-module credentials=omit should not send the ' +
+    'credentials for cross-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new Worker() with type=module and credentials=same-origin should not ' +
+    'send the credentials for cross-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new Worker() with type=module and credentials=include should send the ' +
+    'credentials for cross-origin dynamic imports');
+
+// Tests for classic workers.
+// TODO(domfarolino): Maybe move classic worker tests up a directory?
+
+credentials_test(
+    { type: 'classic' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new Worker() with type=classic should always send the credentials ' +
+    'regardless of the credentials option (default).');
+
+credentials_test(
+    { credentials: 'omit', type: 'classic' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new Worker() with type=classic should always send the credentials ' +
+    'regardless of the credentials option (omit).');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'classic' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new Worker() with type=classic should always send the credentials ' +
+    'regardless of the credentials option (same-origin).');
+
+credentials_test(
+    { credentials: 'include', type: 'classic' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new Worker() with type=classic should always send the credentials ' +
+    'regardless of the credentials option (include).');
+
+// Tests for classic worker dynamic imports.
+
+credentials_test(
+    { type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new Worker() with type=classic should always send the credentials for ' +
+    'same-origin dynamic imports regardless of the credentials option ' +
+    '(default).');
+
+credentials_test(
+    { credentials: 'omit', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new Worker() with type=classic should always send the credentials for ' +
+    'same-origin dynamic imports regardless of the credentials option (omit).');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new Worker() with type=classic should always send the credentials for ' +
+    'same-origin dynamic imports regardless of the credentials option ' +
+    '(same-origin).');
+
+credentials_test(
+    { credentials: 'include', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new Worker() with type=classic should always send the credentials for ' +
+    'same-origin dynamic imports regardless of the credentials option ' +
+    '(include).');
+
+credentials_test(
+    { type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new Worker() with type=classic should never send the credentials for ' +
+    'cross-origin dynamic imports regardless of the credentials option ' +
+    '(default).');
+
+credentials_test(
+    { credentials: 'omit', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new Worker() with type=classic should never send the credentials for ' +
+    'cross-origin dynamic imports regardless of the credentials option ' +
+    '(omit).');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new Worker() with type=classic should never send the credentials for ' +
+    'cross-origin dynamic imports regardless of the credentials option ' +
+    '(same-origin).');
+
+credentials_test(
+    { credentials: 'include', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new Worker() with type=classic should never send the credentials for ' +
+    'cross-origin dynamic imports regardless of the credentials option ' +
+    '(include).');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-options-credentials.html.headers b/test/fixtures/wpt/workers/modules/dedicated-worker-options-credentials.html.headers
new file mode 100644
index 000000000000..8da851ab7363
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-options-credentials.html.headers
@@ -0,0 +1,2 @@
+Set-Cookie: COOKIE_NAME=1
+Access-Control-Allow-Credentials: true
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-options-type.html b/test/fixtures/wpt/workers/modules/dedicated-worker-options-type.html
new file mode 100644
index 000000000000..bb37a18f2cc9
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-options-type.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: WorkerOptions 'type'</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+promise_test(() => {
+  const worker = new Worker('resources/post-message-on-load-worker.js');
+  return new Promise(resolve => worker.onmessage = resolve)
+      .then(msg_event => assert_equals(msg_event.data, 'LOADED'));
+}, 'Test worker construction with the default worker type.');
+
+promise_test(() => {
+  const worker = new Worker('resources/post-message-on-load-worker.js',
+                            { type: 'classic' });
+  return new Promise(resolve => worker.onmessage = resolve)
+      .then(msg_event => assert_equals(msg_event.data, 'LOADED'));
+}, 'Test worker construction with the "classic" worker type.');
+
+promise_test(() => {
+  const worker = new Worker('resources/post-message-on-load-worker.js',
+                            { type: 'module' });
+  return new Promise(resolve => worker.onmessage = resolve)
+      .then(msg_event => assert_equals(msg_event.data, 'LOADED'));
+}, 'Test worker construction with the "module" worker type.');
+
+test(() => {
+  assert_throws_js(
+      TypeError,
+      () => {
+        new Worker('resources/post-message-on-load-worker.js', { type: '' });
+      },
+      'Worker construction with an empty type should throw an exception');
+}, 'Test worker construction with an empty worker type.');
+
+test(() => {
+  assert_throws_js(
+      TypeError,
+      () => {
+        new Worker('resources/post-message-on-load-worker.js',
+                   { type: 'unknown' });
+      },
+      'Worker construction with an unknown type should throw an exception');
+}, 'Test worker construction with an unknown worker type.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-parse-error-failure.html b/test/fixtures/wpt/workers/modules/dedicated-worker-parse-error-failure.html
new file mode 100644
index 000000000000..343bfe289f30
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-parse-error-failure.html
@@ -0,0 +1,51 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: parse error failure</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script> setup({allow_uncaught_exception: true}); </script>
+<script src="../support/check-error-arguments.js"></script>
+<script>
+
+// Check if module scripts are supported on dedicated workers. There is no
+// direct way to detect it, so we assume it's supported when static import is
+// available on the workers.
+//
+// This check is necessary to appropriately test parse error handling because
+// we need to distinguish the parse error invoked by unsupported "import" in
+// the top-level script from the parse error invoked by the statically imported
+// script which is the one we want to check in this test.
+promise_setup(async () => {
+  const scriptURL = 'resources/static-import-worker.js';
+  const worker = new Worker(scriptURL, { type: 'module' });
+  worker.postMessage('Send message for tests from main script.');
+  const supportsModuleWorkers = await new Promise((resolve, reject) => {
+    worker.onmessage = e => {
+      resolve(e.data.length == 1 && e.data[0] == 'export-on-load-script.js');
+    };
+    worker.onerror = () => resolve(false);
+  });
+  assert_implements(
+    supportsModuleWorkers,
+    "Static import must be supported on module dedicated worker to run this test."
+  );
+});
+
+promise_test(async () => {
+  const scriptURL = 'resources/syntax-error.js';
+  const worker = new Worker(scriptURL, { type: 'module' });
+  const args = await new Promise(resolve =>
+      worker.onerror = (...args) => resolve(args));
+  window.checkErrorArguments(args);
+}, 'Module worker construction for script with syntax error should dispatch ' +
+   'an event named error.');
+
+promise_test(async () => {
+  const scriptURL = 'resources/static-import-syntax-error.js';
+  const worker = new Worker(scriptURL, { type: 'module' });
+  const args = await new Promise(resolve =>
+      worker.onerror = (...args) => resolve(args));
+  window.checkErrorArguments(args);
+}, 'Static import on module worker for script with syntax error should ' +
+   'dispatch an event named error.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-and-then-static-import-worker.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-and-then-static-import-worker.js
new file mode 100644
index 000000000000..527702f55117
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-and-then-static-import-worker.js
@@ -0,0 +1,32 @@
+// This script is meant to be imported by a module worker. It receives a
+// message from the worker and responds with the list of imported modules.
+const sourcePromise = new Promise(resolve => {
+  if ('DedicatedWorkerGlobalScope' in self &&
+      self instanceof DedicatedWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.target);
+    };
+  } else if (
+      'SharedWorkerGlobalScope' in self &&
+      self instanceof SharedWorkerGlobalScope) {
+    self.onconnect = e => {
+      resolve(e.ports[0]);
+    };
+  } else if (
+      'ServiceWorkerGlobalScope' in self &&
+      self instanceof ServiceWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.source);
+    };
+  }
+});
+
+const importedModulesPromise =
+  import('./export-on-static-import-script.js')
+    .then(module => module.importedModules)
+    .catch(error => `Failed to do dynamic import: ${error}`);
+
+Promise.all([sourcePromise, importedModulesPromise]).then(results => {
+  const [source, importedModules] = results;
+  source.postMessage(importedModules);
+});
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-data-url-block-cross-origin.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-data-url-block-cross-origin.js
new file mode 100644
index 000000000000..caa15319c55c
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-data-url-block-cross-origin.js
@@ -0,0 +1,24 @@
+const sourcePromise = new Promise(resolve => {
+  if ('DedicatedWorkerGlobalScope' in self &&
+      self instanceof DedicatedWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.target);
+    };
+  } else if (
+      'SharedWorkerGlobalScope' in self &&
+      self instanceof SharedWorkerGlobalScope) {
+    self.onconnect = e => {
+      resolve(e.ports[0]);
+    };
+  }
+});
+
+const importedModulesPromise =
+  import("data:text/javascript, export const importedModules = ['export-block-cross-origin.js'];")
+    .then(module => module.importedModules)
+    .catch(() => ['ERROR']);
+
+Promise.all([sourcePromise, importedModulesPromise]).then(results => {
+  const [source, importedModules] = results;
+  source.postMessage(importedModules);
+});
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-given-url-worker.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-given-url-worker.js
new file mode 100644
index 000000000000..55102759352c
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-given-url-worker.js
@@ -0,0 +1,21 @@
+// This worker dynamically imports the script URL sent by postMessage(), and
+// sends back an error name if the dynamic import fails.
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  self.onmessage = msg_event => {
+    import(msg_event.data)
+        .then(module => postMessage(module.meta_url))
+        .catch(e => postMessage(e.name));
+  };
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = connect_event => {
+    const port = connect_event.ports[0];
+    port.onmessage = msg_event => {
+      import(msg_event.data)
+          .then(module => port.postMessage(module.meta_url))
+          .catch(e => port.postMessage(e.name));
+    };
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-credentials-checker-worker.sub.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-credentials-checker-worker.sub.js
new file mode 100644
index 000000000000..3cfbe7c6e4ca
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-credentials-checker-worker.sub.js
@@ -0,0 +1,15 @@
+// Import a remote origin script.
+const import_url =
+    'http://{{domains[www1]}}:{{ports[http][0]}}/workers/modules/resources/export-credentials.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  import(import_url)
+      .then(module => postMessage(module.cookie));
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    import(import_url)
+        .then(module => e.ports[0].postMessage(module.cookie));
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-referrer-checker-worker.sub.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-referrer-checker-worker.sub.js
new file mode 100644
index 000000000000..014a3467e86c
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-referrer-checker-worker.sub.js
@@ -0,0 +1,16 @@
+// Import a remote origin script.
+const import_url = 'https://{{hosts[alt][]}}:{{ports[https][0]}}/workers/modules/resources/export-referrer-checker.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  import(import_url)
+      .then(module => postMessage(module.referrer))
+      .catch(error => postMessage(`Import failed: ${error}`));
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    import(import_url)
+        .then(module => e.ports[0].postMessage(module.referrer))
+        .catch(error => e.ports[0].postMessage(`Import failed: ${error}`));
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-script-worker.sub.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-script-worker.sub.js
new file mode 100644
index 000000000000..7ed65438904a
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-script-worker.sub.js
@@ -0,0 +1,17 @@
+// Import a remote origin script.
+const importUrl =
+    'https://{{domains[www1]}}:{{ports[https][0]}}/workers/modules/resources/export-on-load-script.js';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  import(importUrl)
+      .then(module => postMessage(module.importedModules))
+      .catch(e => postMessage(['ERROR']));
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    import(importUrl)
+        .then(module => e.ports[0].postMessage(module.importedModules))
+        .catch(error => e.ports[0].postMessage(['ERROR']));
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-same-origin-credentials-checker-worker.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-same-origin-credentials-checker-worker.js
new file mode 100644
index 000000000000..24dbd551280f
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-same-origin-credentials-checker-worker.js
@@ -0,0 +1,13 @@
+const import_url = './export-credentials.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  import(import_url)
+      .then(module => postMessage(module.cookie));
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    import(import_url)
+        .then(module => e.ports[0].postMessage(module.cookie));
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-same-origin-referrer-checker-worker.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-same-origin-referrer-checker-worker.js
new file mode 100644
index 000000000000..56f8a6ffe822
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-same-origin-referrer-checker-worker.js
@@ -0,0 +1,15 @@
+const import_url = './export-referrer-checker.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  import(import_url)
+      .then(module => postMessage(module.referrer))
+      .catch(error => postMessage(`Import failed: ${error}`));
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    import(import_url)
+        .then(module => e.ports[0].postMessage(module.referrer))
+        .catch(error => e.ports[0].postMessage(`Import failed: ${error}`));
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-script-block-cross-origin.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-script-block-cross-origin.js
new file mode 100644
index 000000000000..52ec53066359
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-script-block-cross-origin.js
@@ -0,0 +1,24 @@
+const sourcePromise = new Promise(resolve => {
+  if ('DedicatedWorkerGlobalScope' in self &&
+      self instanceof DedicatedWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.target);
+    };
+  } else if (
+      'SharedWorkerGlobalScope' in self &&
+      self instanceof SharedWorkerGlobalScope) {
+    self.onconnect = e => {
+      resolve(e.ports[0]);
+    };
+  }
+});
+
+const importedModulesPromise =
+  import('./export-block-cross-origin.js')
+    .then(module => module.importedModules)
+    .catch(() => ['ERROR']);
+
+Promise.all([sourcePromise, importedModulesPromise]).then(results => {
+  const [source, importedModules] = results;
+  source.postMessage(importedModules);
+});
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-worker.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-worker.js
new file mode 100644
index 000000000000..2e756fe055e9
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-worker.js
@@ -0,0 +1,32 @@
+// This script is meant to be imported by a module worker. It receives a
+// message from the worker and responds with the list of imported modules.
+const sourcePromise = new Promise(resolve => {
+  if ('DedicatedWorkerGlobalScope' in self &&
+      self instanceof DedicatedWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.target);
+    };
+  } else if (
+      'SharedWorkerGlobalScope' in self &&
+      self instanceof SharedWorkerGlobalScope) {
+    self.onconnect = e => {
+      resolve(e.ports[0]);
+    };
+  } else if (
+      'ServiceWorkerGlobalScope' in self &&
+      self instanceof ServiceWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.source);
+    };
+  }
+});
+
+const importedModulesPromise =
+  import('./export-on-load-script.js')
+    .then(module => module.importedModules)
+    .catch(error => `Failed to do dynamic import: ${error}`);
+
+Promise.all([sourcePromise, importedModulesPromise]).then(results => {
+  const [source, importedModules] = results;
+  source.postMessage(importedModules);
+});
diff --git a/test/fixtures/wpt/workers/modules/resources/empty-worker.js b/test/fixtures/wpt/workers/modules/resources/empty-worker.js
new file mode 100644
index 000000000000..49ceb2648a93
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/empty-worker.js
@@ -0,0 +1 @@
+// Do nothing.
diff --git a/test/fixtures/wpt/workers/modules/resources/eval-dynamic-import-worker.js b/test/fixtures/wpt/workers/modules/resources/eval-dynamic-import-worker.js
new file mode 100644
index 000000000000..60080d4292a8
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/eval-dynamic-import-worker.js
@@ -0,0 +1,29 @@
+// This script is meant to be imported by a module worker. It receives a
+// message from the worker and responds with the list of imported modules.
+const code = 'const sourcePromise = new Promise(resolve => {' +
+    '  if (\'DedicatedWorkerGlobalScope\' in self &&' +
+    '      self instanceof DedicatedWorkerGlobalScope) {' +
+    '    self.onmessage = e => {' +
+    '      resolve(e.target);' +
+    '    };' +
+    '  } else if (\'SharedWorkerGlobalScope\' in self &&' +
+    '             self instanceof SharedWorkerGlobalScope) {' +
+    '    self.onconnect = e => {' +
+    '      resolve(e.ports[0]);' +
+    '    };' +
+    '  } else if (\'ServiceWorkerGlobalScope\' in self &&' +
+    '             self instanceof ServiceWorkerGlobalScope) {' +
+    '    self.onmessage = e => {' +
+    '      resolve(e.source);' +
+    '    };' +
+    '  }' +
+    '});' +
+    'const importedModulesPromise =' +
+    '  import(\'./export-on-load-script.js\')' +
+    '    .then(module => module.importedModules)' +
+    '    .catch(error => `Failed to do dynamic import: ${error}`);' +
+    'Promise.all([sourcePromise, importedModulesPromise]).then(results => {' +
+    '  const [source, importedModules] = results;' +
+    '  source.postMessage(importedModules);' +
+    '});';
+eval(code);
diff --git a/test/fixtures/wpt/workers/modules/resources/export-block-cross-origin.js b/test/fixtures/wpt/workers/modules/resources/export-block-cross-origin.js
new file mode 100644
index 000000000000..a4b513d280e9
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/export-block-cross-origin.js
@@ -0,0 +1 @@
+export const importedModules = ['export-block-cross-origin.js'];
diff --git a/test/fixtures/wpt/workers/modules/resources/export-on-dynamic-import-script.js b/test/fixtures/wpt/workers/modules/resources/export-on-dynamic-import-script.js
new file mode 100644
index 000000000000..bab7cb48d249
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/export-on-dynamic-import-script.js
@@ -0,0 +1,8 @@
+// Export the list of imported modules. It's available after the |ready| promise
+// is resolved.
+export let importedModules = ['export-on-dynamic-import-script.js'];
+export let ready = import('./export-on-load-script.js')
+  .then(module => {
+    Array.prototype.push.apply(importedModules, module.importedModules);
+    return importedModules;
+  });
diff --git a/test/fixtures/wpt/workers/modules/resources/export-on-dynamic-import-script.js.headers b/test/fixtures/wpt/workers/modules/resources/export-on-dynamic-import-script.js.headers
new file mode 100644
index 000000000000..cb762eff8068
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/export-on-dynamic-import-script.js.headers
@@ -0,0 +1 @@
+Access-Control-Allow-Origin: *
diff --git a/test/fixtures/wpt/workers/modules/resources/export-on-load-script.js b/test/fixtures/wpt/workers/modules/resources/export-on-load-script.js
new file mode 100644
index 000000000000..7d1b122c3225
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/export-on-load-script.js
@@ -0,0 +1 @@
+export const importedModules = ['export-on-load-script.js'];
diff --git a/test/fixtures/wpt/workers/modules/resources/export-on-load-script.js.headers b/test/fixtures/wpt/workers/modules/resources/export-on-load-script.js.headers
new file mode 100644
index 000000000000..cb762eff8068
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/export-on-load-script.js.headers
@@ -0,0 +1 @@
+Access-Control-Allow-Origin: *
diff --git a/test/fixtures/wpt/workers/modules/resources/export-on-static-import-script.js b/test/fixtures/wpt/workers/modules/resources/export-on-static-import-script.js
new file mode 100644
index 000000000000..3f7174eef0be
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/export-on-static-import-script.js
@@ -0,0 +1,3 @@
+import * as module from './export-on-load-script.js';
+const filename = 'export-on-static-import-script.js';
+export const importedModules = [filename].concat(module.importedModules);
diff --git a/test/fixtures/wpt/workers/modules/resources/export-on-static-import-script.js.headers b/test/fixtures/wpt/workers/modules/resources/export-on-static-import-script.js.headers
new file mode 100644
index 000000000000..cb762eff8068
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/export-on-static-import-script.js.headers
@@ -0,0 +1 @@
+Access-Control-Allow-Origin: *
diff --git a/test/fixtures/wpt/workers/modules/resources/import-meta-url-export.js b/test/fixtures/wpt/workers/modules/resources/import-meta-url-export.js
new file mode 100644
index 000000000000..5287b2e9e849
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/import-meta-url-export.js
@@ -0,0 +1 @@
+export const meta_url = import.meta.url;
diff --git a/test/fixtures/wpt/workers/modules/resources/import-meta-url-worker.js b/test/fixtures/wpt/workers/modules/resources/import-meta-url-worker.js
new file mode 100644
index 000000000000..7887836a6cc1
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/import-meta-url-worker.js
@@ -0,0 +1,10 @@
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  postMessage(import.meta.url);
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage(import.meta.url);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/import-scripts-worker.js b/test/fixtures/wpt/workers/modules/resources/import-scripts-worker.js
new file mode 100644
index 000000000000..d85f573ffe3a
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/import-scripts-worker.js
@@ -0,0 +1,33 @@
+try {
+  importScripts('empty-worker.js');
+  if ('DedicatedWorkerGlobalScope' in self &&
+      self instanceof DedicatedWorkerGlobalScope) {
+    postMessage('LOADED');
+  } else if (
+      'SharedWorkerGlobalScope' in self &&
+      self instanceof SharedWorkerGlobalScope) {
+    onconnect = e => {
+      e.ports[0].postMessage('LOADED');
+    };
+  }
+} catch (e) {
+  // Post a message instead of propagating an ErrorEvent to the page because
+  // propagated event loses an error name.
+  //
+  // Step 1. "Let notHandled be the result of firing an event named error at the
+  // Worker object associated with the worker, using ErrorEvent, with the
+  // cancelable attribute initialized to true, the message, filename, lineno,
+  // and colno attributes initialized appropriately, and the error attribute
+  // initialized to null."
+  // https://html.spec.whatwg.org/multipage/workers.html#runtime-script-errors-2
+  if ('DedicatedWorkerGlobalScope' in self &&
+      self instanceof DedicatedWorkerGlobalScope) {
+    postMessage(e.name);
+  } else if (
+      'SharedWorkerGlobalScope' in self &&
+      self instanceof SharedWorkerGlobalScope) {
+    onconnect = connectEvent => {
+      connectEvent.ports[0].postMessage(e.name);
+    };
+  }
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/import-test-cases.js b/test/fixtures/wpt/workers/modules/resources/import-test-cases.js
new file mode 100644
index 000000000000..8ad89e8fda11
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/import-test-cases.js
@@ -0,0 +1,59 @@
+const testCases = [
+    {
+        scriptURL: '/workers/modules/resources/static-import-worker.js',
+        expectation: ['export-on-load-script.js'],
+        description: 'Static import.'
+    },
+    {
+        scriptURL: '/workers/modules/resources/static-import-remote-origin-script-worker.sub.js',
+        expectation: ['export-on-load-script.js'],
+        description: 'Static import (cross-origin).'
+    },
+    {
+        scriptURL: '/workers/modules/resources/static-import-redirect-worker.js',
+        expectation: ['export-on-load-script.js'],
+        description: 'Static import (redirect).'
+    },
+    {
+        scriptURL: '/workers/modules/resources/nested-static-import-worker.js',
+        expectation: [
+            'export-on-static-import-script.js',
+            'export-on-load-script.js'
+        ],
+        description: 'Nested static import.'
+    },
+    {
+        scriptURL: '/workers/modules/resources/static-import-and-then-dynamic-import-worker.js',
+        expectation: [
+            'export-on-dynamic-import-script.js',
+            'export-on-load-script.js'
+        ],
+        description: 'Static import and then dynamic import.'
+    },
+    {
+        scriptURL: '/workers/modules/resources/dynamic-import-worker.js',
+        expectation: ['export-on-load-script.js'],
+        description: 'Dynamic import.'
+    },
+    {
+        scriptURL: '/workers/modules/resources/nested-dynamic-import-worker.js',
+        expectation: [
+            'export-on-dynamic-import-script.js',
+            'export-on-load-script.js'
+        ],
+        description: 'Nested dynamic import.'
+    },
+    {
+        scriptURL: '/workers/modules/resources/dynamic-import-and-then-static-import-worker.js',
+        expectation: [
+            'export-on-static-import-script.js',
+            'export-on-load-script.js'
+        ],
+        description: 'Dynamic import and then static import.'
+    },
+    {
+        scriptURL: '/workers/modules/resources/eval-dynamic-import-worker.js',
+        expectation: ['export-on-load-script.js'],
+        description: 'eval(import()).'
+    }
+];
diff --git a/test/fixtures/wpt/workers/modules/resources/nested-dynamic-import-worker.js b/test/fixtures/wpt/workers/modules/resources/nested-dynamic-import-worker.js
new file mode 100644
index 000000000000..00da43c5f078
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/nested-dynamic-import-worker.js
@@ -0,0 +1,34 @@
+// This script is meant to be imported by a module worker. It receives a
+// message from the worker and responds with the list of imported modules.
+
+const sourcePromise = new Promise(resolve => {
+  if ('DedicatedWorkerGlobalScope' in self &&
+      self instanceof DedicatedWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.target);
+    };
+  } else if (
+      'SharedWorkerGlobalScope' in self &&
+      self instanceof SharedWorkerGlobalScope) {
+    self.onconnect = e => {
+      resolve(e.ports[0]);
+    };
+  } else if (
+      'ServiceWorkerGlobalScope' in self &&
+      self instanceof ServiceWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.source);
+    };
+  }
+});
+
+const importedModulesPromise =
+  import('./export-on-dynamic-import-script.js')
+    .then(module => module.ready)
+    .then(importedModules => importedModules)
+    .catch(error => `Failed to do dynamic import: ${error}`);
+
+Promise.all([sourcePromise, importedModulesPromise]).then(results => {
+  const [source, importedModules] = results;
+  source.postMessage(importedModules);
+});
diff --git a/test/fixtures/wpt/workers/modules/resources/nested-static-import-worker.js b/test/fixtures/wpt/workers/modules/resources/nested-static-import-worker.js
new file mode 100644
index 000000000000..c3a9ff0b799d
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/nested-static-import-worker.js
@@ -0,0 +1,21 @@
+// This script is meant to be imported by a module worker. It receives a
+// message from the worker and responds with the list of imported modules.
+import * as module from './export-on-static-import-script.js';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.target.postMessage(module.importedModules);
+  };
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage(module.importedModules);
+  };
+} else if (
+    'ServiceWorkerGlobalScope' in self &&
+    self instanceof ServiceWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.source.postMessage(module.importedModules);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/new-shared-worker-window.html b/test/fixtures/wpt/workers/modules/resources/new-shared-worker-window.html
new file mode 100644
index 000000000000..84564fd7b6e5
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/new-shared-worker-window.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<title>SharedWorker: new SharedWorker()</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+let worker;
+
+// Create a new shared worker for a given script url.
+window.onmessage = e => {
+  worker = new SharedWorker(e.data.scriptURL,
+                            { name: e.data.name, type: 'module' });
+  worker.port.onmessage = msg => window.opener.postMessage(msg.data, '*');
+  worker.onerror = err => {
+    window.opener.postMessage(['ERROR'], '*');
+    err.preventDefault();
+  };
+}
+window.opener.postMessage('LOADED', '*');
+</script>
diff --git a/test/fixtures/wpt/workers/modules/resources/new-worker-window.html b/test/fixtures/wpt/workers/modules/resources/new-worker-window.html
new file mode 100644
index 000000000000..32a89fae0ecd
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/new-worker-window.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: new Worker()</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+let worker;
+
+// Creates a new dedicated worker for a given script url.
+window.onmessage = e => {
+  worker = new Worker(e.data, { type: 'module' });
+  worker.postMessage('start');
+  worker.onmessage = msg => window.opener.postMessage(msg.data, '*');
+  worker.onerror = err => {
+      window.opener.postMessage(['ERROR'], '*');
+      err.preventDefault();
+  };
+};
+window.opener.postMessage('LOADED', '*');
+</script>
diff --git a/test/fixtures/wpt/workers/modules/resources/post-message-on-load-worker.js b/test/fixtures/wpt/workers/modules/resources/post-message-on-load-worker.js
new file mode 100644
index 000000000000..e1c547ab6a4d
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/post-message-on-load-worker.js
@@ -0,0 +1,10 @@
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  postMessage('LOADED');
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage('LOADED');
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-and-then-dynamic-import-worker.js b/test/fixtures/wpt/workers/modules/resources/static-import-and-then-dynamic-import-worker.js
new file mode 100644
index 000000000000..2d857a2e90a1
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-and-then-dynamic-import-worker.js
@@ -0,0 +1,34 @@
+// This script is meant to be imported by a module worker. It receives a
+// message from the worker and responds with the list of imported modules.
+import * as module from './export-on-dynamic-import-script.js';
+
+const sourcePromise = new Promise(resolve => {
+  if ('DedicatedWorkerGlobalScope' in self &&
+      self instanceof DedicatedWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.target);
+    };
+  } else if (
+      'SharedWorkerGlobalScope' in self &&
+      self instanceof SharedWorkerGlobalScope) {
+    self.onconnect = e => {
+      resolve(e.ports[0]);
+    };
+  } else if (
+      'ServiceWorkerGlobalScope' in self &&
+      self instanceof ServiceWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.source);
+    };
+  }
+});
+
+export let importedModules = ['export-on-dynamic-import-script.js'];
+const importedModulesPromise = module.ready
+  .then(importedModules => importedModules)
+  .catch(error => `Failed to do dynamic import: ${error}`);
+
+Promise.all([sourcePromise, importedModulesPromise]).then(results => {
+  const [source, importedModules] = results;
+  source.postMessage(importedModules);
+});
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-data-url-block-cross-origin.js b/test/fixtures/wpt/workers/modules/resources/static-import-data-url-block-cross-origin.js
new file mode 100644
index 000000000000..833348d66cce
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-data-url-block-cross-origin.js
@@ -0,0 +1,14 @@
+import * as module from "data:text/javascript, export const importedModules = ['export-block-cross-origin.js'];";
+
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.target.postMessage(module.importedModules);
+  };
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage(module.importedModules);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-non-existent-script-worker.js b/test/fixtures/wpt/workers/modules/resources/static-import-non-existent-script-worker.js
new file mode 100644
index 000000000000..16f70e9daf49
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-non-existent-script-worker.js
@@ -0,0 +1 @@
+import './non-existent-script.js';
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-redirect-worker.js b/test/fixtures/wpt/workers/modules/resources/static-import-redirect-worker.js
new file mode 100644
index 000000000000..8434c1a34e28
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-redirect-worker.js
@@ -0,0 +1,21 @@
+// This script is meant to be imported by a module worker. It receives a
+// message from the worker and responds with the list of imported modules.
+import * as module from './redirect.py?location=/workers/modules/resources/export-on-load-script.js';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.target.postMessage(module.importedModules);
+  };
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage(module.importedModules);
+  };
+} else if (
+    'ServiceWorkerGlobalScope' in self &&
+    self instanceof ServiceWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.source.postMessage(module.importedModules);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-credentials-checker-worker.sub.js b/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-credentials-checker-worker.sub.js
new file mode 100644
index 000000000000..c543cb496160
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-credentials-checker-worker.sub.js
@@ -0,0 +1,12 @@
+// Import a remote origin script.
+import * as module from 'http://{{domains[www1]}}:{{ports[http][0]}}/workers/modules/resources/export-credentials.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  postMessage(module.cookie);
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    e.ports[0].postMessage(module.cookie);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-referrer-checker-worker.sub.js b/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-referrer-checker-worker.sub.js
new file mode 100644
index 000000000000..c1f8340f36d7
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-referrer-checker-worker.sub.js
@@ -0,0 +1,12 @@
+// Import a remote origin script.
+import * as module from 'https://{{hosts[alt][]}}:{{ports[https][0]}}/workers/modules/resources/export-referrer-checker.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  postMessage(module.referrer);
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    e.ports[0].postMessage(module.referrer);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-script-worker.sub.js b/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-script-worker.sub.js
new file mode 100644
index 000000000000..6432dd5d80d0
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-script-worker.sub.js
@@ -0,0 +1,20 @@
+// Import a remote origin script.
+import * as module from 'https://{{domains[www1]}}:{{ports[https][0]}}/workers/modules/resources/export-on-load-script.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.target.postMessage(module.importedModules);
+  };
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage(module.importedModules);
+  };
+} else if (
+    'ServiceWorkerGlobalScope' in self &&
+    self instanceof ServiceWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.source.postMessage(module.importedModules);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-same-origin-credentials-checker-worker.js b/test/fixtures/wpt/workers/modules/resources/static-import-same-origin-credentials-checker-worker.js
new file mode 100644
index 000000000000..e83dc92070ff
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-same-origin-credentials-checker-worker.js
@@ -0,0 +1,11 @@
+import * as module from './export-credentials.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  postMessage(module.cookie);
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    e.ports[0].postMessage(module.cookie);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-same-origin-referrer-checker-worker.js b/test/fixtures/wpt/workers/modules/resources/static-import-same-origin-referrer-checker-worker.js
new file mode 100644
index 000000000000..ffcab9e45fdf
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-same-origin-referrer-checker-worker.js
@@ -0,0 +1,11 @@
+import * as module from './export-referrer-checker.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  postMessage(module.referrer);
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    e.ports[0].postMessage(module.referrer);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-script-block-cross-origin.js b/test/fixtures/wpt/workers/modules/resources/static-import-script-block-cross-origin.js
new file mode 100644
index 000000000000..82be8e7ce72e
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-script-block-cross-origin.js
@@ -0,0 +1,14 @@
+import * as module from './export-block-cross-origin.js';
+
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.target.postMessage(module.importedModules);
+  };
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage(module.importedModules);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-syntax-error.js b/test/fixtures/wpt/workers/modules/resources/static-import-syntax-error.js
new file mode 100644
index 000000000000..3a20e792c455
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-syntax-error.js
@@ -0,0 +1 @@
+import * as module from './syntax-error.js';
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-worker.js b/test/fixtures/wpt/workers/modules/resources/static-import-worker.js
new file mode 100644
index 000000000000..19a347999d38
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-worker.js
@@ -0,0 +1,21 @@
+// This script is meant to be imported by a module worker. It receives a
+// message from the worker and responds with the list of imported modules.
+import * as module from './export-on-load-script.js';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.target.postMessage(module.importedModules);
+  };
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage(module.importedModules);
+  };
+} else if (
+    'ServiceWorkerGlobalScope' in self &&
+    self instanceof ServiceWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.source.postMessage(module.importedModules);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/syntax-error.js b/test/fixtures/wpt/workers/modules/resources/syntax-error.js
new file mode 100644
index 000000000000..8c5c4df671bc
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/syntax-error.js
@@ -0,0 +1 @@
+1 + ;
diff --git a/test/fixtures/wpt/workers/modules/resources/throw.js b/test/fixtures/wpt/workers/modules/resources/throw.js
new file mode 100644
index 000000000000..3d876d43d930
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/throw.js
@@ -0,0 +1 @@
+throw new Error('custom message');
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-import-blob-url.window.js b/test/fixtures/wpt/workers/modules/shared-worker-import-blob-url.window.js
new file mode 100644
index 000000000000..a79d5725ad87
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-import-blob-url.window.js
@@ -0,0 +1,26 @@
+// META: script=/workers/modules/resources/import-test-cases.js
+
+// Imports |testCase.scriptURL| on a shared worker loaded from a blob URL,
+// and waits until the list of imported modules is sent from the worker. Passes
+// if the list is equal to |testCase.expectation|.
+function import_blob_url_test(testCase) {
+  promise_test(async () => {
+    const importURL = new URL(testCase.scriptURL, location.href);
+    const blob =
+        new Blob([`import "${importURL}";`], {type: 'text/javascript'});
+    const blobURL = URL.createObjectURL(blob);
+    const worker = new SharedWorker(blobURL, {type: 'module'});
+    worker.port.postMessage('Send message for tests from main script.');
+    const msgEvent = await new Promise((resolve, reject) => {
+      worker.port.onmessage = resolve;
+      worker.onerror = error => {
+        const msg = error instanceof ErrorEvent ? error.message
+                                                : 'unknown error';
+        reject(msg);
+      };
+    });
+    assert_array_equals(msgEvent.data, testCase.expectation);
+  }, testCase.description);
+}
+
+testCases.forEach(import_blob_url_test);
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-import-csp.html b/test/fixtures/wpt/workers/modules/shared-worker-import-csp.html
new file mode 100644
index 000000000000..c7ca37557a1d
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-import-csp.html
@@ -0,0 +1,128 @@
+<!DOCTYPE html>
+<title>SharedWorker: CSP for ES Modules</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+// This Set is for checking a shared worker in each test is newly created.
+const existingWorkers = new Set();
+
+async function openWindow(url) {
+  const win = window.open(url, '_blank');
+  add_result_callback(() => win.close());
+  const msgEvent = await new Promise(resolve => window.onmessage = resolve);
+  assert_equals(msgEvent.data, 'LOADED');
+  return win;
+}
+
+function import_csp_test(
+    cspHeader, importType, expectedImportedModules, description) {
+  // Append CSP header to windowURL for static import tests since static import
+  // scripts should obey Window's CSP.
+  const windowURL = `resources/new-shared-worker-window.html` +
+      `${importType === 'static'
+          ? '?pipe=header(Content-Security-Policy, ' + cspHeader + ')'
+          : ''}`;
+  // Append CSP header to scriptURL for dynamic import tests since dynamic
+  // import scripts should obey SharedWorker script's responce's CSP.
+  const scriptURL = `${importType}-import-remote-origin-script-worker.sub.js` +
+      `${importType === 'dynamic'
+          ? '?pipe=header(Content-Security-Policy, ' + cspHeader + ')'
+          : ''}`;
+  promise_test(async () => {
+    // Open a window that has the given CSP header.
+    const win = await openWindow(windowURL);
+    // Construct a unique name for SharedWorker.
+    const name = `${cspHeader}_${importType}`;
+    const workerProperties = { scriptURL, name };
+    // Check if this shared worker is newly created.
+    assert_false(existingWorkers.has(workerProperties));
+    existingWorkers.add(workerProperties);
+
+    // Ask the window to start a shared worker with the given CSP header.
+    // The shared worker doesn't inherits the window's CSP header.
+    // https://w3c.github.io/webappsec-csp/#initialize-global-object-csp
+    win.postMessage(workerProperties, '*');
+    const msg_event = await new Promise(resolve => window.onmessage = resolve);
+    assert_array_equals(msg_event.data, expectedImportedModules);
+  }, description);
+}
+
+// Tests for static import.
+//
+// Static import should obey the worker-src directive and the script-src
+// directive. If the both directives are specified, the worker-src directive
+// should be prioritized.
+//
+// "The script-src directive acts as a default fallback for all script-like
+// destinations (including worker-specific destinations if worker-src is not
+// present)."
+// https://w3c.github.io/webappsec-csp/#directive-script-src
+
+import_csp_test(
+    "worker-src 'self' 'unsafe-inline'", "static",
+    ['ERROR'],
+    "worker-src 'self' directive should disallow cross origin static import.");
+
+import_csp_test(
+    "worker-src * 'unsafe-inline'", "static",
+    ["export-on-load-script.js"],
+    "worker-src * directive should allow cross origin static import.");
+
+import_csp_test(
+    "script-src 'self' 'unsafe-inline'", "static",
+    ['ERROR'],
+    "script-src 'self' directive should disallow cross origin static import.");
+
+import_csp_test(
+    "script-src * 'unsafe-inline'", "static",
+    ["export-on-load-script.js"],
+    "script-src * directive should allow cross origin static import.");
+
+import_csp_test(
+    "worker-src *; script-src 'self' 'unsafe-inline'", "static",
+    ["export-on-load-script.js"],
+    "worker-src * directive should override script-src 'self' directive and " +
+        "allow cross origin static import.");
+
+import_csp_test(
+    "worker-src 'self'; script-src * 'unsafe-inline'", "static",
+    ['ERROR'],
+    "worker-src 'self' directive should override script-src * directive and " +
+        "disallow cross origin static import.");
+
+// Tests for dynamic import.
+//
+// Dynamic import should obey SharedWorker script's CSP instead of parent
+// Window's CSP.
+//
+// Dynamic import should obey the script-src directive instead of the worker-src
+// directive according to the specs:
+//
+// Dynamic import has the "script" destination.
+// Step 3: "Fetch a single module script graph given url, ..., "script", ..."
+// https://html.spec.whatwg.org/multipage/webappapis.html#fetch-an-import()-module-script-graph
+//
+// The "script" destination should obey the script-src CSP directive.
+// "The script-src directive acts as a default fallback for all script-like
+// destinations (including worker-specific destinations if worker-src is not
+// present)."
+// https://w3c.github.io/webappsec-csp/#directive-script-src
+
+import_csp_test(
+    "script-src 'self' 'unsafe-inline'", "dynamic",
+    ['ERROR'],
+    "script-src 'self' directive should disallow cross origin dynamic import.");
+
+import_csp_test(
+    "script-src * 'unsafe-inline'", "dynamic",
+    ["export-on-load-script.js"],
+    "script-src * directive should allow cross origin dynamic import.");
+
+import_csp_test(
+    "worker-src 'self' 'unsafe-inline'", "dynamic",
+    ["export-on-load-script.js"],
+    "worker-src 'self' directive should not take effect on dynamic import.");
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-import-data-url-cross-origin.html b/test/fixtures/wpt/workers/modules/shared-worker-import-data-url-cross-origin.html
new file mode 100644
index 000000000000..06724a2b9ea5
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-import-data-url-cross-origin.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<title>SharedWorker: ES modules for data URL workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+const import_from_data_url_worker_test = (importType, isDataURL, expectation) => {
+  promise_test(async () => {
+    const importURL = new URL(`resources/${importType}-import-` +
+        `${isDataURL ? 'data-url' : 'script'}-block-cross-origin.js`,
+        location.href) + '?pipe=header(Access-Control-Allow-Origin, *)';
+    const dataURL = `data:text/javascript,import "${importURL}";`;
+    const worker = new SharedWorker(dataURL, { type: 'module' });
+    worker.port.postMessage('Send message for tests from main script.');
+    const msgEvent = await new Promise((resolve, reject) =>{
+        worker.port.onmessage = resolve;
+        worker.onerror = reject;
+    }).catch(e => assert_true(false));
+
+    assert_array_equals(msgEvent.data,
+        expectation === 'blocked' ? ['ERROR']
+                                  : ['export-block-cross-origin.js']);
+  }, `${importType} import ${isDataURL ? 'data url' : 'script'} from data: ` +
+     `URL should be ${expectation}.`);
+}
+
+// Static import should obey the outside settings.
+// SecurityOrigin of the outside settings is decided by Window.
+import_from_data_url_worker_test('static', true, 'allowed');
+import_from_data_url_worker_test('static', false, 'allowed');
+
+
+// Dynamic import should obey the inside settings.
+// SecurityOrigin of the inside settings is a unique opaque origin.
+//
+// Data url script is cross-origin to the inside settings' SecurityOrigin, but
+// dynamic importing it is allowed.
+// https://fetch.spec.whatwg.org/#concept-main-fetch
+// Step 5: request’s current URL’s scheme is "data" [spec text]
+import_from_data_url_worker_test('dynamic', true, 'allowed');
+
+// Non-data url script is cross-origin to the inside settings' SecurityOrigin.
+// It should be blocked.
+import_from_data_url_worker_test('dynamic', false, 'blocked');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-import-data-url.window.js b/test/fixtures/wpt/workers/modules/shared-worker-import-data-url.window.js
new file mode 100644
index 000000000000..5c77f6d93661
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-import-data-url.window.js
@@ -0,0 +1,25 @@
+// META: script=/workers/modules/resources/import-test-cases.js
+
+// Imports |testCase.scriptURL| on a shared worker loaded from a data URL,
+// and waits until the list of imported modules is sent from the worker. Passes
+// if the list is equal to |testCase.expectation|.
+function import_data_url_test(testCase) {
+  promise_test(async () => {
+    // The Access-Control-Allow-Origin header is necessary because a worker
+    // loaded from a data URL has a null origin and import() on the worker
+    // without the header is blocked.
+    const importURL = new URL(testCase.scriptURL, location.href) +
+        '?pipe=header(Access-Control-Allow-Origin, *)';
+    const dataURL = `data:text/javascript,import "${importURL}";`;
+
+    const worker = new SharedWorker(dataURL, { type: 'module'});
+    worker.port.postMessage('Send message for tests from main script.');
+    const msgEvent = await new Promise((resolve, reject) =>{
+        worker.port.onmessage = resolve;
+        worker.onerror = reject;
+    }).catch(e => assert_true(false));
+    assert_array_equals(msgEvent.data, testCase.expectation);
+  }, testCase.description);
+}
+
+testCases.forEach(import_data_url_test);
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-import-failure.html b/test/fixtures/wpt/workers/modules/shared-worker-import-failure.html
new file mode 100644
index 000000000000..c9d166c4fe78
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-import-failure.html
@@ -0,0 +1,70 @@
+<!DOCTYPE html>
+<title>SharedWorker: import failure</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script> setup({allow_uncaught_exception: true}); </script>
+<script>
+
+// TODO: Factor out the test cases into a separate file.
+// (like import-test-cases.js)
+
+// SharedWorkers doesn't fire error events when runtime script errors occur.
+//
+// "For shared workers, if the error is still not handled afterwards, the error
+// may be reported to a developer console." [spec text]
+// https://html.spec.whatwg.org/C/#runtime-script-errors-2
+
+promise_test(async () => {
+  const scriptURL = 'resources/import-scripts-worker.js';
+  const worker = new SharedWorker(scriptURL, { type: 'module' });
+  const msg_event =
+    await new Promise(resolve => worker.port.onmessage = resolve);
+  assert_equals(msg_event.data, 'TypeError');
+}, 'importScripts() on module worker should throw an exception.');
+
+promise_test(() => {
+  const scriptURL = 'resources/non-existent-worker.js';
+  const worker = new SharedWorker(scriptURL, { type: 'module' });
+  return new Promise(resolve => worker.onerror = resolve);
+}, 'Worker construction for non-existent script should dispatch an ' +
+   'ErrorEvent.');
+
+promise_test(() => {
+  const scriptURL = 'resources/static-import-non-existent-script-worker.js';
+  const worker = new SharedWorker(scriptURL, { type: 'module' });
+  return new Promise(resolve => worker.onerror = resolve);
+}, 'Static import for non-existent script should dispatch an ErrorEvent.');
+
+promise_test(async () => {
+  const scriptURL = './non-existent-worker.js';
+  const worker =
+      new SharedWorker('resources/dynamic-import-given-url-worker.js',
+                       { type: 'module' });
+  worker.port.postMessage(scriptURL);
+  const msg_event = await new Promise((resolve, reject) => {
+    worker.port.onmessage = resolve;
+    worker.onerror = error => {
+      const msg = error instanceof ErrorEvent ? error.message
+                                              : 'unknown error';
+      reject(msg);
+    };
+  });
+  assert_equals(msg_event.data, 'TypeError');
+}, 'Dynamic import for non-existent script should throw an exception.');
+
+test(() => {
+  const scriptURL = 'http://invalid:123$';
+  assert_throws_dom('SyntaxError',
+                    () => new SharedWorker(scriptURL, { type: 'module' }));
+}, 'SharedWorker construction for an invalid URL should throw an exception.');
+
+async_test((t) => {
+  const scriptURL = 'file:///static-import-worker.js';
+  const worker = new SharedWorker(scriptURL, { type: 'module' });
+  worker.onerror = t.step_func_done(function(e) {
+    assert_true(e instanceof Event);
+  });
+
+}, 'SharedWorker construction for a file URL should throw an exception.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-import-meta.html b/test/fixtures/wpt/workers/modules/shared-worker-import-meta.html
new file mode 100644
index 000000000000..e8e9b51f6a50
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-import-meta.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<title>SharedWorker: import.meta</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+promise_test(() => {
+  const script_url = 'resources/import-meta-url-worker.js';
+  const worker = new SharedWorker(script_url, { type: 'module' });
+  return new Promise((resolve, reject) => {
+        worker.port.onmessage = resolve;
+        worker.onerror = (error) => reject(error && error.message);
+      })
+      .then(msg_event => assert_true(msg_event.data.endsWith(script_url)));
+}, 'Test import.meta.url on the top-level module script.');
+
+promise_test(() => {
+  const script_url = 'import-meta-url-export.js';
+  const worker = new SharedWorker(
+      'resources/dynamic-import-given-url-worker.js',
+      { type: 'module' });
+  worker.port.postMessage('./' + script_url);
+  return new Promise((resolve, reject) => {
+        worker.port.onmessage = resolve;
+        worker.onerror = (error) => reject(error && error.message);
+      })
+      .then(msg_event => assert_true(msg_event.data.endsWith(script_url)));
+}, 'Test import.meta.url on the imported module script.');
+
+promise_test(() => {
+  const script_url = 'import-meta-url-export.js';
+  const worker = new SharedWorker(
+      'resources/dynamic-import-given-url-worker.js',
+      { type: 'module' });
+  worker.port.postMessage('./' + script_url);
+
+  return new Promise((resolve, reject) => {
+        worker.port.onmessage = resolve;
+        worker.onerror = (error) => reject(error && error.message);
+      })
+      .then(msg_event => assert_true(msg_event.data.endsWith(script_url)))
+      .then(() => {
+        worker.port.postMessage('./' + script_url + '#1');
+        return new Promise(resolve => worker.port.onmessage = resolve);
+      })
+      .then(msg_event => assert_true(msg_event.data.endsWith(script_url + "#1")));
+}, 'Test import.meta.url on the imported module script with a fragment.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-import-referrer.html b/test/fixtures/wpt/workers/modules/shared-worker-import-referrer.html
new file mode 100644
index 000000000000..1096fd2ad872
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-import-referrer.html
@@ -0,0 +1,259 @@
+<!DOCTYPE html>
+<title>SharedWorker: Referrer</title>
+<meta name="timeout" content="long" />
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+// This Set is for checking a shared worker in each test is newly created.
+const existingWorkers = new Set();
+
+async function openWindow(url) {
+  const win = window.open(url, '_blank');
+  add_result_callback(() => win.close());
+  const msg_event = await new Promise(resolve => window.onmessage = resolve);
+  assert_equals(msg_event.data, 'LOADED');
+  return win;
+}
+
+// Removes URL parameters from the given URL string and returns it.
+function removeParams(url_string) {
+  if (!url_string)
+    return url_string;
+  let url = new URL(url_string);
+  for (var key of url.searchParams.keys())
+    url.searchParams.delete(key);
+  return url.href;
+}
+
+// Generates a referrer given a fetchType, referrer policy, and a request URL
+// (used to determine whether request is remote-origin or not). This function
+// is used to generate expected referrers.
+function generateExpectedReferrer(referrerURL, referrerPolicy, requestURL) {
+  let generatedReferrer = "";
+  if (referrerPolicy === 'no-referrer')
+    generatedReferrer = "";
+  else if (referrerPolicy === 'origin')
+    generatedReferrer = new URL('resources/' + referrerURL, location.href).origin + '/';
+  else if (referrerPolicy === 'same-origin')
+    generatedReferrer = requestURL.includes('remote') ? "" : new URL('resources/' + referrerURL, location.href).href;
+  else
+    generatedReferrer = new URL('resources/' + referrerURL, location.href).href;
+
+  return generatedReferrer;
+}
+
+// Runs a referrer policy test with the given settings. This opens a new window
+// that starts a shared worker.
+//
+// |settings| has options as follows:
+//
+//   settings = {
+//     scriptURL: 'resources/referrer-checker.sub.js',
+//     windowReferrerPolicy: 'no-referrer',
+//     workerReferrerPolicy: 'same-origin',
+//     fetchType: 'top-level' or 'descendant-static' or 'descendant-dynamic'
+//   };
+//
+// - |scriptURL| is used for starting a new worker.
+// - |windowReferrerPolicy| is to set the ReferrerPolicy HTTP header of the
+//   window. This policy should be applied to top-level worker module script
+//   loading and static imports.
+// - |workerReferrerPolicy| is to set the ReferrerPolicy HTTP header of the
+//   worker. This policy should be applied to dynamic imports.
+// - |fetchType| indicates a script whose referrer will be tested.
+function import_referrer_test(settings, description) {
+  promise_test(async () => {
+    let windowURL = 'resources/new-shared-worker-window.html';
+    if (settings.windowReferrerPolicy) {
+      windowURL +=
+          `?pipe=header(Referrer-Policy, ${settings.windowReferrerPolicy})`;
+    }
+
+    let scriptURL = settings.scriptURL;
+    if (settings.workerReferrerPolicy) {
+      // 'sub' is necessary even if the |scriptURL| contains the '.sub'
+      // extension because the extension doesn't work with the 'pipe' parameter.
+      // See an issue on the WPT's repository:
+      // https://github.com/web-platform-tests/wpt/issues/9345
+      scriptURL +=
+          `?pipe=sub|header(Referrer-Policy, ${settings.workerReferrerPolicy})`;
+    }
+
+    const win = await openWindow(windowURL);
+    // Construct a unique name for SharedWorker.
+    const name = `${settings.scriptURL}_` +
+        `${settings.windowReferrerPolicy ? settings.windowReferrerPolicy
+                                         : settings.workerReferrerPolicy}` +
+        `_${settings.fetchType}`;
+    const workerProperties = { scriptURL, name };
+    // Check if this shared worker is newly created.
+    assert_false(existingWorkers.has(workerProperties));
+    existingWorkers.add(workerProperties);
+
+    win.postMessage(workerProperties, '*');
+    const msgEvent = await new Promise(resolve => window.onmessage = resolve);
+
+    // Generate the expected referrer, given:
+    //   - The fetchType of the test
+    //   - Referrer URL to be used
+    //   - Relevant referrer policy
+    //   - Request URL
+    let expectedReferrer;
+    if (settings.fetchType === 'top-level') {
+      // Top-level worker requests have their outgoing referrers set given their
+      // containing window's URL and referrer policy.
+      expectedReferrer = generateExpectedReferrer('new-shared-worker-window.html', settings.windowReferrerPolicy, settings.scriptURL);
+    } else if (settings.fetchType === 'descendant-static') {
+      // Static descendant script requests from a worker have their outgoing
+      // referrer set given their containing script's URL and containing
+      // window's referrer policy.
+
+      // In the below cases, the referrer URL and the request URLs are the same
+      // because the initial request (for the top-level worker script) should
+      // act as the referrer for future descendant requests.
+      expectedReferrer = generateExpectedReferrer(settings.scriptURL, settings.windowReferrerPolicy, settings.scriptURL);
+    } else if (settings.fetchType === 'descendant-dynamic') {
+      // Dynamic descendant script requests from a worker have their outgoing
+      // referrer set given their containing script's URL and referrer policy.
+      expectedReferrer = generateExpectedReferrer(settings.scriptURL, settings.workerReferrerPolicy, settings.scriptURL);
+    }
+
+    // Delete query parameters from the actual referrer to make it easy to match
+    // it with the expected referrer.
+    const actualReferrer = removeParams(msgEvent.data);
+
+    assert_equals(actualReferrer, expectedReferrer);
+  }, description);
+}
+
+// Tests for top-level worker module script loading.
+//
+// Top-level worker module scripts should inherit the containing window's
+// referrer policy when using the containing window's URL as the referrer.
+//
+// [Current document]
+// --(open)--> [Window] whose referrer policy is |windowReferrerPolicy|.
+//   --(new SharedWorker)--> [SharedWorker] should respect [windowReferrerPolicy|
+//                           when using [Window]'s URL as the referrer.
+
+import_referrer_test(
+    { scriptURL: 'postmessage-referrer-checker.py',
+      windowReferrerPolicy: 'no-referrer',
+      fetchType: 'top-level' },
+    'Same-origin top-level module script loading with "no-referrer" referrer ' +
+        'policy');
+
+import_referrer_test(
+    { scriptURL: 'postmessage-referrer-checker.py',
+      windowReferrerPolicy: 'origin',
+      fetchType: 'top-level' },
+    'Same-origin top-level module script loading with "origin" referrer ' +
+        'policy');
+
+import_referrer_test(
+    { scriptURL: 'postmessage-referrer-checker.py',
+      windowReferrerPolicy: 'same-origin',
+      fetchType: 'top-level' },
+    'Same-origin top-level module script loading with "same-origin" referrer ' +
+        'policy');
+
+// Tests for static imports.
+//
+// Static imports should inherit the containing window's referrer policy when
+// using the containing module script's URL as the referrer.
+// Note: This is subject to change in the future; see
+// https://github.com/w3c/webappsec-referrer-policy/issues/111.
+//
+// [Current document]
+// --(open)--> [Window] whose referrer policy is |windowReferrerPolicy|.
+//   --(new SharedWorker)--> [SharedWorker]
+//     --(static import)--> [Script] should respect |windowReferrerPolicy| when
+//                          using [SharedWorker]'s URL as the referrer.
+
+import_referrer_test(
+    { scriptURL: 'static-import-same-origin-referrer-checker-worker.js',
+      windowReferrerPolicy: 'no-referrer',
+      fetchType: 'descendant-static' },
+    'Same-origin static import with "no-referrer" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-same-origin-referrer-checker-worker.js',
+      windowReferrerPolicy: 'origin',
+      fetchType: 'descendant-static' },
+    'Same-origin static import with "origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-same-origin-referrer-checker-worker.js',
+      windowReferrerPolicy: 'same-origin',
+      fetchType: 'descendant-static' },
+    'Same-origin static import with "same-origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-remote-origin-referrer-checker-worker.sub.js',
+      windowReferrerPolicy: 'no-referrer',
+      fetchType: 'descendant-static' },
+    'Cross-origin static import with "no-referrer" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-remote-origin-referrer-checker-worker.sub.js',
+      windowReferrerPolicy: 'origin',
+      fetchType: 'descendant-static' },
+    'Cross-origin static import with "origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-remote-origin-referrer-checker-worker.sub.js',
+      windowReferrerPolicy: 'same-origin',
+      fetchType: 'descendant-static' },
+    'Cross-origin static import with "same-origin" referrer policy.');
+
+// Tests for dynamic imports.
+//
+// Dynamic imports should inherit the containing script's referrer policy if
+// set, and use the default referrer policy otherwise, when using the
+// containing script's URL as the referrer.
+//
+// [Current document]
+// --(open)--> [Window]
+//   --(new SharedWorker)--> [SharedWorker] whose referrer policy is
+//                           |workerReferrerPolicy|.
+//     --(dynamic import)--> [Script] should respect |workerReferrerPolicy| when
+//                           using [SharedWorker]'s URL as the referrer.
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-same-origin-referrer-checker-worker.js',
+      workerReferrerPolicy: 'no-referrer',
+      fetchType: 'descendant-dynamic' },
+    'Same-origin dynamic import with "no-referrer" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-same-origin-referrer-checker-worker.js',
+      workerReferrerPolicy: 'origin',
+      fetchType: 'descendant-dynamic' },
+    'Same-origin dynamic import with "origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-same-origin-referrer-checker-worker.js',
+      workerReferrerPolicy: 'same-origin',
+      fetchType: 'descendant-dynamic' },
+    'Same-origin dynamic import with "same-origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-remote-origin-referrer-checker-worker.sub.js',
+      workerReferrerPolicy: 'no-referrer',
+      fetchType: 'descendant-dynamic' },
+    'Cross-origin dynamic import with "no-referrer" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-remote-origin-referrer-checker-worker.sub.js',
+      workerReferrerPolicy: 'origin',
+      fetchType: 'descendant-dynamic' },
+    'Cross-origin dynamic import with "origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-remote-origin-referrer-checker-worker.sub.js',
+      workerReferrerPolicy: 'same-origin',
+      fetchType: 'descendant-dynamic' },
+    'Cross-origin dynamic import with "same-origin" referrer policy.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-import.window.js b/test/fixtures/wpt/workers/modules/shared-worker-import.window.js
new file mode 100644
index 000000000000..5be49ec12598
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-import.window.js
@@ -0,0 +1,22 @@
+// META: script=/workers/modules/resources/import-test-cases.js
+
+// Starts a shared worker for |testCase.scriptURL| and waits until the list
+// of imported modules is sent from the worker. Passes if the list is equal to
+// |testCase.expectation|.
+function import_test(testCase) {
+  promise_test(async () => {
+    const worker = new SharedWorker(testCase.scriptURL, {type: 'module'});
+    worker.port.postMessage('Send message for tests from main script.');
+    const msgEvent = await new Promise((resolve, reject) => {
+      worker.port.onmessage = resolve;
+      worker.onerror = error => {
+        const msg = error instanceof ErrorEvent ? error.message
+                                                : 'unknown error';
+        reject(msg);
+      };
+    });
+    assert_array_equals(msgEvent.data, testCase.expectation);
+  }, testCase.description);
+}
+
+testCases.forEach(import_test);
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-options-credentials.html b/test/fixtures/wpt/workers/modules/shared-worker-options-credentials.html
new file mode 100644
index 000000000000..221dd01a376f
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-options-credentials.html
@@ -0,0 +1,309 @@
+<!DOCTYPE html>
+<title>SharedWorker: WorkerOptions 'credentials'</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script>
+host_info = get_host_info();
+
+// Determines the expected cookie value to be reported by a shared worker
+// based on the given option. The worker reports an empty string as the actual
+// cookie value if the cookie wasn't sent to the server. Otherwise, it's the
+// value set by the headers file:
+// "shared-worker-options-credentials.html.headers"
+function DetermineExpectedCookieValue(options, config) {
+  // Valid WorkerOptions and test config checking.
+  if (config.origin !== 'same' && config.origin !== 'remote')
+    assert_unreached('Invalid config.origin was specified: ' + config.origin);
+  if (options.credentials && options.credentials !== 'omit' &&
+      options.credentials !== 'same-origin' &&
+      options.credentials !== 'include') {
+    assert_unreached('Invalid credentials option was specified: ' +
+                      options.credentials);
+  }
+  if (options.type !== 'classic' && options.type !== 'module')
+    assert_unreached('Invalid type option was specified: ' + options.type);
+
+  if (options.type === 'classic')
+    return (config.origin === 'same') ? '1' : '';
+
+  if (options.credentials === 'omit')
+    return '';
+  else if (options.credentials === 'include')
+    return '1';
+  else
+    return (config.origin === 'same') ? '1' : '';
+}
+
+// Runs a credentials test with the given WorkerOptions.
+//
+// |options| is a WorkerOptions dict.
+// |config| has options as follows:
+//
+//   config = {
+//     fetchType: 'top-level' or 'descendant-static' or 'descendant-dynamic'
+//     origin: 'remote' or 'same'
+//   };
+//
+// - |config.fetchType| indicates the type of script to load for the test.
+// - |config.origin| indicates same-origin-ness of the script to load.
+function credentials_test(options, config, description) {
+  promise_test(async () => {
+    let workerURL, origin = config.origin;
+    if (config.fetchType === 'top-level') {
+      workerURL = 'resources/postmessage-credentials.py';
+    } else if (config.fetchType === 'descendant-static') {
+      workerURL =
+        `resources/static-import-${origin}-origin-credentials-checker-worker.${origin === 'same' ? '' : 'sub.'}js`;
+    } else if (config.fetchType === 'descendant-dynamic') {
+      workerURL =
+        `resources/dynamic-import-${origin}-origin-credentials-checker-worker.${origin === 'same' ? '' : 'sub.'}js`;
+    } else {
+      assert_unreached('Invalid config.fetchType: ' + config.fetchType);
+    }
+
+    // Name idetically for each test cases so that it connects to the shared
+    // worker with specified type and credentials.
+    options.name = `${options.type}_${options.credentials || 'default'}_${config.fetchType}_${config.origin}`;
+
+    const worker = new SharedWorker(workerURL, options);
+
+    // Wait until the worker sends the actual cookie value.
+    const msg_event = await new Promise(resolve => worker.port.onmessage = resolve);
+
+    const expectedCookieValue = DetermineExpectedCookieValue(options, config);
+    assert_equals(msg_event.data, expectedCookieValue);
+  }, description);
+}
+
+function init() {
+  // Same-origin cookie is set up in the .headers file in this directory.
+  promise_test(async () => {
+    return fetch(
+      `${host_info.HTTP_REMOTE_ORIGIN}/cookies/resources/set-cookie.py?name=COOKIE_NAME&path=/workers/modules/`,
+      {
+        mode: 'no-cors',
+        credentials: 'include'
+      });
+  }, 'Test initialization: setting up cross-origin cookie');
+}
+
+init();
+
+// Tests for module workers.
+
+credentials_test(
+    { type: 'module' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new SharedWorker() with type=module and default credentials option ' +
+    'should behave as credentials=same-origin and send the credentials');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=omit should not ' +
+    'send the credentials');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=same-origin should ' +
+    'send the credentials');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=include should send ' +
+    'the credentials');
+
+// Tests for module worker static imports.
+
+credentials_test(
+    { type: 'module' },
+    { fetchType: 'descendant-static', origin: 'same' },
+    'new SharedWorker() with type=module and default credentials option ' +
+    'should behave as credentials=same-origin and send the credentials for ' +
+    'same-origin static imports');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=omit should not ' +
+    'send the credentials for same-origin static imports');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=same-origin should ' +
+    'send the credentials for same-origin static imports');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=include should send ' +
+    'the credentials for same-origin static imports');
+
+credentials_test(
+    { type: 'module' },
+    { fetchType: 'descendant-static', origin: 'remote' },
+    'new SharedWorker() with type=module and default credentials option ' +
+    'should behave as credentials=same-origin and not send the credentials ' +
+    'for cross-origin static imports');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'remote' },
+    'new SharedWorker() with type=module and credentials=omit should not ' +
+    'send the credentials for cross-origin static imports');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'remote' },
+    'new SharedWorker() with type=module and credentials=same-origin should ' +
+    'not send the credentials for cross-origin static imports');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'remote' },
+    'new SharedWorker() with type=module and credentials=include should send ' +
+    'the credentials for cross-origin static imports');
+
+// Tests for module worker dynamic imports.
+
+credentials_test(
+    { type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new SharedWorker() with type=module and default credentials option ' +
+    'should behave as credentials=same-origin and send the credentials for ' +
+    'same-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=omit should not ' +
+    'send the credentials for same-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=same-origin should ' +
+    'send the credentials for same-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=include should send ' +
+    'the credentials for same-origin dynamic imports');
+
+credentials_test(
+    { type: 'module'},
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new SharedWorker() with type=module and default credentials option ' +
+    'should behave as credentials=same-origin and not send the credentials ' +
+    'for cross-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new SharedWorker() with type=module and credentials=omit should not ' +
+    'send the credentials for cross-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new SharedWorker() with type=module and credentials=same-origin should ' +
+    'not send the credentials for cross-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new SharedWorker() with type=module and credentials=include should send ' +
+    'the credentials for cross-origin dynamic imports');
+
+// Tests for classic workers.
+// TODO(domfarolino): Maybe move classic worker tests up a directory?
+
+credentials_test(
+    { type: 'classic' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new SharedWorker() with type=classic should always send the credentials ' +
+    'regardless of the credentials option (default).');
+
+credentials_test(
+    { credentials: 'omit', type: 'classic' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new SharedWorker() with type=classic should always send the credentials ' +
+    'regardless of the credentials option (omit).');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'classic' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new SharedWorker() with type=classic should always send the credentials ' +
+    'regardless of the credentials option (same-origin).');
+
+credentials_test(
+    { credentials: 'include', type: 'classic' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new SharedWorker() with type=classic should always send the credentials ' +
+    'regardless of the credentials option (include).');
+
+// Tests for classic worker dynamic imports.
+
+credentials_test(
+    { type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new SharedWorker() with type=classic should always send the credentials ' +
+    'for same-origin dynamic imports regardless of the credentials option ' +
+    '(default).');
+
+credentials_test(
+    { credentials: 'omit', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new SharedWorker() with type=classic should always send the credentials ' +
+    'for same-origin dynamic imports regardless of the credentials option ' +
+    '(omit).');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new SharedWorker() with type=classic should always send the credentials ' +
+    'for same-origin dynamic imports regardless of the credentials option ' +
+    '(same-origin).');
+
+credentials_test(
+    { credentials: 'include', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new SharedWorker() with type=classic should always send the credentials ' +
+    'for same-origin dynamic imports regardless of the credentials option ' +
+    '(include).');
+
+credentials_test(
+    { type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new SharedWorker() with type=classic should never send the credentials ' +
+    'for cross-origin dynamic imports regardless of the credentials option ' +
+    '(default).');
+
+credentials_test(
+    { credentials: 'omit', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new SharedWorker() with type=classic should never send the credentials ' +
+    'for cross-origin dynamic imports regardless of the credentials option ' +
+    '(omit).');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new SharedWorker() with type=classic should never send the credentials ' +
+    'for cross-origin dynamic imports regardless of the credentials option ' +
+    '(same-origin).');
+
+credentials_test(
+    { credentials: 'include', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new SharedWorker() with type=classic should never send the credentials ' +
+    'for cross-origin dynamic imports regardless of the credentials option ' +
+    '(include).');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-options-credentials.html.headers b/test/fixtures/wpt/workers/modules/shared-worker-options-credentials.html.headers
new file mode 100644
index 000000000000..8da851ab7363
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-options-credentials.html.headers
@@ -0,0 +1,2 @@
+Set-Cookie: COOKIE_NAME=1
+Access-Control-Allow-Credentials: true
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-options-type.html b/test/fixtures/wpt/workers/modules/shared-worker-options-type.html
new file mode 100644
index 000000000000..f62eeeb76b9f
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-options-type.html
@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<title>SharedWorker: WorkerOptions 'type'</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+promise_test(() => {
+  const worker = new SharedWorker('resources/post-message-on-load-worker.js',
+                                  'default');
+  return new Promise(resolve => worker.port.onmessage = resolve)
+      .then(msg_event => assert_equals(msg_event.data, 'LOADED'));
+}, 'Test worker construction with the default worker type.');
+
+promise_test(() => {
+  const worker = new SharedWorker('resources/post-message-on-load-worker.js',
+                                  { name: 'classic', type: 'classic' });
+  return new Promise(resolve => worker.port.onmessage = resolve)
+      .then(msg_event => assert_equals(msg_event.data, 'LOADED'));
+}, 'Test worker construction with the "classic" worker type.');
+
+promise_test(() => {
+  const worker = new SharedWorker('resources/post-message-on-load-worker.js',
+                                  { name: 'module', type: 'module' });
+  return new Promise(resolve => worker.port.onmessage = resolve)
+      .then(msg_event => assert_equals(msg_event.data, 'LOADED'));
+}, 'Test worker construction with the "module" worker type.');
+
+test(() => {
+  assert_throws_js(
+      TypeError,
+      () => {
+        new SharedWorker('resources/post-message-on-load-worker.js',
+                         { name: 'blank', type : '' });
+      },
+      'Worker construction with an empty type should throw an exception');
+}, 'Test worker construction with an empty worker type.');
+
+test(() => {
+  assert_throws_js(
+      TypeError,
+      () => {
+        new SharedWorker('resources/post-message-on-load-worker.js',
+                         { name: 'unknown', type : 'unknown' });
+      },
+      'Worker construction with an unknown type should throw an exception');
+}, 'Test worker construction with an unknown worker type.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-parse-error-failure.html b/test/fixtures/wpt/workers/modules/shared-worker-parse-error-failure.html
new file mode 100644
index 000000000000..f197d81e36ac
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-parse-error-failure.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<title>SharedWorker: parse error failure</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../support/check-error-arguments.js"></script>
+<script>
+
+// Use a unique URL fragment to prevent potential interference from other tests
+// which might use the same SharedWorker URL.
+const uniqueFragment = '#shared-worker-parse-error-failure';
+
+// Check if module shared worker is supported.
+// In this test scope, we only use simple non-nested static import as a feature
+// of module shared worker, so we only check if static import is supported.
+//
+// This check is necessary to appropriately test parse error handling because
+// we need to distingusih the parse error invoked by unsupported "import" in
+// the top-level script from the parse error invoked by the statically imported
+// script which is the one we want to check in this test.
+promise_setup(async () => {
+  const scriptURL = 'resources/static-import-worker.js' + uniqueFragment;
+  const worker = new SharedWorker(scriptURL, { type: 'module' });
+  const supportsModuleWorkers = await new Promise((resolve, reject) => {
+    worker.port.onmessage = e => {
+      resolve(e.data.length == 1 && e.data[0] == 'export-on-load-script.js');
+    };
+    worker.onerror = () => resolve(false);
+  });
+  assert_implements(
+    supportsModuleWorkers,
+    "Static import must be supported on module shared worker to run this test."
+  );
+});
+
+promise_test(async () => {
+  const scriptURL = 'resources/syntax-error.js' + uniqueFragment;
+  const worker = new SharedWorker(scriptURL, { type: 'module' });
+  const args = await new Promise(resolve =>
+      worker.onerror = (...args) => resolve(args));
+  window.checkErrorArguments(args);
+}, 'Module shared worker construction for script with syntax error should ' +
+   'dispatch an event named error.');
+
+promise_test(async () => {
+  const scriptURL = 'resources/static-import-syntax-error.js' + uniqueFragment;
+  const worker = new SharedWorker(scriptURL, { type: 'module' });
+  const args = await new Promise(resolve =>
+      worker.onerror = (...args) => resolve(args));
+  window.checkErrorArguments(args);
+}, 'Static import on module shared worker for script with syntax error ' +
+   'should dispatch an event named error.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/multi-globals/WEB_FEATURES.yml b/test/fixtures/wpt/workers/multi-globals/WEB_FEATURES.yml
new file mode 100644
index 000000000000..b16862ba1c01
--- /dev/null
+++ b/test/fixtures/wpt/workers/multi-globals/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/multi-globals/current/current.html b/test/fixtures/wpt/workers/multi-globals/current/current.html
new file mode 100644
index 000000000000..e6261f83883f
--- /dev/null
+++ b/test/fixtures/wpt/workers/multi-globals/current/current.html
@@ -0,0 +1,3 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Current page</title>
diff --git a/test/fixtures/wpt/workers/multi-globals/current/worker.js b/test/fixtures/wpt/workers/multi-globals/current/worker.js
new file mode 100644
index 000000000000..44103842a40d
--- /dev/null
+++ b/test/fixtures/wpt/workers/multi-globals/current/worker.js
@@ -0,0 +1 @@
+postMessage('current');
diff --git a/test/fixtures/wpt/workers/multi-globals/incumbent/incumbent.html b/test/fixtures/wpt/workers/multi-globals/incumbent/incumbent.html
new file mode 100644
index 000000000000..d8bd1ae2c0f2
--- /dev/null
+++ b/test/fixtures/wpt/workers/multi-globals/incumbent/incumbent.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<title>Incumbent page</title>
+
+<iframe src="../current/current.html" id="c"></iframe>
+
+<script>
+  const current = document.querySelector("#c").contentWindow;
+
+  window.hello = () => {
+    const worker = new current.Worker('worker.js');
+    worker.onmessage = e => { parent.postMessage(e.data, '*'); }
+  };
+</script>
diff --git a/test/fixtures/wpt/workers/multi-globals/incumbent/worker.js b/test/fixtures/wpt/workers/multi-globals/incumbent/worker.js
new file mode 100644
index 000000000000..03f02a869086
--- /dev/null
+++ b/test/fixtures/wpt/workers/multi-globals/incumbent/worker.js
@@ -0,0 +1 @@
+postMessage('incumbent');
diff --git a/test/fixtures/wpt/workers/multi-globals/url-parsing.html b/test/fixtures/wpt/workers/multi-globals/url-parsing.html
new file mode 100644
index 000000000000..27bbc0cb50fe
--- /dev/null
+++ b/test/fixtures/wpt/workers/multi-globals/url-parsing.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<title>Multiple globals for Worker constructor: parsing scriptURL</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<!-- This is the entry global -->
+
+<iframe src="incumbent/incumbent.html"></iframe>
+
+<script>
+async_test((t) => {
+  onload = t.step_func(() => {
+    frames[0].hello();
+  });
+  onmessage = t.step_func_done(e => {
+    assert_equals(e.data, 'current');
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/multi-globals/worker.js b/test/fixtures/wpt/workers/multi-globals/worker.js
new file mode 100644
index 000000000000..fcc521e31370
--- /dev/null
+++ b/test/fixtures/wpt/workers/multi-globals/worker.js
@@ -0,0 +1 @@
+postMessage('entry');
diff --git a/test/fixtures/wpt/workers/name-property.html b/test/fixtures/wpt/workers/name-property.html
new file mode 100644
index 000000000000..ccc2a9de3a9c
--- /dev/null
+++ b/test/fixtures/wpt/workers/name-property.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test the name property of shared and dedicated workers via the name constructor option</title>
+<link rel="help" href="https://html.spec.whatwg.org/multipage/#concept-workerglobalscope-name">
+<link rel="help" href="https://html.spec.whatwg.org/multipage/#dom-sharedworkerglobalscope-name">
+<link rel="help" href="https://html.spec.whatwg.org/multipage/#dom-dedicatedworkerglobalscope-name">
+<link rel="author" title="Domenic Denicola" href="mailto:d@domenic.me">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<script>
+"use strict";
+setup({explicit_done: true});
+
+(async function() {
+  const worker = new Worker("support/name.js", { name: "my name" });
+  await fetch_tests_from_worker(worker);
+
+  const worker2 = new Worker("support/name-as-accidental-global.js");
+  await fetch_tests_from_worker(worker2);
+
+  const sharedWorker = new SharedWorker("support/name.js", { name: "my name" });
+  await fetch_tests_from_worker(sharedWorker);
+
+  const sharedWorker2 = new SharedWorker("support/name-as-accidental-global.js");
+  await fetch_tests_from_worker(sharedWorker2);
+
+  done();
+})();
+</script>
diff --git a/test/fixtures/wpt/workers/nested_worker.worker.js b/test/fixtures/wpt/workers/nested_worker.worker.js
new file mode 100644
index 000000000000..005b3c2f3039
--- /dev/null
+++ b/test/fixtures/wpt/workers/nested_worker.worker.js
@@ -0,0 +1,11 @@
+importScripts("/resources/testharness.js");
+
+async_test(function() {
+    var worker1 = new Worker("support/WorkerBasic.js");
+    worker1.postMessage("ping");
+    worker1.onmessage = this.step_func_done(function(evt) {
+        assert_equals(evt.data, "Pass");
+        worker1.terminate();
+    });
+}, "Nested worker");
+done();
diff --git a/test/fixtures/wpt/workers/nested_worker_close_from_parent_worker.html b/test/fixtures/wpt/workers/nested_worker_close_from_parent_worker.html
new file mode 100644
index 000000000000..57c98517cbd3
--- /dev/null
+++ b/test/fixtures/wpt/workers/nested_worker_close_from_parent_worker.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test terminating a nested workers by calling terminate() from its parent worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(function() {
+  const worker = new Worker("support/parent_of_nested_worker.js");
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, "Pass");
+    done();
+  });
+  worker.postMessage("close");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/nested_worker_close_self.worker.js b/test/fixtures/wpt/workers/nested_worker_close_self.worker.js
new file mode 100644
index 000000000000..73c87f405508
--- /dev/null
+++ b/test/fixtures/wpt/workers/nested_worker_close_self.worker.js
@@ -0,0 +1,12 @@
+importScripts("/resources/testharness.js");
+
+async_test(function() {
+  if (!self.Worker)
+    done();
+  const worker = new Worker("support/WorkerClose.js");
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, "close");
+    done();
+  });
+  worker.postMessage("close");
+}, "Nested work that closes itself");
diff --git a/test/fixtures/wpt/workers/nested_worker_importScripts.worker.js b/test/fixtures/wpt/workers/nested_worker_importScripts.worker.js
new file mode 100644
index 000000000000..a671ee4e1e93
--- /dev/null
+++ b/test/fixtures/wpt/workers/nested_worker_importScripts.worker.js
@@ -0,0 +1,11 @@
+importScripts("/resources/testharness.js");
+
+async_test(function() {
+    const worker = new Worker("support/ImportScripts.js");
+    worker.postMessage("ping");
+    worker.onmessage = this.step_func_done(function(evt) {
+        assert_equals(evt.data, "Pass");
+        worker.terminate();
+    });
+}, "Nested worker that calls importScripts()");
+done();
diff --git a/test/fixtures/wpt/workers/nested_worker_sync_xhr.worker.js b/test/fixtures/wpt/workers/nested_worker_sync_xhr.worker.js
new file mode 100644
index 000000000000..609ecc49e16d
--- /dev/null
+++ b/test/fixtures/wpt/workers/nested_worker_sync_xhr.worker.js
@@ -0,0 +1,11 @@
+importScripts("/resources/testharness.js");
+
+async_test(function() {
+    const worker = new Worker("support/sync_xhr.js");
+    worker.postMessage("ping");
+    worker.onmessage = this.step_func_done(function(evt) {
+        assert_equals(evt.data, "Pass");
+        worker.terminate();
+    });
+}, "Nested worker that issues a sync XHR");
+done();
diff --git a/test/fixtures/wpt/workers/nested_worker_terminate_from_document.html b/test/fixtures/wpt/workers/nested_worker_terminate_from_document.html
new file mode 100644
index 000000000000..10849b3f6ce8
--- /dev/null
+++ b/test/fixtures/wpt/workers/nested_worker_terminate_from_document.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test terminating a chain of nested workers by calling terminate() from the owning document</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(function() {
+  const worker = new Worker("support/parent_of_nested_worker.js");
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, "Pass");
+    worker.terminate();
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/non-automated/WEB_FEATURES.yml b/test/fixtures/wpt/workers/non-automated/WEB_FEATURES.yml
new file mode 100644
index 000000000000..182aad016868
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- navigator-onLine.html: [online]
diff --git a/test/fixtures/wpt/workers/non-automated/infinite-nested.html b/test/fixtures/wpt/workers/non-automated/infinite-nested.html
new file mode 100644
index 000000000000..3ff3edb35348
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/infinite-nested.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<title>infinite nested workers</title>
+<p>There number below should be increasing (ideally never-ending).</p>
+<div>0</div>
+<script>
+var worker = new Worker('infinite-nested.js');
+var div = document.getElementsByTagName('div')[0];
+var i = 0;
+worker.onmessage = function(e) {
+  div.textContent = i++;
+}
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/non-automated/infinite-nested.js b/test/fixtures/wpt/workers/non-automated/infinite-nested.js
new file mode 100644
index 000000000000..137dd0a2e281
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/infinite-nested.js
@@ -0,0 +1,5 @@
+postMessage(1);
+var w = new Worker('infinite-nested.js');
+w.onmessage = function(e) {
+  postMessage(e.data);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/non-automated/infinite-sibling-and-nested.html b/test/fixtures/wpt/workers/non-automated/infinite-sibling-and-nested.html
new file mode 100644
index 000000000000..463546cc969f
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/infinite-sibling-and-nested.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<title>infinite sibling and nested workers</title>
+<p>The number below should be increasing (ideally never-ending).</p>
+<div>0</div>
+<script>
+var worker = new Worker('infinite-sibling-and-nested.js');
+var div = document.getElementsByTagName('div')[0];
+var i = 0;
+worker.onmessage = function(e) {
+  div.textContent = i + e.data;
+}
+</script>
diff --git a/test/fixtures/wpt/workers/non-automated/infinite-sibling-and-nested.js b/test/fixtures/wpt/workers/non-automated/infinite-sibling-and-nested.js
new file mode 100644
index 000000000000..cf7b794a414d
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/infinite-sibling-and-nested.js
@@ -0,0 +1,8 @@
+function createWorker() {
+  var worker = new Worker('infinite-nested.js?' + Math.random());
+  worker.onmessage = function(e) {
+    postMessage(e.data);
+    createWorker();
+  }
+}
+createWorker();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/non-automated/infinite-sibling.html b/test/fixtures/wpt/workers/non-automated/infinite-sibling.html
new file mode 100644
index 000000000000..edcb8d707227
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/infinite-sibling.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<title>infinite sibling workers</title>
+<p>The number below should be increasing (ideally never-ending).</p>
+<div>0</div>
+<script>
+var worker = new Worker('infinite-sibling.js');
+var div = document.getElementsByTagName('div')[0];
+var i = 0;
+worker.onmessage = function(e) {
+  div.textContent = i + e.data;
+}
+</script>
diff --git a/test/fixtures/wpt/workers/non-automated/infinite-sibling.js b/test/fixtures/wpt/workers/non-automated/infinite-sibling.js
new file mode 100644
index 000000000000..6424f7009324
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/infinite-sibling.js
@@ -0,0 +1,8 @@
+function createWorker() {
+  var worker = new Worker('post-a-1.js?' + Math.random());
+  worker.onmessage = function(e) {
+    postMessage(e.data);
+    createWorker();
+  }
+}
+createWorker();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/non-automated/navigator-onLine.html b/test/fixtures/wpt/workers/non-automated/navigator-onLine.html
new file mode 100644
index 000000000000..5f2746b54633
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/navigator-onLine.html
@@ -0,0 +1,29 @@
+<!doctype html>
+<title>navigator.onLine in dedicated worker</title>
+<pre>Log:
+</pre>
+<script>
+var pre = document.querySelector('pre');
+var worker, shared;
+try { worker = new Worker('navigator-onLine.js'); } catch(e) { pre.textContent += '\nnew Worker threw: ' + e.message; }
+try { shared = new SharedWorker('#', ''); } catch(e) { pre.textContent += '\nnew SharedWorker threw: ' + e.message; }
+if (worker) {
+  worker.onmessage = function(e) {
+    pre.textContent += '\ndedicated worker: ' + e.data;
+  }
+}
+if (shared) {
+  shared.port.onmessage = function(e) {
+    pre.textContent += '\nshared worker: ' + e.data;
+  }
+}
+function update() {
+  pre.textContent += '\n\n' + new Date() + '\n<script>: ' + navigator.onLine;
+  if (worker) worker.postMessage(1);
+  if (shared) shared.port.postMessage(1);
+}
+update();
+ononline = onoffline = update;
+</script>
+<p>As you go online and offline, the log should be filled with the correct status of navigator.onLine.</p>
+<p><button onclick="update()">Check navigator.onLine status</button></p>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/non-automated/navigator-onLine.js b/test/fixtures/wpt/workers/non-automated/navigator-onLine.js
new file mode 100644
index 000000000000..592b286bb352
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/navigator-onLine.js
@@ -0,0 +1,11 @@
+if ('onmessage' in self) { // dedicated worker
+  onmessage = function(e) {
+    postMessage(navigator.onLine);
+  }
+} else { // shared worker
+  onconnect = function(e) {
+    e.ports[0].onmessage = function(e) {
+      this.postMessage(navigator.onLine);
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/non-automated/post-a-1.js b/test/fixtures/wpt/workers/non-automated/post-a-1.js
new file mode 100644
index 000000000000..2318c2e267db
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/post-a-1.js
@@ -0,0 +1 @@
+postMessage(1);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/opaque-origin.html b/test/fixtures/wpt/workers/opaque-origin.html
new file mode 100644
index 000000000000..83574b456fec
--- /dev/null
+++ b/test/fixtures/wpt/workers/opaque-origin.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+<script>
+// Sandboxed iframe forwards messages from its worker, this translates those
+// messages back to something fetch_tests_from_worker can parse.
+const channel = new MessageChannel();
+onmessage = e => {
+  channel.port2.postMessage(e.data);
+};
+fetch_tests_from_worker(channel.port1);
+channel.port1.start();
+</script>
+<iframe sandbox="allow-scripts" src="support/sandboxed-tests.html?pipe=sub"></iframe>
+</body>
diff --git a/test/fixtures/wpt/workers/postMessage_DataCloneErr.htm b/test/fixtures/wpt/workers/postMessage_DataCloneErr.htm
new file mode 100644
index 000000000000..24093ce4e3e5
--- /dev/null
+++ b/test/fixtures/wpt/workers/postMessage_DataCloneErr.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> postMessage() with WorkerNavigator </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerDataCloneErr.js");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data, "Pass");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/postMessage_block.https.html b/test/fixtures/wpt/workers/postMessage_block.https.html
new file mode 100644
index 000000000000..c3e69f6193f0
--- /dev/null
+++ b/test/fixtures/wpt/workers/postMessage_block.https.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+<script>
+const t = async_test('postMessage and block');
+
+const w = new Worker('support/postMessage_block_worker.js');
+
+w.onmessage = t.step_func_done(() => {
+  const a = new Int32Array(new SharedArrayBuffer(4));
+  w.postMessage(a);
+  while (Atomics.load(a, 0) === 0);
+  assert_equals(Atomics.load(a, 0), 1);
+});
+</script>
+</body>
diff --git a/test/fixtures/wpt/workers/postMessage_block.https.html.headers b/test/fixtures/wpt/workers/postMessage_block.https.html.headers
new file mode 100644
index 000000000000..63b60e490f47
--- /dev/null
+++ b/test/fixtures/wpt/workers/postMessage_block.https.html.headers
@@ -0,0 +1,2 @@
+Cross-Origin-Opener-Policy: same-origin
+Cross-Origin-Embedder-Policy: require-corp
diff --git a/test/fixtures/wpt/workers/postMessage_clone_port.htm b/test/fixtures/wpt/workers/postMessage_clone_port.htm
new file mode 100644
index 000000000000..b1d7b84e3c09
--- /dev/null
+++ b/test/fixtures/wpt/workers/postMessage_clone_port.htm
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<title> postMessage(): clone a port </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var channelA = new MessageChannel();
+  var channelB = new MessageChannel();
+  var originalPort = channelB.port2;
+  channelA.port2.onmessage = t.step_func(function(e) {
+    assert_equals(e.data, "ports");
+    var clonedPort = e.ports[0];
+    assert_not_equals(clonedPort, originalPort, "new cloned port object should not equal to the original port!");
+    clonedPort.onmessage = t.step_func_done(function(e) {
+      assert_equals(e.data, "ping", "Data sent through remote port is received by the new cloned port");
+    });
+  });
+  channelA.port1.postMessage("ports", [channelB.port2]);
+  channelB.port1.postMessage("ping");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/postMessage_clone_port_error.htm b/test/fixtures/wpt/workers/postMessage_clone_port_error.htm
new file mode 100644
index 000000000000..3558987476bd
--- /dev/null
+++ b/test/fixtures/wpt/workers/postMessage_clone_port_error.htm
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<title> postMessage(): cloning source port </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+test(function() {
+  var channel = new MessageChannel();
+  channel.port1.start();
+  assert_throws_dom("DataCloneError", function() {
+    channel.port1.postMessage("ports", [channel.port1]);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/postMessage_event_properties.htm b/test/fixtures/wpt/workers/postMessage_event_properties.htm
new file mode 100644
index 000000000000..8122413de40d
--- /dev/null
+++ b/test/fixtures/wpt/workers/postMessage_event_properties.htm
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<title> postMessage(): MessageEvent properties </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var channel = new MessageChannel();
+  var targetPort = channel.port2;
+  targetPort.start();
+  targetPort.addEventListener("message", t.step_func_done(function (evt) {
+    assert_class_string(evt, "MessageEvent");
+    assert_equals(evt.type, "message");
+    assert_false(evt.bubbles, "bubbles should be false");
+    assert_false(evt.cancelable, "cancelable should be false");
+    assert_equals(evt.data, "ping", "data");
+    assert_equals(evt.origin, "", "origin");
+    assert_equals(evt.lastEventId, "", "lastEventId");
+    assert_equals(evt.source, null, "source");
+    assert_array_equals(evt.ports, [], "ports");
+  }), true);
+  channel.port1.postMessage("ping");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/postMessage_ports_readonly_array.htm b/test/fixtures/wpt/workers/postMessage_ports_readonly_array.htm
new file mode 100644
index 000000000000..bd833ede9361
--- /dev/null
+++ b/test/fixtures/wpt/workers/postMessage_ports_readonly_array.htm
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<title> postMessage(): read-only ports array </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+"use strict";
+async_test(function(t) {
+  var channel = new MessageChannel();
+  var targetPort = channel.port2;
+  targetPort.start();
+  targetPort.addEventListener("message", t.step_func_done(function(e) {
+    var channel3 = new MessageChannel();
+    assert_throws_js(TypeError, () => {
+      e.ports.push(channel3.port1);
+    }, "ports is a frozen object");
+    assert_equals(e.ports.length, 1, "ports is a read only array with length == 1.");
+  }), true);
+  var channel2 = new MessageChannel();
+  channel.port1.postMessage("ports", [channel2.port1]);
+});
+</script>
diff --git a/test/fixtures/wpt/workers/postMessage_target_source.htm b/test/fixtures/wpt/workers/postMessage_target_source.htm
new file mode 100644
index 000000000000..7d684916dde2
--- /dev/null
+++ b/test/fixtures/wpt/workers/postMessage_target_source.htm
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<title> postMessage(): target port and source port </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var channel = new MessageChannel();
+  var source = channel.port1;
+  var target = channel.port2;
+  target.start();
+  target.addEventListener("message", t.step_func_done(function(e) {
+    assert_equals(e.target, target);
+    assert_not_equals(e.target, source);
+  }), true);
+  source.postMessage("ping");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/resources/shared-worker-memory.js b/test/fixtures/wpt/workers/resources/shared-worker-memory.js
new file mode 100644
index 000000000000..b1504f38c504
--- /dev/null
+++ b/test/fixtures/wpt/workers/resources/shared-worker-memory.js
@@ -0,0 +1,30 @@
+'use strict';
+
+let stored_data = null;
+
+function processMessage(e) {
+  function respond(data) {
+    e.currentTarget.postMessage(Object.assign(data, {reqid: e.data.reqid}));
+  }
+
+  switch (e.data.op) {
+    case 'load': {
+      respond({ack: 'load', status: 'OK', data: stored_data});
+      break;
+    }
+    case 'store': {
+      try {
+        stored_data = e.data.data
+      } catch (err) {
+        respond({ack: 'store', status: 'ERROR', error: err.name});
+        return;
+      }
+      respond({ack: 'store', status: 'OK'});
+      break;
+    }
+  }
+}
+
+self.addEventListener('connect', e => {
+  e.ports[0].onmessage = processMessage;
+});
diff --git a/test/fixtures/wpt/workers/resources/worker-url-encoding.js b/test/fixtures/wpt/workers/resources/worker-url-encoding.js
new file mode 100644
index 000000000000..444a19db4e2d
--- /dev/null
+++ b/test/fixtures/wpt/workers/resources/worker-url-encoding.js
@@ -0,0 +1 @@
+postMessage(location.search);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/same-origin-check.sub.html b/test/fixtures/wpt/workers/same-origin-check.sub.html
new file mode 100644
index 000000000000..7af021b8dbb7
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-origin-check.sub.html
@@ -0,0 +1,56 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+const sameOrigin = 'http://{{host}}:{{ports[http][0]}}';
+const crossOrigin = 'http://{{host}}:{{ports[http][1]}}';
+const workerPath = '/workers/support/post-message-on-load-worker.js?pipe=header(Access-Control-Allow-Origin,*)';
+const redirectPath = '/service-workers/service-worker/resources/redirect.py?ACAOrigin=*&Redirect=';
+const tests = [
+  {
+    name: "cross-origin",
+    url: crossOrigin + workerPath
+  },
+  {
+    name: "cross-origin-to-same-origin-redirect",
+    url: crossOrigin + redirectPath +
+         encodeURIComponent(sameOrigin + workerPath)
+  },
+  {
+    name: "same-origin-to-cross-origin-redirect",
+    url: sameOrigin + redirectPath + encodeURIComponent(crossOrigin + workerPath)
+  },
+  {
+    name: "same-origin-to-cross-origin-to-same-origin-redirect",
+    url: sameOrigin + redirectPath +
+         encodeURIComponent(
+             crossOrigin + redirectPath +
+             encodeURIComponent(sameOrigin + workerPath))
+  },
+];
+
+for (const test of tests) {
+  for (const type of ['classic', 'module']) {
+    promise_test(t => new Promise((resolve, reject) => {
+        try {
+          const worker = new Worker(test.url, {type});
+          worker.onmessage = _ => reject('Worker loaded unexpectedly');
+          worker.onerror = resolve;
+        } catch (e) {
+          resolve();
+        }
+      }), 'Worker: ' + test.name + ' (' + type + ')');
+
+    promise_test(t => new Promise((resolve, reject) => {
+        try {
+          const worker = new SharedWorker(
+              test.url + '&label=' + type + test.name, {type});
+          worker.port.onmessage = _ => reject('Worker loaded unexpectedly');
+          worker.onerror = resolve;
+        } catch (e) {
+          resolve();
+        }
+      }), 'SharedWorker: ' + test.name + ' (' + type + ')');
+  }
+}
+</script>
diff --git a/test/fixtures/wpt/workers/same-site-cookies/first-party.all.tentative.https.window.js b/test/fixtures/wpt/workers/same-site-cookies/first-party.all.tentative.https.window.js
new file mode 100644
index 000000000000..ac6030e65403
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/first-party.all.tentative.https.window.js
@@ -0,0 +1,29 @@
+// META: script=/resources/testdriver.js
+// META: script=/resources/testdriver-vendor.js
+// META: script=/workers/same-site-cookies/resources/util.js
+
+'use strict';
+
+// Here's the set-up for this test:
+// Step 1 (window) Set cookies.
+// Step 2 (window) Set up listener for cookie message and start worker.
+// Step 3 (redirect) Redirect to worker script.
+// Step 4 (worker) Send cookie message to window.
+// Step 5 (window) Receive cookie message and cleanup.
+
+async_test(t => {
+    // Step 1
+    const cookie_set_window = window.open("/workers/same-site-cookies/resources/set_cookies.py");
+    cookie_set_window.onload =  t.step_func(_ => {
+        // Step 2
+        const worker = new SharedWorker("/workers/same-site-cookies/resources/worker_redirect.py", {sameSiteCookies: "all"});
+        worker.port.onmessage = t.step_func(e => {
+            // Step 5
+            getCookieNames().then(t.step_func((cookies) => {
+                assert_equals(e.data + cookies, "ReadOnLoad:StrictLaxNone,ReadOnFetch:StrictLaxNone,SetOnRedirectLoad:StrictLaxNone,SetOnLoad:StrictLaxNone,SetOnRedirectFetch:StrictLaxNone,SetOnFetch:StrictLaxNone", "Worker should get/set all cookies");
+                cookie_set_window.close();
+                t.done();
+            }));
+        });
+    });
+}, "Check SharedWorker sameSiteCookies option all for first-party");
diff --git a/test/fixtures/wpt/workers/same-site-cookies/first-party.default.tentative.https.window.js b/test/fixtures/wpt/workers/same-site-cookies/first-party.default.tentative.https.window.js
new file mode 100644
index 000000000000..2c64ff628f5b
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/first-party.default.tentative.https.window.js
@@ -0,0 +1,29 @@
+// META: script=/resources/testdriver.js
+// META: script=/resources/testdriver-vendor.js
+// META: script=/workers/same-site-cookies/resources/util.js
+
+'use strict';
+
+// Here's the set-up for this test:
+// Step 1 (window) Set cookies.
+// Step 2 (window) Set up listener for cookie message and start worker.
+// Step 3 (redirect) Redirect to worker script.
+// Step 4 (worker) Send cookie message to window.
+// Step 5 (window) Receive cookie message and cleanup.
+
+async_test(t => {
+    // Step 1
+    const cookie_set_window = window.open("/workers/same-site-cookies/resources/set_cookies.py");
+    cookie_set_window.onload =  t.step_func(_ => {
+        // Step 2
+        const worker = new SharedWorker("/workers/same-site-cookies/resources/worker_redirect.py");
+        worker.port.onmessage = t.step_func(e => {
+            // Step 5
+            getCookieNames().then(t.step_func((cookies) => {
+                assert_equals(e.data + cookies, "ReadOnLoad:StrictLaxNone,ReadOnFetch:StrictLaxNone,SetOnRedirectLoad:StrictLaxNone,SetOnLoad:StrictLaxNone,SetOnRedirectFetch:StrictLaxNone,SetOnFetch:StrictLaxNone", "Worker should get/set all cookies");
+                cookie_set_window.close();
+                t.done();
+            }));
+        });
+    });
+}, "Check SharedWorker sameSiteCookies option default for first-party");
diff --git a/test/fixtures/wpt/workers/same-site-cookies/first-party.none.tentative.https.window.js b/test/fixtures/wpt/workers/same-site-cookies/first-party.none.tentative.https.window.js
new file mode 100644
index 000000000000..76a8b1d8bcb5
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/first-party.none.tentative.https.window.js
@@ -0,0 +1,29 @@
+// META: script=/resources/testdriver.js
+// META: script=/resources/testdriver-vendor.js
+// META: script=/workers/same-site-cookies/resources/util.js
+
+'use strict';
+
+// Here's the set-up for this test:
+// Step 1 (window) Set cookies.
+// Step 2 (window) Set up listener for cookie message and start worker.
+// Step 3 (redirect) Redirect to worker script.
+// Step 4 (worker) Send cookie message to window.
+// Step 5 (window) Receive cookie message and cleanup.
+
+async_test(t => {
+    // Step 1
+    const cookie_set_window = window.open("/workers/same-site-cookies/resources/set_cookies.py");
+    cookie_set_window.onload =  t.step_func(_ => {
+        // Step 2
+        const worker = new SharedWorker("/workers/same-site-cookies/resources/worker_redirect.py", {sameSiteCookies: "none"});
+        worker.port.onmessage = t.step_func(e => {
+            // Step 5
+            getCookieNames().then(t.step_func((cookies) => {
+                assert_equals(e.data + cookies, "ReadOnLoad:None,ReadOnFetch:None,SetOnRedirectLoad:None,SetOnLoad:None,SetOnRedirectFetch:None,SetOnFetch:None", "Worker should get/set SameSite=None cookies only");
+                cookie_set_window.close();
+                t.done();
+            }));
+        });
+    });
+}, "Check SharedWorker sameSiteCookies option none for first-party");
diff --git a/test/fixtures/wpt/workers/same-site-cookies/resources/iframe-iframe.html b/test/fixtures/wpt/workers/same-site-cookies/resources/iframe-iframe.html
new file mode 100644
index 000000000000..efd4f3a65468
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/resources/iframe-iframe.html
@@ -0,0 +1,31 @@
+<!doctype html>
+<meta charset="utf-8">
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<body>
+<script>
+// Step 4 (workers/same-site-cookies/third-party.{})
+test_driver.set_test_context(window.top);
+const type = (new URLSearchParams(window.location.search)).get("type");
+let options = {};
+switch (type) {
+    case "default":
+        break;
+    case "all":
+        options.sameSiteCookies = "all";
+        break;
+    case "none":
+        options.sameSiteCookies = "none";
+        break;
+}
+// Step 7 (workers/same-site-cookies/third-party.{})
+try {
+    const worker = new SharedWorker("/workers/same-site-cookies/resources/worker_redirect.py", options);
+    worker.port.onmessage = (e) => {
+        window.top.postMessage(e.data, "*");
+    };
+} catch (_) {
+    window.top.postMessage("DidNotStart", "*");
+}
+</script>
+</body>
diff --git a/test/fixtures/wpt/workers/same-site-cookies/resources/iframe.sub.html b/test/fixtures/wpt/workers/same-site-cookies/resources/iframe.sub.html
new file mode 100644
index 000000000000..c4724d01d2f5
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/resources/iframe.sub.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<meta charset="utf-8">
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<body>
+<script>
+// Step 3 (workers/same-site-cookies/third-party.{})
+test_driver.set_test_context(window.top);
+const type = (new URLSearchParams(window.location.search)).get("type");
+let iframe = document.createElement("iframe");
+iframe.src = "https://{{hosts[][]}}:{{ports[https][0]}}/workers/same-site-cookies/resources/iframe-iframe.html?type=" + type;
+document.body.appendChild(iframe);
+</script>
+</body>
diff --git a/test/fixtures/wpt/workers/same-site-cookies/resources/util.js b/test/fixtures/wpt/workers/same-site-cookies/resources/util.js
new file mode 100644
index 000000000000..67d9ee5c06bf
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/resources/util.js
@@ -0,0 +1,46 @@
+async function getCookieNames() {
+  const cookies = await test_driver.get_all_cookies();
+  const cookie_names = {};
+  cookies.forEach((element) => cookie_names[element["name"]] = true);
+  let message = ",SetOnRedirectLoad:";
+  if (cookie_names.hasOwnProperty("samesite_strict_set_on_redirect_load")) {
+    message += "Strict";
+  }
+  if (cookie_names.hasOwnProperty("samesite_lax_set_on_redirect_load")) {
+      message += "Lax";
+  }
+  if (cookie_names.hasOwnProperty("samesite_none_set_on_redirect_load")) {
+      message += "None";
+  }
+  message += ",SetOnLoad:";
+  if (cookie_names.hasOwnProperty("samesite_strict_set_on_load")) {
+    message += "Strict";
+  }
+  if (cookie_names.hasOwnProperty("samesite_lax_set_on_load")) {
+      message += "Lax";
+  }
+  if (cookie_names.hasOwnProperty("samesite_none_set_on_load")) {
+      message += "None";
+  }
+  message += ",SetOnRedirectFetch:";
+  if (cookie_names.hasOwnProperty("samesite_strict_set_on_redirect_fetch")) {
+    message += "Strict";
+  }
+  if (cookie_names.hasOwnProperty("samesite_lax_set_on_redirect_fetch")) {
+      message += "Lax";
+  }
+  if (cookie_names.hasOwnProperty("samesite_none_set_on_redirect_fetch")) {
+      message += "None";
+  }
+  message += ",SetOnFetch:";
+  if (cookie_names.hasOwnProperty("samesite_strict_set_on_fetch")) {
+    message += "Strict";
+  }
+  if (cookie_names.hasOwnProperty("samesite_lax_set_on_fetch")) {
+      message += "Lax";
+  }
+  if (cookie_names.hasOwnProperty("samesite_none_set_on_fetch")) {
+      message += "None";
+  }
+  return message;
+}
diff --git a/test/fixtures/wpt/workers/same-site-cookies/third-party.all.tentative.sub.https.window.js b/test/fixtures/wpt/workers/same-site-cookies/third-party.all.tentative.sub.https.window.js
new file mode 100644
index 000000000000..21b53819d93f
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/third-party.all.tentative.sub.https.window.js
@@ -0,0 +1,32 @@
+// META: script=/resources/testdriver.js
+// META: script=/resources/testdriver-vendor.js
+// META: script=/workers/same-site-cookies/resources/util.js
+
+'use strict';
+
+// Here's the set-up for this test:
+// Step 1 (window) Set cookies.
+// Step 2 (top-frame) Set up listener for "DidNotStart" message and open cross-site iframe.
+// Step 3 (sub-frame) Open iframe same-site to top-frame.
+// Step 4 (sub-sub-frame) Set up listener for message and start worker.
+// Step 5 (redirect) Skipped.
+// Step 6 (worker) Skipped.
+// Step 7 (sub-sub-frame) Worker failed to start and window messages "DidNotStart".
+// Step 8 (top-frame) Receive "DidNotStart" message and cleanup.
+
+async_test(t => {
+  // Step 1
+  const cookie_set_window = window.open("/workers/same-site-cookies/resources/set_cookies.py");
+  cookie_set_window.onload =  t.step_func(_ => {
+    // Step 2
+    window.addEventListener("message", t.step_func(e => {
+      // Step 8
+      assert_equals(e.data, "DidNotStart", "Worker should not have started");
+      cookie_set_window.close();
+      t.done();
+    }));
+    let iframe = document.createElement("iframe");
+    iframe.src = "https://{{hosts[alt][]}}:{{ports[https][0]}}/workers/same-site-cookies/resources/iframe.sub.html?type=all";
+    document.body.appendChild(iframe);
+  });
+}, "Check SharedWorker sameSiteCookies option all for third-party");
diff --git a/test/fixtures/wpt/workers/same-site-cookies/third-party.default.tentative.sub.https.window.js b/test/fixtures/wpt/workers/same-site-cookies/third-party.default.tentative.sub.https.window.js
new file mode 100644
index 000000000000..bf499c1992c9
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/third-party.default.tentative.sub.https.window.js
@@ -0,0 +1,34 @@
+// META: script=/resources/testdriver.js
+// META: script=/resources/testdriver-vendor.js
+// META: script=/workers/same-site-cookies/resources/util.js
+
+'use strict';
+
+// Here's the set-up for this test:
+// Step 1 (window) Set cookies.
+// Step 2 (top-frame) Set up listener for cookie message and open cross-site iframe.
+// Step 3 (sub-frame) Open iframe same-site to top-frame.
+// Step 4 (sub-sub-frame) Set up listener for message and start worker.
+// Step 5 (redirect) Redirect to worker script.
+// Step 6 (worker) Send cookie message to iframe.
+// Step 7 (sub-sub-frame) Receive message and pass on to window.
+// Step 8 (top-frame) Receive cookie message and cleanup.
+
+async_test(t => {
+  // Step 1
+  const cookie_set_window = window.open("/workers/same-site-cookies/resources/set_cookies.py");
+  cookie_set_window.onload =  t.step_func(_ => {
+    // Step 2
+    window.addEventListener("message", t.step_func(e => {
+      // Step 8
+      getCookieNames().then(t.step_func((cookies) => {
+        assert_equals(e.data + cookies, "ReadOnLoad:None,ReadOnFetch:None,SetOnRedirectLoad:None,SetOnLoad:None,SetOnRedirectFetch:None,SetOnFetch:None", "Worker should get/set SameSite=None cookies only");
+        cookie_set_window.close();
+        t.done();
+      }));
+    }));
+    let iframe = document.createElement("iframe");
+    iframe.src = "https://{{hosts[alt][]}}:{{ports[https][0]}}/workers/same-site-cookies/resources/iframe.sub.html?type=default";
+    document.body.appendChild(iframe);
+  });
+}, "Check SharedWorker sameSiteCookies option default for third-party");
diff --git a/test/fixtures/wpt/workers/same-site-cookies/third-party.none.tentative.sub.https.window.js b/test/fixtures/wpt/workers/same-site-cookies/third-party.none.tentative.sub.https.window.js
new file mode 100644
index 000000000000..f00e585f7783
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/third-party.none.tentative.sub.https.window.js
@@ -0,0 +1,34 @@
+// META: script=/resources/testdriver.js
+// META: script=/resources/testdriver-vendor.js
+// META: script=/workers/same-site-cookies/resources/util.js
+
+'use strict';
+
+// Here's the set-up for this test:
+// Step 1 (window) Set cookies.
+// Step 2 (top-frame) Set up listener for cookie message and open cross-site iframe.
+// Step 3 (sub-frame) Open iframe same-site to top-frame.
+// Step 4 (sub-sub-frame) Set up listener for message and start worker.
+// Step 5 (redirect) Redirect to worker script.
+// Step 6 (worker) Send cookie message to iframe.
+// Step 7 (sub-sub-frame) Receive message and pass on to window.
+// Step 8 (top-frame) Receive cookie message and cleanup.
+
+async_test(t => {
+  // Step 1
+  const cookie_set_window = window.open("/workers/same-site-cookies/resources/set_cookies.py");
+  cookie_set_window.onload =  t.step_func(_ => {
+    // Step 2
+    window.addEventListener("message", t.step_func(e => {
+      // Step 8
+      getCookieNames().then(t.step_func((cookies) => {
+        assert_equals(e.data + cookies, "ReadOnLoad:None,ReadOnFetch:None,SetOnRedirectLoad:None,SetOnLoad:None,SetOnRedirectFetch:None,SetOnFetch:None", "Worker should get/set SameSite=None cookies only");
+        cookie_set_window.close();
+        t.done();
+      }));
+    }));
+    let iframe = document.createElement("iframe");
+    iframe.src = "https://{{hosts[alt][]}}:{{ports[https][0]}}/workers/same-site-cookies/resources/iframe.sub.html?type=none";
+    document.body.appendChild(iframe);
+  });
+}, "Check SharedWorker sameSiteCookies option none for third-party");
diff --git a/test/fixtures/wpt/workers/semantics/encodings/001.html b/test/fixtures/wpt/workers/semantics/encodings/001.html
new file mode 100644
index 000000000000..05ee5e006b45
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/001.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>encoding, dedicated worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('001.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '\u00e5');
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/encodings/001.js b/test/fixtures/wpt/workers/semantics/encodings/001.js
new file mode 100644
index 000000000000..03bc557c33c4
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/001.js
@@ -0,0 +1 @@
+postMessage('å');
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/encodings/001.js.headers b/test/fixtures/wpt/workers/semantics/encodings/001.js.headers
new file mode 100644
index 000000000000..5614aaa7f0f5
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/001.js.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript; charset=windows-1252
diff --git a/test/fixtures/wpt/workers/semantics/encodings/002.html b/test/fixtures/wpt/workers/semantics/encodings/002.html
new file mode 100644
index 000000000000..fecbffc18da7
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/002.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>encoding, shared worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new SharedWorker('002.js', '');
+  worker.port.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '\u00e5');
+    this.done();
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/encodings/002.js b/test/fixtures/wpt/workers/semantics/encodings/002.js
new file mode 100644
index 000000000000..9dde7bbda921
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/002.js
@@ -0,0 +1,3 @@
+onconnect = function(e) {
+  e.ports[0].postMessage('å');
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/encodings/002.js.headers b/test/fixtures/wpt/workers/semantics/encodings/002.js.headers
new file mode 100644
index 000000000000..5614aaa7f0f5
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/002.js.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript; charset=windows-1252
diff --git a/test/fixtures/wpt/workers/semantics/encodings/003.html b/test/fixtures/wpt/workers/semantics/encodings/003.html
new file mode 100644
index 000000000000..095320e4d147
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/003.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>URL encoding, dedicated worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('003.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/encodings/003.js b/test/fixtures/wpt/workers/semantics/encodings/003.js
new file mode 100644
index 000000000000..35bda8bba88b
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/003.js
@@ -0,0 +1,5 @@
+var xhr = new XMLHttpRequest();
+xhr.open('GET', '003-1.py?x=å', false);
+xhr.send();
+var passed = xhr.responseText == 'PASS';
+postMessage(passed);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/encodings/004.html b/test/fixtures/wpt/workers/semantics/encodings/004.html
new file mode 100644
index 000000000000..cd556b8190e7
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/004.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>URL encoding, shared worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new SharedWorker('004.js');
+  worker.port.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/encodings/004.js b/test/fixtures/wpt/workers/semantics/encodings/004.js
new file mode 100644
index 000000000000..5146929a73b5
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/004.js
@@ -0,0 +1,7 @@
+onconnect = function(e) {
+  var xhr = new XMLHttpRequest();
+  xhr.open('GET', '003-1.py?x=å', false);
+  xhr.send();
+  var passed = xhr.responseText == 'PASS';
+  e.ports[0].postMessage(passed);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/encodings/004.worker.js b/test/fixtures/wpt/workers/semantics/encodings/004.worker.js
new file mode 100644
index 000000000000..28489a572be1
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/004.worker.js
@@ -0,0 +1,5 @@
+importScripts("/resources/testharness.js");
+test(function() {
+  assert_equals("�", "\ufffd");
+}, "Decoding invalid utf-8");
+done();
diff --git a/test/fixtures/wpt/workers/semantics/encodings/WEB_FEATURES.yml b/test/fixtures/wpt/workers/semantics/encodings/WEB_FEATURES.yml
new file mode 100644
index 000000000000..082be9e2a20c
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/WEB_FEATURES.yml
@@ -0,0 +1,4 @@
+rules:
+- 002.html: [shared-workers]
+- 004.html: [shared-workers]
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/semantics/interface-objects/001.worker.js b/test/fixtures/wpt/workers/semantics/interface-objects/001.worker.js
new file mode 100644
index 000000000000..a95da5638f52
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/interface-objects/001.worker.js
@@ -0,0 +1,82 @@
+importScripts("/resources/testharness.js");
+var expected = [
+  // https://html.spec.whatwg.org/
+  "WorkerGlobalScope",
+  "DedicatedWorkerGlobalScope",
+  "Worker",
+  "MessagePort",
+  "MessageEvent",
+  "WorkerNavigator",
+  "MessageChannel",
+  "WorkerLocation",
+  "ImageData",
+  "ImageBitmap",
+  "CanvasGradient",
+  "CanvasPattern",
+  "TextMetrics",
+  "Path2D",
+  "PromiseRejectionEvent",
+  "EventSource",
+  "BroadcastChannel",
+  // https://websockets.spec.whatwg.org/
+  "WebSocket",
+  "CloseEvent",
+  // https://tc39.github.io/ecma262/
+  "ArrayBuffer",
+  "Int8Array",
+  "Uint8Array",
+  "Uint8ClampedArray",
+  "Int16Array",
+  "Uint16Array",
+  "Int32Array",
+  "Uint32Array",
+  "Float16Array",
+  "Float32Array",
+  "Float64Array",
+  "DataView",
+  // https://xhr.spec.whatwg.org/
+  "XMLHttpRequestEventTarget",
+  "XMLHttpRequestUpload",
+  "XMLHttpRequest",
+  "ProgressEvent",
+  "FormData",
+  // https://url.spec.whatwg.org/
+  "URL",
+  "URLSearchParams",
+  // https://w3c.github.io/FileAPI/
+  "File",
+  "Blob",
+  "FileList",
+  "FileReader",
+  "FileReaderSync",
+  // https://dom.spec.whatwg.org/
+  "EventTarget",
+  "ErrorEvent",
+  "Event",
+  "CustomEvent",
+  // https://webidl.spec.whatwg.org/
+  "DOMException",
+  // https://streams.spec.whatwg.org/
+  "ReadableStream",
+  "WritableStream",
+  "ByteLengthQueuingStrategy",
+  "CountQueuingStrategy",
+  // http://w3c.github.io/IndexedDB/
+  "IDBRequest",
+  "IDBOpenDBRequest",
+  "IDBVersionChangeEvent",
+  "IDBFactory",
+  "IDBDatabase",
+  "IDBObjectStore",
+  "IDBIndex",
+  "IDBKeyRange",
+  "IDBCursor",
+  "IDBCursorWithValue",
+  "IDBTransaction",
+];
+for (var i = 0; i < expected.length; ++i) {
+  test(function () {
+    assert_own_property(self, expected[i]);
+  }, "The " + expected[i] + " interface object should be exposed.");
+}
+done();
diff --git a/test/fixtures/wpt/workers/semantics/interface-objects/002.worker.js b/test/fixtures/wpt/workers/semantics/interface-objects/002.worker.js
new file mode 100644
index 000000000000..9c8dc6746e07
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/interface-objects/002.worker.js
@@ -0,0 +1,45 @@
+importScripts("/resources/testharness.js");
+var unexpected = [
+  // https://html.spec.whatwg.org/
+  "SharedWorker",
+  "CanvasPath",
+  "SharedWorkerGlobalScope",
+  "AbstractView",
+  "AbstractWorker",
+  "ApplicationCache",
+  "Location",
+  "Navigator",
+  "Audio",
+  "HTMLCanvasElement",
+  "Path",
+  "CanvasProxy",
+  "CanvasRenderingContext2D",
+  "DrawingStyle",
+  "BeforeUnloadEvent",
+  "PopStateEvent",
+  "HashChangeEvent",
+  "PageTransitionEvent",
+  // https://dom.spec.whatwg.org/
+  "DOMImplementation",
+  // http://w3c.github.io/IndexedDB/
+  "IDBEnvironment",
+  // https://www.w3.org/TR/2010/NOTE-webdatabase-20101118/
+  "Database",
+  // https://w3c.github.io/uievents/
+  "UIEvent",
+  "FocusEvent",
+  "MouseEvent",
+  "WheelEvent",
+  "InputEvent",
+  "KeyboardEvent",
+  "CompositionEvent",
+  // https://w3c.github.io/webvtt/
+  "VTTCue",
+  "VTTRegion",
+];
+for (var i = 0; i < unexpected.length; ++i) {
+  test(function () {
+    assert_false(unexpected[i] in self);
+  }, "The " + unexpected[i] + " interface object should not be exposed.");
+}
+done();
diff --git a/test/fixtures/wpt/workers/semantics/interface-objects/003.any.js b/test/fixtures/wpt/workers/semantics/interface-objects/003.any.js
new file mode 100644
index 000000000000..9dcc024ab7b3
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/interface-objects/003.any.js
@@ -0,0 +1,82 @@
+// META: global=sharedworker
+
+var expected = [
+  // https://html.spec.whatwg.org/
+  "WorkerGlobalScope",
+  "SharedWorkerGlobalScope",
+  "Worker",
+  "MessagePort",
+  "MessageEvent",
+  "WorkerNavigator",
+  "MessageChannel",
+  "WorkerLocation",
+  "ImageData",
+  "ImageBitmap",
+  "CanvasGradient",
+  "CanvasPattern",
+  "Path2D",
+  "PromiseRejectionEvent",
+  "EventSource",
+  "BroadcastChannel",
+  // https://websockets.spec.whatwg.org/
+  "WebSocket",
+  "CloseEvent",
+  // https://tc39.github.io/ecma262/
+  "ArrayBuffer",
+  "Int8Array",
+  "Uint8Array",
+  "Uint8ClampedArray",
+  "Int16Array",
+  "Uint16Array",
+  "Int32Array",
+  "Uint32Array",
+  "Float16Array",
+  "Float32Array",
+  "Float64Array",
+  "DataView",
+  // https://xhr.spec.whatwg.org/
+  "XMLHttpRequestEventTarget",
+  "XMLHttpRequestUpload",
+  "XMLHttpRequest",
+  "ProgressEvent",
+  "FormData",
+  // https://url.spec.whatwg.org/
+  "URL",
+  "URLSearchParams",
+  // https://w3c.github.io/FileAPI/
+  "File",
+  "Blob",
+  "FileList",
+  "FileReader",
+  "FileReaderSync",
+  // https://dom.spec.whatwg.org/
+  "EventTarget",
+  "ErrorEvent",
+  "Event",
+  "CustomEvent",
+  // https://webidl.spec.whatwg.org/
+  "DOMException",
+  // https://streams.spec.whatwg.org/
+  "ReadableStream",
+  "WritableStream",
+  "ByteLengthQueuingStrategy",
+  "CountQueuingStrategy",
+  // http://w3c.github.io/IndexedDB/
+  "IDBRequest",
+  "IDBOpenDBRequest",
+  "IDBVersionChangeEvent",
+  "IDBFactory",
+  "IDBDatabase",
+  "IDBObjectStore",
+  "IDBIndex",
+  "IDBKeyRange",
+  "IDBCursor",
+  "IDBCursorWithValue",
+  "IDBTransaction",
+];
+
+for (var i = 0; i < expected.length; ++i) {
+  test(function() {
+    assert_true(expected[i] in self);
+  }, "The " + expected[i] + " interface object should be exposed");
+}
diff --git a/test/fixtures/wpt/workers/semantics/interface-objects/004.any.js b/test/fixtures/wpt/workers/semantics/interface-objects/004.any.js
new file mode 100644
index 000000000000..1b0b93b5df0f
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/interface-objects/004.any.js
@@ -0,0 +1,41 @@
+// META: global=sharedworker
+
+var unexpected = [
+  // https://html.spec.whatwg.org/
+  "ApplicationCache",
+  "SharedWorker",
+  "CanvasPath",
+  "DedicatedWorkerGlobalScope",
+  "AbstractView",
+  "AbstractWorker",
+  "Location",
+  "Navigator",
+  "DOMImplementation",
+  "Audio",
+  "HTMLCanvasElement",
+  "Path",
+  "CanvasProxy",
+  "CanvasRenderingContext2D",
+  "DrawingStyle",
+  "PopStateEvent",
+  "HashChangeEvent",
+  "PageTransitionEvent",
+  // http://w3c.github.io/IndexedDB/
+  "IDBEnvironment",
+  // https://www.w3.org/TR/2010/NOTE-webdatabase-20101118/
+  "Database",
+  // https://w3c.github.io/uievents/
+  "UIEvent",
+  "FocusEvent",
+  "MouseEvent",
+  "WheelEvent",
+  "InputEvent",
+  "KeyboardEvent",
+  "CompositionEvent",
+];
+
+for (var i = 0; i < unexpected.length; ++i) {
+  test(function() {
+    assert_false(unexpected[i] in self);
+  }, "The " + unexpected[i] + " interface object should not be exposed");
+}
diff --git a/test/fixtures/wpt/workers/semantics/interface-objects/WEB_FEATURES.yml b/test/fixtures/wpt/workers/semantics/interface-objects/WEB_FEATURES.yml
new file mode 100644
index 000000000000..601723d1a665
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/interface-objects/WEB_FEATURES.yml
@@ -0,0 +1,7 @@
+rules:
+# These "any.js" tests are limited to the SharedWorker context via the "META"
+# configuration.
+- 003.any.js: [shared-workers]
+- 004.any.js: [shared-workers]
+- 001.worker.js: [dedicated-workers]
+- 002.worker.js: [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/001.html b/test/fixtures/wpt/workers/semantics/multiple-workers/001.html
new file mode 100644
index 000000000000..f9e2bbeabab1
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/001.html
@@ -0,0 +1,23 @@
+<!doctype html>
+<title>dedicated and shared worker in same page</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('001.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 'dedicated');
+    this.done();
+  });
+  worker.postMessage('dedicated');
+}, 'dedicated');
+async_test(function() {
+  var shared = new SharedWorker('001.js', '');
+  shared.port.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 'shared');
+    this.done();
+  });
+  shared.port.postMessage('shared');
+}, 'shared');
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/001.js b/test/fixtures/wpt/workers/semantics/multiple-workers/001.js
new file mode 100644
index 000000000000..6d51169dea0e
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/001.js
@@ -0,0 +1,11 @@
+if ('onmessage' in self) { // dedicated worker
+  onmessage = function(e) {
+    postMessage(e.data);
+  }
+} else { // shared worker
+  onconnect = function(e) {
+    e.ports[0].onmessage = function(e) {
+      this.postMessage(e.data);
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/002.html b/test/fixtures/wpt/workers/semantics/multiple-workers/002.html
new file mode 100644
index 000000000000..aa01e361d806
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/002.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<title>creating 3 sibling dedicated workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var w1 = new Worker('002.js');
+  var w2 = new Worker('002.js');
+  var w3 = new Worker('002.js');
+  var got = [false, false, false];
+  var check_done = t.step_func(function() {
+                       if (got.every(function(x) {return x})) {
+                           t.done();
+                       }
+                   });
+  w1.onmessage = t.step_func(function(e) {got[0] = true; check_done()});
+  w2.onmessage = t.step_func(function(e) {got[1] = true; check_done()});
+  w3.onmessage = t.step_func(function(e) {got[2] = true; check_done()});
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/002.js b/test/fixtures/wpt/workers/semantics/multiple-workers/002.js
new file mode 100644
index 000000000000..2318c2e267db
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/002.js
@@ -0,0 +1 @@
+postMessage(1);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/003.html b/test/fixtures/wpt/workers/semantics/multiple-workers/003.html
new file mode 100644
index 000000000000..f6e03c75f782
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/003.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<title>creating 3 nested dedicated workers</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var w1 = new Worker('003.js#1');
+  w1.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '123');
+    this.done();
+  });
+  w1.onerror = this.unreached_func("error");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/003.js b/test/fixtures/wpt/workers/semantics/multiple-workers/003.js
new file mode 100644
index 000000000000..14a5a614b3d8
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/003.js
@@ -0,0 +1,13 @@
+if (location.hash == '#1') {
+  var w2 = new Worker('003.js#2');
+  w2.onmessage = function(e) {
+    postMessage('1'+e.data);
+  }
+} else if (location.hash == '#2') {
+  var w3 = new Worker('003.js#3');
+  w3.onmessage = function(e) {
+    postMessage('2'+e.data);
+  }
+} else {
+  postMessage('3');
+}
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/004-1.html b/test/fixtures/wpt/workers/semantics/multiple-workers/004-1.html
new file mode 100644
index 000000000000..eac038c5beef
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/004-1.html
@@ -0,0 +1,7 @@
+<!doctype html>
+<title></title>
+<script>
+window.onload = function() {
+  var w=new SharedWorker('004-2.js', 'x');
+};
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/004-2.js b/test/fixtures/wpt/workers/semantics/multiple-workers/004-2.js
new file mode 100644
index 000000000000..e59cd6927e34
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/004-2.js
@@ -0,0 +1,6 @@
+var port;
+onconnect = function(e) {
+  if (!port)
+    port = e.ports[0];
+  port.postMessage(1);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/004.html b/test/fixtures/wpt/workers/semantics/multiple-workers/004.html
new file mode 100644
index 000000000000..552cc8a63340
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/004.html
@@ -0,0 +1,37 @@
+<!doctype html>
+<title>shared worker with multiple documents</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+setup({ single_test: true });
+
+var i = 0;
+var load_count = 0;
+
+var w1 = new SharedWorker('004-2.js', 'x');
+w1.port.onmessage = function(e) {
+  i++;
+  check_result();
+};
+
+
+function iframe_loaded() {
+  load_count++;
+  check_result();
+}
+
+function check_result() {
+  //timeout to allow for extra, unexpected, messages to arrive
+  if (i == 3 && load_count == 2) {
+    setTimeout(function() {
+      assert_equals(load_count, 2);
+      assert_equals(i, 3);
+      done();
+    }, 500);
+  }
+}
+</script>
+<iframe src=004-1.html onload="iframe_loaded()"></iframe>
+<iframe src=004-1.html onload="iframe_loaded()"></iframe>
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/008-1.html b/test/fixtures/wpt/workers/semantics/multiple-workers/008-1.html
new file mode 100644
index 000000000000..d19d7fa3369a
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/008-1.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<title>008-1</title>
+<script>
+var w1 = new SharedWorker('008.js');
+w1.port.onmessage = function(e) {
+  e.ports[0].postMessage(2);
+}
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/008.html b/test/fixtures/wpt/workers/semantics/multiple-workers/008.html
new file mode 100644
index 000000000000..ee38d80866e8
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/008.html
@@ -0,0 +1,19 @@
+<!doctype html>
+<title>messagechannel in shared worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<iframe src=008-1.html></iframe>
+<script>
+var t = async_test();
+onload = t.step_func(function() {
+  var w1 = new SharedWorker('008.js');
+  w1.port.onmessage = this.step_func(function(e) {
+    e.ports[0].onmessage = this.step_func(function(e) {
+      assert_equals(e.data, 2);
+      this.done();
+    });
+  });
+  w1.onerror = this.unreached_func("error");
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/008.js b/test/fixtures/wpt/workers/semantics/multiple-workers/008.js
new file mode 100644
index 000000000000..92593ebb865f
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/008.js
@@ -0,0 +1,6 @@
+var channel = new MessageChannel();
+var i = 0;
+onconnect = function(e) {
+  i++;
+  e.ports[0].postMessage(1, [channel['port' + i]]);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/WEB_FEATURES.yml b/test/fixtures/wpt/workers/semantics/multiple-workers/WEB_FEATURES.yml
new file mode 100644
index 000000000000..e3386cc09310
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/WEB_FEATURES.yml
@@ -0,0 +1,4 @@
+rules:
+- 004.html: [shared-workers]
+- 008.html: [shared-workers]
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/exposure.any.js b/test/fixtures/wpt/workers/semantics/multiple-workers/exposure.any.js
new file mode 100644
index 000000000000..7e226a7333fb
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/exposure.any.js
@@ -0,0 +1,11 @@
+// META: global=window,worker
+
+test(() => {
+  const assert = "ServiceWorkerGlobalScope" in globalThis ? assert_equals : assert_not_equals;
+  assert(globalThis.Worker, undefined);
+}, "Worker exposure");
+
+test(() => {
+  const assert = globalThis.GLOBAL.isWindow() ? assert_not_equals : assert_equals;
+  assert(globalThis.SharedWorker, undefined);
+}, "SharedWorker exposure");
diff --git a/test/fixtures/wpt/workers/semantics/navigation/001-1.html b/test/fixtures/wpt/workers/semantics/navigation/001-1.html
new file mode 100644
index 000000000000..c259c2c839f8
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/navigation/001-1.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<title>001-1</title>
+<script>
+onload = function() {
+  var worker = new Worker('001-1.js');
+  worker.onmessage = function(e) {
+    var started = !!parent.date;
+    parent.date = e.data;
+    if (!started) {
+      parent.start_test()
+    }
+  }
+}
+</script>
+<a href='data:text/html,<title>foo</title><script>onload=function(){window.parent.postMessage({title: window.document.title}, "*")}</script>'>link</a>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/navigation/001-1.js b/test/fixtures/wpt/workers/semantics/navigation/001-1.js
new file mode 100644
index 000000000000..f62c365e3221
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/navigation/001-1.js
@@ -0,0 +1 @@
+setInterval(function() { postMessage(new Date()) }, 10)
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/navigation/001.html b/test/fixtures/wpt/workers/semantics/navigation/001.html
new file mode 100644
index 000000000000..f31c2590e58e
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/navigation/001.html
@@ -0,0 +1,39 @@
+<!--
+
+/*
+-->
+<!doctype html>
+<title>navigating</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+setup({ single_test: true });
+var date;
+var newDate;
+</script>
+<iframe></iframe>
+<script>
+var iframe = document.querySelector('iframe');
+onload = function() {
+  iframe.src = "001-1.html?" + Math.random();
+};
+var start_test = function() {
+  window[0].document.links[0].click();
+};
+var after_load = function(event) {
+  history.back();
+  newDate = new Date();
+  setTimeout(function() {
+    assert_greater_than(Number(date), Number(newDate));
+    assert_equals(window[0].document.title, '001-1');
+    window.removeEventListener("message", after_load);
+    done();
+  }, 2000);
+};
+window.addEventListener("message", after_load);
+</script>
+<!--
+*/
+//-->
+
diff --git a/test/fixtures/wpt/workers/semantics/navigation/002.html b/test/fixtures/wpt/workers/semantics/navigation/002.html
new file mode 100644
index 000000000000..8ea98ef2d44a
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/navigation/002.html
@@ -0,0 +1,38 @@
+<!--
+
+/*
+-->
+<!doctype html>
+<title>navigating 2</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+var date;
+var newDate;
+</script>
+<iframe></iframe>
+<script>
+var t = async_test();
+var iframe = document.querySelector('iframe');
+onload = t.step_func(function() {
+  iframe.src = "001-1.html?" + Math.random();
+});
+var start_test = t.step_func(function() {
+  window[0].document.links[0].click();
+});
+var after_load = t.step_func(function(event) {
+  newDate = new Date();
+  setTimeout(this.step_func(function() {
+    assert_less_than(Number(date), Number(newDate));
+    assert_equals(event.data.title, 'foo');
+    window.removeEventListener("message", after_load);
+    this.done();
+  }), 500);
+});
+window.addEventListener("message", after_load);
+</script>
+<!--
+*/
+//-->
+
diff --git a/test/fixtures/wpt/workers/semantics/navigation/WEB_FEATURES.yml b/test/fixtures/wpt/workers/semantics/navigation/WEB_FEATURES.yml
new file mode 100644
index 000000000000..b16862ba1c01
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/navigation/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/001.html b/test/fixtures/wpt/workers/semantics/reporting-errors/001.html
new file mode 100644
index 000000000000..d8b17289fe24
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/001.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>shared worker, not handled</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+setup({allow_uncaught_exception:true});
+async_test(function() {
+  window.onerror = this.step_func(function(a) {
+    assert_unreached('window.onerror invoked: ' + a);
+  });
+  var worker = new SharedWorker('001.js', '');
+  worker.port.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, '');
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/001.js b/test/fixtures/wpt/workers/semantics/reporting-errors/001.js
new file mode 100644
index 000000000000..5736666cc3b6
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/001.js
@@ -0,0 +1,28 @@
+var port;
+var timeout;
+onerror = function(a,b,c,d,e) {
+  // will return undefined, thus the error is "not handled"
+  // so error should be reported to the user, but this test doesn't check
+  // that.
+  // just make sure that this method is invoked with five arguments
+  clearTimeout(timeout);
+  var log = '';
+  if (arguments.length != 5)
+    log += 'got ' + arguments.length + ' arguments, expected 5. ';
+  if (typeof a != 'string')
+    log += 'first argument wasn\'t a string. ';
+  if (b != location.href)
+    log += 'second argument was ' + b + ', expected ' + location.href + '. ';
+  if (typeof c != 'number')
+    log += 'third argument wasn\'t a number. ';
+  if (typeof d != 'number')
+    log += 'fourth argument wasn\'t a number. ';
+  if (e != 42)
+    log += 'fifth argument wasn\'t the thrown exception. ';
+  port.postMessage(log);
+}
+onconnect = function (e) {
+  port = e.ports[0];
+  timeout = setTimeout(function() { port.postMessage('self.onerror was not invoked'); }, 250);
+  throw 42; // will "report the error"
+}
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/002.html b/test/fixtures/wpt/workers/semantics/reporting-errors/002.html
new file mode 100644
index 000000000000..4b322a5f07d1
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/002.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>shared worker, addEventListener</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+setup({allow_uncaught_exception:true});
+async_test(function() {
+  window.onerror = this.step_func(function(a) {
+    assert_unreached('window.onerror invoked: ' + a);
+  });
+  var worker = new SharedWorker('002.js', '');
+  worker.port.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, '');
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/002.js b/test/fixtures/wpt/workers/semantics/reporting-errors/002.js
new file mode 100644
index 000000000000..ff96922634ff
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/002.js
@@ -0,0 +1,34 @@
+var port;
+var timeout;
+addEventListener('error', function(e) {
+  // event is not canceled, thus the error is "not handled"
+  // so error should be reported to the user, but this test doesn't check
+  // that.
+  // just make sure that this event has the right properties
+  clearTimeout(timeout);
+  var log = '';
+  if (!self.ErrorEvent || Object.getPrototypeOf(e) != ErrorEvent.prototype)
+    log += 'event should be an ErrorEvent. ';
+  if (e.bubbles)
+    log += 'event should not bubble. ';
+  if (!e.cancelable)
+    log += 'event should be cancelable. ';
+  if (!e.isTrusted)
+    log += 'event should be trusted. ';
+  if (typeof e.message != 'string')
+    log += 'message wasn\'t a string. ';
+  if (e.filename != location.href)
+    log += 'filename was ' + e.filename + ', expected ' + location.href + '. ';
+  if (typeof e.lineno != 'number')
+    log += 'lineno wasn\'t a number. ';
+  if (typeof e.colno != 'number')
+    log += 'colno argument wasn\'t a number. ';
+  if (e.error != 42)
+    log += 'fifth argument wasn\'t the thrown exception. ';
+  port.postMessage(log);
+}, false);
+onconnect = function (e) {
+  port = e.ports[0];
+  timeout = setTimeout(function() { port.postMessage('No error event fired'); }, 250);
+  throw 42; // will "report the error"
+}
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/003.html b/test/fixtures/wpt/workers/semantics/reporting-errors/003.html
new file mode 100644
index 000000000000..8ea59b810616
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/003.html
@@ -0,0 +1,23 @@
+<!doctype html>
+<title>shared worker, no error event on worker or port</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+setup({allow_uncaught_exception:true});
+async_test(function() {
+  window.onerror = this.step_func(function(a) {
+    assert_unreached('window.onerror invoked: ' + a);
+  });
+  var worker = new SharedWorker('003.js', '');
+  worker.addEventListener('error', this.step_func(function(e) {
+    assert_unreached('error on worker');
+  }), false);
+  worker.port.addEventListener('error', this.step_func(function(e) {
+    assert_unreached('error on port');
+  }), false);
+  worker.port.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, '');
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/003.js b/test/fixtures/wpt/workers/semantics/reporting-errors/003.js
new file mode 100644
index 000000000000..8a3390bb2490
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/003.js
@@ -0,0 +1,8 @@
+onconnect = function (e) {
+  setTimeout(function() { e.ports[0].postMessage(''); }, 250);
+  y(); // will "report the error"
+  // onerror is null so it'll be "not handled", and the error should be
+  // reported to the user, although we don't test that here
+  // make sure we don't fire an error event on the message port or the
+  // SharedWorker object
+}
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/004-1.html b/test/fixtures/wpt/workers/semantics/reporting-errors/004-1.html
new file mode 100644
index 000000000000..326e1399ec5f
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/004-1.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<script>
+parent.t.step(function() {
+  window.onerror = this.step_func(function(a) {
+    assert_unreached('(inner) window.onerror invoked: ' + a);
+  });
+  var worker = new SharedWorker('004.js', '');
+  worker.addEventListener('error', this.step_func(function(e) {
+    parent.assert_unreached('(inner) error on worker');
+  }), false);
+  worker.port.addEventListener('error', this.step_func(function(e) {
+    parent.assert_unreached('(inner) error on port');
+  }), false);
+  worker.port.onmessage = this.step_func_done(function(e) {
+    parent.assert_equals(e.data, 2);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/004.html b/test/fixtures/wpt/workers/semantics/reporting-errors/004.html
new file mode 100644
index 000000000000..8516e52c6fe2
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/004.html
@@ -0,0 +1,26 @@
+<!doctype html>
+<title>shared worker in two documents and window.onerror</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+setup({allow_uncaught_exception:true});
+var t = async_test(function() {
+  window.onerror = this.step_func(function(a) {
+    assert_unreached('(outer) window.onerror invoked: ' + a);
+  });
+  var worker = new SharedWorker('004.js', '');
+  worker.addEventListener('error', this.step_func(function(e) {
+    assert_unreached('(outer) error on worker');
+  }), false);
+  worker.port.addEventListener('error', this.step_func(function(e) {
+    assert_unreached('(outer) error on port');
+  }), false);
+  worker.port.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 1);
+    var iframe = document.createElement('iframe');
+    iframe.src = '004-1.html';
+    document.body.appendChild(iframe);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/004.js b/test/fixtures/wpt/workers/semantics/reporting-errors/004.js
new file mode 100644
index 000000000000..a68d2ab01def
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/004.js
@@ -0,0 +1,6 @@
+var i = 0;
+onconnect = function (e) {
+  i++;
+  setTimeout(function() { e.ports[0].postMessage(i); }, 250);
+  y(); // will "report the error"
+}
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/WEB_FEATURES.yml b/test/fixtures/wpt/workers/semantics/reporting-errors/WEB_FEATURES.yml
new file mode 100644
index 000000000000..73744331853b
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [shared-workers]
diff --git a/test/fixtures/wpt/workers/semantics/run-a-worker/001.html b/test/fixtures/wpt/workers/semantics/run-a-worker/001.html
new file mode 100644
index 000000000000..71e48c277114
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/run-a-worker/001.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>worker global scope, dedicated worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('001.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/run-a-worker/001.js b/test/fixtures/wpt/workers/semantics/run-a-worker/001.js
new file mode 100644
index 000000000000..33ed47f1b442
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/run-a-worker/001.js
@@ -0,0 +1 @@
+postMessage(this === self);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/run-a-worker/002.html b/test/fixtures/wpt/workers/semantics/run-a-worker/002.html
new file mode 100644
index 000000000000..9487d886a67d
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/run-a-worker/002.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>worker global scope, shared worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new SharedWorker('002.js');
+  worker.port.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/run-a-worker/002.js b/test/fixtures/wpt/workers/semantics/run-a-worker/002.js
new file mode 100644
index 000000000000..627272aaefa3
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/run-a-worker/002.js
@@ -0,0 +1,4 @@
+var passed = this === self;
+onconnect = function(e) {
+  e.ports[0].postMessage(passed);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/run-a-worker/003.html b/test/fixtures/wpt/workers/semantics/run-a-worker/003.html
new file mode 100644
index 000000000000..e96c176f20ab
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/run-a-worker/003.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<title>handling for 404 response</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new Worker('404_worker');
+  worker.onerror = e => t.done();
+}, 'worker');
+
+async_test(t => {
+  const shared = new SharedWorker('404_shared');
+  shared.onerror = e => t.done();
+}, 'shared');
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/run-a-worker/WEB_FEATURES.yml b/test/fixtures/wpt/workers/semantics/run-a-worker/WEB_FEATURES.yml
new file mode 100644
index 000000000000..fb5bc3756c1e
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/run-a-worker/WEB_FEATURES.yml
@@ -0,0 +1,3 @@
+rules:
+- 002.html: [shared-workers]
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/semantics/structured-clone/dedicated.html b/test/fixtures/wpt/workers/semantics/structured-clone/dedicated.html
new file mode 100644
index 000000000000..16b6be56f147
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/structured-clone/dedicated.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<title>structured clone to dedicated worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src=/common/sab.js></script>
+<script src=/html/webappapis/structured-clone/structured-clone-battery-of-tests.js></script>
+<script src=/html/webappapis/structured-clone/structured-clone-battery-of-tests-with-transferables.js></script>
+<script src=/html/webappapis/structured-clone/structured-clone-battery-of-tests-harness.js></script>
+<div id=log></div>
+<script>
+  runStructuredCloneBatteryOfTests({
+    setup() {
+      const blob = new Blob([`
+        onmessage = ev => postMessage(ev.data, ev.data.transfer);
+      `], {type: 'text/javascript'});
+      this.blobURL = URL.createObjectURL(blob);
+      this.worker = new Worker(this.blobURL);
+    },
+    structuredClone(data, transfer) {
+      return new Promise(resolve => {
+        this.worker.addEventListener('message', function f(ev) {
+          this.worker.removeEventListener('message', f);
+          resolve(ev.data.data);
+        }.bind(this));
+        this.worker.postMessage({data, transfer}, transfer);
+      });
+    },
+    teardown() {
+      this.worker.terminate();
+      URL.revokeObjectURL(this.blobURL);
+    }
+  });
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/structured-clone/shared.html b/test/fixtures/wpt/workers/semantics/structured-clone/shared.html
new file mode 100644
index 000000000000..eb85499fe283
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/structured-clone/shared.html
@@ -0,0 +1,37 @@
+<!doctype html>
+<title>structured clone to shared worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src=/common/sab.js></script>
+<script src=/html/webappapis/structured-clone/structured-clone-battery-of-tests.js></script>
+<script src=/html/webappapis/structured-clone/structured-clone-battery-of-tests-with-transferables.js></script>
+<script src=/html/webappapis/structured-clone/structured-clone-battery-of-tests-harness.js></script>
+<div id=log></div>
+<script>
+  runStructuredCloneBatteryOfTests({
+    setup() {
+      const blob = new Blob([`
+        onconnect = ev => {
+          const port = ev.ports[0];
+          port.onmessage = ev => port.postMessage(ev.data, ev.data.transfer);
+        };
+      `], {type: 'text/javascript'});
+      this.blobURL = URL.createObjectURL(blob);
+      this.worker = new SharedWorker(this.blobURL);
+      this.port = this.worker.port;
+    },
+    structuredClone(data, transfer) {
+      return new Promise(resolve => {
+        this.port.addEventListener('message', function f(ev) {
+          this.port.removeEventListener('message', f);
+          resolve(ev.data.data);
+        }.bind(this));
+        this.port.start();
+        this.port.postMessage({data, transfer}, transfer);
+      });
+    },
+    teardown() {
+      URL.revokeObjectURL(this.blobURL);
+    }
+  });
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/xhr/001-1.xml b/test/fixtures/wpt/workers/semantics/xhr/001-1.xml
new file mode 100644
index 000000000000..5d735bdf6199
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/001-1.xml
@@ -0,0 +1 @@
+<x>foo</x>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/xhr/001.html b/test/fixtures/wpt/workers/semantics/xhr/001.html
new file mode 100644
index 000000000000..da59f5ac2d16
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/001.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<title>async XMLHttpRequest in dedicated worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+var t = async_test();
+function runtest() {
+  var worker = new Worker('001.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '');
+    this.done();
+  });
+}
+</script>
+<iframe src=001-1.xml onload="t.step(runtest);"></iframe>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/xhr/001.js b/test/fixtures/wpt/workers/semantics/xhr/001.js
new file mode 100644
index 000000000000..1cbe98ba470b
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/001.js
@@ -0,0 +1,13 @@
+var xhr = new XMLHttpRequest();
+var log = '';
+xhr.onreadystatechange = function(e) {
+  if (this.readyState == 4) {
+    if (this.responseXML != null)
+      log += 'responseXML was not null. ';
+    if (this.responseText != '<x>foo</x>')
+      log += 'responseText was ' + this.responseText + ', expected <x>foo</x>. ';
+    postMessage(log);
+  }
+}
+xhr.open('GET', '001-1.xml', true);
+xhr.send();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/xhr/002.html b/test/fixtures/wpt/workers/semantics/xhr/002.html
new file mode 100644
index 000000000000..60c0e161cc8e
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/002.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<title>sync XMLHttpRequest in dedicated worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+var t = async_test();
+function runtest() {
+  var worker = new Worker('002.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '');
+    this.done();
+  });
+}
+</script>
+<iframe src=001-1.xml onload="t.step(runtest);"></iframe>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/xhr/002.js b/test/fixtures/wpt/workers/semantics/xhr/002.js
new file mode 100644
index 000000000000..68d7e91d451e
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/002.js
@@ -0,0 +1,9 @@
+var xhr = new XMLHttpRequest();
+var log = '';
+xhr.open('GET', '001-1.xml', false);
+xhr.send();
+if (xhr.responseXML != null)
+  log += 'responseXML was not null. ';
+if (xhr.responseText != '<x>foo</x>')
+  log += 'responseText was ' + this.responseText + ', expected <x>foo</x>. ';
+postMessage(log);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/xhr/003.html b/test/fixtures/wpt/workers/semantics/xhr/003.html
new file mode 100644
index 000000000000..e3ce36b82cfc
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/003.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<title>async XMLHttpRequest in shared worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+var t = async_test();
+function runtest() {
+  var worker = new SharedWorker('003.js', '');
+  worker.port.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '');
+    this.done();
+  });
+}
+</script>
+<iframe src=001-1.xml onload="t.step(runtest);"></iframe>
diff --git a/test/fixtures/wpt/workers/semantics/xhr/003.js b/test/fixtures/wpt/workers/semantics/xhr/003.js
new file mode 100644
index 000000000000..1a9c5a7ee816
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/003.js
@@ -0,0 +1,17 @@
+onconnect = function(e) {
+  var xhr = new XMLHttpRequest();
+  var log = '';
+  var port = e.ports[0];
+  var postMessage = port.postMessage;
+  xhr.onreadystatechange = function(e) {
+    if (this.readyState == 4) {
+      if (this.responseXML != null)
+        log += 'responseXML was not null. ';
+      if (this.responseText && this.responseText != '<x>foo</x>')
+        log += 'responseText was ' + this.responseText + ', expected <x>foo</x>. ';
+      postMessage.call(port, log);
+    }
+  }
+  xhr.open('GET', '001-1.xml', true);
+  xhr.send();
+}
diff --git a/test/fixtures/wpt/workers/semantics/xhr/004.html b/test/fixtures/wpt/workers/semantics/xhr/004.html
new file mode 100644
index 000000000000..d11e3dbc1b92
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/004.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<title>sync XMLHttpRequest in shared worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+var t = async_test();
+function runtest() {
+  var worker = new SharedWorker('004.js', '');
+  worker.port.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '');
+    this.done();
+  });
+}
+</script>
+<iframe src=001-1.xml onload="t.step(runtest);"></iframe>
diff --git a/test/fixtures/wpt/workers/semantics/xhr/004.js b/test/fixtures/wpt/workers/semantics/xhr/004.js
new file mode 100644
index 000000000000..1741c8d36a0e
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/004.js
@@ -0,0 +1,11 @@
+onconnect = function(e) {
+  var xhr = new XMLHttpRequest();
+  var log = '';
+  xhr.open('GET', '001-1.xml', false);
+  xhr.send();
+  if (xhr.responseXML != null)
+    log += 'responseXML was not null. ';
+  if (xhr.responseText != '<x>foo</x>')
+    log += 'responseText was ' + xhr.responseText + ', expected <x>foo</x>. ';
+  e.ports[0].postMessage(log);
+}
diff --git a/test/fixtures/wpt/workers/semantics/xhr/005.html b/test/fixtures/wpt/workers/semantics/xhr/005.html
new file mode 100644
index 000000000000..84abdb0c4264
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/005.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<title>base url, dedicated worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+var t = async_test();
+var i = 0;
+function runtest() {
+  i++;
+  if (i != 2)
+    return;
+  var worker = new Worker('support/005-1.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+}
+</script>
+<iframe src=001-1.xml onload="t.step(runtest);"></iframe>
+<iframe src=support/001-1.xml onload="t.step(runtest);"></iframe>
diff --git a/test/fixtures/wpt/workers/semantics/xhr/006.html b/test/fixtures/wpt/workers/semantics/xhr/006.html
new file mode 100644
index 000000000000..7411b4baef3a
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/006.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<title>base url, shared worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+var t = async_test();
+var i = 0;
+function runtest() {
+  i++;
+  if (i != 2)
+    return;
+  var worker = new SharedWorker('support/006-1.js','');
+  worker.port.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+}
+</script>
+<iframe src=001-1.xml onload="t.step(runtest);"></iframe>
+<iframe src=support/001-1.xml onload="t.step(runtest);"></iframe>
diff --git a/test/fixtures/wpt/workers/semantics/xhr/WEB_FEATURES.yml b/test/fixtures/wpt/workers/semantics/xhr/WEB_FEATURES.yml
new file mode 100644
index 000000000000..233f18fee3cf
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/WEB_FEATURES.yml
@@ -0,0 +1,7 @@
+rules:
+- 003.html: [shared-workers]
+- 004.html: [shared-workers]
+- 006.html: [shared-workers]
+- 001.html: [dedicated-workers]
+- 002.html: [dedicated-workers]
+- 005.html: [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/semantics/xhr/support/001-1.xml b/test/fixtures/wpt/workers/semantics/xhr/support/001-1.xml
new file mode 100644
index 000000000000..ecea58a93574
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/support/001-1.xml
@@ -0,0 +1 @@
+<x>bar</x>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/xhr/support/005-1.js b/test/fixtures/wpt/workers/semantics/xhr/support/005-1.js
new file mode 100644
index 000000000000..45f6519a2104
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/support/005-1.js
@@ -0,0 +1,5 @@
+var xhr = new XMLHttpRequest();
+xhr.open('GET', '001-1.xml', false);
+xhr.send();
+var passed = xhr.responseText == '<x>bar</x>';
+postMessage(passed);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/xhr/support/006-1.js b/test/fixtures/wpt/workers/semantics/xhr/support/006-1.js
new file mode 100644
index 000000000000..d446781eb7c1
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/support/006-1.js
@@ -0,0 +1,7 @@
+onconnect = function(e) {
+  var xhr = new XMLHttpRequest();
+  xhr.open('GET', '001-1.xml', false);
+  xhr.send();
+  var passed = xhr.responseText == '<x>bar</x>';
+  e.ports[0].postMessage(passed);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/shared-worker-from-blob-url.window.js b/test/fixtures/wpt/workers/shared-worker-from-blob-url.window.js
new file mode 100644
index 000000000000..d3c6d4fe47f2
--- /dev/null
+++ b/test/fixtures/wpt/workers/shared-worker-from-blob-url.window.js
@@ -0,0 +1,73 @@
+function message_from_port(port) {
+  return new Promise(resolve => {
+    port.onmessage = e => resolve(e.data);
+  });
+}
+
+promise_test(async t => {
+  const run_result = 'worker_OK_';
+  const blob_contents =
+    'self.counter = 0; self.onconnect = e => {++self.counter;' +
+    'e.source.postMessage("' + run_result + '" + self.counter); };';
+  const blob = new Blob([blob_contents]);
+  const url = URL.createObjectURL(blob);
+
+  const worker1 = new SharedWorker(url);
+  const reply1 = await message_from_port(worker1.port);
+  assert_equals(reply1, run_result + '1');
+  const worker2 = new SharedWorker(url);
+  const reply2 = await message_from_port(worker2.port);
+  assert_equals(reply2, run_result + '2');
+}, 'Creating a shared worker from a blob URL works.');
+
+promise_test(async t => {
+  const run_result = 'worker_OK';
+  const blob_contents =
+    'self.onconnect = e => { e.source.postMessage("' + run_result + '"); };';
+  const blob = new Blob([blob_contents]);
+  const url = URL.createObjectURL(blob);
+
+  const worker = new SharedWorker(url);
+  URL.revokeObjectURL(url);
+
+  const reply = await message_from_port(worker.port);
+  assert_equals(reply, run_result);
+}, 'Creating a shared worker from a blob URL works immediately before revoking.');
+
+promise_test(async t => {
+  const run_result = 'worker_OK_';
+  const blob_contents =
+    'self.counter = 0; self.onconnect = e => {++self.counter;' +
+    'e.source.postMessage("' + run_result + '" + self.counter); };';
+  const blob = new Blob([blob_contents]);
+  const url = URL.createObjectURL(blob);
+
+  const worker1 = new SharedWorker(url);
+  URL.revokeObjectURL(url);
+
+  const reply1 = await message_from_port(worker1.port);
+  assert_equals(reply1, run_result + '1');
+  const worker2 = new SharedWorker(url);
+  const reply2 = await message_from_port(worker2.port);
+  assert_equals(reply2, run_result + '2');
+}, 'Connecting to a shared worker on a revoked blob URL works.');
+
+promise_test(async t => {
+  const run_result = false;
+  const blob_contents = `
+let constructedRequest = false;
+try {
+  new Request("./file.js");
+  constructedRequest = true;
+} catch (e) {}
+self.onconnect = e => {
+  e.source.postMessage(constructedRequest);
+};
+`;
+  const blob = new Blob([blob_contents]);
+  const url = URL.createObjectURL(blob);
+
+  const worker = new SharedWorker(url);
+  const reply = await message_from_port(worker.port);
+  assert_equals(reply, run_result, "Should not be able to resolve request with relative file path in blob");
+}, 'Blob URLs should not resolve relative to document base URL.');
diff --git a/test/fixtures/wpt/workers/shared-worker-in-data-url-context.window.js b/test/fixtures/wpt/workers/shared-worker-in-data-url-context.window.js
new file mode 100644
index 000000000000..b768c815d08d
--- /dev/null
+++ b/test/fixtures/wpt/workers/shared-worker-in-data-url-context.window.js
@@ -0,0 +1,65 @@
+// META: title=data URL shared worker in data URL context
+// META: script=/service-workers/service-worker/resources/test-helpers.sub.js
+const mimeType = 'application/javascript';
+
+// Tests creating a data URL shared worker in a data URL iframe.
+promise_test(async t => {
+  const nestedWorkerScriptURL =
+      new URL('/workers/support/post-message-on-load-worker.js', location.href);
+
+  // This code will be executed in a data URL iframe. The iframe tries to create
+  // a shared worker from |nestedWorkerScriptURL|, but that should result in a
+  // failure. This is because the data URL iframe has an opaque origin, and
+  // script fetch is handled as a cross-origin request.
+  const frameCode = `
+      <script>
+      try {
+        const worker = new SharedWorker('${nestedWorkerScriptURL}');
+        worker.port.onmessage = e => {
+          window.parent.postMessage(
+              'SharedWorker construction unexpectedly succeeded', '*');
+        };
+        worker.onerror = e => window.parent.postMessage('PASS', '*');
+      } catch (e) {
+        // Cross-origin request should asynchronously fail during worker script
+        // fetch because its request mode is 'same-origin'.
+        window.parent.postMessage(
+            'SharedWorker construction unexpectedly synchronously failed', '*');
+      }
+      </script>
+  `;
+
+  const p = new Promise(r => window.onmessage = e => r(e.data));
+  const frame = await with_iframe(`data:text/html;base64,${btoa(frameCode)}`);
+  const result = await p;
+  assert_equals(result, 'PASS');
+}, 'Create a shared worker in a data url frame');
+
+// Tests creating a data URL shared worker in a data URL iframe.
+promise_test(async t => {
+  const workerCode = `onconnect = e => e.ports[0].postMessage("PASS");`;
+
+  // This code will be executed in a data URL iframe. The iframe tries to create
+  // a data URL shared worker. Fetching a data URL from the data URL shared
+  // worker is allowed, so the worker construction should succeed. The worker
+  // posts the result to the parent frame.
+  const frameCode = `
+      <script>
+      try {
+        const worker = new SharedWorker('data:${mimeType},${workerCode};');
+        worker.port.onmessage = e => window.parent.postMessage(e.data, '*');
+        worker.onerror = e => {
+          window.parent.postMessage('FAIL: ' + e.message, '*');
+        };
+      } catch (e) {
+        window.parent.postMessage(
+            'SharedWorker construction unexpectedly synchronously failed', '*');
+      }
+      </script>
+  `;
+
+  const p = new Promise(r => window.onmessage = e => r(e.data));
+  const frame = await with_iframe(`data:text/html;base64,${btoa(frameCode)}`);
+  const result = await p;
+  assert_equals(result, 'PASS');
+}, 'Create a data url shared worker in a data url frame');
diff --git a/test/fixtures/wpt/workers/shared-worker-name-via-options.html b/test/fixtures/wpt/workers/shared-worker-name-via-options.html
new file mode 100644
index 000000000000..1914d66db748
--- /dev/null
+++ b/test/fixtures/wpt/workers/shared-worker-name-via-options.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test the name property of shared workers mixing constructor options and constructor strings</title>
+<link rel="help" href="https://html.spec.whatwg.org/multipage/#concept-workerglobalscope-name">
+<link rel="help" href="https://html.spec.whatwg.org/multipage/#dom-sharedworker">
+<link rel="help" href="https://html.spec.whatwg.org/multipage/#dom-sharedworkerglobalscope-name">
+<link rel="author" title="Domenic Denicola" href="mailto:d@domenic.me">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<script>
+"use strict";
+setup({ single_test: true });
+
+const name = "my name";
+
+const worker1 = new SharedWorker("support/shared-name.js", { name });
+worker1.port.onmessage = receiveMessage;
+
+const worker2 = new SharedWorker("support/shared-name.js", { name });
+worker2.port.onmessage = receiveMessage;
+
+const worker3 = new SharedWorker("support/shared-name.js", name);
+worker3.port.onmessage = receiveMessage;
+
+let nextCounterExpected = 1;
+function receiveMessage(e) {
+  const { counter, name: receivedName } = e.data;
+
+  assert_equals(receivedName, name);
+  assert_equals(counter, nextCounterExpected);
+
+  ++nextCounterExpected;
+  if (nextCounterExpected === 4) {
+    done();
+  }
+}
+</script>
diff --git a/test/fixtures/wpt/workers/shared-worker-options-mismatch.html b/test/fixtures/wpt/workers/shared-worker-options-mismatch.html
new file mode 100644
index 000000000000..f4cf6c4192d8
--- /dev/null
+++ b/test/fixtures/wpt/workers/shared-worker-options-mismatch.html
@@ -0,0 +1,81 @@
+<!DOCTYPE html>
+<title>SharedWorker: type or credentials mismatch failure</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+const mismatch_test = (testName, firstOptions, secondOptions) => {
+  promise_test(async () => {
+    firstOptions.name = testName;
+    secondOptions.name = testName;
+    const scriptURL = 'support/SharedWorker-common.js';
+    const firstWorker = new SharedWorker(scriptURL, firstOptions);
+    const secondWorker = new SharedWorker(scriptURL, secondOptions);
+    const result = new Promise((resolve, reject) => {
+      secondWorker.onerror = resolve;
+      secondWorker.port.onmessage = () => reject("Worker loaded succesfully");
+    });
+    secondWorker.port.postMessage("ping");
+    await result;
+    firstWorker.port.postMessage("close");
+    secondWorker.port.postMessage("close");
+    return result;
+  }, 'Connecting to shared worker with different options should be blocked: '
+  + testName);
+};
+
+// Tests different type.
+mismatch_test('default to module', {}, { type: 'module' });
+mismatch_test('module to default', { type: 'module' }, {});
+mismatch_test('classic to module', { type: 'classic' }, { type: 'module' });
+mismatch_test('module to classic', { type: 'module' }, { type: 'classic' });
+
+['classic', 'module'].forEach(type => {
+  // Tests different credentials.
+  mismatch_test('default to omit in ' + type,
+                { type },
+                { type, credentials: 'omit' });
+  mismatch_test('default to include in ' + type,
+                { type },
+                { type, credentials: 'include' });
+  mismatch_test('omit to default in ' + type,
+                { type, credentials: 'omit' },
+                { type });
+  mismatch_test('omit to same-origin in ' + type,
+                { type, credentials: 'omit' },
+                { type, credentials: 'same-origin' });
+  mismatch_test('omit to include in ' + type,
+                { type, credentials: 'omit' },
+                { type, credentials: 'include' });
+  mismatch_test('same-origin to omit in ' + type,
+                { type, credentials: 'same-origin'},
+                { type, credentials: 'omit' });
+  mismatch_test('same-origin to include in ' + type,
+                { type, credentials: 'same-origin'},
+                { type, credentials: 'include' });
+  mismatch_test('include to default in ' + type,
+                { type, credentials: 'include' },
+                { type });
+  mismatch_test('include to omit in ' + type,
+                { type, credentials: 'include' },
+                { type, credentials: 'omit' });
+  mismatch_test('include to same-origin in ' + type,
+                { type, credentials: 'include' },
+                { type, credentials: 'same-origin' });
+
+  // Tests different extendedLifetime.
+  mismatch_test('default to extended in ' + type,
+                { type },
+                { type, extendedLifetime: true });
+  mismatch_test('extended to default in ' + type,
+                { type, extendedLifetime: true },
+                { type });
+  mismatch_test('true to false in ' + type,
+                { type, extendedLifetime: true },
+                { type, extendedLifetime: false });
+  mismatch_test('false to true in ' + type,
+                { type, extendedLifetime: false },
+                { type, extendedLifetime: true });
+});
+
+</script>
diff --git a/test/fixtures/wpt/workers/shared-worker-parse-error-failure.html b/test/fixtures/wpt/workers/shared-worker-parse-error-failure.html
new file mode 100644
index 000000000000..3f1b4c5d85f4
--- /dev/null
+++ b/test/fixtures/wpt/workers/shared-worker-parse-error-failure.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<title>SharedWorker: parse error failure</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./support/check-error-arguments.js"></script>
+<script>
+
+promise_test(async () => {
+  const scriptURL = 'modules/resources/syntax-error.js';
+  const worker = new SharedWorker(scriptURL, { type: 'classic' });
+  const args = await new Promise(resolve =>
+      worker.onerror = (...args) => resolve(args));
+  window.checkErrorArguments(args);
+}, 'Classic shared worker construction for script with syntax error should ' +
+   'dispatch an event named error.');
+
+promise_test(async () => {
+  const scriptURL = 'modules/resources/static-import-worker.js';
+  const worker = new SharedWorker(scriptURL, { type: 'classic' });
+  const args = await new Promise(resolve =>
+      worker.onerror = (...args) => resolve(args));
+  window.checkErrorArguments(args);
+}, 'Static import on classic shared worker should dispatch an event named ' +
+   'error.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/shared-worker-partitioned-cookies.tentative.https.html b/test/fixtures/wpt/workers/shared-worker-partitioned-cookies.tentative.https.html
new file mode 100644
index 000000000000..f17a96449796
--- /dev/null
+++ b/test/fixtures/wpt/workers/shared-worker-partitioned-cookies.tentative.https.html
@@ -0,0 +1,62 @@
+<!DOCTYPE html>
+<head>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>SharedWorker: Partitioned Cookies</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="support/shared-worker-partitioned-cookies-helper.js"></script>
+</head>
+
+<body>
+<script>
+
+promise_test(async () => {
+  // Set a Partitioned cookie.
+  document.cookie =
+      '__Host-partitioned=123; Secure; Path=/; SameSite=None; Partitioned;';
+  assert_true(document.cookie.includes('__Host-partitioned=123'));
+
+  // Set an unpartitioned cookie.
+  document.cookie = 'unpartitioned=456; Secure; Path=/; SameSite=None;';
+  assert_true(document.cookie.includes('unpartitioned=456'));
+
+  const worker = new SharedWorker('support/shared-worker-echo-cookies.js');
+  const next_message = worker_message_generator(worker);
+
+  worker.port.postMessage({type: 'test_message'});
+  const msg1 = await next_message();
+  assert_true(msg1.ok, 'Message passing');
+
+  worker.port.postMessage({type: 'echo_cookies_http'});
+  const msg2 = await next_message();
+  assert_true(msg2.ok, 'Get cookies');
+  assert_true(
+      msg2.cookies.includes('__Host-partitioned'),
+      'Can access partitioned cookie via HTTP');
+  assert_true(
+      msg2.cookies.includes('unpartitioned'),
+      'Can access unpartitioned cookie via HTTP');
+
+  worker.port.postMessage({type: 'echo_cookies_import'});
+  const msg3 = await next_message();
+  assert_true(msg3.ok, 'Get cookies');
+  assert_true(msg3.cookies.includes(
+      '__Host-partitioned'),
+      'Can access partitioned cookie via importScripts');
+  assert_true(
+      msg3.cookies.includes('unpartitioned'),
+      'Can access unpartitioned cookie via importScripts');
+
+  const popup = window.open(
+      new URL(
+          `./support/shared-worker-partitioned-cookies-3p-window.html?origin=${
+              encodeURIComponent(self.location.origin)}`,
+          get_host_info().HTTPS_NOTSAMESITE_ORIGIN + self.location.pathname));
+  await fetch_tests_from_window(popup);
+});
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/workers/shared-worker-partitioned.tentative.html b/test/fixtures/wpt/workers/shared-worker-partitioned.tentative.html
new file mode 100644
index 000000000000..0be8479fa9b0
--- /dev/null
+++ b/test/fixtures/wpt/workers/shared-worker-partitioned.tentative.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test partitioning of shared workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+
+<body>
+<script>
+async function onload() {
+  const worker = new SharedWorker("support/shared-name.js");
+
+  let e = await new Promise((r) => {worker.port.onmessage = r});
+  assert_equals(e.data.counter, 1);
+
+  const third_party_url = new URL(
+      'support/window-sw-shared-name.html',
+      get_host_info().HTTP_NOTSAMESITE_ORIGIN + self.location.pathname);
+
+  third_party_window = window.open(third_party_url);
+
+  e = await new Promise((r) => {window.onmessage = r});
+  assert_equals(e.data.counter, 1);
+
+  third_party_window.close();
+}
+
+promise_test(onload);
+</script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/shared-worker-runtime-error-is-not-parse-error.html b/test/fixtures/wpt/workers/shared-worker-runtime-error-is-not-parse-error.html
new file mode 100644
index 000000000000..da7872f3f709
--- /dev/null
+++ b/test/fixtures/wpt/workers/shared-worker-runtime-error-is-not-parse-error.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<title>SharedWorker: runtime errors are not parse errors</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+promise_test(async t => {
+  const worker = new SharedWorker('support/shared-worker-eval-syntax-error.js');
+  worker.onerror = t.unreached_func(
+      'onerror should not be invoked for eval() runtime error');
+  const data = await new Promise(resolve => worker.port.onmessage = e => resolve(e.data));
+  assert_equals(data, 'onerror-fired',
+      'Error should have fired at the SharedWorkerGlobalScope');
+}, 'eval() with syntax error fires at global scope but not at SharedWorker');
+
+promise_test(async t => {
+  const worker = new SharedWorker('support/shared-worker-json-parse-error.js');
+  worker.onerror = t.unreached_func(
+      'onerror should not be invoked for JSON.parse() runtime error');
+  const data = await new Promise(resolve => worker.port.onmessage = e => resolve(e.data));
+  assert_equals(data, 'onerror-fired',
+      'Error should have fired at the SharedWorkerGlobalScope');
+}, 'JSON.parse() error fires at global scope but not at SharedWorker');
+
+promise_test(async () => {
+  const worker = new SharedWorker('modules/resources/syntax-error.js');
+  const event = await new Promise(resolve => {
+    worker.onerror = e => { e.preventDefault(); resolve(e); };
+  });
+  assert_equals(event.constructor, Event,
+      'Script parse error should dispatch Event, not ErrorEvent');
+  assert_false(event instanceof ErrorEvent,
+      'Script parse error should not be an ErrorEvent');
+}, 'Script parse error dispatches plain Event at SharedWorker');
+
+</script>
diff --git a/test/fixtures/wpt/workers/support/ErrorEvent-error.js b/test/fixtures/wpt/workers/support/ErrorEvent-error.js
new file mode 100644
index 000000000000..930b54c0d588
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/ErrorEvent-error.js
@@ -0,0 +1,9 @@
+onerror = function(message, location, line, col, error) {
+  postMessage({ source: "onerror", value: error });
+}
+
+addEventListener("error", function(e) {
+  postMessage({ source: "event listener", value: e.error });
+});
+
+throw "hello";
diff --git a/test/fixtures/wpt/workers/support/ErrorEvent.js b/test/fixtures/wpt/workers/support/ErrorEvent.js
new file mode 100644
index 000000000000..22ea6d4fb515
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/ErrorEvent.js
@@ -0,0 +1,10 @@
+onmessage = function(evt)
+{
+    throw(new Error(evt.data));
+}
+
+onerror = function(message, location, line, col)
+{
+    postMessage( {"message": message, "filename": location, "lineno": line, "colno": col} );
+    return false; // "not handled" so the error propagates up to the Worker object
+}
diff --git a/test/fixtures/wpt/workers/support/ImportScripts.js b/test/fixtures/wpt/workers/support/ImportScripts.js
new file mode 100644
index 000000000000..7f2a2bcb552e
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/ImportScripts.js
@@ -0,0 +1,9 @@
+try
+{
+    importScripts("WorkerBasic.js");
+}
+catch(ex)
+{
+    result = "Fail";
+    postMessage(result);
+}
diff --git a/test/fixtures/wpt/workers/support/ImportScriptsNetworkErr.js b/test/fixtures/wpt/workers/support/ImportScriptsNetworkErr.js
new file mode 100644
index 000000000000..8179c8b10013
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/ImportScriptsNetworkErr.js
@@ -0,0 +1,15 @@
+var result = "Fail";
+
+try
+{
+    importScripts("NonExistentFile.js");
+}
+catch(ex)
+{
+    if (ex.code != null && ex.code == ex.NETWORK_ERR)
+    {
+        result = "Pass";
+    }
+}
+
+postMessage(result);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/support/ImportScriptsNosniffErr.js b/test/fixtures/wpt/workers/support/ImportScriptsNosniffErr.js
new file mode 100644
index 000000000000..22dc9c1ba57c
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/ImportScriptsNosniffErr.js
@@ -0,0 +1,9 @@
+importScripts('/resources/testharness.js');
+
+test(t => {
+  assert_throws_dom('NetworkError', () => {
+    importScripts("nosiniff-error-worker.py");
+  });
+}, "importScripts throws on 'nosniff' violation");
+
+done();
diff --git a/test/fixtures/wpt/workers/support/SharedWorker-common.js b/test/fixtures/wpt/workers/support/SharedWorker-common.js
new file mode 100644
index 000000000000..1c1dac39714b
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/SharedWorker-common.js
@@ -0,0 +1,32 @@
+function generateError()
+{
+    // Generate an exception by accessing an undefined variable.
+    foo.bar = 0;
+}
+
+onconnect = function(event) {
+    event.ports[0].onmessage = function(evt) { handleMessage(evt, event.ports[0]); };
+};
+
+function handleMessage(event, port) {
+    self.port = port;
+    if (event.data == "ping")
+        port.postMessage("PASS: Received ping message");
+    else if (event.data == "close")
+        close();
+    else if (event.data == "done")
+        port.postMessage("DONE");
+    else if (event.data == "throw")
+        generateError();
+    else if (event.data == "testingNameAttribute")
+        port.postMessage(self.name);
+    else if (/eval.+/.test(event.data)) {
+        try {
+            port.postMessage(event.data.substr(5) + ": " + eval(event.data.substr(5)));
+        } catch (ex) {
+            port.postMessage(event.data.substr(5) + ": " + ex);
+        }
+    }
+    else
+        port.postMessage("FAILURE: Received unknown message: " + event.data);
+}
diff --git a/test/fixtures/wpt/workers/support/SharedWorker-create-common.js b/test/fixtures/wpt/workers/support/SharedWorker-create-common.js
new file mode 100644
index 000000000000..1d06174f12d8
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/SharedWorker-create-common.js
@@ -0,0 +1,8 @@
+// Make a SharedWorker that has the same external interface as a DedicatedWorker, to use in shared test code.
+function createWorker()
+{
+    var worker = new SharedWorker('support/SharedWorker-common.js', 'name');
+    worker.port.onmessage = function(evt) { worker.onmessage(evt); };
+    worker.postMessage = function(msg, port) { worker.port.postMessage(msg, port); };
+    return worker;
+}
diff --git a/test/fixtures/wpt/workers/support/SharedWorker-script-error.js b/test/fixtures/wpt/workers/support/SharedWorker-script-error.js
new file mode 100644
index 000000000000..0e78949d97bd
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/SharedWorker-script-error.js
@@ -0,0 +1,22 @@
+onconnect = function(event) {
+    event.ports[0].onmessage = function(evt) { handleMessage(evt, event.ports[0]); };
+};
+
+function handleMessage(event, port) {
+    if (event.data == "unhandledError") {
+        // Generate an unhandled error.
+        onerror = null;
+        setTimeout(function() {
+            port.postMessage("SUCCESS: unhandled error generated");
+        }, 100);
+        generateError();  // Undefined function call
+    } else if (event.data == "handledError") {
+        onerror = function() {
+            port.postMessage("SUCCESS: error handled via onerror");
+            return true;
+        };
+        generateError();  // Undefined function call
+    } else {
+        port.postMessage("FAIL: Got unexpected message: " + event.data);
+    }
+};
diff --git a/test/fixtures/wpt/workers/support/Timer.js b/test/fixtures/wpt/workers/support/Timer.js
new file mode 100644
index 000000000000..a86a224dbb41
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Timer.js
@@ -0,0 +1,50 @@
+var count = 0;
+var id;
+
+onmessage = function(evt)
+{
+    try
+    {
+        switch(evt.data)
+        {
+            case "TimeoutHandler":
+                count = 0;
+                id = setTimeout("TimeoutHandler()", 10);
+                postMessage('hello');
+                break;
+            case "IntervalHandler":
+                count = 0;
+                id = setInterval("IntervalHandler()", 10);
+                postMessage('hello');
+                break;
+        }
+    }
+    catch(ex)
+    {
+        postMessage("Fail");
+    }
+}
+
+function TimeoutHandler()
+{
+    count++;
+    postMessage("worker");
+
+    id = setTimeout("TimeoutHandler()", 10);
+
+    if (count >= 2)
+    {
+        clearTimeout(id);
+    }
+}
+
+function IntervalHandler()
+{
+    count++;
+    postMessage("worker");
+
+    if (count >= 2)
+    {
+        clearInterval(id);
+    }
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-common.js b/test/fixtures/wpt/workers/support/Worker-common.js
new file mode 100644
index 000000000000..55188fe913c5
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-common.js
@@ -0,0 +1,16 @@
+onmessage = function(evt)
+{
+    if (evt.data == "ping")
+        postMessage("pong");
+    else if (evt.data == "freeze")
+        while (1) {}
+    else if (evt.data == "close")
+        close();
+    else if (/eval.+/.test(evt.data)) {
+        try {
+            postMessage(evt.data.substr(5) + ": " + eval(evt.data.substr(5)));
+        } catch (ex) {
+            postMessage(evt.data.substr(5) + ": " + ex);
+        }
+    }
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-create-common.js b/test/fixtures/wpt/workers/support/Worker-create-common.js
new file mode 100644
index 000000000000..f0b8efe46bd8
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-create-common.js
@@ -0,0 +1,4 @@
+function createWorker()
+{
+    return new Worker('support/Worker-common.js');
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-creation-happens-in-parallel.js b/test/fixtures/wpt/workers/support/Worker-creation-happens-in-parallel.js
new file mode 100644
index 000000000000..1e68302a0fc4
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-creation-happens-in-parallel.js
@@ -0,0 +1,3 @@
+onmessage = (e) => {
+  e.data[0] = 1;
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-creation-happens-in-parallel.js.headers b/test/fixtures/wpt/workers/support/Worker-creation-happens-in-parallel.js.headers
new file mode 100644
index 000000000000..8249c49c340f
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-creation-happens-in-parallel.js.headers
@@ -0,0 +1 @@
+Cross-Origin-Embedder-Policy:require-corp
diff --git a/test/fixtures/wpt/workers/support/Worker-messageport.js b/test/fixtures/wpt/workers/support/Worker-messageport.js
new file mode 100644
index 000000000000..1e01b0a52b58
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-messageport.js
@@ -0,0 +1,40 @@
+onmessage = function(evt) {
+    if (evt.data == "port") {
+        if (evt.ports) {
+            postMessage("PASS: Received message port");
+            evt.ports[0].onmessage = pingBack;
+            evt.ports[0].start();
+        } else {
+            postMessage("FAIL: Did not receive expected MessagePort");
+        }
+    } else if (evt.data == "noport") {
+        if (!evt.ports || evt.ports.length) {
+            postMessage("FAIL: Received message port or null ports array");
+        } else {
+            postMessage("PASS: evt.ports = [] as expected");
+        }
+    } else if (evt.data == "spam") {
+        for (var i = 0 ; i < 1000 ; i++) {
+            evt.ports[0].postMessage(i);
+        }
+        postMessage("spamDone");
+    } else if (evt.data == "getport") {
+        var channel = new MessageChannel();
+        postMessage("port", [channel.port1]);
+        channel.port2.onmessage = pingBack;
+        channel.port2.start();
+    } else {
+        postMessage("Unknown message:" + evt.data);
+    }
+
+}
+
+function pingBack(evt) {
+    // Make sure we got the expected data and send a return message over
+    // the port.
+    if (evt.data == "ping") {
+        evt.target.postMessage("pong");
+    } else {
+        postMessage("FAIL: unknown message: " + evt.data);
+    }
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-postMessage-happens-in-parallel.js b/test/fixtures/wpt/workers/support/Worker-postMessage-happens-in-parallel.js
new file mode 100644
index 000000000000..48b4c34fe3a6
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-postMessage-happens-in-parallel.js
@@ -0,0 +1,7 @@
+onmessage = (e) => {
+  if (e.data == 'init') {
+    postMessage(0);
+  } else {
+    e.data[0] = 1;
+  }
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-postMessage-happens-in-parallel.js.headers b/test/fixtures/wpt/workers/support/Worker-postMessage-happens-in-parallel.js.headers
new file mode 100644
index 000000000000..8249c49c340f
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-postMessage-happens-in-parallel.js.headers
@@ -0,0 +1 @@
+Cross-Origin-Embedder-Policy:require-corp
diff --git a/test/fixtures/wpt/workers/support/Worker-run-forever-during-dynamic-import.js b/test/fixtures/wpt/workers/support/Worker-run-forever-during-dynamic-import.js
new file mode 100644
index 000000000000..62840bd5b4ff
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-run-forever-during-dynamic-import.js
@@ -0,0 +1,3 @@
+import('./Worker-run-forever.js')
+  .then(r => postMessage('resolved: ' + r))
+  .catch(e => postMessage('rejected: ' + e));
diff --git a/test/fixtures/wpt/workers/support/Worker-run-forever-during-importScripts.js b/test/fixtures/wpt/workers/support/Worker-run-forever-during-importScripts.js
new file mode 100644
index 000000000000..6a3083f38215
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-run-forever-during-importScripts.js
@@ -0,0 +1,4 @@
+importScripts('Worker-run-forever.js');
+
+// This is not expected to run.
+postMessage('after importScripts()');
diff --git a/test/fixtures/wpt/workers/support/Worker-run-forever-during-nested-importScripts.js b/test/fixtures/wpt/workers/support/Worker-run-forever-during-nested-importScripts.js
new file mode 100644
index 000000000000..aae86a0b0553
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-run-forever-during-nested-importScripts.js
@@ -0,0 +1 @@
+importScripts('Worker-run-forever-during-importScripts.js');
diff --git a/test/fixtures/wpt/workers/support/Worker-run-forever-during-top-level-await.js b/test/fixtures/wpt/workers/support/Worker-run-forever-during-top-level-await.js
new file mode 100644
index 000000000000..a1c8b32b6197
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-run-forever-during-top-level-await.js
@@ -0,0 +1,4 @@
+await 1;
+postMessage('start');
+onerror = () => postMessage('onerror');
+while(1);
diff --git a/test/fixtures/wpt/workers/support/Worker-run-forever.js b/test/fixtures/wpt/workers/support/Worker-run-forever.js
new file mode 100644
index 000000000000..2d822d407f4c
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-run-forever.js
@@ -0,0 +1,3 @@
+postMessage('start');
+onerror = () => postMessage('onerror');
+while(1);
diff --git a/test/fixtures/wpt/workers/support/Worker-structure-message.js b/test/fixtures/wpt/workers/support/Worker-structure-message.js
new file mode 100644
index 000000000000..81cd98243b4d
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-structure-message.js
@@ -0,0 +1,15 @@
+self.onmessage = function(evt) {
+    if (evt.data.operation == 'find-edges' &&
+        ArrayBuffer.prototype.isPrototypeOf(evt.data.input) &&
+        evt.data.input.byteLength == 20 &&
+        evt.data.threshold == 0.6) {
+        self.postMessage("PASS: Worker receives correct structure message.");
+        self.postMessage({
+            operation: evt.data.operation,
+            input: evt.data.input,
+            threshold: evt.data.threshold
+        });
+    }
+    else
+        self.postMessage("FAIL: Worker receives error structure message.");
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-termination-with-port-messages.js b/test/fixtures/wpt/workers/support/Worker-termination-with-port-messages.js
new file mode 100644
index 000000000000..a827db357e23
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-termination-with-port-messages.js
@@ -0,0 +1,10 @@
+function echo(evt)
+{
+    evt.target.postMessage(evt.data);
+}
+
+onmessage = function(evt)
+{
+    evt.ports[0].onmessage = echo;
+    evt.ports[0].start();
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-thread-multi-port.js b/test/fixtures/wpt/workers/support/Worker-thread-multi-port.js
new file mode 100644
index 000000000000..2ce7cae596b5
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-thread-multi-port.js
@@ -0,0 +1,43 @@
+onmessage = function(event) {
+  if (event.data == "noport") {
+    if (event.ports && !event.ports.length)
+      testPassed("event.ports is non-null and zero length when no port sent");
+    else
+      testFailed("event.ports is null or non-zero length when no port sent");
+  } else if (event.data == "zero ports") {
+    if (event.ports && !event.ports.length)
+      testPassed("event.ports is non-null and zero length when empty array sent");
+    else
+      testFailed("event.ports is null or non-zero length when empty array sent");
+  } else if (event.data == "two ports") {
+    if (!event.ports) {
+      testFailed("event.ports should be non-null when ports sent");
+      return;
+    }
+    if (event.ports.length == 2)
+      testPassed("event.ports contains two ports when two ports sent");
+    else
+      testFailed("event.ports contained " + event.ports.length + " when two ports sent");
+  } else if (event.data == "failed ports") {
+    if (event.ports.length == 2)
+      testPassed("event.ports contains two ports when two ports re-sent after error");
+    else
+      testFailed("event.ports contained " + event.ports.length + " when two ports re-sent after error");
+  } else if (event.data == "noargs") {
+    try {
+      postMessage();
+      testFailed("postMessage() did not throw");
+    } catch (e) {
+      testPassed("postMessage() threw exception: " + e);
+    }
+  } else
+    testFailed("Received unexpected message: " + event.data);
+};
+
+function testPassed(msg) {
+  postMessage("PASS"+msg);
+}
+
+function testFailed(msg) {
+  postMessage("FAIL"+msg);
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-timeout-cancel-order.js b/test/fixtures/wpt/workers/support/Worker-timeout-cancel-order.js
new file mode 100644
index 000000000000..afc66cf6a0b4
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-timeout-cancel-order.js
@@ -0,0 +1,7 @@
+// The test will create 2 timeouts and cancel the first one. If only the second
+// timeout executes then the test passes.
+self.addEventListener('message', function(e) {
+    var t1 = setTimeout(function () { postMessage(1); }, 5);
+    setTimeout(function () { postMessage(2); }, 10);
+    clearTimeout(t1);
+}, false);
diff --git a/test/fixtures/wpt/workers/support/Worker-timeout-decreasing-order.js b/test/fixtures/wpt/workers/support/Worker-timeout-decreasing-order.js
new file mode 100644
index 000000000000..b93dd5dc771a
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-timeout-decreasing-order.js
@@ -0,0 +1,7 @@
+// The test will create 3 timeouts with their intervals decreasing.
+// If the timeouts execute in order then the test is PASS.
+self.addEventListener('message', function(e) {
+    setTimeout(function () { postMessage(3); }, 15);
+    setTimeout(function () { postMessage(2); }, 10);
+    setTimeout(function () { postMessage(1); }, 5);
+}, false);
diff --git a/test/fixtures/wpt/workers/support/Worker-timeout-increasing-order.js b/test/fixtures/wpt/workers/support/Worker-timeout-increasing-order.js
new file mode 100644
index 000000000000..42f81daa29c0
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-timeout-increasing-order.js
@@ -0,0 +1,7 @@
+// The test will create 3 timeouts with their intervals increasing.
+// If the timeouts execute in order then the test is PASS.
+self.addEventListener('message', function(e) {
+    setTimeout(function () { postMessage(1); }, 5);
+    setTimeout(function () { postMessage(2); }, 10);
+    setTimeout(function () { postMessage(3); }, 15);
+}, false);
diff --git a/test/fixtures/wpt/workers/support/WorkerBasic.js b/test/fixtures/wpt/workers/support/WorkerBasic.js
new file mode 100644
index 000000000000..6bb6d32b1419
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerBasic.js
@@ -0,0 +1,7 @@
+var result = "Fail";
+
+onmessage = function(evt)
+{
+    result = "Pass";
+    postMessage(result);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/support/WorkerClose.js b/test/fixtures/wpt/workers/support/WorkerClose.js
new file mode 100644
index 000000000000..81f99993d81e
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerClose.js
@@ -0,0 +1,5 @@
+onmessage = function(evt)
+{
+    postMessage(evt.data);
+    self.close();
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/support/WorkerDataCloneErr.js b/test/fixtures/wpt/workers/support/WorkerDataCloneErr.js
new file mode 100644
index 000000000000..b7e8b0ae1676
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerDataCloneErr.js
@@ -0,0 +1,15 @@
+var result = "Fail";
+
+try
+{
+    postMessage(navigator);
+}
+catch(ex)
+{
+    if(ex.code != null && ex.code == ex.DATA_CLONE_ERR)
+    {
+        result = "Pass";
+    }
+}
+
+postMessage(result);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/support/WorkerFetchURL.js b/test/fixtures/wpt/workers/support/WorkerFetchURL.js
new file mode 100644
index 000000000000..4ad700bcce46
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerFetchURL.js
@@ -0,0 +1,8 @@
+onconnect = e => {
+  let port = e.ports[0];
+  port.onmessage = (e) => {
+    fetch(e.data)
+    .then(response => response.text())
+    .then(text => port.postMessage('Worker reply:' + text));
+  };
+}
diff --git a/test/fixtures/wpt/workers/support/WorkerGlobalScope-close.js b/test/fixtures/wpt/workers/support/WorkerGlobalScope-close.js
new file mode 100644
index 000000000000..e2b1c0a2fddf
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerGlobalScope-close.js
@@ -0,0 +1,43 @@
+// Check to see if the worker handles pending events. Messages after close() will not be sent to the parent page, so we use exceptions instead to report failures after close().
+onmessage = function(evt)
+{
+    if (evt.data == "closeWithPendingEvents") {
+        // Set a timer to generate an event - minimum timeout is 1ms.
+        setTimeout(function() {
+                postMessage("pending event processed");
+                throw "should not be executed";
+            }, 1);
+        var start = new Date().getTime();
+        // Loop for 10 ms so the timer is ready to fire
+        while (new Date().getTime() - start < 100)
+            ;
+        // Now close - timer should not fire
+        close();
+    } else if (evt.data == "typeofClose") {
+        postMessage("typeof close: " + (typeof close));
+    } else if (evt.data == "close") {
+        close();
+        postMessage("Should be delivered");
+    } else if (evt.data == "ping") {
+        postMessage("pong");
+    } else if (evt.data == "throw") {
+        throw "should never be executed";
+    } else if (evt.data == "closeWithError") {
+        close();
+        nonExistentFunction();  // Undefined function - throws exception
+    } else if (evt.data == "close_post_loop") {
+        close();
+        postMessage("closed");
+        while(true) {} // Should loop forever.
+    } else if (evt.data == "take_port") {
+        messagePort = evt.ports[0];
+        messagePort.onmessage = function(event) {
+            close();
+            postMessage("echo_" + event.data);
+        }
+    } else if (evt.data == "start_port") {
+        messagePort.start();
+    } else {
+        postMessage("FAIL: Unknown message type: " + evt.data);
+    }
+}
diff --git a/test/fixtures/wpt/workers/support/WorkerLocation-origin.html b/test/fixtures/wpt/workers/support/WorkerLocation-origin.html
new file mode 100644
index 000000000000..3d948030a79e
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerLocation-origin.html
@@ -0,0 +1,6 @@
+<script>
+const w = new Worker("./WorkerLocation.js");
+w.onmessage = e => {
+  parent.postMessage(e.data, "*");
+}
+</script>
diff --git a/test/fixtures/wpt/workers/support/WorkerLocation.js b/test/fixtures/wpt/workers/support/WorkerLocation.js
new file mode 100644
index 000000000000..901e21542a05
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerLocation.js
@@ -0,0 +1,13 @@
+var obj = new Object();
+obj.location = location.toString();
+obj.href     = location.href;
+obj.origin   = location.origin;
+obj.protocol = location.protocol;
+obj.host     = location.host;
+obj.hostname = location.hostname;
+obj.port     = location.port;
+obj.pathname = location.pathname;
+obj.search   = location.search;
+obj.hash     = location.hash;
+
+postMessage(obj);
diff --git a/test/fixtures/wpt/workers/support/WorkerNavigator.js b/test/fixtures/wpt/workers/support/WorkerNavigator.js
new file mode 100644
index 000000000000..4258384ac444
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerNavigator.js
@@ -0,0 +1,27 @@
+(async () => {
+  const obj = new Object();
+  obj.appName    = navigator.appName;
+  obj.appVersion = navigator.appVersion;
+  obj.platform   = navigator.platform;
+  obj.userAgent  = navigator.userAgent;
+  obj.onLine     = navigator.onLine;
+  if (navigator.userAgentData) {
+    obj.brands = navigator.userAgentData.brands;
+    obj.mobile = navigator.userAgentData.mobile;
+    obj.platform = navigator.userAgentData.platform;
+    const highEntropyValues = await navigator.userAgentData.getHighEntropyValues([
+      "architecture", "bitness", "fullVersionList", "model",
+      "platformVersion", "uaFullVersion", "wow64", "formFactors",
+    ]);
+    obj.architecture = highEntropyValues.architecture;
+    obj.bitness = highEntropyValues.bitness;
+    obj.fullVersionList = highEntropyValues.fullVersionList;
+    obj.model = highEntropyValues.model;
+    obj.platformVersion = highEntropyValues.platformVersion;
+    obj.uaFullVersion = highEntropyValues.uaFullVersion;
+    obj.wow64 = highEntropyValues.wow64;
+    obj.formFactors = highEntropyValues.formFactors;
+    obj.NavigatorUADataExposed = (typeof self.NavigatorUAData != "undefined");
+  }
+  postMessage(obj);
+})();
diff --git a/test/fixtures/wpt/workers/support/WorkerSendingPerformanceNow.js b/test/fixtures/wpt/workers/support/WorkerSendingPerformanceNow.js
new file mode 100644
index 000000000000..ac12190efe3a
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerSendingPerformanceNow.js
@@ -0,0 +1,22 @@
+function calcResponse() {
+  const response = [
+    typeof(workerStart),
+    typeof(performance),
+    typeof(performance.now),
+    performance.now()
+  ];
+  return response;
+}
+
+self.onmessage = function(event) {
+  postMessage(calcResponse());
+  self.close();
+}
+
+self.addEventListener("connect", function(event) {
+  const port = event.ports[0];
+  port.onmessage = function(event) {
+    port.postMessage(calcResponse());
+    port.close();
+  };
+});
diff --git a/test/fixtures/wpt/workers/support/WorkerTerminate.js b/test/fixtures/wpt/workers/support/WorkerTerminate.js
new file mode 100644
index 000000000000..7c99e7ec5605
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerTerminate.js
@@ -0,0 +1,10 @@
+onmessage = function(evt)
+{
+    for (var i=0; true; i++)
+    {
+        if (i%1000 == 0)
+        {
+            postMessage(i);
+        }
+    }
+}
diff --git a/test/fixtures/wpt/workers/support/WorkerText.txt b/test/fixtures/wpt/workers/support/WorkerText.txt
new file mode 100644
index 000000000000..e4eeb5391da6
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerText.txt
@@ -0,0 +1,2 @@
+var result = "Pass";
+postMessage(result);
diff --git a/test/fixtures/wpt/workers/support/abrupt-completion.js b/test/fixtures/wpt/workers/support/abrupt-completion.js
new file mode 100644
index 000000000000..f0884cc1d26a
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/abrupt-completion.js
@@ -0,0 +1,21 @@
+const isSharedWorker =
+  "SharedWorkerGlobalScope" in self && self instanceof SharedWorkerGlobalScope;
+
+function setMessageHandler(response) {
+  onmessage = e => {
+    e.ports[0].postMessage(response);
+  };
+
+  if (isSharedWorker) {
+    onconnect = e => {
+      e.ports[0].onmessage = onmessage;
+    };
+  }
+}
+
+setMessageHandler("handler-before-throw");
+
+throw new Error("uncaught-exception");
+
+// This should never be called because of the uncaught exception above.
+setMessageHandler("handler-after-throw");
diff --git a/test/fixtures/wpt/workers/support/check-error-arguments.js b/test/fixtures/wpt/workers/support/check-error-arguments.js
new file mode 100644
index 000000000000..64441f9225ec
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/check-error-arguments.js
@@ -0,0 +1,4 @@
+window.checkErrorArguments = args => {
+  assert_equals(args.length, 1);
+  assert_equals(args[0].constructor, Event);
+};
diff --git a/test/fixtures/wpt/workers/support/empty-worker.js b/test/fixtures/wpt/workers/support/empty-worker.js
new file mode 100644
index 000000000000..49ceb2648a93
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/empty-worker.js
@@ -0,0 +1 @@
+// Do nothing.
diff --git a/test/fixtures/wpt/workers/support/eval-syntax-error.js b/test/fixtures/wpt/workers/support/eval-syntax-error.js
new file mode 100644
index 000000000000..0c1610aa4037
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/eval-syntax-error.js
@@ -0,0 +1 @@
+eval('1 + ;');
diff --git a/test/fixtures/wpt/workers/support/iframe-sw-shared-name.html b/test/fixtures/wpt/workers/support/iframe-sw-shared-name.html
new file mode 100644
index 000000000000..c1c7a536e13e
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/iframe-sw-shared-name.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<title>Iframe for cross-origin Shared Worker</title>
+<script src="/common/get-host-info.sub.js"></script>
+
+<body>
+<script>
+
+const worker_url = new URL(
+  'shared-name.js',
+  get_host_info().ORIGIN + self.location.pathname);
+
+let worker = new SharedWorker(worker_url);
+worker.port.onmessage = e => {
+  parent.postMessage(e.data, '*');
+}
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/workers/support/iframe_sw_dataUrl.html b/test/fixtures/wpt/workers/support/iframe_sw_dataUrl.html
new file mode 100644
index 000000000000..0fb0ec228079
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/iframe_sw_dataUrl.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title>Iframe for Shared Worker: Data URL cross-origin checks</title>
+<body>
+<script>
+
+let worker = new SharedWorker('data:text/javascript,let conns=0; onconnect = e => { e.ports[0].postMessage(++conns); }');
+worker.port.onmessage = e => {
+  parent.postMessage(e.data, '*');
+}
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/workers/support/importScripts-1.js b/test/fixtures/wpt/workers/support/importScripts-1.js
new file mode 100644
index 000000000000..8869a4fbcafc
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/importScripts-1.js
@@ -0,0 +1 @@
+importScripts("importScripts-2.js");
diff --git a/test/fixtures/wpt/workers/support/importScripts-2.js b/test/fixtures/wpt/workers/support/importScripts-2.js
new file mode 100644
index 000000000000..7f3f1116e76c
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/importScripts-2.js
@@ -0,0 +1 @@
+importScripts("importScripts-3.js");
diff --git a/test/fixtures/wpt/workers/support/importScripts-3.js b/test/fixtures/wpt/workers/support/importScripts-3.js
new file mode 100644
index 000000000000..2d103a0411fe
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/importScripts-3.js
@@ -0,0 +1 @@
+importScripts("invalidScript.js");
diff --git a/test/fixtures/wpt/workers/support/invalidScript.js b/test/fixtures/wpt/workers/support/invalidScript.js
new file mode 100644
index 000000000000..8655d4d1f18c
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/invalidScript.js
@@ -0,0 +1 @@
+SELECT * FROM TABLE; // an invalid script.
diff --git a/test/fixtures/wpt/workers/support/json-parse-error.js b/test/fixtures/wpt/workers/support/json-parse-error.js
new file mode 100644
index 000000000000..ac0c175e21b3
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/json-parse-error.js
@@ -0,0 +1 @@
+JSON.parse('!');
diff --git a/test/fixtures/wpt/workers/support/name-as-accidental-global.js b/test/fixtures/wpt/workers/support/name-as-accidental-global.js
new file mode 100644
index 000000000000..f2c39ea715aa
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/name-as-accidental-global.js
@@ -0,0 +1,9 @@
+"use strict";
+importScripts("/resources/testharness.js");
+
+var name = "something else";
+
+// This just makes the test name not "Untitled"
+test(() => { }, `Declaring name as an accidental global must not cause a harness error for ${self.constructor.name}`);
+
+done();
diff --git a/test/fixtures/wpt/workers/support/name.js b/test/fixtures/wpt/workers/support/name.js
new file mode 100644
index 000000000000..970578e425a3
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/name.js
@@ -0,0 +1,18 @@
+"use strict";
+importScripts("/resources/testharness.js");
+
+test(() => {
+  assert_true(self.hasOwnProperty("name"), "property exists on the global");
+  assert_equals(self.name, "my name");
+}, `name property value for ${self.constructor.name}`);
+
+test(() => {
+  self.name = "something new";
+  const propDesc = Object.getOwnPropertyDescriptor(self, "name");
+  assert_equals(propDesc.value, "something new", "value");
+  assert_true(propDesc.configurable, "configurable");
+  assert_true(propDesc.writable, "writable");
+  assert_true(propDesc.enumerable, "enumerable");
+}, `name property is replaceable for ${self.constructor.name}`);
+
+done();
diff --git a/test/fixtures/wpt/workers/support/parent_of_nested_worker.js b/test/fixtures/wpt/workers/support/parent_of_nested_worker.js
new file mode 100644
index 000000000000..1f14334290a3
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/parent_of_nested_worker.js
@@ -0,0 +1,14 @@
+try {
+  var worker = new Worker("WorkerBasic.js");
+  worker.onmessage = function(e) {
+    if (e.data == "Pass") {
+      postMessage("Pass");
+    } else if (e.data == "close") {
+      close();
+      postMessage("Pass");
+    }
+  };
+  worker.postMessage("start");
+} catch (e) {
+  postMessage("Fail: " + e);
+}
diff --git a/test/fixtures/wpt/workers/support/post-message-on-load-worker.js b/test/fixtures/wpt/workers/support/post-message-on-load-worker.js
new file mode 100644
index 000000000000..e1c547ab6a4d
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/post-message-on-load-worker.js
@@ -0,0 +1,10 @@
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  postMessage('LOADED');
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage('LOADED');
+  };
+}
diff --git a/test/fixtures/wpt/workers/support/postMessage_block_worker.js b/test/fixtures/wpt/workers/support/postMessage_block_worker.js
new file mode 100644
index 000000000000..0c7bcacccaf8
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/postMessage_block_worker.js
@@ -0,0 +1,2 @@
+onmessage = e => Atomics.store(e.data, 0, 1);
+postMessage('ready');
diff --git a/test/fixtures/wpt/workers/support/postMessage_block_worker.js.headers b/test/fixtures/wpt/workers/support/postMessage_block_worker.js.headers
new file mode 100644
index 000000000000..6604450991a1
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/postMessage_block_worker.js.headers
@@ -0,0 +1 @@
+Cross-Origin-Embedder-Policy: require-corp
diff --git a/test/fixtures/wpt/workers/support/sandboxed-tests.html b/test/fixtures/wpt/workers/support/sandboxed-tests.html
new file mode 100644
index 000000000000..811c925f56f1
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/sandboxed-tests.html
@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<script>
+const channel = new BroadcastChannel('echochannel');
+channel.onmessage = e => channel.postMessage(e.data);
+</script>
+<div id='workersrc' style='display:none'>
+importScripts("http://{{host}}:{{ports[http][0]}}/resources/testharness.js");
+onmessage = e => {
+  const external_blob = e.data.blob;
+  const external_blob_url = e.data.url;
+
+  test(t => {
+      assert_equals('null', self.location.origin);
+    }, 'Worker has an opaque origin.');
+
+  async_test(t => {
+      const r = new FileReader();
+      r.onloadend = t.step_func_done(e => assert_equals(r.result, 'from worker'));
+      r.readAsText(new Blob(['from worker']));
+    }, 'Worker can read its own blobs.');
+
+  async_test(t => {
+      const r = new FileReader();
+      r.onloadend = t.step_func_done(e => assert_equals(r.result, 'from page'));
+      r.readAsText(external_blob);
+    }, 'Worker can read its owners blobs.');
+
+  async_test(t => {
+      const request = new XMLHttpRequest();
+      request.open('GET', external_blob_url);
+      request.onreadystatechange = t.step_func(() => {
+          if (request.readyState == 4) {
+            assert_equals(request.responseText, 'from page');
+            t.done();
+          }
+        });
+      request.send();
+    }, 'Worker can XHR fetch a blob.');
+
+  promise_test(t =>
+      fetch(external_blob_url).then(r => r.text()).then(text => assert_equals(text, 'from page'))
+    , 'Worker can fetch a blob.');
+
+  async_test(t => {
+      const channel = new BroadcastChannel('echochannel');
+      channel.onmessage = t.step_func_done(e => assert_equals('ping', e.data));
+      channel.postMessage('ping');
+    }, 'Worker can access BroadcastChannel');
+  done();
+};
+</div>
+<script>
+// Create a worker with a blob URL to get a same opaque origin worker.
+const b = new Blob([document.getElementById('workersrc').textContent]);
+const url = URL.createObjectURL(b);
+const worker = new Worker(url);
+// Pass back any messages from the worker to our parent to collect test results.
+worker.onmessage = e => {
+  parent.postMessage(e.data, '*');
+};
+
+// Send test data to the worker.
+const b2 = new Blob(['from page']);
+const url2 = URL.createObjectURL(b2);
+worker.postMessage({url: url2, blob: b2});
+</script>
diff --git a/test/fixtures/wpt/workers/support/shared-name.js b/test/fixtures/wpt/workers/support/shared-name.js
new file mode 100644
index 000000000000..f00448271922
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/shared-name.js
@@ -0,0 +1,8 @@
+"use strict";
+
+self.counter = 0;
+
+self.onconnect = e => {
+  ++self.counter;
+  e.source.postMessage({ counter: self.counter, name: self.name });
+};
diff --git a/test/fixtures/wpt/workers/support/shared-worker-echo-cookies.js b/test/fixtures/wpt/workers/support/shared-worker-echo-cookies.js
new file mode 100644
index 000000000000..34dcbc9d260b
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/shared-worker-echo-cookies.js
@@ -0,0 +1,40 @@
+let port;
+
+self.onconnect = e => {
+  port = e.ports[0];
+  port.addEventListener('message', onMessage);
+  port.start();
+};
+
+async function onMessage(e) {
+  switch (e.data.type) {
+    case 'test_message':
+      port.postMessage({ok: true});
+      return;
+    case 'echo_cookies_http':
+      return onEchoCookiesHttp(e);
+    case 'echo_cookies_import':
+      return onEchoCookiesImport();
+    default:
+      throw new Error('Unexpected message type ' + e.data.type);
+  }
+}
+
+async function onEchoCookiesHttp(e) {
+  try {
+    const resp = await fetch(
+        `${self.origin}/cookies/resources/list.py`, {credentials: 'include'});
+    const cookies = await resp.json();
+    port.postMessage({ok: true, cookies: Object.keys(cookies)});
+  } catch (err) {
+    port.postMessage({ok: false});
+  }
+}
+
+// Sets `self._cookies` variable, array of the names of cookies available to
+// the request.
+importScripts(`${self.origin}/cookies/resources/list-cookies-for-script.py`);
+
+function onEchoCookiesImport() {
+  port.postMessage({ok: true, cookies: self._cookies});
+}
diff --git a/test/fixtures/wpt/workers/support/shared-worker-eval-syntax-error.js b/test/fixtures/wpt/workers/support/shared-worker-eval-syntax-error.js
new file mode 100644
index 000000000000..9911bf3cd526
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/shared-worker-eval-syntax-error.js
@@ -0,0 +1,9 @@
+let errorFired = false;
+onerror = () => {
+  errorFired = true;
+  return false;
+};
+onconnect = e => {
+  e.ports[0].postMessage(errorFired ? "onerror-fired" : "no-error");
+};
+eval('1 + ;');
diff --git a/test/fixtures/wpt/workers/support/shared-worker-json-parse-error.js b/test/fixtures/wpt/workers/support/shared-worker-json-parse-error.js
new file mode 100644
index 000000000000..f4bfd43e1891
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/shared-worker-json-parse-error.js
@@ -0,0 +1,9 @@
+let errorFired = false;
+onerror = () => {
+  errorFired = true;
+  return false;
+};
+onconnect = e => {
+  e.ports[0].postMessage(errorFired ? "onerror-fired" : "no-error");
+};
+JSON.parse('!');
diff --git a/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-3p-frame.html b/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-3p-frame.html
new file mode 100644
index 000000000000..45c01c8937a1
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-3p-frame.html
@@ -0,0 +1,43 @@
+<!DOCTYPE html>
+<head>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>Service Worker: Partitioned Cookies 3P Iframe</title>
+<script src="/resources/testharness.js"></script>
+<script src="shared-worker-partitioned-cookies-helper.js"></script>
+</head>
+
+<body>
+<script>
+
+promise_test(async () => {
+  const worker = new SharedWorker('./shared-worker-echo-cookies.js');
+  const next_message = worker_message_generator(worker);
+
+  worker.port.postMessage({type: 'test_message'});
+  const msg1 = await next_message();
+  assert_true(msg1.ok, 'Message passing');
+
+  worker.port.postMessage({type: 'echo_cookies_http'});
+  const msg2 = await next_message();
+  assert_true(msg2.ok, 'Get cookies');
+  assert_false(
+      msg2.cookies.includes('__Host-partitioned'),
+      'Cannot access partitioned cookie via HTTP');
+  assert_true(
+      msg2.cookies.includes('unpartitioned'),
+      'Can access unpartitioned cookie via HTTP');
+
+  worker.port.postMessage({type: 'echo_cookies_import'});
+  const msg3 = await next_message();
+  assert_true(msg3.ok, 'Get cookies');
+  assert_false(
+      msg3.cookies.includes('__Host-partitioned'),
+      'Cannot access partitioned cookie via importScripts');
+  assert_true(
+      msg3.cookies.includes('unpartitioned'),
+      'Can access unpartitioned cookie via importScripts');
+});
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-3p-window.html b/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-3p-window.html
new file mode 100644
index 000000000000..e37e0a2cc6b6
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-3p-window.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<head>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>SharedWorker: Partitioned Cookies 3P Window</title>
+<script src="/resources/testharness.js"></script>
+</head>
+
+<body>
+<script>
+
+promise_test(async t => {
+  assert_true(
+      location.search.includes('origin='), 'First party origin passed');
+  const first_party_origin =
+      new URLSearchParams(window.location.search).get('origin');
+  const iframe = document.createElement('iframe');
+  iframe.src = new URL(
+      './shared-worker-partitioned-cookies-3p-frame.html',
+      first_party_origin + location.pathname).href;
+  document.body.appendChild(iframe);
+  await fetch_tests_from_window(iframe.contentWindow);
+});
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-helper.js b/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-helper.js
new file mode 100644
index 000000000000..e54d3848ae13
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-helper.js
@@ -0,0 +1,28 @@
+// Return a generator containing the worker's message.
+//
+// Usage:
+//   const worker = new SharedWorker(...);
+//   const nextMessage = worker_message_generator(worker);
+//   const msg_1 = await nextMessage();
+//   const msg_2 = await nextMessage();
+//   const msg_3 = await nextMessage();
+function worker_message_generator(shared_worker) {
+  const buffer = [];
+  let resolve = null;
+
+  shared_worker.port.onmessage = message => {
+    buffer.push(message.data);
+    if (resolve) {
+      resolve();
+    }
+  }
+  shared_worker.port.start();
+
+  return async function() {
+    if (buffer.length != 0) {
+      return buffer.shift();
+    }
+    await new Promise(r => resolve = r);
+    return buffer.shift();
+  }
+}
diff --git a/test/fixtures/wpt/workers/support/sync_xhr.js b/test/fixtures/wpt/workers/support/sync_xhr.js
new file mode 100644
index 000000000000..5de747653738
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/sync_xhr.js
@@ -0,0 +1,13 @@
+try
+{
+  const request = new XMLHttpRequest();
+  request.open("GET", "sync_xhr_target.xml", false);
+  request.send();
+  result = request.responseText == "<foo>sometext</foo>\n" ? "Pass" : "Fail";
+  postMessage(result);
+}
+catch(ex)
+{
+  result = "Fail";
+  postMessage(result);
+}
diff --git a/test/fixtures/wpt/workers/support/sync_xhr_target.xml b/test/fixtures/wpt/workers/support/sync_xhr_target.xml
new file mode 100644
index 000000000000..d31a8c5eb463
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/sync_xhr_target.xml
@@ -0,0 +1 @@
+<foo>sometext</foo>
diff --git a/test/fixtures/wpt/workers/support/throw-on-message-Worker.js b/test/fixtures/wpt/workers/support/throw-on-message-Worker.js
new file mode 100644
index 000000000000..3648f1f47853
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/throw-on-message-Worker.js
@@ -0,0 +1,11 @@
+self.onerror = function(evt) {
+  postMessage('error');
+  return true;
+}
+
+self.onmessage = function(evt) {
+    if (evt.data === "first")
+        throw Error();
+    else
+        postMessage(evt.data);
+}
diff --git a/test/fixtures/wpt/workers/support/window-sw-shared-name.html b/test/fixtures/wpt/workers/support/window-sw-shared-name.html
new file mode 100644
index 000000000000..4a0704f9e4be
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/window-sw-shared-name.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<title>Window for cross-origin iframe with Shared Worker</title>
+<script src="/common/get-host-info.sub.js"></script>
+
+<body>
+<script>
+
+const iframe_url = new URL(
+  'iframe-sw-shared-name.html',
+    get_host_info().ORIGIN + self.location.pathname);
+
+
+window.onmessage = (e) => {window.opener.postMessage(e.data, '*')};
+
+var frame = document.createElement('iframe');
+frame.src = iframe_url;
+frame.style.position = 'absolute';
+document.body.appendChild(frame);
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/workers/support/worker-request-animation-frame.js b/test/fixtures/wpt/workers/support/worker-request-animation-frame.js
new file mode 100644
index 000000000000..b73781244ebd
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/worker-request-animation-frame.js
@@ -0,0 +1,6 @@
+self.onmessage = function(event) {
+  requestAnimationFrame(time => {
+    postMessage(time);
+    self.close();
+  });
+}
diff --git a/test/fixtures/wpt/workers/worker-performance.worker.js b/test/fixtures/wpt/workers/worker-performance.worker.js
new file mode 100644
index 000000000000..c913b2e73750
--- /dev/null
+++ b/test/fixtures/wpt/workers/worker-performance.worker.js
@@ -0,0 +1,129 @@
+"use strict";
+
+// Tests that most of the functionality of the window.performance object is available in web workers.
+
+importScripts("/resources/testharness.js");
+
+function verifyEntry (entry, name, type, duration, assertName) {
+    assert_equals(entry.name, name, assertName + " has the right name");
+    assert_equals(entry.entryType, type, assertName + " has the right type");
+    assert_equals(entry.duration, duration, assertName + "has the right duration");
+}
+
+var start;
+test(function testPerformanceNow () {
+    start = performance.now();
+}, "Can use performance.now in workers");
+
+test(function testPerformanceMark () {
+    while (performance.now() == start) { }
+    performance.mark("mark1");
+     // Stall the minimum amount of time to ensure the marks are separate
+    var now = performance.now();
+    while (performance.now() == now) { }
+    performance.mark("mark2");
+}, "Can use performance.mark in workers");
+
+test(function testPerformanceMeasure () {
+    performance.measure("measure1", "mark1", "mark2");
+}, "Can use performance.measure in workers");
+
+test(function testPerformanceGetEntriesByName () {
+    var mark1s = performance.getEntriesByName("mark1");
+    assert_equals(mark1s.length, 1, "getEntriesByName gave correct number of entries");
+    verifyEntry(mark1s[0], "mark1", "mark", 0, "Entry got by name");
+}, "Can use performance.getEntriesByName in workers");
+
+var marks;
+var measures;
+test(function testPerformanceGetEntriesByType () {
+    marks = performance.getEntriesByType("mark");
+    assert_equals(marks.length, 2, "getEntriesByType gave correct number of entries");
+    verifyEntry(marks[0], "mark1", "mark", 0, "First mark entry");
+    verifyEntry(marks[1], "mark2", "mark", 0, "Second mark entry");
+    measures = performance.getEntriesByType("measure");
+    assert_equals(measures.length, 1, "getEntriesByType(\"measure\") gave correct number of entries");
+    verifyEntry(measures[0], "measure1", "measure", marks[1].startTime - marks[0].startTime, "Measure entry");
+}, "Can use performance.getEntriesByType in workers");
+
+test(function testPerformanceEntryOrder () {
+    assert_greater_than(marks[0].startTime, start, "First mark startTime is after a time before it");
+    assert_greater_than(marks[1].startTime, marks[0].startTime, "Second mark startTime is after first mark startTime");
+    assert_equals(measures[0].startTime, marks[0].startTime, "measure's startTime is the first mark's startTime");
+}, "Performance marks and measures seem to be working correctly in workers");
+
+test(function testPerformanceClearing () {
+    performance.clearMarks();
+    assert_equals(performance.getEntriesByType("mark").length, 0, "clearMarks cleared the marks");
+    performance.clearMeasures();
+    assert_equals(performance.getEntriesByType("measure").length, 0, "clearMeasures cleared the measures");
+}, "Can use clearMarks and clearMeasures in workers");
+
+test(function testPerformanceResourceTiming () {  // Resource timing
+    var start = performance.now();
+    var xhr = new XMLHttpRequest();
+     // Do a synchronous request and add a little artificial delay
+    xhr.open("GET", "/resources/testharness.js?pipe=trickle(d0.25)", false);
+    xhr.send();
+     // The browser might or might not have added a resource performance entry for the importScripts() above; we're only interested in xmlhttprequest entries
+    var entries = performance.getEntriesByType("resource").filter(entry => entry.initiatorType == "xmlhttprequest");
+    assert_equals(entries.length, 1, "getEntriesByType(\"resource\") returns one entry with initiatorType of xmlhttprequest");
+    assert_true(!!entries[0].name.match(/\/resources\/testharness.js/), "Resource entry has loaded url as its name");
+    assert_equals(entries[0].entryType, "resource", "Resource entry has correct entryType");
+    assert_equals(entries[0].initiatorType, "xmlhttprequest", "Resource entry has correct initiatorType");
+    var currentTimestamp = start;
+    var currentTimestampName = "a time before it";
+    [
+        "startTime", "fetchStart", "requestStart", "responseStart", "responseEnd"
+    ].forEach((name) => {
+        var timestamp = entries[0][name];
+        // We want to skip over values that are 0 because of TAO securty rescritions
+        // Or else this test will fail. This can happen for "requestStart", "responseStart".
+        if (timestamp != 0) {
+            assert_greater_than_equal(timestamp, currentTimestamp, "Resource entry " + name + " is after " + currentTimestampName);
+            currentTimestamp = timestamp;
+            currentTimestampName = name;
+        }
+    });
+    assert_greater_than(entries[0].responseEnd, entries[0].startTime, "The resource request should have taken at least some time");
+     // We requested a delay of 250ms, but it could be a little bit less, and could be significantly more.
+    assert_greater_than(entries[0].responseEnd - entries[0].responseStart, 230, "Resource timing numbers reflect reality somewhat");
+}, "Resource timing seems to work in workers");
+
+test(function testPerformanceClearResourceTimings () {
+    performance.clearResourceTimings();
+    assert_equals(performance.getEntriesByType("resource").length, 0, "clearResourceTimings cleared the resource timings");
+}, "performance.clearResourceTimings in workers");
+
+test(function testPerformanceSetResourceTimingBufferSize () {
+    performance.setResourceTimingBufferSize(0);
+    var xhr = new XMLHttpRequest();
+    xhr.open("GET", "/resources/testharness.js", false);  // synchronous request
+    xhr.send();
+    assert_equals(performance.getEntriesByType("resource").length, 0, "setResourceTimingBufferSize(0) prevents resource entries from being added");
+}, "performance.setResourceTimingBufferSize in workers");
+
+test(function testPerformanceHasNoTiming () {
+    assert_equals(typeof(performance.timing), "undefined", "performance.timing is undefined");
+}, "performance.timing is not available in workers");
+
+test(function testPerformanceHasNoNavigation () {
+    assert_equals(typeof(performance.navigation), "undefined", "performance.navigation is undefined");
+}, "performance.navigation is not available in workers");
+
+test(function testPerformanceHasToJSON () {
+    assert_equals(typeof(performance.toJSON), "function", "performance.toJSON is a function");
+}, "performance.toJSON is available in workers");
+
+test(function testPerformanceNoNavigationEntries () {
+    assert_equals(performance.getEntriesByType("navigation").length, 0, "getEntriesByType(\"navigation\") returns nothing");
+    assert_equals(performance.getEntriesByName("document", "navigation").length, 0, "getEntriesByName(\"document\", \"navigation\") returns nothing");
+    assert_equals(performance.getEntriesByName("document").length, 0, "getEntriesByName(\"document\") returns nothing");
+    var hasNavigation = performance.getEntries().some((e,i,a) => {
+        return e.entryType == "navigation";
+    });
+    assert_false(hasNavigation, "getEntries should return no navigation entries.");
+
+}, "There are no navigation type performance entries in workers");
+
+done();
diff --git a/test/fixtures/wpt/workers/worker-request-animation-frame.html b/test/fixtures/wpt/workers/worker-request-animation-frame.html
new file mode 100644
index 000000000000..2d65bc2c4610
--- /dev/null
+++ b/test/fixtures/wpt/workers/worker-request-animation-frame.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>raf time in dedicated workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+</head>
+<body>
+<script>
+  async function waitForMessage(worker) {
+    return new Promise(resolve => {
+      worker.onmessage = event => resolve(event);
+    });
+  }
+
+  promise_test(t => {
+    const worker = new Worker('support/worker-request-animation-frame.js');
+    const message = waitForMessage(worker);
+    worker.postMessage('');
+    message.then((event) => {
+      const raf_time = event.data;
+      assert_true(performance.now() >= raf_time,
+                  'raf time cannot exceed time of page load');
+    });
+    return message;
+  }, 'requestAnimationTime reports frame time relative to worker load');
+</script>
diff --git a/test/fixtures/wpt/workers/worker-url-encoding.html b/test/fixtures/wpt/workers/worker-url-encoding.html
new file mode 100644
index 000000000000..56357a68603e
--- /dev/null
+++ b/test/fixtures/wpt/workers/worker-url-encoding.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset=windows-1252>
+<title>Worker URL is parsed using document encoding</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+  async_test(t => {
+    let worker = new Worker("resources/worker-url-encoding.js?\u00DF");
+    worker.onmessage = t.step_func(e => {
+      assert_equals(e.data, "?%DF");
+      t.done();
+    });
+  }, "Worker URL is parsed using document encoding");
+</script>
\ No newline at end of file
diff --git a/test/message/node_run_list.js b/test/message/node_run_list.js
new file mode 100644
index 000000000000..c4f846e56705
--- /dev/null
+++ b/test/message/node_run_list.js
@@ -0,0 +1,12 @@
+'use strict';
+
+require('../common');
+const { spawnSyncAndExit } = require('../common/child_process');
+const fixtures = require('../common/fixtures');
+
+spawnSyncAndExit(
+  process.execPath,
+  [ '--no-warnings', '--run'],
+  { cwd: fixtures.path('run-script'), encoding: 'utf8', stdio: ['ignore', 'ignore', 'inherit'] },
+  { status: 9, signal: null },
+);
diff --git a/test/message/node_run_list.out b/test/message/node_run_list.out
new file mode 100644
index 000000000000..5f634a03506b
--- /dev/null
+++ b/test/message/node_run_list.out
@@ -0,0 +1,14 @@
+Available scripts are:
+  test: echo "Error: no test specified" && exit 1
+  ada: ada
+  ada-windows: ada.bat
+  positional-args: positional-args
+  positional-args-windows: positional-args.bat
+  custom-env: custom-env
+  custom-env-windows: custom-env.bat
+  path-env: path-env
+  path-env-windows: path-env.bat
+  special-env-variables: special-env-variables
+  special-env-variables-windows: special-env-variables.bat
+  pwd: pwd
+  pwd-windows: cd
diff --git a/test/module-hooks/test-module-hooks-builtin-require.js b/test/module-hooks/test-module-hooks-builtin-require.js
index 2086cbe062b0..0ee8de756116 100644
--- a/test/module-hooks/test-module-hooks-builtin-require.js
+++ b/test/module-hooks/test-module-hooks-builtin-require.js
@@ -1,3 +1,4 @@
+// Flags: --experimental-bench --no-warnings
 'use strict';
 
 // This tests that when builtins that demand the `node:` prefix are
@@ -11,6 +12,8 @@ const assert = require('assert');
 const { registerHooks } = require('module');
 
 const schemelessBlockList = new Set([
+  'bench',
+  'bench/reporters',
   'sea',
   'test',
   'test/reporters',
diff --git a/test/module-hooks/test-module-hooks-load-builtin-require.js b/test/module-hooks/test-module-hooks-load-builtin-require.js
index 962080b3c2c8..d86eb4b9df76 100644
--- a/test/module-hooks/test-module-hooks-load-builtin-require.js
+++ b/test/module-hooks/test-module-hooks-load-builtin-require.js
@@ -1,3 +1,4 @@
+// Flags: --experimental-bench --no-warnings
 'use strict';
 
 const common = require('../common');
@@ -35,6 +36,8 @@ hook.deregister();
 // the one with the `node:` prefix. The one with the prefix
 // stripped for internal lookups should not get passed into the hooks.
 const schemelessBlockList = new Set([
+  'bench',
+  'bench/reporters',
   'sea',
   'test',
   'test/reporters',
diff --git a/test/node-api/test_sea_addon/test.js b/test/node-api/test_sea_addon/test.js
index ef5fa118a0a4..eeac7384945d 100644
--- a/test/node-api/test_sea_addon/test.js
+++ b/test/node-api/test_sea_addon/test.js
@@ -2,9 +2,9 @@
 // This tests that SEA can load addons packaged as assets by writing them to disk
 // and loading them via process.dlopen().
 const common = require('../../common');
-const { generateSEA, skipIfSingleExecutableIsNotSupported } = require('../../common/sea');
+const { buildSEA, skipIfBuildSEAIsNotSupported } = require('../../common/sea');
 
-skipIfSingleExecutableIsNotSupported();
+skipIfBuildSEAIsNotSupported();
 
 const tmpdir = require('../../common/tmpdir');
 const { copyFileSync, rmSync, cpSync } = require('fs');
@@ -27,7 +27,7 @@ cpSync(fixtureDir, tmpdir.path, { recursive: true });
 copyFileSync(addonPath, copiedAddonPath);
 
 // Generate the SEA using the working directory directly (skip copy).
-const outputFile = generateSEA(tmpdir.path, tmpdir.path);
+const outputFile = buildSEA(tmpdir.path);
 
 // Remove the copied addon after it's been packaged into the SEA blob.
 rmSync(copiedAddonPath, { force: true });
diff --git a/test/parallel/parallel.status b/test/parallel/parallel.status
index 1954c1b0f5bd..d8fba447e96e 100644
--- a/test/parallel/parallel.status
+++ b/test/parallel/parallel.status
@@ -99,8 +99,6 @@ test-fs-watch-ignore-regexp: SKIP
 [$system==aix]
 # https://github.com/nodejs/node/issues/54346
 test-esm-loader-hooks-inspect-wait: PASS, FLAKY
-# https://github.com/nodejs/node/issues/65697
-test-fs-watch-recursive-delete-race: SKIP
 
 [$system==ibmi]
 # https://github.com/nodejs/node/pull/30819
diff --git a/test/parallel/test-abortcontroller-internal.js b/test/parallel/test-abortcontroller-internal.js
index 63dd26c36e32..cd6dfb1a74d8 100644
--- a/test/parallel/test-abortcontroller-internal.js
+++ b/test/parallel/test-abortcontroller-internal.js
@@ -30,3 +30,22 @@ test('A weak event listener should not prevent gc', async () => {
   globalThis.gc();
   assert.strictEqual(ref.deref(), undefined);
 });
+
+test('two weak listeners with the same retainer should both run on abort', async () => {
+  // Regression test for https://github.com/nodejs/node/issues/63954
+  const ac = new AbortController();
+  let aRan = false;
+  let bRan = false;
+
+  ac.signal.addEventListener('a', () => { aRan = true; }, { [kWeakHandler]: ac });
+  ac.signal.addEventListener('b', () => { bRan = true; }, { [kWeakHandler]: ac });
+
+  await sleep(10);
+  globalThis.gc();
+
+  ac.signal.dispatchEvent(new Event('a'));
+  ac.signal.dispatchEvent(new Event('b'));
+
+  assert.strictEqual(aRan, true);
+  assert.strictEqual(bRan, true);
+});
diff --git a/test/parallel/test-bench-auto-run.js b/test/parallel/test-bench-auto-run.js
new file mode 100644
index 000000000000..82e91f97b4a4
--- /dev/null
+++ b/test/parallel/test-bench-auto-run.js
@@ -0,0 +1,27 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const { bench } = require('node:bench');
+
+const child = spawnSync(process.execPath, [
+  '--no-warnings',
+  '--experimental-bench',
+  '-e',
+  'require("node:bench").bench("failure", () => { throw new Error(); })',
+]);
+assert.strictEqual(child.status, 1);
+
+const completion = bench('automatic execution', common.mustCall((b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+}, 30));
+
+completion.then(common.mustCall((result) => {
+  assert.strictEqual(result.name, 'automatic execution');
+  assert.strictEqual(result.samples.length, 30);
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(result.skip, undefined);
+  assert.strictEqual(result.summary.mean > 0, true);
+}));
diff --git a/test/parallel/test-bench-cli-arguments.js b/test/parallel/test-bench-cli-arguments.js
new file mode 100644
index 000000000000..f8757300a843
--- /dev/null
+++ b/test/parallel/test-bench-cli-arguments.js
@@ -0,0 +1,80 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+
+const spawnTimeout = common.platformTimeout(30_000);
+
+function spawnNode(args, options = undefined) {
+  const result = spawnSync(process.execPath, args, {
+    __proto__: null,
+    encoding: 'utf8',
+    timeout: spawnTimeout,
+    ...options,
+  });
+  assert.ifError(result.error);
+  assert.strictEqual(result.signal, null);
+  return result;
+}
+
+function spawnBench(args, options = undefined) {
+  return spawnNode([
+    '--no-warnings', '--experimental-bench', '--bench', ...args,
+  ], options);
+}
+
+for (const { args, message } of [
+  {
+    args: ['--bench-isolation=invalid', 'unused.js'],
+    message: /invalid value for --bench-isolation/,
+  },
+  {
+    args: ['--bench-samples=0', 'unused.js'],
+    message: /--bench-samples must be greater than 0/,
+  },
+  {
+    args: ['--bench-warmup=4294967296', 'unused.js'],
+    message: /--bench-warmup.*out of range/,
+  },
+  {
+    args: ['--bench-samples=2x', 'unused.js'],
+    message: /invalid value for --bench-samples/,
+  },
+  {
+    args: ['--bench-warmup=abc', 'unused.js'],
+    message: /invalid value for --bench-warmup/,
+  },
+  {
+    args: ['--bench-name-pattern=[', 'unused.js'],
+    message: /invalid regular expression/,
+  },
+  {
+    args: ['--eval=1', 'unused.js'],
+    message: /either --bench or --eval can be used, not both/,
+  },
+  {
+    args: ['--interactive', 'unused.js'],
+    message: /either --bench or --interactive can be used, not both/,
+  },
+  {
+    args: ['--watch', 'unused.js'],
+    message: /either --bench or --watch can be used, not both/,
+  },
+  {
+    args: ['--watch-path=.', 'unused.js'],
+    message: /either --bench or --watch can be used, not both/,
+  },
+  {
+    args: ['--check', 'unused.js'],
+    message: /either --bench or --check can be used, not both/,
+  },
+  {
+    args: ['--test', 'unused.js'],
+    message: /either --bench or --test can be used, not both/,
+  },
+]) {
+  const result = spawnBench(args);
+  assert.notStrictEqual(result.status, 0);
+  assert.match(result.stderr, message);
+}
diff --git a/test/parallel/test-bench-cli-backpressure.js b/test/parallel/test-bench-cli-backpressure.js
new file mode 100644
index 000000000000..47e4fdff252d
--- /dev/null
+++ b/test/parallel/test-bench-cli-backpressure.js
@@ -0,0 +1,64 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fixtures = require('../common/fixtures');
+
+const spawnTimeout = common.platformTimeout(30_000);
+
+function spawnNode(args, options = undefined) {
+  const result = spawnSync(process.execPath, args, {
+    __proto__: null,
+    encoding: 'utf8',
+    timeout: spawnTimeout,
+    ...options,
+  });
+  assert.ifError(result.error);
+  assert.strictEqual(result.signal, null);
+  return result;
+}
+
+function spawnBench(args, options = undefined) {
+  return spawnNode([
+    '--no-warnings', '--experimental-bench', '--bench', ...args,
+  ], options);
+}
+
+function parseRecords(result) {
+  assert.strictEqual(result.stderr, '');
+  return parseOutput(result.stdout);
+}
+
+function parseOutput(output) {
+  return output.trim().split('\n').map((line) => JSON.parse(line));
+}
+
+{
+  const result = spawnBench([
+    `--bench-reporter=${fixtures.fileURL('bench-runner/slow-reporter.cjs')}`,
+    fixtures.path('bench-runner/many-records.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stderr, '');
+  const report = JSON.parse(result.stdout);
+  assert.strictEqual(report.samples, 30);
+  assert.strictEqual(report.stdout,
+                     Array.from({ length: 30 }, (_, i) => `${i}\n`).join(''));
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/acknowledged-records.mjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stderr, '');
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert.strictEqual(diagnostics.length, 32);
+  assert(diagnostics.every(
+    ({ data }) => /^acknowledged 10\d{3}$/.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, true);
+}
diff --git a/test/parallel/test-bench-cli-lifecycle.js b/test/parallel/test-bench-cli-lifecycle.js
new file mode 100644
index 000000000000..ab42857f2789
--- /dev/null
+++ b/test/parallel/test-bench-cli-lifecycle.js
@@ -0,0 +1,260 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fixtures = require('../common/fixtures');
+
+const spawnTimeout = common.platformTimeout(30_000);
+
+function spawnNode(args, options = undefined) {
+  const result = spawnSync(process.execPath, args, {
+    __proto__: null,
+    encoding: 'utf8',
+    timeout: spawnTimeout,
+    ...options,
+  });
+  assert.ifError(result.error);
+  assert.strictEqual(result.signal, null);
+  return result;
+}
+
+function spawnBench(args, options = undefined) {
+  return spawnNode([
+    '--no-warnings', '--experimental-bench', '--bench', ...args,
+  ], options);
+}
+
+function parseRecords(result) {
+  assert.strictEqual(result.stderr, '');
+  return parseOutput(result.stdout);
+}
+
+function parseOutput(output) {
+  return output.trim().split('\n').map((line) => JSON.parse(line));
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/error.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const failure = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.deepStrictEqual(failure.params, { kind: 'structured-error' });
+  assert.strictEqual(failure.error.name, 'Error');
+  assert.strictEqual(failure.error.message, 'benchmark fixture failed');
+  assert.strictEqual(failure.error.code, 'ERR_BENCHMARK_FIXTURE');
+  assert.deepStrictEqual(failure.error.cause, { value: '42' });
+  assert.match(failure.error.stack, /error\.cjs/);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+{
+  const result = spawnBench([
+    '--bench-isolation=none',
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/throws-null.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic').data;
+  assert.strictEqual(diagnostic.message, 'null');
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+for (const isolation of ['process', 'none']) {
+  const result = spawnBench([
+    `--bench-isolation=${isolation}`,
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/load-error-after-declaration.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' &&
+    data.message === 'load failed after declaration'));
+  const plan = records.find(({ type }) => type === 'bench:plan').data;
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(plan.name, 'declared before load error');
+  assert.strictEqual(plan.selected, true);
+  assert.strictEqual(completion.name, plan.name);
+  assert.strictEqual(completion.error, undefined);
+  assert.strictEqual(completion.samples.length, 1);
+  assert.strictEqual(records.at(-1).data.counts.completed, 1);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/recorded-detail.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(completion.samples.length, 1);
+  const { rate, ...sample } = completion.samples[0];
+  assert.deepStrictEqual(sample, {
+    detail: { index: 0, phase: 'measurement', value: '42' },
+    duration_ns: '4',
+    operations: 2,
+  });
+  assert(Math.abs(rate - 500_000_000) < 1);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/diagnostic.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic').data;
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.deepStrictEqual(diagnostic.message, {
+    name: 'node:bench:test:diagnostic',
+    message: { value: '42' },
+  });
+  assert.strictEqual(diagnostic.level, 'info');
+  assert.strictEqual(diagnostic.phase, 'measurement');
+  assert.strictEqual(diagnostic.index, 0);
+  assert.strictEqual(diagnostic.detail, undefined);
+  assert.strictEqual(diagnostic.benchId, completion.benchId);
+  assert.strictEqual(diagnostic.fileRunId, completion.fileRunId);
+  assert.strictEqual(completion.error, undefined);
+}
+
+for (const { kind, message } of [
+  { kind: 'sequence', message: /valid record sequence/ },
+  { kind: 'record', message: /not a valid benchmark record/ },
+  { kind: 'identity', message: /not a valid benchmark record/ },
+  { kind: 'name-path', message: /not a valid benchmark record/ },
+  { kind: 'plan', message: /not a valid benchmark plan/ },
+  { kind: 'timeout', message: /not a valid benchmark plan/ },
+  { kind: 'diagnostic', message: /not a valid benchmark diagnostic/ },
+  { kind: 'diagnostic-order', message: /valid lifecycle sequence/ },
+  { kind: 'summary', message: /not a valid benchmark summary/ },
+]) {
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/malformed-record.cjs'),
+  ], {
+    env: {
+      __proto__: null,
+      ...process.env,
+      NODE_BENCH_MALFORMED_RECORD: kind,
+    },
+  });
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert(diagnostics.some(({ data }) => message.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/malformed-plan-order.mjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert(diagnostics.some(
+    ({ data }) => /valid lifecycle sequence/.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+{
+  const result = spawnBench([
+    '--bench-isolation=none',
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/a.cjs'),
+    fixtures.path('bench-runner/exit-code.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostic = records.find(({ type, data }) =>
+    type === 'bench:diagnostic' && /set exit code/.test(data.message)).data;
+  assert.strictEqual(diagnostic.entryFile, null);
+  assert.strictEqual(diagnostic.fileRunId, null);
+  assert.strictEqual(diagnostic.file, null);
+}
+
+for (const { mode, message } of [
+  { mode: 'code', message: /failed with exit code 2/ },
+  { mode: 'late', message: /failed with exit code 2/ },
+  ...common.isWindows ? [] : [
+    { mode: 'signal', message: /failed with signal SIGTERM/ },
+  ],
+]) {
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/abrupt-exit.cjs'),
+  ], {
+    env: {
+      __proto__: null,
+      ...process.env,
+      NODE_BENCH_EXIT_MODE: mode,
+    },
+  });
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert(diagnostics.some(({ data }) => message.test(data.message)));
+}
+
+for (const mode of ['callback', 'throw']) {
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/send-error.cjs'),
+  ], {
+    env: {
+      __proto__: null,
+      ...process.env,
+      NODE_BENCH_SEND_ERROR: mode,
+    },
+  });
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  const messages = diagnostics.map(({ data }) => data.message).join('');
+  assert.match(messages, /benchmark send/);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/run.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic');
+  assert.match(diagnostic.data.message,
+               /run\(\) cannot be called from a file run with --bench/);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/exit-code.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' && /set exit code/.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, false);
+}
diff --git a/test/parallel/test-bench-cli-reporters.js b/test/parallel/test-bench-cli-reporters.js
new file mode 100644
index 000000000000..31cee67aaa12
--- /dev/null
+++ b/test/parallel/test-bench-cli-reporters.js
@@ -0,0 +1,151 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+const spawnTimeout = common.platformTimeout(30_000);
+
+tmpdir.refresh();
+
+function spawnNode(args, options = undefined) {
+  const result = spawnSync(process.execPath, args, {
+    __proto__: null,
+    encoding: 'utf8',
+    timeout: spawnTimeout,
+    ...options,
+  });
+  assert.ifError(result.error);
+  assert.strictEqual(result.signal, null);
+  return result;
+}
+
+function spawnBench(args, options = undefined) {
+  return spawnNode([
+    '--no-warnings', '--experimental-bench', '--bench', ...args,
+  ], options);
+}
+
+function parseRecords(result) {
+  assert.strictEqual(result.stderr, '');
+  return parseOutput(result.stdout);
+}
+
+function parseOutput(output) {
+  return output.trim().split('\n').map((line) => JSON.parse(line));
+}
+
+for (const { file, status } of [
+  { file: 'a.cjs', status: 0 },
+  { file: 'error.cjs', status: 1 },
+]) {
+  const result = spawnBench([
+    `--bench-reporter=${fixtures.fileURL('bench-runner/verifying-reporter.cjs')}`,
+    fixtures.path(`bench-runner/${file}`),
+  ]);
+  assert.strictEqual(result.status, status);
+  assert.strictEqual(result.stderr, '');
+  assert.strictEqual(result.stdout, 'verified\n');
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-reporter-destination=stderr',
+    fixtures.path('bench-runner/output.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stdout, '');
+  const records = parseOutput(result.stderr);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert.deepStrictEqual(diagnostics.map(({ data }) => data.stream).sort(), [
+    'stderr',
+    'stdout',
+  ]);
+  assert(diagnostics.some(
+    ({ data }) => data.message === 'benchmark stdout\n'));
+  assert(diagnostics.some(
+    ({ data }) => data.message === 'benchmark stderr\n'));
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/utf8-output.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const output = records.filter(
+    ({ type, data }) => type === 'bench:diagnostic' &&
+      data.stream === 'stdout').map(({ data }) => data.message).join('');
+  assert.strictEqual(output, 'split:\u20ac\n');
+}
+
+{
+  const result = spawnBench([
+    `--bench-reporter=${fixtures.fileURL('bench-runner/failing-reporter.cjs')}`,
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /benchmark reporter failed/);
+}
+
+{
+  const result = spawnBench([
+    `--bench-reporter=${fixtures.fileURL('bench-runner/destroying-reporter.cjs')}`,
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /benchmark reporter closed the stream/);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-reporter-destination=stdout',
+    '--bench-reporter=data:text/javascript,export default 0',
+    '--bench-reporter-destination=stderr',
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /is not a valid reporter/);
+}
+
+{
+  const destination = tmpdir.resolve('bench.txt');
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-reporter-destination=stdout',
+    '--bench-reporter=spec',
+    `--bench-reporter-destination=${destination}`,
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  parseRecords(result);
+  assert.match(fs.readFileSync(destination, 'utf8'),
+               /^benchmark \| samples \| mean rate/);
+}
+
+{
+  const result = spawnBench([fixtures.path('bench-runner/a.cjs')]);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stderr, '');
+  assert.match(result.stdout, /^benchmark \| samples \| mean rate/);
+  assert.match(result.stdout, /1 completed, 0 failed, 0 skipped/);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-reporter=spec',
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr,
+               /must match the number of specified '.*destination'/);
+}
diff --git a/test/parallel/test-bench-cli.js b/test/parallel/test-bench-cli.js
new file mode 100644
index 000000000000..df1c6edeb220
--- /dev/null
+++ b/test/parallel/test-bench-cli.js
@@ -0,0 +1,438 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+const basicPattern = fixtures.path('bench-runner/[ab].*');
+const spawnTimeout = common.platformTimeout(30_000);
+
+tmpdir.refresh();
+
+function spawnNode(args, options = undefined) {
+  const result = spawnSync(process.execPath, args, {
+    __proto__: null,
+    encoding: 'utf8',
+    timeout: spawnTimeout,
+    ...options,
+  });
+  assert.ifError(result.error);
+  assert.strictEqual(result.signal, null);
+  return result;
+}
+
+function spawnBench(args, options = undefined) {
+  return spawnNode([
+    '--no-warnings', '--experimental-bench', '--bench', ...args,
+  ], options);
+}
+
+function parseRecords(result) {
+  assert.strictEqual(result.stderr, '');
+  return parseOutput(result.stdout);
+}
+
+function parseOutput(output) {
+  return output.trim().split('\n').map((line) => JSON.parse(line));
+}
+
+for (const option of [
+  '--bench',
+  '--bench-isolation=process',
+  '--bench-name-pattern=benchmark',
+  '--bench-reporter=spec',
+  '--bench-reporter-destination=stdout',
+  '--bench-samples=1',
+  '--bench-warmup=0',
+]) {
+  const result = spawnNode([option]);
+  assert.notStrictEqual(result.status, 0);
+  assert.match(result.stderr, /--experimental-bench is required/);
+}
+
+{
+  const result = spawnBench([]);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr, /--bench requires at least one file or glob/);
+}
+
+{
+  const result = spawnBench(['does-not-exist-*.js']);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr, /^Could not find/);
+}
+
+if (common.canCreateSymLink()) {
+  const dangling = tmpdir.resolve('dangling.cjs');
+  fs.symlinkSync(tmpdir.resolve('missing.cjs'), dangling);
+  const result = spawnBench([dangling]);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr, /^Could not find/);
+}
+
+for (const { patterns, message } of [
+  {
+    patterns: [
+      fixtures.path('bench-runner/a.cjs'),
+      fixtures.path('bench-runner/b.mjs'),
+    ],
+    message: /benchmark child process requires exactly one file/,
+  },
+  {
+    patterns: [fixtures.path('bench-runner/missing.cjs')],
+    message: /^Could not find/,
+  },
+]) {
+  const result = spawnNode([
+    '--no-warnings',
+    '--experimental-bench',
+    '--require', fixtures.path('bench-runner/fake-ipc.cjs'),
+    '--bench',
+    ...patterns,
+  ], {
+    __proto__: null,
+    env: { __proto__: null, ...process.env, NODE_BENCH_CONTEXT: 'child' },
+  });
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr, message);
+}
+
+{
+  const result = spawnBench(['--bench-reporter=json', basicPattern]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const plans = records.filter(
+    ({ type }) => type === 'bench:plan').map(({ data }) => data);
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete');
+
+  assert.deepStrictEqual(plans.map(({ name }) => name), ['alpha', 'beta']);
+  assert.deepStrictEqual(completions.map(({ data }) => data.name), [
+    'alpha',
+    'beta',
+  ]);
+  assert.notStrictEqual(
+    completions[0].data.params.pid,
+    completions[1].data.params.pid,
+  );
+  assert.deepStrictEqual(completions.map(({ data }) => data.params.file), [
+    'a',
+    'b',
+  ]);
+  assert.match(completions[0].data.samples[0].duration_ns, /^\d+$/);
+  assert(Number.isFinite(completions[0].data.summary.mean));
+
+  const summaries = records.filter(
+    ({ type }) => type === 'bench:summary');
+  assert.strictEqual(summaries.length, 1);
+  assert.strictEqual(summaries[0].data.file, null);
+  assert.deepStrictEqual(summaries[0].data.counts, {
+    completed: 2,
+    failed: 0,
+    skipped: 0,
+    total: 2,
+  });
+}
+
+for (const isolation of ['process', 'none']) {
+  const result = spawnBench([
+    `--bench-isolation=${isolation}`,
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/identity-entry-*.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const plans = records.filter(
+    ({ type }) => type === 'bench:plan').map(({ data }) => data);
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete').map(({ data }) => data);
+  const summary = records.at(-1).data;
+
+  assert.strictEqual(plans.length, 2);
+  for (const plan of plans) {
+    const planIndex = records.findIndex(({ type, data }) =>
+      type === 'bench:plan' && data.fileRunId === plan.fileRunId);
+    const startIndex = records.findIndex(({ type, data }) =>
+      type === 'bench:start' && data.fileRunId === plan.fileRunId);
+    assert(planIndex < startIndex);
+  }
+  assert.strictEqual(completions.length, 2);
+  assert.strictEqual(completions[0].benchId, completions[1].benchId);
+  assert.strictEqual(completions[0].runId, completions[1].runId);
+  assert.strictEqual(completions[0].runId, summary.runId);
+  assert.notStrictEqual(
+    completions[0].fileRunId, completions[1].fileRunId);
+  assert.deepStrictEqual(completions.map(({ entryFile }) => entryFile), [
+    fixtures.path('bench-runner/identity-entry-a.cjs'),
+    fixtures.path('bench-runner/identity-entry-b.cjs'),
+  ]);
+  assert.deepStrictEqual(completions.map(({ namePath }) => namePath), [
+    ['shared suite', 'shared identity'],
+    ['shared suite', 'shared identity'],
+  ]);
+  assert.strictEqual(summary.fileRunId, null);
+  assert.strictEqual(summary.entryFile, null);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/identity-suite.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete').map(({ data }) => data);
+  const parentId = JSON.stringify([
+    fixtures.path('bench-runner/identity-suite.cjs'),
+    ['cross-module suite'],
+  ]);
+
+  assert.deepStrictEqual(completions.map(({ name }) => name), [
+    'child a',
+    'child b',
+  ]);
+  assert(completions.every((completion) =>
+    completion.parentId === parentId));
+  assert.deepStrictEqual(completions.map(({ namePath }) => namePath), [
+    ['cross-module suite', 'child a'],
+    ['cross-module suite', 'child b'],
+  ]);
+  assert(completions.every(({ entryFile }) =>
+    entryFile === fixtures.path('bench-runner/identity-suite.cjs')));
+}
+
+for (const isolation of ['process', 'none']) {
+  const result = spawnBench([
+    '--require', fixtures.path('bench-runner/identity-preload.cjs'),
+    `--bench-isolation=${isolation}`,
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/identity-entry-*.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const preloads = records.filter(
+    ({ type, data }) => type === 'bench:complete' &&
+      data.name === 'preload identity').map(({ data }) => data);
+  assert.strictEqual(preloads.length, isolation === 'process' ? 2 : 1);
+  assert.strictEqual(
+    new Set(preloads.map(({ fileRunId }) => fileRunId)).size,
+    preloads.length,
+  );
+  assert(preloads.every(({ entryFile }) => entryFile === null));
+  assert(preloads.every(
+    ({ runId }) => runId === records.at(-1).data.runId));
+}
+
+{
+  const result = spawnBench([
+    '--bench-isolation=none',
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/a.cjs'),
+    fixtures.path('bench-runner/identity-hook.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostic = records.find(
+    ({ type, data }) => type === 'bench:diagnostic' &&
+      data.message === 'scoped hook failed').data;
+  const completion = records.find(
+    ({ type, data }) => type === 'bench:complete' &&
+      data.name === 'scoped hook benchmark').data;
+  assert.strictEqual(diagnostic.entryFile,
+                     fixtures.path('bench-runner/identity-hook.cjs'));
+  assert.strictEqual(diagnostic.fileRunId, completion.fileRunId);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-isolation=none',
+    basicPattern,
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete');
+  assert.strictEqual(completions.length, 2);
+  assert.strictEqual(
+    completions[0].data.params.pid,
+    completions[1].data.params.pid,
+  );
+  assert.strictEqual(records.at(-1).data.file, null);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-name-pattern=selected',
+    '--bench-samples=2',
+    '--bench-warmup=3',
+    fixtures.path('bench-runner/options.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const plans = records.filter(
+    ({ type }) => type === 'bench:plan').map(({ data }) => data);
+  const samples = records.filter(({ type }) => type === 'bench:sample');
+  assert.deepStrictEqual(samples.map(({ data }) => data.operations), [4, 5]);
+  assert.deepStrictEqual(plans.map((plan) => ({
+    name: plan.name,
+    samples: plan.samples,
+    selected: plan.selected,
+    skip: plan.skip,
+    timeout: plan.timeout,
+    warmup: plan.warmup,
+    yieldBetweenSamples: plan.yieldBetweenSamples,
+  })), [
+    {
+      name: 'selected',
+      samples: 2,
+      selected: true,
+      skip: undefined,
+      timeout: null,
+      warmup: 3,
+      yieldBetweenSamples: true,
+    },
+    {
+      name: 'filtered out',
+      samples: 2,
+      selected: false,
+      skip: 'name pattern',
+      timeout: null,
+      warmup: 3,
+      yieldBetweenSamples: true,
+    },
+  ]);
+
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete');
+  const selected = completions.find(({ data }) => data.name === 'selected').data;
+  assert.deepStrictEqual(selected.params, {
+    boolean: true,
+    number: 42,
+    string: 'value',
+  });
+  assert.strictEqual(selected.samples.length, 2);
+  assert.strictEqual(
+    selected.summary.mean,
+    (selected.samples[0].rate + selected.samples[1].rate) / 2,
+  );
+  assert(Number.isFinite(selected.summary.medianConfidenceInterval.lower));
+
+  const filtered = completions.find(
+    ({ data }) => data.name === 'filtered out').data;
+  assert.strictEqual(filtered.skip, 'name pattern');
+}
+
+{
+  const result = spawnBench([
+    '--require',
+    fixtures.path('bench-runner/preload.cjs'),
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/preloaded.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete');
+  assert.deepStrictEqual(completion.data.params, { preloaded: true });
+}
+
+for (const isolation of ['process', 'none']) {
+  const result = spawnBench([
+    `--bench-isolation=${isolation}`,
+    '--bench-reporter=json',
+    '--import', fixtures.fileURL('bench-runner/import.mjs'),
+    fixtures.path('bench-runner/imported.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete');
+  assert.deepStrictEqual(completion.data.params, { imported: 'loaded' });
+}
+
+{
+  const lock = tmpdir.resolve('serial.lock');
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/serial-[ab].cjs'),
+  ], {
+    env: { __proto__: null, ...process.env, NODE_BENCH_LOCK: lock },
+  });
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  assert.deepStrictEqual(records.filter(
+    ({ type }) => type === 'bench:complete').map(({ data }) => data.name), [
+    'serial a',
+    'serial b',
+  ]);
+  assert.strictEqual(fs.existsSync(lock), false);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/ipc.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  assert.strictEqual(records.find(
+    ({ type }) => type === 'bench:complete').data.name, 'user IPC');
+  assert.strictEqual(records.at(-1).data.file,
+                     fixtures.path('bench-runner/ipc.cjs'));
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--random-seed=17',
+    '--stack-trace-limit=17',
+    fixtures.path('bench-runner/v8-option.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  assert.strictEqual(records.find(
+    ({ type }) => type === 'bench:complete').data.name, 'V8 option');
+}
+
+if (common.hasInspector) {
+  const result = spawnBench([
+    '--inspect=0',
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/inspector.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic')
+    .map(({ data }) => data.message).join('');
+  assert.match(diagnostics, /Debugger listening on ws:\/\//);
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(completion.params.inspectPort, '--inspect-port=0');
+}
+
+{
+  // --experimental-bench is passed on the command line rather than via the
+  // config file's "nodeOptions" section because builds configured with
+  // --without-node-options ignore that section entirely.
+  const result = spawnNode([
+    '--no-warnings',
+    '--experimental-bench',
+    `--experimental-config-file=${fixtures.path('bench-runner/node.config.json')}`,
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  assert.strictEqual(records.find(
+    ({ type }) => type === 'bench:complete').data.samples.length, 1);
+}
diff --git a/test/parallel/test-bench-clock-precision.js b/test/parallel/test-bench-clock-precision.js
new file mode 100644
index 000000000000..7f7fc8009694
--- /dev/null
+++ b/test/parallel/test-bench-clock-precision.js
@@ -0,0 +1,22 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+
+const originalHrtimeBigint = process.hrtime.bigint;
+process.hrtime.bigint = () => 1n;
+const { bench, run } = require('node:bench');
+process.hrtime.bigint = originalHrtimeBigint;
+
+const completion = bench('zero duration', { samples: 1 }, (b) => {
+  b.start();
+  b.end(1);
+});
+
+(async () => {
+  await run().toArray();
+  const result = await completion;
+  assert.strictEqual(result.error.code, 'ERR_INVALID_STATE');
+  assert.match(result.error.message, /insufficient clock precision/);
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-context-control.js b/test/parallel/test-bench-context-control.js
new file mode 100644
index 000000000000..d8be59a4e5e2
--- /dev/null
+++ b/test/parallel/test-bench-context-control.js
@@ -0,0 +1,106 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+
+(async () => {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const invocations = [];
+  let closedContext;
+
+  const controlledCompletion = runner.bench('controlled', {
+    samples: 5,
+    warmup: 2,
+  }, common.mustCall((b) => {
+    invocations.push(`${b.phase}:${b.index}`);
+    const detail = { index: b.index, phase: b.phase };
+    const sample = completeSample(b, 2, { detail });
+    detail.index = -1;
+
+    assert.strictEqual(sample.operations, 2);
+    assert.strictEqual(typeof sample.duration_ns, 'bigint');
+    assert.strictEqual(sample.rate > 0, true);
+    assert.notStrictEqual(sample.detail, detail);
+    assert.notStrictEqual(sample.detail.index, -1);
+    sample.operations = 0;
+    sample.rate = NaN;
+    sample.detail.index = -2;
+
+    if (b.phase === 'measurement' && b.index === 1) {
+      b.done();
+      closedContext = b;
+    }
+  }, 4));
+
+  const recordedCompletion = runner.bench(
+    'recorded', { samples: 3 }, common.mustCall((b) => {
+      const detail = { source: 'worker', value: 1n };
+      const sample = b.record({
+        __proto__: null,
+        detail,
+        duration_ns: 20n,
+        operations: 5,
+      });
+      detail.source = 'changed';
+      assert.deepStrictEqual(sample, {
+        __proto__: null,
+        detail: { source: 'worker', value: 1n },
+        duration_ns: 20n,
+        operations: 5,
+        rate: 250_000_000,
+      });
+      sample.operations = 0;
+      sample.rate = NaN;
+      sample.detail.source = 'returned value changed';
+      b.done();
+    }));
+
+  const variableSamples = [
+    { __proto__: null, duration_ns: 1_000_000_000n, operations: 1 },
+    { __proto__: null, duration_ns: 100_000_000n, operations: 100 },
+  ];
+  const variableCompletion = runner.bench('variable batch', {
+    samples: variableSamples.length,
+  }, common.mustCall((b) => {
+    b.record(variableSamples[b.index]);
+  }, variableSamples.length));
+
+  const records = await runner.run().toArray();
+  const [controlled, recorded, variable] = await Promise.all([
+    controlledCompletion,
+    recordedCompletion,
+    variableCompletion,
+  ]);
+
+  assert.deepStrictEqual(invocations, [
+    'warmup:0',
+    'warmup:1',
+    'measurement:0',
+    'measurement:1',
+  ]);
+  assert.strictEqual(controlled.samples.length, 2);
+  assert.deepStrictEqual(
+    controlled.samples.map(({ operations }) => operations), [2, 2]);
+  assert.deepStrictEqual(
+    controlled.samples.map(({ detail }) => detail.index), [0, 1]);
+  assert.strictEqual(controlled.samples.every(({ rate }) => rate > 0), true);
+  assert.strictEqual(recorded.samples.length, 1);
+  assert.deepStrictEqual(recorded.samples[0].detail,
+                         { source: 'worker', value: 1n });
+  assert.deepStrictEqual(variable.samples.map(({ rate }) => rate), [1, 1000]);
+  assert.strictEqual(variable.summary.mean, 500.5);
+  const pooledRate = 1_000_000_000 * 101 / 1_100_000_000;
+  assert.notStrictEqual(variable.summary.mean, pooledRate);
+  assert.strictEqual(
+    records.filter(({ type }) => type === 'bench:sample').length, 5);
+  assert.throws(() => closedContext.start(), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => closedContext.end(1), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => closedContext.record({
+    duration_ns: 1n,
+    operations: 1,
+  }), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => closedContext.done(), { code: 'ERR_INVALID_STATE' });
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-context-errors.js b/test/parallel/test-bench-context-errors.js
new file mode 100644
index 000000000000..4fd81ee2c821
--- /dev/null
+++ b/test/parallel/test-bench-context-errors.js
@@ -0,0 +1,125 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+
+const runner = createRunner({ yieldBetweenSamples: false });
+
+runner.bench('done during warmup', { samples: 1, warmup: 1 }, (b) => {
+  completeSample(b);
+  b.done();
+});
+runner.bench('invalid record', { samples: 1 }, (b) => b.record(null));
+runner.bench('invalid duration type', { samples: 1 }, (b) => b.record({
+  duration_ns: 1,
+  operations: 1,
+}));
+runner.bench('invalid duration value', { samples: 1 }, (b) => b.record({
+  duration_ns: 0n,
+  operations: 1,
+}));
+runner.bench('duration too large', { samples: 1 }, (b) => b.record({
+  duration_ns: 9_007_199_254_740_992n,
+  operations: 1,
+}));
+runner.bench('invalid operations', { samples: 1 }, (b) => b.record({
+  duration_ns: 1n,
+  operations: 0,
+}));
+runner.bench('mixed timing', { samples: 1 }, (b) => {
+  b.start();
+  b.record({ duration_ns: 1n, operations: 1 });
+});
+runner.bench('start after record', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+  b.start();
+});
+runner.bench('end after record', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+  b.end(1);
+});
+runner.bench('duplicate record', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+  b.record({ duration_ns: 1n, operations: 1 });
+});
+runner.bench('reentrant record', { samples: 1 }, (b) => {
+  const sample = { duration_ns: 1n };
+  Object.defineProperty(sample, 'operations', {
+    get() {
+      b.record({ duration_ns: 1n, operations: 1 });
+      return 1;
+    },
+  });
+  b.record(sample);
+});
+runner.bench('uncloneable detail', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1, detail: () => {} });
+});
+runner.bench('uncloneable diagnostic message', { samples: 1 }, (b) => {
+  b.diagnostic(() => {});
+});
+runner.bench('invalid diagnostic level', { samples: 1 }, (b) => {
+  b.diagnostic('invalid', { level: 'error' });
+});
+runner.bench('uncloneable diagnostic detail', { samples: 1 }, (b) => {
+  b.diagnostic('invalid', { detail: () => {} });
+});
+runner.bench('caught contract violation', { samples: 1 },
+             common.mustCall((b) => {
+               b.start();
+               assert.throws(() => b.start(), { code: 'ERR_INVALID_STATE' });
+               b.end(1);
+             }));
+runner.bench('caught diagnostic violation', { samples: 1 },
+             common.mustCall((b) => {
+               assert.throws(() => b.diagnostic('invalid', {
+                 level: 'error',
+               }), { code: 'ERR_INVALID_ARG_VALUE' });
+               b.record({ duration_ns: 1n, operations: 1 });
+             }));
+
+(async () => {
+  const records = await runner.run().toArray();
+  const completions = records
+    .filter(({ type }) => type === 'bench:complete')
+    .map(({ data }) => data);
+  const byName = new Map(completions.map((result) => [result.name, result]));
+
+  assert.strictEqual(byName.get('done during warmup').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('invalid record').error.code,
+                     'ERR_INVALID_ARG_TYPE');
+  assert.strictEqual(byName.get('invalid duration type').error.code,
+                     'ERR_INVALID_ARG_TYPE');
+  assert.strictEqual(byName.get('invalid duration value').error.code,
+                     'ERR_OUT_OF_RANGE');
+  assert.strictEqual(byName.get('duration too large').error.code,
+                     'ERR_OUT_OF_RANGE');
+  assert.strictEqual(byName.get('invalid operations').error.code,
+                     'ERR_OUT_OF_RANGE');
+  assert.strictEqual(byName.get('mixed timing').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('start after record').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('end after record').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('duplicate record').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('reentrant record').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('uncloneable detail').error.name,
+                     'DataCloneError');
+  assert.strictEqual(byName.get('uncloneable diagnostic message').error.name,
+                     'DataCloneError');
+  assert.strictEqual(byName.get('invalid diagnostic level').error.code,
+                     'ERR_INVALID_ARG_VALUE');
+  assert.strictEqual(byName.get('uncloneable diagnostic detail').error.name,
+                     'DataCloneError');
+  assert.match(byName.get('caught contract violation').error.message,
+               /violated the context method contract/);
+  assert.match(byName.get('caught diagnostic violation').error.message,
+               /violated the context method contract/);
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-create-runner.js b/test/parallel/test-bench-create-runner.js
new file mode 100644
index 000000000000..d12bc5db4b6e
--- /dev/null
+++ b/test/parallel/test-bench-create-runner.js
@@ -0,0 +1,100 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+
+(async () => {
+  const first = createRunner({ yieldBetweenSamples: false });
+  const second = createRunner({ yieldBetweenSamples: false });
+  let firstCalls = 0;
+  let secondCalls = 0;
+
+  first.before(common.mustCall());
+  second.before(common.mustCall());
+
+  const firstCompletion = first.bench(
+    'same name', { samples: 2 }, common.mustCall((b) => {
+      firstCalls++;
+      completeSample(b);
+    }, 2));
+  const secondCompletion = second.bench(
+    'same name', { samples: 1 }, common.mustCall((b) => {
+      secondCalls++;
+      completeSample(b);
+    }));
+
+  await setImmediate();
+  assert.strictEqual(firstCalls, 0);
+  assert.strictEqual(secondCalls, 0);
+
+  const firstStream = first.run();
+  const secondStream = second.run();
+  assert.throws(() => first.run(), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => first.bench('late', common.mustNotCall()),
+                { code: 'ERR_INVALID_STATE' });
+  const [firstRecords, secondRecords] = await Promise.all([
+    firstStream.toArray(),
+    secondStream.toArray(),
+  ]);
+  const [firstResult, secondResult] = await Promise.all([
+    firstCompletion,
+    secondCompletion,
+  ]);
+
+  assert.strictEqual(firstCalls, 2);
+  assert.strictEqual(secondCalls, 1);
+  assert.strictEqual(firstResult.samples.length, 2);
+  assert.strictEqual(secondResult.samples.length, 1);
+  assert.strictEqual(firstResult.error, undefined);
+  assert.strictEqual(secondResult.error, undefined);
+  assert.strictEqual(firstResult.benchId, secondResult.benchId);
+  assert.notStrictEqual(firstResult.runId, secondResult.runId);
+  assert.strictEqual(firstResult.fileRunId, firstResult.runId);
+  assert.strictEqual(secondResult.fileRunId, secondResult.runId);
+  assert.strictEqual(firstResult.entryFile, process.argv[1]);
+  assert.strictEqual(secondResult.entryFile, process.argv[1]);
+  assert.deepStrictEqual(firstResult.namePath, ['same name']);
+  assert.deepStrictEqual(secondResult.namePath, ['same name']);
+  assert(firstRecords.every(({ data }) => data.runId === firstResult.runId));
+  assert(secondRecords.every(({ data }) => data.runId === secondResult.runId));
+  assert.strictEqual(
+    firstRecords.filter(({ type }) => type === 'bench:summary').length, 1);
+  assert.strictEqual(
+    secondRecords.filter(({ type }) => type === 'bench:summary').length, 1);
+  assert.strictEqual(typeof first.bench.skip, 'function');
+  assert.strictEqual(typeof first.bench.only, 'function');
+  assert.strictEqual(first.describe, first.suite);
+
+  const retry = createRunner({ yieldBetweenSamples: false });
+  retry.bench('not filtered', { samples: 1 }, (b) => {
+    completeSample(b);
+  });
+  assert.throws(() => retry.run({
+    namePattern: 'filtered',
+    samples: 0,
+  }), { code: 'ERR_OUT_OF_RANGE' });
+  const retryRecords = await retry.run().toArray();
+  const retryResult = retryRecords.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(retryResult.skip, undefined);
+  assert.strictEqual(retryResult.samples.length, 1);
+
+  const reentrant = createRunner({ yieldBetweenSamples: false });
+  reentrant.bench('reentrant options', { samples: 1 }, (b) => {
+    completeSample(b);
+  });
+  const reentrantOptions = {};
+  Object.defineProperty(reentrantOptions, 'samples', {
+    get: common.mustCall(() => reentrant.run()),
+  });
+  assert.throws(() => reentrant.run(reentrantOptions),
+                { code: 'ERR_INVALID_STATE' });
+  const reentrantRecords = await reentrant.run().toArray();
+  const reentrantResult = reentrantRecords.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(reentrantResult.samples.length, 1);
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-custom-reporter.js b/test/parallel/test-bench-custom-reporter.js
new file mode 100644
index 000000000000..9c67dfa56ff1
--- /dev/null
+++ b/test/parallel/test-bench-custom-reporter.js
@@ -0,0 +1,36 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { Writable } = require('stream');
+const { finished } = require('stream/promises');
+const { bench, run } = require('node:bench');
+
+bench('completed', { samples: 1 }, (b) => {
+  completeSample(b);
+});
+bench.skip('skipped', { samples: 1 }, common.mustNotCall());
+
+async function* customReporter(source) {
+  for await (const { type, data } of source) {
+    if (type !== 'bench:complete') continue;
+    yield `${data.name}:${data.skip === undefined ? 'completed' : 'skipped'}\n`;
+  }
+}
+
+let output = '';
+const destination = new Writable({
+  write(chunk, _encoding, callback) {
+    output += chunk;
+    callback();
+  },
+});
+
+run().compose(customReporter).pipe(destination);
+
+(async () => {
+  await finished(destination);
+  assert.strictEqual(output, 'completed:completed\nskipped:skipped\n');
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-diagnostic-channels.js b/test/parallel/test-bench-diagnostic-channels.js
new file mode 100644
index 000000000000..1c6d3f60135b
--- /dev/null
+++ b/test/parallel/test-bench-diagnostic-channels.js
@@ -0,0 +1,119 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const dc = require('diagnostics_channel');
+const { createRunner } = require('node:bench');
+
+const prefix = `node:bench:test:${process.pid}`;
+const inheritedName = `${prefix}:inherited`;
+const nestedName = `${prefix}:nested`;
+const benchmarkName = `${prefix}:benchmark`;
+const unlistedName = `${prefix}:unlisted`;
+const symbolName = Symbol(`${prefix}:symbol`);
+const inheritedChannel = dc.channel(inheritedName);
+const nestedChannel = dc.channel(nestedName);
+const benchmarkChannel = dc.channel(benchmarkName);
+const unlistedChannel = dc.channel(unlistedName);
+const symbolChannel = dc.channel(symbolName);
+
+function recordSample(context) {
+  context.record({ duration_ns: 1n, operations: 1 });
+}
+
+async function testCapture() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.suite('outer', {
+    diagnosticChannels: [inheritedName, symbolName, inheritedName],
+  }, common.mustCall(() => {
+    runner.suite('inner', {
+      diagnosticChannels: [nestedName],
+    }, common.mustCall(() => {
+      runner.bench('captured', {
+        diagnosticChannels: [benchmarkName, nestedName],
+        samples: 1,
+      }, common.mustCall((context) => {
+        const message = { value: 1 };
+        inheritedChannel.publish(message);
+        message.value = 0;
+        nestedChannel.publish({ value: 2 });
+        benchmarkChannel.publish({ value: 3 });
+        unlistedChannel.publish({ value: 4 });
+        symbolChannel.publish({ value: 5 });
+        recordSample(context);
+      }));
+    }));
+  }));
+  runner.bench('not captured', { samples: 1 }, common.mustCall((context) => {
+    inheritedChannel.publish({ value: 6 });
+    recordSample(context);
+  }));
+
+  const records = await runner.run().toArray();
+  const plan = records.find(
+    ({ type, data }) => type === 'bench:plan' && data.name === 'captured').data;
+  assert.deepStrictEqual(plan.diagnosticChannels, [
+    inheritedName,
+    nestedName,
+    benchmarkName,
+  ]);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic').map(({ data }) => data);
+  assert.deepStrictEqual(diagnostics.map(({ message }) => message), [
+    { name: inheritedName, message: { value: 1 } },
+    { name: nestedName, message: { value: 2 } },
+    { name: benchmarkName, message: { value: 3 } },
+  ]);
+  assert(diagnostics.every(({ level }) => level === 'info'));
+  assert.strictEqual(inheritedChannel.hasSubscribers, false);
+  assert.strictEqual(nestedChannel.hasSubscribers, false);
+  assert.strictEqual(benchmarkChannel.hasSubscribers, false);
+  assert.strictEqual(symbolChannel.hasSubscribers, false);
+}
+
+async function testUncloneableMessage() {
+  const name = `${prefix}:uncloneable`;
+  const channel = dc.channel(name);
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.bench('uncloneable', {
+    diagnosticChannels: [name],
+    samples: 1,
+  }, common.mustCall((context) => {
+    channel.publish(() => {});
+    recordSample(context);
+  }));
+  const records = await runner.run().toArray();
+  const result = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(result.error.name, 'DataCloneError');
+  assert.strictEqual(channel.hasSubscribers, false);
+}
+
+async function testAbortCleanup() {
+  const name = `${prefix}:abort`;
+  const channel = dc.channel(name);
+  const controller = new AbortController();
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.bench('abort', {
+    diagnosticChannels: [name],
+    samples: 1,
+    signal: controller.signal,
+  }, common.mustCall((context) => {
+    controller.abort(new Error('stop'));
+    assert.strictEqual(channel.hasSubscribers, false);
+    channel.publish({ ignored: true });
+    recordSample(context);
+  }));
+  const records = await runner.run().toArray();
+  assert.strictEqual(
+    records.some(({ type }) => type === 'bench:diagnostic'),
+    false,
+  );
+}
+
+(async () => {
+  await testCapture();
+  await testUncloneableMessage();
+  await testAbortCleanup();
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-diagnostics.js b/test/parallel/test-bench-diagnostics.js
new file mode 100644
index 000000000000..b5383f2bdacc
--- /dev/null
+++ b/test/parallel/test-bench-diagnostics.js
@@ -0,0 +1,177 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+
+function recordSample(b) {
+  b.record({
+    __proto__: null,
+    duration_ns: 1n,
+    operations: 1,
+  });
+}
+
+async function testListenerFailure(callbackError) {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const listenerError = new Error('diagnostic listener failed');
+  const completion = runner.bench('listener failure', {
+    samples: 1,
+  }, common.mustCall((b) => {
+    b.diagnostic('listener failure');
+    if (callbackError !== undefined) throw callbackError;
+    recordSample(b);
+  }));
+  const stream = runner.run();
+  stream.on('bench:diagnostic', common.mustCall(() => {
+    throw listenerError;
+  }));
+  await stream.toArray();
+  const result = await completion;
+  assert.strictEqual(result.error, callbackError ?? listenerError);
+  assert.strictEqual(result.samples.length, callbackError === undefined ? 1 : 0);
+}
+
+async function testAbortDuringDiagnosticDelivery() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const abortReason = new Error('stop diagnostic delivery');
+  const controller = new AbortController();
+  const completion = runner.bench('abort diagnostics', {
+    samples: 1,
+  }, common.mustCall((b) => {
+    for (let i = 0; i < 32; i++) b.diagnostic(`diagnostic ${i}`);
+    recordSample(b);
+  }));
+  const stream = runner.run({ signal: controller.signal });
+  const iterator = stream[Symbol.asyncIterator]();
+  const records = [];
+  records.push((await iterator.next()).value);
+  for (let i = 0; i < 100 &&
+       stream.readableLength < stream.readableHighWaterMark; i++) {
+    await setImmediate();
+  }
+  assert.strictEqual(stream.readableLength, stream.readableHighWaterMark);
+  controller.abort(abortReason);
+  while (true) {
+    const { done, value } = await iterator.next();
+    if (done) break;
+    records.push(value);
+  }
+
+  const result = await completion;
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  const completeIndex = records.findIndex(
+    ({ type }) => type === 'bench:complete');
+  assert.strictEqual(diagnostics.length, 32);
+  assert(records.indexOf(diagnostics.at(-1)) < completeIndex);
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(result.error.code, 'ABORT_ERR');
+  assert.strictEqual(result.error.cause, abortReason);
+  assert.strictEqual(result.samples.length, 1);
+}
+
+async function testAfterEachFailurePrecedence() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const callbackError = new Error('callback failed');
+  const afterEachError = new Error('afterEach failed');
+  runner.afterEach(common.mustCall(() => {
+    throw afterEachError;
+  }));
+  const completion = runner.bench('afterEach precedence', {
+    samples: 1,
+  }, common.mustCall((b) => {
+    b.diagnostic('before failures');
+    throw callbackError;
+  }));
+  await runner.run().toArray();
+  assert.strictEqual((await completion).error, afterEachError);
+}
+
+(async () => {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  let finalContext;
+  const completed = runner.bench('diagnostics', {
+    samples: 2,
+    warmup: 1,
+  }, common.mustCall((b) => {
+    finalContext = b;
+    const detail = { index: b.index };
+    const message = { index: b.index, phase: b.phase };
+    const level = b.phase === 'warmup' ? 'info' : 'warning';
+    assert.strictEqual(b.diagnostic(message, {
+      detail,
+      level,
+    }), undefined);
+    detail.index = -1;
+    message.index = -1;
+    recordSample(b);
+  }, 3));
+  const expectedError = new Error('benchmark failed');
+  const failed = runner.bench('failed diagnostic', {
+    samples: 1,
+  }, common.mustCall((b) => {
+    b.diagnostic('before failure', {
+      detail: { retained: true },
+      level: 'warning',
+    });
+    throw expectedError;
+  }));
+
+  const namedDiagnostics = [];
+  const stream = runner.run();
+  stream.on('bench:diagnostic', (diagnostic) => {
+    namedDiagnostics.push(diagnostic);
+  });
+  const records = await stream.toArray();
+  const completedResult = await completed;
+  const failedResult = await failed;
+  const diagnosticRecords = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  const diagnostics = diagnosticRecords.map(({ data }) => data);
+
+  assert.strictEqual(completedResult.error, undefined);
+  assert.strictEqual(failedResult.error, expectedError);
+  assert.strictEqual(diagnostics.length, 4);
+  assert.strictEqual(namedDiagnostics.length, diagnostics.length);
+  assert.deepStrictEqual(diagnostics.map(({ message }) => message), [
+    { index: 0, phase: 'warmup' },
+    { index: 0, phase: 'measurement' },
+    { index: 1, phase: 'measurement' },
+    'before failure',
+  ]);
+  assert.deepStrictEqual(diagnostics.map(({ phase, index, level }) => ({
+    phase,
+    index,
+    level,
+  })), [
+    { phase: 'warmup', index: 0, level: 'info' },
+    { phase: 'measurement', index: 0, level: 'warning' },
+    { phase: 'measurement', index: 1, level: 'warning' },
+    { phase: 'measurement', index: 0, level: 'warning' },
+  ]);
+  assert.deepStrictEqual(
+    diagnostics.map(({ detail }) => detail),
+    [{ index: 0 }, { index: 0 }, { index: 1 }, { retained: true }]);
+  assert(diagnostics.slice(0, 3).every(
+    ({ benchId }) => benchId === completedResult.benchId));
+  assert.strictEqual(diagnostics[3].benchId, failedResult.benchId);
+  assert.notStrictEqual(namedDiagnostics[0], diagnostics[0]);
+
+  for (let i = 0; i < 2; i++) {
+    const diagnosticIndex = records.indexOf(diagnosticRecords[i + 1]);
+    const sampleIndex = records.findIndex(({ type, data }) =>
+      type === 'bench:sample' && data.benchId === completedResult.benchId &&
+      data.index === i);
+    assert(diagnosticIndex < sampleIndex);
+  }
+  assert.throws(() => finalContext.diagnostic('too late'), {
+    code: 'ERR_INVALID_STATE',
+  });
+  await testListenerFailure(undefined);
+  await testListenerFailure(new Error('callback failed'));
+  await testAbortDuringDiagnosticDelivery();
+  await testAfterEachFailurePrecedence();
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-errors.js b/test/parallel/test-bench-errors.js
new file mode 100644
index 000000000000..c6e4a022cfdd
--- /dev/null
+++ b/test/parallel/test-bench-errors.js
@@ -0,0 +1,121 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { bench, run, suite } = require('node:bench');
+const { setTimeout } = require('timers/promises');
+
+const options = { samples: 1 };
+
+bench('missing start', options, () => {});
+bench('missing end', options, (b) => b.start());
+bench('end before start', options, (b) => b.end(1));
+bench('duplicate start', options, (b) => {
+  b.start();
+  b.start();
+});
+bench('duplicate end', options, (b) => {
+  b.start();
+  b.end(1);
+  b.end(1);
+});
+bench('invalid operations', options, (b) => {
+  b.start();
+  b.end(0);
+});
+bench('throws', options, () => {
+  throw new Error('benchmark failure');
+});
+let lateTimeoutActive = false;
+bench('late timeout', { samples: 1, timeout: 5 }, async (b) => {
+  lateTimeoutActive = true;
+  try {
+    b.start();
+    await setTimeout(30);
+    b.end(1);
+  } finally {
+    lateTimeoutActive = false;
+  }
+});
+bench('after late timeout', options, common.mustCall((b) => {
+  assert.strictEqual(lateTimeoutActive, false);
+  completeSample(b);
+}));
+
+const signal = AbortSignal.abort(new Error('stop'));
+bench('aborted', { samples: 1, signal }, () => {});
+
+bench('duplicate', { samples: 1, params: { value: 1 } }, completeSample);
+bench('duplicate', { samples: 1, params: { value: 1 } }, completeSample);
+bench('continues', options, completeSample);
+bench('timeout', { samples: 1, timeout: 10 }, async () => {
+  await new Promise(() => {});
+});
+const suiteCompletion = suite('after unsettled timeout suite', () => {
+  bench('after unsettled timeout', options, common.mustNotCall());
+  bench.skip('skipped after unsettled timeout', options, common.mustNotCall());
+});
+suiteCompletion.then(common.mustCall());
+
+const completions = [];
+const sampleNames = [];
+let summary;
+const stream = run();
+stream.on('bench:complete', (result) => completions.push(result));
+stream.on('bench:sample', (sample) => sampleNames.push(sample.name));
+stream.on('bench:summary', (result) => { summary = result; });
+stream.on('end', common.mustCall(() => {
+  assert.strictEqual(completions.length, 16);
+  assert.deepStrictEqual(summary.counts, {
+    __proto__: null,
+    completed: 3,
+    failed: 12,
+    skipped: 1,
+    total: 16,
+  });
+  assert.strictEqual(summary.success, false);
+
+  const byName = new Map();
+  for (const result of completions) {
+    const values = byName.get(result.name) ?? [];
+    values.push(result);
+    byName.set(result.name, values);
+  }
+
+  assert.match(byName.get('missing start')[0].error.message,
+               /did not call start/);
+  assert.match(byName.get('missing end')[0].error.message,
+               /did not call end/);
+  assert.match(byName.get('end before start')[0].error.message,
+               /before start/);
+  assert.strictEqual(byName.get('duplicate start')[0].error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('duplicate end')[0].error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('invalid operations')[0].error.code,
+                     'ERR_OUT_OF_RANGE');
+  assert.strictEqual(byName.get('throws')[0].error.message,
+                     'benchmark failure');
+  assert.strictEqual(byName.get('timeout')[0].error.code,
+                     'ERR_OPERATION_FAILED');
+  assert.strictEqual(byName.get('late timeout')[0].error.code,
+                     'ERR_OPERATION_FAILED');
+  assert.strictEqual(byName.get('after late timeout')[0].error, undefined);
+  assert.strictEqual(byName.get('aborted')[0].error.code, 'ABORT_ERR');
+
+  const duplicates = byName.get('duplicate');
+  assert.strictEqual(duplicates[0].error, undefined);
+  assert.match(duplicates[1].error.message, /duplicate benchmark identity/);
+  assert.strictEqual(byName.get('continues')[0].error, undefined);
+  const unsettled = byName.get('after unsettled timeout')[0].error;
+  assert.strictEqual(unsettled.code, 'ABORT_ERR');
+  assert.strictEqual(unsettled.cause.code, 'ERR_OPERATION_FAILED');
+  assert.strictEqual(
+    byName.get('skipped after unsettled timeout')[0].skip, true);
+  setTimeout(40).then(common.mustCall(() => {
+    assert.strictEqual(sampleNames.includes('late timeout'), false);
+  }));
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-filtering.js b/test/parallel/test-bench-filtering.js
new file mode 100644
index 000000000000..b9a3124d8b7e
--- /dev/null
+++ b/test/parallel/test-bench-filtering.js
@@ -0,0 +1,61 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { bench, run, suite } = require('node:bench');
+
+const calls = [];
+
+function complete(name) {
+  return (b) => {
+    calls.push(name);
+    completeSample(b);
+  };
+}
+
+suite('selected', { only: true }, () => {
+  bench('included', { samples: 1 }, complete('included'));
+  bench.skip('explicitly skipped', { samples: 1 },
+             common.mustNotCall());
+  bench('pattern filtered', { samples: 1 },
+        common.mustNotCall());
+});
+bench('only filtered', { samples: 1 }, common.mustNotCall());
+
+const results = [];
+const plans = [];
+const namePattern = /^selected (included|explicitly skipped)$/;
+let patternMutated = false;
+const stream = run({ namePattern });
+stream.on('bench:plan', common.mustCall((plan) => {
+  assert.deepStrictEqual(calls, []);
+  plans.push(plan);
+  if (!patternMutated) {
+    patternMutated = true;
+    namePattern.compile('only filtered');
+  }
+}, 4));
+stream.on('bench:complete', (result) => results.push(result));
+stream.on('end', common.mustCall(() => {
+  assert.deepStrictEqual(calls, ['included']);
+  assert.strictEqual(results.length, 4);
+
+  const byName = new Map(results.map((result) => [result.name, result]));
+  assert.strictEqual(byName.get('included').error, undefined);
+  assert.strictEqual(byName.get('explicitly skipped').skip, true);
+  assert.strictEqual(byName.get('pattern filtered').skip, 'name pattern');
+  assert.strictEqual(byName.get('only filtered').skip, 'only');
+  assert.deepStrictEqual(plans.map(({ name, selected, skip }) => ({
+    name,
+    selected,
+    skip,
+  })), [
+    { name: 'included', selected: true, skip: undefined },
+    { name: 'explicitly skipped', selected: false, skip: true },
+    { name: 'pattern filtered', selected: false, skip: 'name pattern' },
+    { name: 'only filtered', selected: false, skip: 'only' },
+  ]);
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-harness-errors.js b/test/parallel/test-bench-harness-errors.js
new file mode 100644
index 000000000000..a8ea3bb779ad
--- /dev/null
+++ b/test/parallel/test-bench-harness-errors.js
@@ -0,0 +1,141 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+
+async function testSynchronousSuiteFailure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const completion = runner.suite('outer', () => {
+    runner.suite('nested', () => {
+      runner.bench('blocked', { samples: 1 }, common.mustNotCall());
+    });
+    throw new Error('synchronous suite failure');
+  });
+  const records = await runner.run().toArray();
+  await completion;
+  const plan = records.find(
+    ({ type }) => type === 'bench:plan').data;
+  const result = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(plan.name, 'blocked');
+  assert.strictEqual(plan.selected, true);
+  assert.strictEqual(
+    records.some(({ type }) => type === 'bench:start'), false);
+  assert.strictEqual(result.name, 'blocked');
+  assert.strictEqual(result.error.message, 'synchronous suite failure');
+}
+
+async function testRunSignal() {
+  const runner = createRunner();
+  const controller = new AbortController();
+  let invocations = 0;
+  let abortPromise;
+  const completion = runner.bench('aborted between samples', {
+    samples: 3,
+  }, (b) => {
+    invocations++;
+    completeSample(b);
+    if (b.index === 0) {
+      abortPromise = setImmediate().then(() => {
+        controller.abort(new Error('run aborted'));
+      });
+    }
+  });
+  await runner.run({ signal: controller.signal }).toArray();
+  const result = await completion;
+  await abortPromise;
+  await setImmediate();
+  assert.strictEqual(result.error.code, 'ABORT_ERR');
+  assert.strictEqual(result.error.cause.message, 'run aborted');
+  assert.strictEqual(invocations, 1);
+}
+
+async function testRunSignalAfterSample() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const controller = new AbortController();
+  const reason = new Error('sample aborted');
+  const completion = runner.bench('aborted after sample', {
+    samples: 2,
+  }, completeSample);
+  const stream = runner.run({ signal: controller.signal });
+  stream.once('bench:sample', common.mustCall(() => {
+    controller.abort(reason);
+  }));
+  const records = await stream.toArray();
+  const result = await completion;
+  assert.strictEqual(result.error.code, 'ABORT_ERR');
+  assert.strictEqual(result.error.cause, reason);
+  assert.strictEqual(result.samples.length, 1);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testStringNamePattern() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.bench('included', { samples: 1 }, completeSample);
+  runner.bench('excluded', { samples: 1 }, common.mustNotCall());
+  const records = await runner.run({ namePattern: 'included' }).toArray();
+  const excluded = records.find(
+    ({ type, data }) => type === 'bench:complete' &&
+      data.name === 'excluded').data;
+  const included = records.find(
+    ({ type, data }) => type === 'bench:complete' &&
+      data.name === 'included').data;
+  assert.strictEqual(included.error, undefined);
+  assert.strictEqual(included.samples.length, 1);
+  assert.strictEqual(excluded.skip, 'name pattern');
+}
+
+async function testTopLevelRecovery() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const suiteCompletion = runner.suite('nested', () => {
+    runner.bench('listener failure', { samples: 1 }, completeSample);
+  });
+  const stream = runner.run();
+  const failure = new Error();
+  failure.message = undefined;
+  stream.on('bench:start', common.mustCall(() => { throw failure; }));
+  const records = await stream.toArray();
+  await suiteCompletion;
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic').data;
+  const summary = records.find(({ type }) => type === 'bench:summary').data;
+  assert.strictEqual(diagnostic.message, 'Error');
+  assert.strictEqual(diagnostic.file, undefined);
+  assert.strictEqual(diagnostic.line, undefined);
+  assert.strictEqual(diagnostic.column, undefined);
+  assert.strictEqual(summary.duration_ns, 0n);
+  assert.strictEqual(summary.success, false);
+}
+
+async function testRepeatedReportingFailure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const original = new Error('start listener failed');
+  const diagnostic = new Error('diagnostic listener failed');
+  const summary = new Error('summary listener failed');
+  const completion = runner.bench('reporting failures', {
+    samples: 1,
+  }, completeSample);
+  const stream = runner.run();
+  stream.on('bench:start', common.mustCall(() => { throw original; }));
+  stream.on('bench:diagnostic', common.mustCall(() => {
+    throw diagnostic;
+  }, 2));
+  stream.on('bench:summary', common.mustCall(() => { throw summary; }));
+  const ended = new Promise((resolve) => stream.once('end', resolve));
+  stream.resume();
+  await ended;
+  assert.strictEqual((await completion).error, original);
+}
+
+(async () => {
+  await testSynchronousSuiteFailure();
+  await testRunSignal();
+  await testRunSignalAfterSample();
+  await testStringNamePattern();
+  await testTopLevelRecovery();
+  await testRepeatedReportingFailure();
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-hook-errors.js b/test/parallel/test-bench-hook-errors.js
new file mode 100644
index 000000000000..498406010c49
--- /dev/null
+++ b/test/parallel/test-bench-hook-errors.js
@@ -0,0 +1,80 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { setImmediate } = require('timers/promises');
+const {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  run,
+  suite,
+} = require('node:bench');
+
+suite('before failure', () => {
+  before(() => { throw new Error('before failure'); });
+  after(common.mustCall());
+  bench('blocked by before', { samples: 1 }, common.mustNotCall());
+});
+
+suite('beforeEach failure', () => {
+  beforeEach(() => { throw new Error('beforeEach failure'); });
+  afterEach(common.mustCall());
+  bench('blocked by beforeEach', { samples: 1 }, common.mustNotCall());
+});
+
+suite('after failure', () => {
+  after(() => { throw new Error('after failure'); });
+  bench('completes before after', { samples: 1 }, completeSample);
+});
+
+suite('build failure', async () => {
+  await setImmediate();
+  throw new Error('build failure');
+});
+
+bench('continues after suite failures', { samples: 1 }, completeSample);
+
+const completions = [];
+const diagnostics = [];
+let summary;
+const stream = run();
+stream.on('bench:complete', (result) => completions.push(result));
+stream.on('bench:diagnostic', (diagnostic) => {
+  diagnostics.push(diagnostic);
+});
+stream.on('bench:summary', (value) => { summary = value; });
+stream.on('end', common.mustCall(() => {
+  assert.deepStrictEqual(summary.counts, {
+    __proto__: null,
+    completed: 2,
+    failed: 2,
+    skipped: 0,
+    total: 4,
+  });
+  assert.strictEqual(summary.success, false);
+
+  const byName = new Map(completions.map((result) => [result.name, result]));
+  assert.strictEqual(byName.get('blocked by before').error.message,
+                     'before failure');
+  assert.strictEqual(byName.get('blocked by beforeEach').error.message,
+                     'beforeEach failure');
+  assert.strictEqual(byName.get('completes before after').error, undefined);
+  assert.strictEqual(
+    byName.get('continues after suite failures').error, undefined);
+
+  assert.deepStrictEqual(
+    diagnostics.map(({ message }) => message).sort(),
+    ['after failure', 'before failure', 'build failure'],
+  );
+  for (const diagnostic of diagnostics) {
+    assert.strictEqual(typeof diagnostic.file, 'string');
+    assert.strictEqual(typeof diagnostic.line, 'number');
+    assert.strictEqual(typeof diagnostic.column, 'number');
+  }
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-module.mjs b/test/parallel/test-bench-module.mjs
new file mode 100644
index 000000000000..b3b17976e19f
--- /dev/null
+++ b/test/parallel/test-bench-module.mjs
@@ -0,0 +1,54 @@
+// Flags: --experimental-bench --no-warnings
+
+import '../common/index.mjs';
+import assert from 'node:assert';
+import { createRequire, builtinModules, isBuiltin } from 'node:module';
+import benchDefault, {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  describe,
+  run,
+  suite,
+} from 'node:bench';
+import { json, spec } from 'node:bench/reporters';
+
+assert.strictEqual(benchDefault, bench);
+assert.strictEqual(describe, suite);
+for (const value of [
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  run,
+  suite,
+]) {
+  assert.strictEqual(typeof value, 'function');
+}
+assert.strictEqual(typeof bench.skip, 'function');
+assert.strictEqual(typeof bench.only, 'function');
+assert.strictEqual(typeof json, 'function');
+assert.strictEqual(typeof spec, 'function');
+
+assert.strictEqual(isBuiltin('node:bench'), true);
+assert.strictEqual(isBuiltin('node:bench/reporters'), true);
+assert.strictEqual(isBuiltin('bench'), false);
+assert.strictEqual(isBuiltin('bench/reporters'), false);
+assert.strictEqual(builtinModules.includes('node:bench'), true);
+assert.strictEqual(builtinModules.includes('node:bench/reporters'), true);
+assert.strictEqual(process.getBuiltinModule('node:bench'), benchDefault);
+assert.strictEqual(process.getBuiltinModule('bench'), undefined);
+
+const require = createRequire(import.meta.url);
+const reporters = require('node:bench/reporters');
+assert.strictEqual(reporters.json, json);
+assert.strictEqual(reporters.spec, spec);
+assert.throws(() => require('bench'), { code: 'MODULE_NOT_FOUND' });
+assert.throws(() => require('bench/reporters'), { code: 'MODULE_NOT_FOUND' });
+await assert.rejects(import('bench'), { code: 'ERR_MODULE_NOT_FOUND' });
+await assert.rejects(import('bench/reporters'), {
+  code: 'ERR_MODULE_NOT_FOUND',
+});
diff --git a/test/parallel/test-bench-reporters.js b/test/parallel/test-bench-reporters.js
new file mode 100644
index 000000000000..7a3ed8bff7cc
--- /dev/null
+++ b/test/parallel/test-bench-reporters.js
@@ -0,0 +1,177 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { Readable } = require('stream');
+const { bench, run } = require('node:bench');
+const { json, spec } = require('node:bench/reporters');
+
+bench('json completed', {
+  params: { size: 'small' },
+  samples: 1,
+}, (b) => {
+  completeSample(b);
+});
+
+bench('json failed', { samples: 1 }, () => {
+  const error = new Error('benchmark failed', { cause: 7n });
+  error.code = 'ERR_BENCHMARK_EXAMPLE';
+  throw error;
+});
+
+(async () => {
+  const chunks = await run().compose(json).toArray();
+  const lines = chunks.join('').trim().split('\n');
+  const records = lines.map((line) => JSON.parse(line));
+
+  assert.strictEqual(records.length, 8);
+  const plans = records.filter(({ type }) => type === 'bench:plan');
+  assert.deepStrictEqual(plans.map(({ data }) => data.selected), [true, true]);
+  const sample = records.find(({ type }) => type === 'bench:sample');
+  assert.match(sample.data.duration_ns, /^\d+$/);
+
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete');
+  const completed = completions.find(
+    ({ data }) => data.name === 'json completed').data;
+  assert.match(completed.samples[0].duration_ns, /^\d+$/);
+
+  const failed = completions.find(
+    ({ data }) => data.name === 'json failed').data;
+  assert.strictEqual(failed.error.name, 'Error');
+  assert.strictEqual(failed.error.message, 'benchmark failed');
+  assert.strictEqual(failed.error.code, 'ERR_BENCHMARK_EXAMPLE');
+  assert.strictEqual(failed.error.cause, '7');
+  assert.match(failed.error.stack, /benchmark failed/);
+
+  const summary = records.find(
+    ({ type }) => type === 'bench:summary').data;
+  assert.match(summary.duration_ns, /^\d+$/);
+  assert.deepStrictEqual(summary.counts, {
+    completed: 1,
+    failed: 1,
+    skipped: 0,
+    total: 2,
+  });
+
+  const synthetic = [
+    {
+      type: 'bench:complete',
+      data: {
+        name: 'fast',
+        params: { size: 'small' },
+        samples: [{}, {}],
+        summary: {
+          mean: 1500,
+          median: 1400,
+          coefficientOfVariation: 0.1,
+          confidenceInterval: { lower: 1000, upper: 2000 },
+          skewness: 2,
+        },
+      },
+    },
+    {
+      type: 'bench:complete',
+      data: {
+        name: 'later',
+        params: {},
+        samples: [],
+        skip: 'not supported',
+      },
+    },
+    {
+      type: 'bench:complete',
+      data: {
+        name: 'broken',
+        params: {},
+        samples: [],
+        error: new Error('boom'),
+      },
+    },
+    {
+      type: 'bench:diagnostic',
+      data: { message: 'suite problem' },
+    },
+    {
+      type: 'bench:summary',
+      data: {
+        counts: { completed: 1, failed: 1, skipped: 1, total: 3 },
+      },
+    },
+  ];
+  const specChunks = await Readable.from(synthetic).compose(spec).toArray();
+  assert.strictEqual(specChunks.join(''),
+                     'benchmark | samples | mean rate | 95% CI | ' +
+                     'median rate | warning\n' +
+                     'fast [size="small"] | 2 | 1.50k ops/s | ' +
+                     '[1.00k ops/s, 2.00k ops/s] | 1.40k ops/s | ' +
+                     'noisy, skewed\n' +
+                     'later | 0 | - | - | - | skipped: not supported\n' +
+                     'broken | 0 | - | - | - | error: boom\n' +
+                     'diagnostic: suite problem\n\n' +
+                     '1 completed, 1 failed, 1 skipped\n');
+
+  const circular = {};
+  circular.self = circular;
+  const aggregate = new AggregateError([1n], 'aggregate failure');
+  const jsonEdgeChunks = await Readable.from([{
+    type: 'bench:diagnostic',
+    data: { aggregate, circular },
+  }]).compose(json).toArray();
+  const jsonEdge = JSON.parse(jsonEdgeChunks.join(''));
+  assert.deepStrictEqual(jsonEdge.data.aggregate.errors, ['1']);
+  assert.strictEqual(jsonEdge.data.circular.self, '[Circular]');
+
+  async function* undefinedRecord() {
+    yield undefined;
+  }
+  const undefinedChunks = [];
+  for await (const chunk of json(undefinedRecord())) {
+    undefinedChunks.push(chunk);
+  }
+  assert.strictEqual(undefinedChunks.join(''), 'null\n');
+
+  function result(name, rate) {
+    return {
+      type: 'bench:complete',
+      data: {
+        name,
+        params: {},
+        samples: [{}],
+        summary: {
+          mean: rate,
+          median: rate,
+          coefficientOfVariation: 0,
+          confidenceInterval: { lower: rate, upper: rate },
+          skewness: 0,
+        },
+      },
+    };
+  }
+
+  const specEdgeChunks = await Readable.from([
+    result('giga', 1_500_000_000),
+    result('mega', 1_500_000),
+    result('fractional', 0.5),
+    {
+      type: 'bench:complete',
+      data: { name: 'skip', params: {}, samples: [], skip: true },
+    },
+    {
+      type: 'bench:complete',
+      data: { name: 'error', params: {}, samples: [], error: 'failure' },
+    },
+  ]).compose(spec).toArray();
+  const specEdgeOutput = specEdgeChunks.join('');
+  assert.match(specEdgeOutput, /giga \| 1 \| 1\.50G ops\/s/);
+  assert.match(specEdgeOutput, /mega \| 1 \| 1\.50M ops\/s/);
+  assert.match(specEdgeOutput, /fractional \| 1 \| 0\.500 ops\/s/);
+  assert.match(specEdgeOutput, /skip \| 0 \| - \| - \| - \| skipped\n/);
+  assert.match(specEdgeOutput,
+               /error \| 0 \| - \| - \| - \| error: failure/);
+
+  const emptySpecChunks = await Readable.from([]).compose(spec).toArray();
+  assert.deepStrictEqual(emptySpecChunks, []);
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-run-file.js b/test/parallel/test-bench-run-file.js
new file mode 100644
index 000000000000..14735986dc7c
--- /dev/null
+++ b/test/parallel/test-bench-run-file.js
@@ -0,0 +1,433 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const { once } = require('events');
+const path = require('path');
+const { runFile } = require('node:bench');
+
+const fixture = fixtures.path('bench-runner/run-file.cjs');
+const relativeFixture = path.relative(process.cwd(), fixture);
+
+assert.throws(() => runFile(null), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => runFile(fixture, null), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => runFile(fixture, { execArgv: null }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { execArgv: [1] }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--bench'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: [fixture] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['-e', '0'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['-e0'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--require'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--require', ''] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--require='] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: [`-r=${fixture}`] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--prof-process'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--prof_process'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, {
+  execArgv: ['--bench_name_pattern=run'],
+}), { code: 'ERR_INVALID_ARG_VALUE' });
+assert.throws(() => runFile(`${fixture}\0`), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(Buffer.from(`${fixture}\0`)), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { env: null }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { env: { INVALID: 1 } }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { env: { INVALID: 'x\0' } }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { env: { NODE_CHANNEL_FD: 1 } }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { signal: {} }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { signal: { aborted: false } }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+
+async function testRunFile() {
+  const execArgv = ['--expose-gc', '--no-warnings', '-r', 'fs'];
+  const env = {
+    __proto__: null,
+    ...process.env,
+    NODE_BENCH_CONTEXT: 'not-a-child',
+    NODE_BENCH_OMITTED: undefined,
+    NODE_BENCH_RUN_FILE: 'original',
+    NODE_CHANNEL_FD: '999',
+    NODE_CHANNEL_SERIALIZATION_MODE: 'json',
+  };
+  const stream = runFile(relativeFixture, { env, execArgv });
+  execArgv.length = 0;
+  env.NODE_BENCH_RUN_FILE = 'mutated';
+  const records = await stream.toArray();
+  const plan = records.find(({ type }) => type === 'bench:plan').data;
+  const result = records.find(({ type }) => type === 'bench:complete').data;
+  const summary = records.at(-1).data;
+
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(plan.params.context, 'child');
+  assert.strictEqual(plan.params.exposed, true);
+  assert.strictEqual(plan.params.omitted, true);
+  assert.strictEqual(plan.params.value, 'original');
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(result.samples.length, 1);
+  assert.strictEqual(typeof result.samples[0].duration_ns, 'bigint');
+  assert.notStrictEqual(result.samples[0].detail.pid, process.pid);
+  assert(result.samples[0].detail.execArgv.includes('--expose-gc'));
+  assert(result.samples[0].detail.execArgv.includes('--no-warnings'));
+  assert(result.samples[0].detail.execArgv.includes('-r'));
+  assert.strictEqual(summary.success, true);
+  assert.strictEqual(summary.file, fixture);
+  assert.strictEqual(summary.entryFile, fixture);
+  assert.strictEqual(summary.fileRunId, result.fileRunId);
+  assert.strictEqual(summary.runId, result.runId);
+  assert.strictEqual(records.filter(
+    ({ type }) => type === 'bench:summary').length, 1);
+}
+
+async function testConcurrentCalls() {
+  const [cjsRecords, esmRecords] = await Promise.all([
+    runFile(fixtures.fileURL('bench-runner/a.cjs')).toArray(),
+    runFile(Buffer.from(path.relative(
+      process.cwd(),
+      fixtures.path('bench-runner/b.mjs'),
+    ))).toArray(),
+  ]);
+  const cjsResult = cjsRecords.find(
+    ({ type }) => type === 'bench:complete').data;
+  const esmResult = esmRecords.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(cjsResult.name, 'alpha');
+  assert.strictEqual(esmResult.name, 'beta');
+  assert.notStrictEqual(cjsResult.params.pid, esmResult.params.pid);
+  assert.notStrictEqual(cjsResult.runId, esmResult.runId);
+  assert.strictEqual(
+    cjsRecords.at(-1).data.file,
+    fixtures.path('bench-runner/a.cjs'),
+  );
+  assert.strictEqual(
+    esmRecords.at(-1).data.file,
+    fixtures.path('bench-runner/b.mjs'),
+  );
+}
+
+async function testLoadFailure() {
+  const missing = path.resolve(fixtures.fixturesDir, 'does-not-exist.cjs');
+  const records = await runFile(missing).toArray();
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert(diagnostics.some(
+    ({ data }) => data.level === 'error' && /failed with exit code/.test(
+      data.message)));
+  assert.strictEqual(records.some(
+    ({ type }) => type === 'bench:complete'), false);
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testEvaluationFailure() {
+  const records = await runFile(fixtures.path(
+    'bench-runner/load-error-after-declaration.cjs')).toArray();
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' &&
+    data.message === 'load failed after declaration'));
+  const result = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(result.name, 'declared before load error');
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(records.at(-1).data.counts.completed, 1);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testStructuredError() {
+  const records = await runFile(
+    fixtures.path('bench-runner/error.cjs')).toArray();
+  const result = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(result.error.code, 'ERR_BENCHMARK_FIXTURE');
+  assert.deepStrictEqual(result.error.cause, { value: 42n });
+  assert.match(result.error.stack, /error\.cjs/);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testAbort() {
+  const controller = new AbortController();
+  const reason = new Error('cancel run file');
+  const stream = runFile(
+    fixtures.path('bench-runner/run-file-blocked.cjs'),
+    { signal: controller.signal });
+  stream.once('bench:start', common.mustCall(() => controller.abort(reason)));
+  const records = await stream.toArray();
+  const diagnostic = records.find(({ type, data }) =>
+    type === 'bench:diagnostic' && data.error?.code === 'ABORT_ERR').data;
+  assert.strictEqual(diagnostic.error.cause.message, reason.message);
+  assert.strictEqual(records.some(
+    ({ type }) => type === 'bench:complete'), false);
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(records.at(-1).data.success, false);
+  assert.deepStrictEqual(records.at(-1).data.counts, {
+    __proto__: null,
+    completed: 0,
+    failed: 0,
+    skipped: 0,
+    total: 1,
+  });
+}
+
+async function testPartialAbort() {
+  const controller = new AbortController();
+  const stream = runFile(
+    fixtures.path('bench-runner/run-file-partial.cjs'),
+    { signal: controller.signal });
+  stream.on('bench:start', ({ name }) => {
+    if (name === 'aborted run file') controller.abort();
+  });
+  const records = await stream.toArray();
+  const summary = records.at(-1).data;
+  assert.strictEqual(records.filter(
+    ({ type }) => type === 'bench:complete').length, 1);
+  assert.deepStrictEqual(summary.counts, {
+    __proto__: null,
+    completed: 1,
+    failed: 0,
+    skipped: 0,
+    total: 2,
+  });
+  assert.strictEqual(summary.success, false);
+}
+
+async function testPostSummaryAbort() {
+  const controller = new AbortController();
+  const stream = runFile(
+    fixtures.path('bench-runner/run-file-lingering.cjs'),
+    { signal: controller.signal });
+  stream.on('bench:diagnostic', common.mustCall(({ message, stream }) => {
+    if (stream === 'stdout' && /child disconnected/.test(message)) {
+      controller.abort(new Error('stop lingering child'));
+    }
+  }, 2));
+  const records = await stream.toArray();
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' && data.error?.code === 'ABORT_ERR'));
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(records.at(-1).data.counts.completed, 1);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testExitCode() {
+  const records = await runFile(
+    fixtures.path('bench-runner/exit-code.cjs')).toArray();
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' &&
+    /set exit code/.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testParentExitCode() {
+  process.exitCode = 42;
+  try {
+    const records = await runFile(fixture).toArray();
+    assert.strictEqual(records.at(-1).data.success, true);
+  } finally {
+    process.exitCode = undefined;
+  }
+}
+
+async function testDefaultExecArgvSnapshot() {
+  const original = Array.from(process.execArgv);
+  try {
+    process.execArgv.push('--bench', '--eval', 'throw new Error()');
+    const stream = runFile(fixture);
+    process.execArgv.push('--require=/does/not/exist.cjs');
+    const records = await stream.toArray();
+    assert.strictEqual(records.at(-1).data.success, true);
+  } finally {
+    process.execArgv.length = 0;
+    process.execArgv.push(...original);
+  }
+}
+
+async function testExecPathSnapshot() {
+  const stream = runFile(fixture);
+  const execPath = process.execPath;
+  process.execPath = '/does/not/exist';
+  try {
+    const records = await stream.toArray();
+    assert.strictEqual(records.at(-1).data.success, true);
+  } finally {
+    process.execPath = execPath;
+  }
+}
+
+async function testSpawnFailure() {
+  const execPath = process.execPath;
+  let stream;
+  try {
+    process.execPath = fixtures.path('does-not-exist-node');
+    stream = runFile(fixture);
+  } finally {
+    process.execPath = execPath;
+  }
+  const records = await stream.toArray();
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic').data;
+  assert.strictEqual(diagnostic.error.code, 'ENOENT');
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+function testEvalParent() {
+  const script = `
+    require('node:bench').runFile(${JSON.stringify(fixture)})
+      .on('bench:summary', (summary) => console.log(summary.success));
+  `;
+  const result = spawnSync(process.execPath, [
+    '--no-warnings',
+    '--experimental-bench',
+    '-e',
+    script,
+  ], { encoding: 'utf8' });
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stdout, 'true\n');
+}
+
+function testPermissions() {
+  const fsReadScript = `
+    const assert = require('assert');
+    const { runFile } = require('node:bench');
+    const { pathToFileURL } = require('url');
+    const target = ${JSON.stringify(fixture)};
+    assert.strictEqual(process.permission.has('child'), true);
+    assert.strictEqual(process.permission.has('fs.read', target), false);
+    Promise.all([
+      target,
+      Buffer.from(target),
+      pathToFileURL(target),
+    ].map(async (input) => {
+      const records = await runFile(input).toArray();
+      const diagnostic = records.find(({ type, data }) =>
+        type === 'bench:diagnostic' &&
+        data.error?.code === 'ERR_ACCESS_DENIED');
+      assert.strictEqual(diagnostic.data.error.permission, 'FileSystemRead');
+      assert.strictEqual(diagnostic.data.error.resource, target);
+      assert.strictEqual(records.at(-1).type, 'bench:summary');
+      assert.strictEqual(records.at(-1).data.success, false);
+    })).catch((error) => {
+      console.error(error);
+      process.exitCode = 1;
+    });
+  `;
+  const result = spawnSync(process.execPath, [
+    '--no-warnings',
+    '--experimental-bench',
+    '--permission',
+    '--allow-child-process',
+    '-e',
+    fsReadScript,
+  ], { encoding: 'utf8' });
+  assert.strictEqual(result.status, 0, result.stderr);
+
+  const childProcessScript = `
+    const assert = require('assert');
+    const { runFile } = require('node:bench');
+    const target = ${JSON.stringify(fixture)};
+    assert.strictEqual(process.permission.has('fs.read', target), true);
+    assert.strictEqual(process.permission.has('child'), false);
+    runFile(target).toArray().then((records) => {
+      const diagnostic = records.find(({ type, data }) =>
+        type === 'bench:diagnostic' &&
+        data.error?.code === 'ERR_ACCESS_DENIED');
+      assert.strictEqual(diagnostic.data.error.permission, 'ChildProcess');
+      assert.strictEqual(diagnostic.data.error.resource, process.execPath);
+      assert.strictEqual(records.at(-1).type, 'bench:summary');
+      assert.strictEqual(records.at(-1).data.success, false);
+    }).catch((error) => {
+      console.error(error);
+      process.exitCode = 1;
+    });
+  `;
+  const childProcessResult = spawnSync(process.execPath, [
+    '--no-warnings',
+    '--experimental-bench',
+    '--permission',
+    `--allow-fs-read=${fixture}`,
+    '-e',
+    childProcessScript,
+  ], { encoding: 'utf8' });
+  assert.strictEqual(
+    childProcessResult.status,
+    0,
+    childProcessResult.stderr,
+  );
+}
+
+async function testPreAborted() {
+  const records = await runFile(fixture, {
+    signal: AbortSignal.abort(new Error('already cancelled')),
+  }).toArray();
+  assert.strictEqual(records.some(({ type }) => type === 'bench:start'), false);
+  assert.strictEqual(records.find(({ type }) =>
+    type === 'bench:diagnostic').data.error.code, 'ABORT_ERR');
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testDestroy() {
+  const stream = runFile(
+    fixtures.path('bench-runner/run-file-blocked.cjs'));
+  stream.once('bench:start', common.mustCall(() => stream.destroy()));
+  await once(stream, 'close');
+  assert.strictEqual(stream.destroyed, true);
+}
+
+(async () => {
+  await testRunFile();
+  await testConcurrentCalls();
+  await testLoadFailure();
+  await testEvaluationFailure();
+  await testStructuredError();
+  await testAbort();
+  await testPartialAbort();
+  await testPostSummaryAbort();
+  await testExitCode();
+  await testParentExitCode();
+  await testDefaultExecArgvSnapshot();
+  await testExecPathSnapshot();
+  await testSpawnFailure();
+  await testPreAborted();
+  await testDestroy();
+  testEvalParent();
+  testPermissions();
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-run-options.js b/test/parallel/test-bench-run-options.js
new file mode 100644
index 000000000000..e68b4e29c102
--- /dev/null
+++ b/test/parallel/test-bench-run-options.js
@@ -0,0 +1,47 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { bench, run } = require('node:bench');
+
+let invocations = 0;
+const timeout = common.platformTimeout(1000);
+bench('overridden', { samples: 8, timeout, warmup: 8 }, (b) => {
+  invocations++;
+  completeSample(b, invocations);
+});
+
+const plans = [];
+const samples = [];
+const types = [];
+const stream = run({
+  samples: 2,
+  warmup: 3,
+  yieldBetweenSamples: false,
+});
+stream.on('bench:plan', (plan) => plans.push(plan));
+stream.on('bench:sample', ({ operations }) => samples.push(operations));
+stream.on('data', ({ type }) => types.push(type));
+stream.on('end', common.mustCall(() => {
+  assert.strictEqual(plans.length, 1);
+  assert.deepStrictEqual({
+    samples: plans[0].samples,
+    selected: plans[0].selected,
+    skip: plans[0].skip,
+    timeout: plans[0].timeout,
+    warmup: plans[0].warmup,
+    yieldBetweenSamples: plans[0].yieldBetweenSamples,
+  }, {
+    samples: 2,
+    selected: true,
+    skip: undefined,
+    timeout,
+    warmup: 3,
+    yieldBetweenSamples: false,
+  });
+  assert.deepStrictEqual(samples, [4, 5]);
+  assert.deepStrictEqual(types.slice(0, 2), ['bench:plan', 'bench:start']);
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-run.js b/test/parallel/test-bench-run.js
new file mode 100644
index 000000000000..0107150262d7
--- /dev/null
+++ b/test/parallel/test-bench-run.js
@@ -0,0 +1,143 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { setImmediate } = require('timers/promises');
+const {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  run,
+  suite,
+} = require('node:bench');
+
+const calls = [];
+const contexts = new Set();
+let active = false;
+
+before(() => calls.push('root before'));
+after(() => calls.push('root after'));
+beforeEach(() => calls.push('root beforeEach'));
+afterEach(() => calls.push('root afterEach'));
+
+const suiteCompletion = suite('group', { tags: ['Group'] }, async () => {
+  await setImmediate();
+
+  before(() => calls.push('suite before'));
+  after(() => calls.push('suite after'));
+  beforeEach(() => calls.push('suite beforeEach'));
+  afterEach(() => calls.push('suite afterEach'));
+
+  bench('sync', {
+    params: { z: 2, a: true },
+    samples: 2,
+    tags: ['SYNC'],
+    warmup: 1,
+  }, common.mustCall((b) => {
+    assert.strictEqual(active, false);
+    active = true;
+    contexts.add(b);
+    calls.push('sync sample');
+    assert.deepStrictEqual(b.params, { __proto__: null, a: true, z: 2 });
+    completeSample(b);
+    active = false;
+  }, 3));
+
+  bench('async', { samples: 2 }, common.mustCall(async (b) => {
+    assert.strictEqual(active, false);
+    active = true;
+    contexts.add(b);
+    calls.push('async sample');
+    await setImmediate();
+    completeSample(b);
+    await setImmediate();
+    active = false;
+  }, 2));
+
+  bench.skip('skipped', { samples: 1 }, common.mustNotCall());
+});
+
+const records = [];
+const plans = [];
+const stream = run();
+stream.on('bench:plan', common.mustCall((plan) => {
+  assert.deepStrictEqual(calls, []);
+  plans.push(plan.name);
+}, 3));
+stream.on('data', (record) => records.push(record));
+stream.on('end', common.mustCall(() => {
+  assert.strictEqual(active, false);
+  assert.strictEqual(contexts.size, 5);
+
+  const starts = records.filter(({ type }) => type === 'bench:start');
+  const samples = records.filter(({ type }) => type === 'bench:sample');
+  const completions = records.filter(({ type }) => type === 'bench:complete');
+  const summaries = records.filter(({ type }) => type === 'bench:summary');
+
+  assert.strictEqual(starts.length, 2);
+  assert.strictEqual(samples.length, 4);
+  assert.strictEqual(completions.length, 3);
+  assert.strictEqual(summaries.length, 1);
+  assert.deepStrictEqual(plans, ['sync', 'async', 'skipped']);
+
+  const sync = completions.find(({ data }) => data.name === 'sync').data;
+  assert.strictEqual(sync.error, undefined);
+  assert.strictEqual(sync.skip, undefined);
+  assert.strictEqual(sync.samples.length, 2);
+  assert.strictEqual(Object.getPrototypeOf(sync), null);
+  assert.strictEqual(Object.getPrototypeOf(sync.params), null);
+  assert.deepStrictEqual(sync.tags, ['group', 'sync']);
+  assert.match(sync.benchId, /\{"a":true,"z":2\}/);
+  assert.notStrictEqual(sync.parentId, null);
+  assert.strictEqual(sync.summary.mean > 0, true);
+  assert.strictEqual(sync.summary.min <= sync.summary.mean, true);
+  assert.strictEqual(sync.summary.mean <= sync.summary.max, true);
+  assert.strictEqual(typeof sync.summary.confidenceInterval.lower, 'number');
+  assert.strictEqual(typeof sync.samples[0].duration_ns, 'bigint');
+
+  const asyncResult = completions.find(
+    ({ data }) => data.name === 'async').data;
+  assert.strictEqual(asyncResult.error, undefined);
+  assert.strictEqual(asyncResult.skip, undefined);
+  assert.strictEqual(asyncResult.samples.length, 2);
+
+  const skipped = completions.find(
+    ({ data }) => data.name === 'skipped').data;
+  assert.strictEqual(skipped.skip, true);
+  assert.deepStrictEqual(skipped.samples, []);
+
+  assert.deepStrictEqual(summaries[0].data.counts, {
+    __proto__: null,
+    completed: 2,
+    failed: 0,
+    skipped: 1,
+    total: 3,
+  });
+  assert.strictEqual(summaries[0].data.success, true);
+
+  assert.deepStrictEqual(calls, [
+    'root before',
+    'suite before',
+    'root beforeEach',
+    'suite beforeEach',
+    'sync sample',
+    'sync sample',
+    'sync sample',
+    'suite afterEach',
+    'root afterEach',
+    'root beforeEach',
+    'suite beforeEach',
+    'async sample',
+    'async sample',
+    'suite afterEach',
+    'root afterEach',
+    'suite after',
+    'root after',
+  ]);
+}));
+
+suiteCompletion.then(common.mustCall());
diff --git a/test/parallel/test-bench-stream.js b/test/parallel/test-bench-stream.js
new file mode 100644
index 000000000000..655a1a229130
--- /dev/null
+++ b/test/parallel/test-bench-stream.js
@@ -0,0 +1,382 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate, setTimeout } = require('timers/promises');
+
+function recordSample(b) {
+  b.record({
+    __proto__: null,
+    operations: 1,
+    duration_ns: 1n,
+  });
+}
+
+async function testReadableBackpressure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const sampleCount = 64;
+  let calls = 0;
+  const completion = runner.bench('bounded stream', {
+    samples: sampleCount,
+  }, (b) => {
+    calls++;
+    recordSample(b);
+  });
+  const stream = runner.run();
+  const iterator = stream[Symbol.asyncIterator]();
+  const first = await iterator.next();
+
+  assert.strictEqual(first.value.type, 'bench:plan');
+  await setImmediate();
+  assert(calls < sampleCount);
+  assert(stream.readableLength <= stream.readableHighWaterMark);
+
+  const records = [first.value];
+  for (;;) {
+    const next = await iterator.next();
+    if (next.done) break;
+    records.push(next.value);
+  }
+
+  const result = await completion;
+  assert.strictEqual(calls, sampleCount);
+  assert.strictEqual(result.samples.length, sampleCount);
+  assert.strictEqual(records[1].type, 'bench:start');
+  assert.strictEqual(records.length, sampleCount + 4);
+}
+
+async function testPlanBackpressure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const benchmarkCount = 32;
+  const completions = [];
+  let calls = 0;
+  for (let i = 0; i < benchmarkCount; i++) {
+    completions.push(runner.bench(`planned ${i}`, { samples: 1 }, (b) => {
+      calls++;
+      recordSample(b);
+    }));
+  }
+  const stream = runner.run();
+  const iterator = stream[Symbol.asyncIterator]();
+  const first = await iterator.next();
+
+  assert.strictEqual(first.value.type, 'bench:plan');
+  await setImmediate();
+  assert.strictEqual(calls, 0);
+  assert(stream.readableLength <= stream.readableHighWaterMark);
+  const records = [first.value];
+  for (;;) {
+    const next = await iterator.next();
+    if (next.done) break;
+    records.push(next.value);
+  }
+
+  await Promise.all(completions);
+  assert.strictEqual(calls, benchmarkCount);
+  assert.strictEqual(
+    records.slice(0, benchmarkCount).every(({ type }) => type === 'bench:plan'),
+    true,
+  );
+}
+
+async function testDestroyWhileBlocked() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const completions = [];
+  for (let i = 0; i < 32; i++) {
+    completions.push(runner.bench(`destroyed ${i}`, {
+      samples: 1,
+    }, recordSample));
+  }
+  const stream = runner.run();
+  const unblocked = stream.waitForDrain();
+  const iterator = stream[Symbol.asyncIterator]();
+  await iterator.next();
+  await unblocked;
+  for (let i = 0; i < 100 &&
+       stream.readableLength < stream.readableHighWaterMark; i++) {
+    await setImmediate();
+  }
+  assert.strictEqual(stream.readableLength, stream.readableHighWaterMark);
+
+  const draining = stream.waitForDrain();
+  const closed = new Promise((resolve) => stream.once('close', resolve));
+  stream.destroy();
+  await assert.rejects(draining, { code: 'ERR_INVALID_STATE' });
+  await assert.rejects(stream.waitForDrain(), { code: 'ERR_INVALID_STATE' });
+  await closed;
+  await Promise.all(completions);
+}
+
+async function testNamedEventsWithoutReading() {
+  const runner = createRunner();
+  const sampleCount = 64;
+  let calls = 0;
+  const completion = runner.bench('named events', {
+    samples: sampleCount,
+  }, (b) => {
+    calls++;
+    recordSample(b);
+  });
+  const stream = runner.run();
+  const summary = await new Promise((resolve) => {
+    stream.once('bench:summary', resolve);
+  });
+  const result = await completion;
+
+  assert.strictEqual(calls, sampleCount);
+  assert.strictEqual(result.samples.length, sampleCount);
+  assert.strictEqual(summary.success, true);
+  assert.strictEqual(stream.readableLength, sampleCount + 4);
+  assert(stream.readableLength > stream.readableHighWaterMark);
+  stream.destroy();
+}
+
+async function testCancellationCompletesBenchmarks() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const first = runner.bench('cancelled stream', { samples: 64 }, recordSample);
+  const second = runner.bench('continues headlessly', {
+    samples: 1,
+  }, recordSample);
+  const stream = runner.run();
+  const iterator = stream[Symbol.asyncIterator]();
+
+  await iterator.next();
+  await iterator.return();
+  const results = await Promise.all([first, second]);
+  assert.strictEqual(results[0].samples.length, 64);
+  assert.strictEqual(results[1].samples.length, 1);
+}
+
+async function testDeliveryDoesNotConsumeTimeout() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const completion = runner.bench('slow consumer', {
+    samples: 32,
+    timeout: common.platformTimeout(20),
+  }, recordSample);
+  const stream = runner.run();
+  const iterator = stream[Symbol.asyncIterator]();
+
+  await iterator.next();
+  await setTimeout(common.platformTimeout(50));
+  for (;;) {
+    const next = await iterator.next();
+    if (next.done) break;
+  }
+
+  const result = await completion;
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(result.samples.length, 32);
+}
+
+async function testReportingFailureSettlesBenchmarks() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const failure = new Error('record listener failed');
+  const first = runner.bench('reported', { samples: 1 }, recordSample);
+  const second = runner.bench('settled', { samples: 1 }, recordSample);
+  const stream = runner.run();
+  stream.once('bench:complete', common.mustCall(() => {
+    throw failure;
+  }));
+  stream.resume();
+
+  const results = await Promise.all([first, second]);
+  assert.strictEqual(results[0].error, undefined);
+  assert.strictEqual(results[1].error, failure);
+  await setImmediate();
+}
+
+async function testSummaryListenerFailure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const failure = new Error('summary listener failed');
+  const completion = runner.bench('summary failure', {
+    samples: 1,
+  }, recordSample);
+  const stream = runner.run();
+  const diagnostics = [];
+  stream.on('bench:diagnostic', (diagnostic) => {
+    diagnostics.push(diagnostic);
+  });
+  stream.once('bench:summary', common.mustCall(() => {
+    throw failure;
+  }));
+  const ended = new Promise((resolve) => stream.once('end', resolve));
+  stream.resume();
+
+  const result = await completion;
+  await ended;
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(diagnostics.length, 1);
+  assert.strictEqual(diagnostics[0].error.message, failure.message);
+}
+
+async function testRecordOwnership() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const expectedError = new Error('expected failure');
+  expectedError.code = 'ERR_EXPECTED';
+  expectedError.cause = expectedError;
+  expectedError.uncloneable = new WeakMap();
+  expectedError.context = {
+    note: 'preserved',
+    callback() {},
+    get accessor() { return 'value'; },
+  };
+  expectedError.customContext = {
+    __proto__: {},
+    note: 'preserved',
+  };
+  expectedError.arrayPayload = [new WeakMap()];
+  const innerError = new Error('inner failure');
+  innerError.code = 'ERR_INNER';
+  const aggregate = new AggregateError([innerError], 'aggregate failure');
+  aggregate.code = 'ERR_AGGREGATE';
+  const causedError = new Error('caused failure', { cause: aggregate });
+  causedError.references = new Map([['self', causedError]]);
+  causedError.members = new Set([causedError]);
+  const measured = runner.bench('owned result', {
+    params: { kind: 'original' },
+    samples: 1,
+  }, (b) => {
+    b.record({
+      __proto__: null,
+      operations: 1,
+      duration_ns: 1n,
+      detail: { value: 'original' },
+    });
+  });
+  const failed = runner.bench('owned error', { samples: 1 }, () => {
+    throw expectedError;
+  });
+  const caused = runner.bench('owned cause', { samples: 1 }, () => {
+    throw causedError;
+  });
+  const throwingNameError = new Error('throwing name');
+  Object.defineProperty(throwingNameError, 'name', {
+    configurable: true,
+    get() { throw new Error('name getter'); },
+  });
+  const throwingName = runner.bench('throwing name', {
+    samples: 1,
+  }, () => {
+    throw throwingNameError;
+  });
+  const thrownValue = new WeakMap();
+  const uncloneable = runner.bench('uncloneable error', {
+    samples: 1,
+  }, () => {
+    throw thrownValue;
+  });
+  const proxyError = new Proxy({}, {
+    getPrototypeOf() {
+      throw new Error('prototype trap');
+    },
+  });
+  const trapped = runner.bench('trapping error', { samples: 1 }, () => {
+    throw proxyError;
+  });
+  const afterTrap = runner.bench('after trapping error', {
+    samples: 1,
+  }, recordSample);
+  const stream = runner.run();
+  let eventSample;
+  let eventComplete;
+  let eventError;
+  let eventSummary;
+
+  stream.on('bench:sample', (sample) => {
+    if (sample.name !== 'owned result') return;
+    eventSample = sample;
+    sample.name = 'changed by event';
+    sample.detail.value = 'changed by event';
+  });
+  stream.on('bench:complete', (result) => {
+    if (result.name === 'owned result') {
+      eventComplete = result;
+      result.params.kind = 'changed by event';
+      result.samples[0].detail.value = 'changed by event';
+    } else if (result.name === 'owned error') {
+      eventError = result.error;
+      result.error.code = 'ERR_CHANGED';
+    }
+  });
+  stream.on('bench:summary', (summary) => {
+    eventSummary = summary;
+    summary.counts.total = 100;
+  });
+
+  const records = await stream.toArray();
+  const measuredResult = await measured;
+  const failedResult = await failed;
+  await caused;
+  const throwingNameResult = await throwingName;
+  const uncloneableResult = await uncloneable;
+  const trappedResult = await trapped;
+  const afterTrapResult = await afterTrap;
+  const streamSample = records.find(
+    ({ type }) => type === 'bench:sample').data;
+  const streamResults = records.filter(
+    ({ type }) => type === 'bench:complete').map(({ data }) => data);
+  const streamMeasured = streamResults.find(
+    ({ name }) => name === 'owned result');
+  const streamFailed = streamResults.find(
+    ({ name }) => name === 'owned error');
+  const streamCaused = streamResults.find(
+    ({ name }) => name === 'owned cause');
+  const streamThrowingName = streamResults.find(
+    ({ name }) => name === 'throwing name');
+  const streamSummary = records.find(
+    ({ type }) => type === 'bench:summary').data;
+
+  assert.notStrictEqual(eventSample, streamSample);
+  assert.notStrictEqual(eventComplete, streamMeasured);
+  assert.notStrictEqual(streamMeasured, measuredResult);
+  assert.strictEqual(streamSample.name, 'owned result');
+  assert.strictEqual(streamSample.detail.value, 'original');
+  assert.strictEqual(streamMeasured.params.kind, 'original');
+  assert.strictEqual(streamMeasured.samples[0].detail.value, 'original');
+  assert.strictEqual(measuredResult.params.kind, 'original');
+  assert.strictEqual(measuredResult.samples[0].detail.value, 'original');
+
+  streamMeasured.samples[0].detail.value = 'changed by stream';
+  assert.strictEqual(measuredResult.samples[0].detail.value, 'original');
+  assert.notStrictEqual(eventError, streamFailed.error);
+  assert.notStrictEqual(streamFailed.error, expectedError);
+  assert.strictEqual(streamFailed.error.code, 'ERR_EXPECTED');
+  assert.strictEqual(streamFailed.error.cause, streamFailed.error);
+  assert.strictEqual(streamFailed.error.context.note, 'preserved');
+  assert.strictEqual(streamFailed.error.context.callback, undefined);
+  assert.strictEqual(streamFailed.error.context.accessor, undefined);
+  assert.strictEqual(streamFailed.error.customContext.note, 'preserved');
+  assert.deepStrictEqual(streamFailed.error.arrayPayload, [undefined]);
+  assert.strictEqual(failedResult.error, expectedError);
+  assert.strictEqual(failedResult.error.code, 'ERR_EXPECTED');
+  assert.strictEqual(failedResult.error.cause, failedResult.error);
+  assert.strictEqual(uncloneableResult.error, thrownValue);
+  assert.strictEqual(trappedResult.error, proxyError);
+  assert.strictEqual(afterTrapResult.error, undefined);
+  assert.strictEqual(throwingNameResult.error, throwingNameError);
+  assert.strictEqual(streamThrowingName.error.name, 'Error');
+  assert.strictEqual(streamThrowingName.error.message, 'throwing name');
+  assert(streamCaused.error.cause instanceof AggregateError);
+  assert.strictEqual(streamCaused.error.cause.name, 'AggregateError');
+  assert.strictEqual(streamCaused.error.cause.code, 'ERR_AGGREGATE');
+  assert.strictEqual(streamCaused.error.cause.errors[0].code, 'ERR_INNER');
+  assert.strictEqual(
+    streamCaused.error.references.get('self'), streamCaused.error);
+  assert.strictEqual(streamCaused.error.members.has(streamCaused.error), true);
+  assert.notStrictEqual(eventSummary, streamSummary);
+  assert.strictEqual(streamSummary.counts.total, 7);
+}
+
+(async () => {
+  await testReadableBackpressure();
+  await testPlanBackpressure();
+  await testDestroyWhileBlocked();
+  await testNamedEventsWithoutReading();
+  await testCancellationCompletesBenchmarks();
+  await testDeliveryDoesNotConsumeTimeout();
+  await testReportingFailureSettlesBenchmarks();
+  await testSummaryListenerFailure();
+  await testRecordOwnership();
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-validation.js b/test/parallel/test-bench-validation.js
new file mode 100644
index 000000000000..2b508f18666f
--- /dev/null
+++ b/test/parallel/test-bench-validation.js
@@ -0,0 +1,80 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { bench, createRunner, run } = require('node:bench');
+
+const noop = () => {};
+let functionOverloadCalls = 0;
+let objectOverloadCalls = 0;
+
+function functionOverload(b) {
+  functionOverloadCalls++;
+  completeSample(b);
+  b.done();
+}
+
+function objectOverload(b) {
+  objectOverloadCalls++;
+  completeSample(b);
+}
+
+assert.throws(() => bench('', noop), { code: 'ERR_INVALID_ARG_VALUE' });
+assert.throws(() => bench('name', null), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { samples: 0 }, noop),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => bench('name', { warmup: -1 }, noop),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => bench('name', { timeout: -1 }, noop),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => bench('name', { signal: {} }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { diagnosticChannels: 'channel' }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { diagnosticChannels: [1] }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { tags: 'fast' }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { tags: [''] }, noop),
+              { code: 'ERR_INVALID_ARG_VALUE' });
+assert.throws(() => bench('name', { params: { value: null } }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { params: { value: NaN } }, noop),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => bench('name', { only: 'yes' }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { skip: 1 }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => run({ namePattern: 1 }),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => run({ samples: 0 }),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => run({ warmup: -1 }),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => run({ yieldBetweenSamples: 1 }),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => createRunner(null),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => createRunner({ yieldBetweenSamples: 1 }),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => createRunner({ yieldBetweenSamples: null }),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+
+bench(functionOverload);
+bench({ samples: 1 }, objectOverload);
+
+bench('valid', { samples: 1 }, (b) => {
+  completeSample(b);
+});
+
+const stream = run();
+stream.on('bench:start', common.mustCall(() => {
+  assert.throws(() => bench('late', noop), { code: 'ERR_INVALID_STATE' });
+}, 3));
+stream.on('end', common.mustCall(() => {
+  assert.strictEqual(functionOverloadCalls, 1);
+  assert.strictEqual(objectOverloadCalls, 1);
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-yield-between-samples.js b/test/parallel/test-bench-yield-between-samples.js
new file mode 100644
index 000000000000..92b51e9409a5
--- /dev/null
+++ b/test/parallel/test-bench-yield-between-samples.js
@@ -0,0 +1,76 @@
+// Flags: --experimental-bench --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+
+async function observe(factoryOptions, runOptions) {
+  const runner = createRunner(factoryOptions);
+  const observed = [];
+  let turnOccurred = false;
+  const turn = setImmediate().then(() => {
+    turnOccurred = true;
+  });
+
+  runner.bench('yielding', { samples: 2 }, (b) => {
+    observed.push(turnOccurred);
+    completeSample(b);
+  });
+
+  await runner.run(runOptions).toArray();
+  await turn;
+  return observed;
+}
+
+async function observeTimeout() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  let invocations = 0;
+  const completion = runner.bench('timeout', {
+    samples: 10,
+    timeout: 5,
+  }, (b) => {
+    invocations++;
+    const until = process.hrtime.bigint() + 2_000_000n;
+    b.start();
+    while (process.hrtime.bigint() < until) { /* Busy loop. */ }
+    b.end(1);
+  });
+  await runner.run().toArray();
+  const result = await completion;
+  assert.strictEqual(result.error.code, 'ERR_OPERATION_FAILED');
+  assert.strictEqual(invocations < 10, true);
+}
+
+async function observeAfterEachTimeout() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.afterEach(common.mustCall(() => {
+    const until = process.hrtime.bigint() + 10_000_000n;
+    while (process.hrtime.bigint() < until) { /* Busy loop. */ }
+  }));
+  const completion = runner.bench('afterEach timeout', {
+    samples: 1,
+    timeout: 5,
+  }, (b) => {
+    completeSample(b);
+  });
+  await runner.run().toArray();
+  const result = await completion;
+  assert.strictEqual(result.error.code, 'ERR_OPERATION_FAILED');
+}
+
+(async () => {
+  assert.deepStrictEqual(await observe(undefined, undefined), [false, true]);
+  assert.deepStrictEqual(
+    await observe({ yieldBetweenSamples: false }, undefined), [false, false]);
+  assert.deepStrictEqual(await observe(
+    { yieldBetweenSamples: false },
+    { yieldBetweenSamples: true }), [false, true]);
+  assert.deepStrictEqual(await observe(
+    { yieldBetweenSamples: true },
+    { yieldBetweenSamples: false }), [false, false]);
+  await observeTimeout();
+  await observeAfterEachTimeout();
+})().then(common.mustCall());
diff --git a/test/parallel/test-benchmark-node-bench-tools.js b/test/parallel/test-benchmark-node-bench-tools.js
new file mode 100644
index 000000000000..3d248b45c0e3
--- /dev/null
+++ b/test/parallel/test-benchmark-node-bench-tools.js
@@ -0,0 +1,305 @@
+// Flags: --no-warnings
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+const {
+  analyzeCompare,
+  analyzeScatter,
+  holmAdjust,
+  isRegressionFailure,
+} = require('../../benchmark/_node-bench-analysis.js');
+const { csvEncode } = require('../../benchmark/_node-bench.js');
+
+const compare = path.resolve(__dirname, '../../benchmark/compare-node-bench.js');
+const legacyScatter = path.resolve(__dirname, '../../benchmark/scatter.js');
+const scatter = path.resolve(__dirname, '../../benchmark/scatter-node-bench.js');
+const benchmark = fixtures.path('bench-runner/tools.cjs');
+
+tmpdir.refresh();
+
+assert.strictEqual(csvEncode(true), 'true');
+assert.deepStrictEqual(holmAdjust([0.01, 0.03, 0.04]), [0.03, 0.06, 0.06]);
+assert.strictEqual(isRegressionFailure({
+  ci95: 3,
+  improvement: -12,
+  pThresholdAdjusted: 0.01,
+}, 10), false);
+assert.strictEqual(isRegressionFailure({
+  ci95: 1,
+  improvement: -12,
+  pThresholdAdjusted: 0.06,
+}, 10), false);
+assert.strictEqual(isRegressionFailure({
+  ci95: 1,
+  improvement: -12,
+  pThresholdAdjusted: 0.01,
+}, 10), true);
+
+function comparisonSamples(oldRates, newRates) {
+  const create = (binary, rate) => ({
+    binary,
+    configuration: '',
+    identity: 'comparison',
+    name: 'comparison',
+    rate,
+  });
+  return [
+    ...oldRates.map((rate) => create('old', rate)),
+    ...newRates.map((rate) => create('new', rate)),
+  ];
+}
+
+{
+  const result = analyzeCompare(comparisonSamples(
+    [98, 99, 100, 100, 101, 102],
+    [48, 49, 50, 50, 51, 52],
+  ), 1000, 0);
+  assert.strictEqual(result.failed, true);
+  assert.strictEqual(result.rows[0].pThresholdAdjusted < 0.05, true);
+}
+
+{
+  const result = analyzeCompare(comparisonSamples(
+    [98, 99, 100, 100, 101, 102],
+    [93, 94, 95, 95, 96, 97],
+  ), 1000, 10);
+  assert.strictEqual(result.rows[0].pAdjusted < 0.05, true);
+  assert.strictEqual(result.rows[0].pThresholdAdjusted > 0.05, true);
+  assert.strictEqual(result.failed, false);
+}
+assert.throws(
+  () => analyzeScatter([{
+    observation: 0,
+    params: { size: 1 },
+    rate: 1,
+  }], 'size', 'size', false),
+  /must name different parameters/,
+);
+assert.doesNotMatch(analyzeScatter([0, 1].map((observation) => ({
+  observation,
+  params: { size: 1 },
+  rate: 1_234_567.89,
+})), 'size', undefined, false), /\(!\)/);
+assert.match(analyzeScatter([
+  { observation: 0, params: { method: 'a', size: 1 }, rate: 10 },
+  { observation: 0, params: { method: 'b', size: 1 }, rate: 20 },
+  { observation: 1, params: { method: 'a', size: 1 }, rate: 30 },
+  { observation: 1, params: { method: 'b', size: 1 }, rate: 50 },
+], 'size', undefined, false), /\n\s*1\s+2\s+/);
+
+function run(script, args, options = undefined) {
+  return spawnSync(process.execPath, [script, ...args], {
+    encoding: 'utf8',
+    timeout: 30_000,
+    ...options,
+  });
+}
+
+{
+  const pidLog = tmpdir.resolve('pids');
+  const result = run(compare, [
+    '--old', process.execPath,
+    '--new', process.execPath,
+    '--runs', '2',
+    '--', benchmark,
+  ], {
+    env: { __proto__: null, ...process.env, NODE_BENCH_PID_LOG: pidLog },
+  });
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  const lines = result.stdout.trim().split('\n');
+  assert.strictEqual(lines[0],
+                     '"binary","filename","configuration","rate","time"');
+  assert.strictEqual(lines.length, 9);
+  assert.strictEqual(lines.filter((line) => line.startsWith('"old",')).length,
+                     4);
+  assert.strictEqual(lines.filter((line) => line.startsWith('"new",')).length,
+                     4);
+  assert.deepStrictEqual(lines.slice(1).map((line) => line.slice(0, 5)), [
+    '"old"', '"old"', '"new"', '"new"',
+    '"new"', '"new"', '"old"', '"old"',
+  ]);
+  assert(lines.slice(1).every(
+    (line) => line.includes('"tools/simple.js"')));
+  const pids = fs.readFileSync(pidLog, 'utf8').trim().split('\n');
+  assert.strictEqual(new Set(pids).size, 4);
+}
+
+{
+  const result = run(scatter, [
+    '--node', process.execPath,
+    '--runs', '2',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  const lines = result.stdout.trim().split('\n');
+  assert.strictEqual(lines[0],
+                     '"filename","method","size","rate","time"');
+  assert.strictEqual(lines.length, 5);
+  assert(lines.slice(1).every(
+    (line) => line.startsWith('"tools/simple.js","loop",')));
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '1',
+    '--', fixtures.path('bench-runner/tools-no-params.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  const lines = result.stdout.trim().split('\n');
+  assert.strictEqual(lines[0], '"filename","rate","time"');
+  assert.strictEqual(lines.length, 2);
+  assert.strictEqual(lines[1].split(',').length, 3);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '1',
+    '--', fixtures.path('bench-runner/tools-reserved-param.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /parameter 'rate' is reserved/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '1',
+    '--', fixtures.path('bench-runner/tools-collision.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /requires one logical benchmark name per file/);
+}
+
+{
+  const result = run(compare, [
+    '--old', process.execPath,
+    '--new', process.execPath,
+    '--runs', '1',
+    '--', fixtures.path('bench-runner/tools-collision.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /Distinct benchmarks would share the CSV group/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '2',
+    '--', fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /set of reported benchmarks changed between runs/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '1',
+    '--name-pattern', 'missing',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /No benchmark samples were produced/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', 'invalid',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /--runs must be an integer/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '2',
+    '--analyze',
+    '--xaxis', 'size',
+    '--category', 'method',
+    '--no-chart',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  assert.match(result.stdout,
+               /size\s+method\s+samples\s+rate\s+confidence\.interval/);
+  assert.match(result.stdout, /Change between consecutive size values/);
+  assert.match(result.stdout, /Mann-Whitney U.*Cliff's delta/);
+  assert.doesNotMatch(result.stdout, /"filename","method"/);
+}
+
+{
+  const result = run(scatter, [
+    '--analyze',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /--analyze requires --xaxis/);
+}
+
+{
+  const result = run(compare, [
+    '--old', process.execPath,
+    '--new', process.execPath,
+    '--runs', '2',
+    '--max-regression', '100',
+    '--', fixtures.path('bench-runner/tools-no-params.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  assert.match(result.stdout, /confidence\s+improvement\s+accuracy/);
+  assert.match(result.stdout, /Holm-Bonferroni correction/);
+  assert.match(result.stdout, /one-sided p-values against the 100% threshold/);
+  assert.doesNotMatch(result.stdout, /"binary","filename"/);
+}
+
+{
+  const result = run(compare, [
+    '--old', process.execPath,
+    '--new', process.execPath,
+    '--runs', '1',
+    '--max-regression', '0',
+    '--', fixtures.path('bench-runner/tools-no-params.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  assert.match(result.stdout, /confidence\s+improvement\s+accuracy/);
+  assert.match(result.stdout, /one-sided p-values against the 0% threshold/);
+  assert.doesNotMatch(result.stdout, /"binary","filename"/);
+}
+
+{
+  const benchmark = path.resolve(
+    __dirname, '../../benchmark/buffers/buffer-compare-offset.js');
+  const nodeBenchmark = path.resolve(
+    __dirname, '../../benchmark/buffers/_buffer-compare-offset.node-bench.js');
+  const legacy = run(legacyScatter, [
+    '--runs', '1',
+    benchmark,
+  ]);
+  const modern = run(scatter, [
+    '--runs', '1',
+    '--', nodeBenchmark,
+  ]);
+  assert.strictEqual(legacy.status, 0, legacy.stderr);
+  assert.strictEqual(modern.status, 0, modern.stderr);
+  const legacyLines = legacy.stdout.trim().split('\n');
+  const modernLines = modern.stdout.trim().split('\n');
+  assert.deepStrictEqual(
+    legacyLines[0].replaceAll(' ', '').split(',').sort(),
+    modernLines[0].split(',').sort(),
+  );
+  assert.strictEqual(modernLines[0],
+                     '"filename","method","n","size","rate","time"');
+  assert.strictEqual(legacyLines.length, 9);
+  assert.strictEqual(modernLines.length, 9);
+  const name = path.join('buffers', 'buffer-compare-offset.js');
+  assert(legacyLines[1].startsWith(`"${name}",`));
+  assert(modernLines[1].startsWith(`"${name}",`));
+}
diff --git a/test/parallel/test-blob-file-backed.js b/test/parallel/test-blob-file-backed.js
index f94eae6d6ed7..c5a5ce14807d 100644
--- a/test/parallel/test-blob-file-backed.js
+++ b/test/parallel/test-blob-file-backed.js
@@ -129,6 +129,19 @@ writeFileSync(testfile5, '');
   await unlink(testfile5);
 })().then(common.mustCall());
 
+(async () => {
+  // A path that cannot be stat'd reports the underlying libuv error rather
+  // than a generic argument error, so ENOENT can be told apart from any other
+  // reason the file could not be used.
+  // Refs: https://github.com/nodejs/node/issues/65514
+  const missing = tmpdir.resolve('does-not-exist.txt');
+  await assert.rejects(async () => openAsBlob(missing), {
+    code: 'ENOENT',
+    syscall: 'stat',
+    path: missing,
+  });
+})().then(common.mustCall());
+
 (async () => {
   // We currently do not allow File-backed blobs to be cloned or transferred
   // across worker threads. This is largely because the underlying FdEntry
diff --git a/test/parallel/test-blocklist.js b/test/parallel/test-blocklist.js
index 08a293bb6a81..f1fc42f6304e 100644
--- a/test/parallel/test-blocklist.js
+++ b/test/parallel/test-blocklist.js
@@ -339,6 +339,34 @@ const util = require('util');
   });
 }
 
+{
+  // addAddresses() and addCIDRs() must throw the same errors for non-array
+  // input regardless of how the checks are implemented internally.
+  const blockList = new BlockList();
+  for (const [value, received] of [
+    ['x', "type string ('x')"],
+    [123, 'type number (123)'],
+    [{}, 'an instance of Object'],
+    [null, 'null'],
+    [undefined, 'undefined'],
+    [1n, 'type bigint (1n)'],
+    [true, 'type boolean (true)'],
+  ]) {
+    assert.throws(() => blockList.addAddresses(value), {
+      code: 'ERR_INVALID_ARG_TYPE',
+      name: 'TypeError',
+      message: 'The "addresses" argument must be an instance of Array. ' +
+               `Received ${received}`,
+    });
+    assert.throws(() => blockList.addCIDRs(value), {
+      code: 'ERR_INVALID_ARG_TYPE',
+      name: 'TypeError',
+      message: 'The "cidrs" argument must be an instance of Array. ' +
+               `Received ${received}`,
+    });
+  }
+}
+
 {
   // Test addAddresses() batch insert.
   const blockList = new BlockList();
@@ -927,3 +955,40 @@ const util = require('util');
   assert(!blockList.check('10.2.0.1'));
   assert.strictEqual(blockList.rules.length, 1);
 }
+
+{
+  // IPv4-mapped / mixed-notation IPv6 rules must survive a toJSON/fromJSON
+  // round-trip. toJSON() emits these addresses in mixed dotted-quad form
+  // (e.g. "::ffff:192.0.2.128"), so the rule parser must accept the "." used
+  // in that notation.
+  const bl = new BlockList();
+  bl.addAddress('::ffff:192.0.2.128', 'ipv6');
+  bl.addSubnet('::ffff:10.0.0.0', 120, 'ipv6');
+  bl.addRange('::ffff:172.16.0.1', '::ffff:172.16.0.10', 'ipv6');
+
+  const expected = [
+    'Address: IPv6 ::ffff:192.0.2.128',
+    'Range: IPv6 ::ffff:172.16.0.1-::ffff:172.16.0.10',
+    'Subnet: IPv6 ::ffff:10.0.0.0/120',
+  ];
+  assert.deepStrictEqual(bl.toJSON().sort(), expected);
+
+  const restored = new BlockList();
+  restored.fromJSON(bl.toJSON());
+
+  // The restored rules must be identical (lossless round-trip).
+  assert.deepStrictEqual(restored.toJSON().sort(), expected);
+
+  // And it must still match the same addresses as the original.
+  [
+    ['::ffff:192.0.2.128', true],  // the single address
+    ['::ffff:192.0.2.129', false],
+    ['::ffff:10.0.0.50', true],    // inside the subnet
+    ['::ffff:10.0.1.0', false],
+    ['::ffff:172.16.0.5', true],   // inside the range
+    ['::ffff:172.16.0.20', false],
+  ].forEach(([address, result]) => {
+    assert.strictEqual(bl.check(address, 'ipv6'), result);
+    assert.strictEqual(restored.check(address, 'ipv6'), result);
+  });
+}
diff --git a/test/parallel/test-bootstrap-modules.js b/test/parallel/test-bootstrap-modules.js
index b4827a13fcea..e6a40d45e26f 100644
--- a/test/parallel/test-bootstrap-modules.js
+++ b/test/parallel/test-bootstrap-modules.js
@@ -118,12 +118,14 @@ expected.atRunTime = new Set([
 
 const { isMainThread } = require('worker_threads');
 // Binaries built without the snapshot (e.g. cross-compiled) and
-// --no-node-snapshot bootstrap the main context from scratch, like a worker.
-const mainContextFromSnapshot = isMainThread &&
+// --no-node-snapshot bootstrap the context from scratch; so do workers under
+// --no-worker-snapshot.
+const contextFromSnapshot =
   process.config.variables.node_use_node_snapshot &&
-  !process.execArgv.includes('--no-node-snapshot');
+  !process.execArgv.includes('--no-node-snapshot') &&
+  (isMainThread || !process.execArgv.includes('--no-worker-snapshot'));
 
-if (mainContextFromSnapshot) {
+if (contextFromSnapshot) {
   [
     'Internal Binding cjs_lexer',
     'NativeModule internal/modules/esm/assert',
@@ -148,7 +150,8 @@ if (mainContextFromSnapshot) {
 } else if (isMainThread) {
   expected.beforePreExec.delete(getFormatNativeModule);
   expected.atRunTime.add(getFormatNativeModule);
-} else {  // Worker.
+}
+if (!isMainThread) {
   [
     'NativeModule diagnostics_channel',
     'NativeModule internal/abort_controller',
diff --git a/test/parallel/test-buffer-alloc-alignment.js b/test/parallel/test-buffer-alloc-alignment.js
index a1a3890ddc20..a55c3fe5fba8 100644
--- a/test/parallel/test-buffer-alloc-alignment.js
+++ b/test/parallel/test-buffer-alloc-alignment.js
@@ -111,6 +111,24 @@ for (const alloc of [Buffer.allocUnsafe, Buffer.allocUnsafeSlow]) {
   assert.strictEqual(buf.buffer.byteLength, 100);
 }
 
+// The padding an aligned allocation needs does not leave a partial element
+// behind it, so a typed array view running from the buffer to the end of its
+// ArrayBuffer can be created without an explicit length.
+{
+  const bufs = [Buffer.allocUnsafe(8), Buffer.allocUnsafeSlow(4096, 4096)];
+  for (const alignment of alignments) {
+    bufs.push(Buffer.allocUnsafe(8, alignment),
+              Buffer.allocUnsafeSlow(8, alignment));
+  }
+  for (const buf of bufs) {
+    const rest = buf.buffer.byteLength - buf.byteOffset;
+    assert.strictEqual(new BigUint64Array(buf.buffer, buf.byteOffset).byteLength,
+                       rest);
+    assert.strictEqual(new Uint32Array(buf.buffer, buf.byteOffset).byteLength,
+                       rest);
+  }
+}
+
 // Buffer.allocUnsafeSlow() is never pooled, even when aligned.
 {
   const a = Buffer.allocUnsafeSlow(64, 64);
diff --git a/test/parallel/test-buffer-indexof.js b/test/parallel/test-buffer-indexof.js
index 2dd62c91e25c..4bed7f935b87 100644
--- a/test/parallel/test-buffer-indexof.js
+++ b/test/parallel/test-buffer-indexof.js
@@ -619,6 +619,32 @@ assert.strictEqual(reallyLong.lastIndexOf(pattern), 0);
   assert.strictEqual(haystack.lastIndexOf(needle), haystack.length - 3);
 }
 
+// UTF-8 string search should use the same replacement-character semantics
+// as Buffer.from() for unpaired UTF-16 surrogates.
+{
+  const prefix = 'a'.repeat(16);
+  const suffix = 'b'.repeat(16);
+  const needles = [
+    `${prefix}${String.fromCharCode(0xd800)}${suffix}`,
+    `${prefix}${String.fromCharCode(0xdc00)}${suffix}`,
+    JSON.parse(`{"needle":"${prefix}\\ud800${suffix}"}`).needle,
+  ];
+
+  for (const needle of needles) {
+    const needleBuffer = Buffer.from(needle, 'utf8');
+    const haystack = Buffer.concat([
+      Buffer.from('xx'),
+      needleBuffer,
+      Buffer.from('yy'),
+    ]);
+
+    assert.strictEqual(Buffer.byteLength(needle, 'utf8'), needleBuffer.length);
+    assert.strictEqual(haystack.indexOf(needle, 0, 'utf8'), 2);
+    assert.strictEqual(haystack.lastIndexOf(needle, haystack.length - 1, 'utf8'), 2);
+    assert.strictEqual(haystack.includes(needle, 0, 'utf8'), true);
+  }
+}
+
 // Avoid abort because of invalid usage
 // see https://github.com/nodejs/node/issues/32753
 {
diff --git a/test/parallel/test-buffer-tostring-rangeerror.js b/test/parallel/test-buffer-tostring-rangeerror.js
index b34f4c612618..856ed84d21cd 100644
--- a/test/parallel/test-buffer-tostring-rangeerror.js
+++ b/test/parallel/test-buffer-tostring-rangeerror.js
@@ -34,6 +34,12 @@ function test(getBuffer) {
       return;
     }
   }
+  // MAX_STRING_LENGTH counts UTF-16 units, not bytes. Uninitialized memory can
+  // hold multi-byte UTF-8 sequences, which decode to fewer units than they
+  // occupy bytes, and a single one of them is enough to bring the result down
+  // to MAX_STRING_LENGTH or less. ASCII bytes keep the decoded length equal to
+  // the buffer length.
+  buf.fill(0);
   assert.throws(() => { buf.toString('utf8'); }, message);
 }
 
diff --git a/test/parallel/test-cli-node-print-help.js b/test/parallel/test-cli-node-print-help.js
index f42129eb1330..84704be2104a 100644
--- a/test/parallel/test-cli-node-print-help.js
+++ b/test/parallel/test-cli-node-print-help.js
@@ -27,7 +27,8 @@ function validateNodePrintHelp() {
     { compileConstant: HAVE_OPENSSL,
       flags: [ '--openssl-config=...', '--tls-cipher-list=...',
                '--use-bundled-ca', '--use-openssl-ca', '--use-system-ca',
-               '--enable-fips', '--force-fips' ] },
+               '--enable-fips', '--enable-fips-indicator-events',
+               '--force-fips' ] },
     { compileConstant: NODE_HAVE_I18N_SUPPORT,
       flags: [ '--icu-data-dir=...', 'NODE_ICU_DATA' ] },
     { compileConstant: HAVE_INSPECTOR,
diff --git a/test/parallel/test-cli-options-as-flags.js b/test/parallel/test-cli-options-as-flags.js
index 9fbc3c1733f5..ed87ba3e1fa5 100644
--- a/test/parallel/test-cli-options-as-flags.js
+++ b/test/parallel/test-cli-options-as-flags.js
@@ -28,6 +28,7 @@ describe('getOptionsAsFlagsFromBinding', () => {
 
     assert.strictEqual(flags.includes('--no-warnings'), true);
     assert.strictEqual(flags.includes('--stack-trace-limit=512'), true);
+    assert.strictEqual(flags.some((flag) => flag.startsWith('--bench-')), false);
   });
 
   it('should extract flags from NODE_OPTIONS environment variable', onlyIfNodeOptionsSupport, async () => {
diff --git a/test/parallel/test-common-wpt-any.js b/test/parallel/test-common-wpt-any.js
new file mode 100644
index 000000000000..c198fd707147
--- /dev/null
+++ b/test/parallel/test-common-wpt-any.js
@@ -0,0 +1,161 @@
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const path = require('path');
+const {
+  getHarnessErrorName,
+  getUnexpectedPasses,
+  isUnexpectedPass,
+  WPTRunner,
+  WPTTestSpec,
+} = require('../common/wpt');
+
+const flakyName = getHarnessErrorName({
+  message: 'this uncaught rejection is expected',
+  stack: 'Error: this uncaught rejection is expected\n    at held.https.any.js:71:14',
+});
+assert.strictEqual(flakyName, 'Error: this uncaught rejection is expected');
+assert.strictEqual(
+  getHarnessErrorName({ message: 'harness failed' }),
+  'harness failed',
+);
+
+const flakySpecs = WPTTestSpec.from(
+  'web-locks',
+  'held.https.any.js',
+  [{
+    key: 'held.https.any.js',
+    requires: [],
+    fail: { flaky: [flakyName] },
+  }],
+);
+assert.strictEqual(flakySpecs.length, 2);
+assert.ok(flakySpecs.every((spec) =>
+  spec.failedTests.includes(flakyName) && spec.flakyTests.includes(flakyName)));
+assert.ok(flakySpecs.every((spec) => !isUnexpectedPass(spec, flakyName)));
+assert.deepStrictEqual(getUnexpectedPasses(flakySpecs, {}), []);
+
+const specs = WPTTestSpec.from(
+  'WebCryptoAPI',
+  'getPublicKey.tentative.https.any.js',
+  [],
+);
+
+assert.deepStrictEqual(specs.map((spec) => ({
+  testPath: spec.getTestPath(),
+  isWebWorkerTest: spec.isWebWorkerTest(),
+})), [
+  {
+    testPath: 'WebCryptoAPI/getPublicKey.tentative.https.any.html',
+    isWebWorkerTest: false,
+  },
+  {
+    testPath: 'WebCryptoAPI/getPublicKey.tentative.https.any.worker.html',
+    isWebWorkerTest: true,
+  },
+]);
+
+const runner = new WPTRunner('WebCryptoAPI');
+assert.throws(
+  () => new WPTRunner('WebCryptoAPI', { concurrency: 0 }),
+  /WPT concurrency must be a positive integer/,
+);
+runner.pretendGlobalThisAs('Window');
+assert.match(runner.fullInitScript(specs[0]), /globalThis\.Window/);
+assert.doesNotMatch(runner.fullInitScript(specs[1]), /globalThis\.Window/);
+
+const nonTestDirs = new Set(['resources', 'support', 'tools']);
+const webLocksRunner = new WPTRunner('web-locks');
+assert.ok([...webLocksRunner.specs].every((spec) =>
+  !spec.filename.split(path.sep).some((part) => nonTestDirs.has(part))));
+
+const variantSpecs = WPTTestSpec.from(
+  'WebCryptoAPI',
+  'derive_bits_keys/hkdf.https.any.js',
+  [],
+);
+
+assert.strictEqual(variantSpecs.length, 8);
+assert.deepStrictEqual(
+  variantSpecs.filter((spec) => spec.isWebWorkerTest())
+    .map((spec) => spec.getTestPath()),
+  [
+    'WebCryptoAPI/derive_bits_keys/hkdf.https.any.worker.html?1-1000',
+    'WebCryptoAPI/derive_bits_keys/hkdf.https.any.worker.html?1001-2000',
+    'WebCryptoAPI/derive_bits_keys/hkdf.https.any.worker.html?2001-3000',
+    'WebCryptoAPI/derive_bits_keys/hkdf.https.any.worker.html?3001-last',
+  ],
+);
+
+const skippedSpecs = WPTTestSpec.from(
+  'WebCryptoAPI',
+  'getPublicKey.tentative.https.any.js',
+  [{ requires: [], skip: 'unsupported' }],
+);
+assert.deepStrictEqual(
+  skippedSpecs.map(({ skipReasons }) => skipReasons),
+  [['unsupported'], ['unsupported']],
+);
+
+const skippedSubtestSpecs = WPTTestSpec.from(
+  'WebCryptoAPI',
+  'getPublicKey.tentative.https.any.js',
+  [{ requires: [], skipTests: [/getPublicKey method/] }],
+);
+assert.ok(skippedSubtestSpecs.every(
+  (spec) => spec.isSkippedTest('getPublicKey method is available')));
+
+const scopedSpecs = WPTTestSpec.from(
+  'WebCryptoAPI',
+  'getPublicKey.tentative.https.any.js',
+  [],
+  (spec) => (spec.getStatusKey().endsWith('.any.worker.html') ?
+    [{ requires: [], skip: 'worker only' }] : []),
+);
+assert.deepStrictEqual(
+  scopedSpecs.map(({ skipReasons }) => skipReasons),
+  [[], ['worker only']],
+);
+
+const sourceRule = {
+  key: 'getPublicKey.tentative.https.any.js',
+  requires: [],
+  fail: { expected: ['shared failure'] },
+};
+const workerRule = {
+  key: 'getPublicKey.tentative.https.any.worker.html',
+  requires: [],
+  fail: { expected: ['worker failure'] },
+};
+const expectedFailureSpecs = WPTTestSpec.from(
+  'WebCryptoAPI',
+  'getPublicKey.tentative.https.any.js',
+  [sourceRule],
+  (spec) => (spec.isWebWorkerTest() ? [workerRule] : []),
+);
+const expectedResults = {
+  'getPublicKey.tentative.https.any.html': {
+    fail: { expected: ['shared failure'] },
+  },
+  'getPublicKey.tentative.https.any.worker.html': {
+    fail: { expected: ['shared failure', 'worker failure'] },
+  },
+};
+
+assert.deepStrictEqual(
+  getUnexpectedPasses(expectedFailureSpecs, expectedResults),
+  [],
+);
+expectedResults['getPublicKey.tentative.https.any.worker.html'].fail.expected =
+  ['worker failure'];
+assert.deepStrictEqual(
+  getUnexpectedPasses(expectedFailureSpecs, expectedResults),
+  ['getPublicKey.tentative.https.any.worker.html:shared failure'],
+);
+expectedResults['getPublicKey.tentative.https.any.worker.html'].fail.expected =
+  ['shared failure'];
+assert.deepStrictEqual(
+  getUnexpectedPasses(expectedFailureSpecs, expectedResults),
+  ['getPublicKey.tentative.https.any.worker.html:worker failure'],
+);
diff --git a/test/parallel/test-common-wpt-backends.js b/test/parallel/test-common-wpt-backends.js
new file mode 100644
index 000000000000..093ecd4dfd17
--- /dev/null
+++ b/test/parallel/test-common-wpt-backends.js
@@ -0,0 +1,274 @@
+'use strict';
+
+// The WPT runner can run each spec on a worker thread or in a child process.
+// Suites opt into either, and share the status files, so both backends have to
+// report the same things in the same way.
+
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
+const { backends, WPTRunner } = require('../common/wpt');
+
+const queueProbe = process.env.NODE_TEST_WPT_QUEUE_PROBE === '1';
+const backendProbe = process.env.NODE_TEST_WPT_BACKEND_PROBE;
+
+const harnessPath = fixtures.path('wpt', 'resources', 'testharness.js');
+const specPath = fixtures.path('wpt-backends-spec.js');
+const execArgv = ['--experimental-web-worker'];
+
+function payload(throws) {
+  return {
+    testRelativePath: 'backends.any.js',
+    wptRunner: path.join(__dirname, '../common/wpt.js'),
+    wptPath: 'compression',
+    initScript: throws ? 'globalThis.WPT_BACKENDS_THROW = true;' : null,
+    harness: {
+      code: fs.readFileSync(harnessPath, 'utf8'),
+      filename: harnessPath,
+    },
+    scriptsToRun: [{
+      code: fs.readFileSync(specPath, 'utf8'),
+      filename: specPath,
+    }],
+    needsGc: false,
+    // A regular expression only survives the trip to a child process because
+    // the runner forks with advanced serialization.
+    skippedTests: ['skipped by name', /^skipped by pattern$/],
+  };
+}
+
+// Collect what a backend reports for one spec, driving it the way the runner
+// does so that the real spawn options are exercised.
+async function collect(backend, throws) {
+  const events = [];
+  let done = false;
+
+  const handle = backends[backend](execArgv, payload(throws), {
+    message: (message) => {
+      switch (message.type) {
+        case 'result':
+          events.push(`result ${message.result.status} ${message.result.name}`);
+          break;
+        case 'skip':
+          events.push(`skip ${message.name}`);
+          break;
+        case 'completion':
+          events.push(`completion ${message.status.status}`);
+          done = true;
+          handle.kill();
+          break;
+        default:
+          assert.fail(`Unexpected message type: ${message.type}`);
+      }
+    },
+    failure: (failure) => {
+      if (done) {
+        return false;
+      }
+      done = true;
+      events.push(`uncaught ${failure.name} | ${failure.message}`);
+      return true;
+    },
+  });
+
+  const watchdog = setTimeout(
+    common.mustNotCall(`The ${backend} WPT backend did not finish`),
+    common.platformTimeout(10_000),
+  );
+  try {
+    await handle.finished;
+  } finally {
+    clearTimeout(watchdog);
+  }
+  return events;
+}
+
+async function compare(throws) {
+  const comparable = async (backend) => {
+    const events = await collect(backend, throws);
+    // A worker thread keeps delivering messages after it throws, so `events`
+    // is copied here and only the error is compared; what the spec reports
+    // before throwing is covered by the run that completes normally.
+    const wanted = throws ? (event) => event.startsWith('uncaught ') : () => true;
+    return events.filter(wanted).sort();
+  };
+
+  const thread = await comparable('thread');
+  const child = await comparable('process');
+  assert.notStrictEqual(thread.length, 0);
+  assert.deepStrictEqual(thread, child);
+  return thread;
+}
+
+// End to end: the runner's own reporting has to match too. The webidl spec
+// reports an uncaught error whose name the status file matches on.
+function runDriver(driver, spec, backend) {
+  const { child: { stdout } } = spawnSyncAndExitWithoutError(
+    process.execPath,
+    [path.join(__dirname, '../wpt', driver), spec],
+    { env: { ...process.env, WPT_BACKEND: backend }, encoding: 'utf8' },
+  );
+  // Specs run concurrently, so the lines arrive in an arbitrary order.
+  return stdout.split('\n').filter((line) => line.startsWith('[')).sort();
+}
+
+function runQueueProbe() {
+  backends.process = common.mustCall((execArgv, workerData, handlers) => {
+    queueMicrotask(() => handlers.message({
+      type: 'completion',
+      status: { status: 0 },
+    }));
+    return {
+      kill() {},
+      // Model the gap between a spec completing and its process closing. The
+      // close notification alone must not be responsible for keeping the
+      // parent alive long enough to start the next queued spec.
+      finished: new Promise((resolve) => {
+        setTimeout(common.mustCall(resolve), 1).unref();
+      }),
+    };
+  }, 2);
+
+  process.argv[2] = 'compression-bad-chunks.any.js';
+  const runner = new WPTRunner('compression', {
+    backend: 'process',
+    concurrency: 1,
+  });
+  // WPT drivers intentionally do not await this method.
+  runner.runJsTests();
+}
+
+function checkQueuedSpecsKeepRunnerAlive() {
+  const result = spawnSync(process.execPath, [__filename], {
+    env: {
+      ...process.env,
+      NODE_TEST_WPT_QUEUE_PROBE: '1',
+      WPT_BACKEND: 'process',
+    },
+    encoding: 'utf8',
+    timeout: common.platformTimeout(10_000),
+  });
+  const { error, status, stdout, stderr } = result;
+  assert.ifError(error);
+  assert.strictEqual(status, 0, `Queued WPT probe failed:\n${stdout}${stderr}`);
+}
+
+function runDefaultBackendProbe() {
+  const runner = new WPTRunner('compression');
+  assert.strictEqual(runner.runSpec, backends[backendProbe]);
+}
+
+function checkBackendSelection() {
+  const env = { ...process.env };
+  delete env.WPT_BACKEND;
+  delete env.WPT_INSPECT;
+
+  for (const [name, expected, args, overrides] of [
+    ['default', 'thread', [__filename]],
+    ['environment override', 'process', [__filename], { WPT_BACKEND: 'process' }],
+    ['inspect override', 'process', [__filename], {
+      WPT_BACKEND: 'thread',
+      WPT_INSPECT: '1',
+    }],
+  ]) {
+    const result = spawnSync(process.execPath, args, {
+      env: {
+        ...env,
+        ...overrides,
+        NODE_TEST_WPT_BACKEND_PROBE: expected,
+      },
+      encoding: 'utf8',
+      timeout: common.platformTimeout(10_000),
+    });
+    const { error, status, stdout, stderr } = result;
+    assert.ifError(error);
+    assert.strictEqual(
+      status,
+      0,
+      `${name} WPT backend probe failed:\n${stdout}${stderr}`,
+    );
+  }
+}
+
+function checkInspectSelection() {
+  const driver = path.join(__dirname, '../wpt/test-compression.js');
+  const env = { ...process.env, WPT_INSPECT: '1' };
+  delete env.WPT_BACKEND;
+
+  const runFailure = common.mustCall((args, expected) => {
+    const result = spawnSync(process.execPath, [driver, ...args], {
+      env,
+      encoding: 'utf8',
+      timeout: common.platformTimeout(10_000),
+    });
+    const { error, status, stdout, stderr } = result;
+    assert.ifError(error);
+    assert.strictEqual(status, 1, `WPT inspect probe passed:\n${stdout}${stderr}`);
+    assert.match(stderr, expected);
+  }, 3);
+
+  runFailure([], /WPT_INSPECT requires a WPT test path/);
+  runFailure(
+    ['compression-bad-chunks.any.js'],
+    /WPT_INSPECT requires exactly one generated WPT test path; .* matched 2:\r?\ncompression\/compression-bad-chunks\.any\.html\r?\ncompression\/compression-bad-chunks\.any\.worker\.html/,
+  );
+  runFailure(
+    ['compression/compression-bad-chunks.any.worker.html'],
+    /WPT_INSPECT does not support worker tests: compression\/compression-bad-chunks\.any\.worker\.html/,
+  );
+}
+
+async function main() {
+  checkBackendSelection();
+  checkInspectSelection();
+  checkQueuedSpecsKeepRunnerAlive();
+
+  const completed = await compare(false);
+  assert.deepStrictEqual(completed, [
+    'completion 0',
+    'result 0 passes',
+    'result 0 passes asynchronously',
+    'result 1 fails',
+    'skip skipped by name',
+    'skip skipped by pattern',
+  ]);
+
+  const uncaught = await compare(true);
+  assert.deepStrictEqual(uncaught, [
+    'uncaught Error: deliberate uncaught error | deliberate uncaught error',
+  ]);
+
+  for (const [driver, spec] of [
+    ['test-compression.js', 'compression-bad-chunks.any.js'],
+    ['test-webidl.js', 'ecmascript-binding/global-object-implicit-this-value.any.js'],
+  ]) {
+    assert.deepStrictEqual(
+      runDriver(driver, spec, 'thread'),
+      runDriver(driver, spec, 'process'),
+    );
+  }
+
+  const windowResults = runDriver(
+    'test-events.js',
+    'dom/events/Event-constructors.any.html',
+    'thread',
+  );
+  const workerResults = runDriver(
+    'test-events.js',
+    'dom/events/Event-constructors.any.worker.html',
+    'thread',
+  ).map((line) => line.replace('.any.worker.html', '.any.html'));
+  assert.deepStrictEqual(workerResults, windowResults);
+}
+
+if (backendProbe) {
+  runDefaultBackendProbe();
+} else if (queueProbe) {
+  runQueueProbe();
+} else {
+  main().then(common.mustCall());
+}
diff --git a/test/parallel/test-common-wpt-inspect.js b/test/parallel/test-common-wpt-inspect.js
new file mode 100644
index 000000000000..ff53902972c5
--- /dev/null
+++ b/test/parallel/test-common-wpt-inspect.js
@@ -0,0 +1,44 @@
+'use strict';
+
+const common = require('../common');
+common.skipIfInspectorDisabled();
+
+const assert = require('assert');
+const path = require('path');
+const { NodeInstance } = require('../common/inspector-helper');
+
+const driver = path.join(__dirname, '../wpt/test-compression.js');
+
+async function main() {
+  const parent = new NodeInstance([], `
+    delete process.env.WPT_BACKEND;
+    process.env.WPT_INSPECT = '1';
+    process.argv[2] = 'compression/compression-bad-chunks.any.html';
+    require(${JSON.stringify(driver)});
+  `, '', {
+    log() {},
+    error() {},
+  });
+  const stderr = [];
+  parent.on('stderr', (line) => stderr.push(line));
+
+  const session = await parent.connectInspectorSession();
+  await session.send([
+    { method: 'Runtime.enable' },
+    { method: 'Debugger.enable' },
+    { method: 'Runtime.runIfWaitingForDebugger' },
+  ]);
+  await session.waitForNotification('Debugger.paused');
+  await session.send({ method: 'Debugger.resume' });
+  await session.disconnect();
+
+  const { exitCode, signal } = await parent.expectShutdown();
+  assert.strictEqual(signal, null);
+  assert.strictEqual(exitCode, 0);
+  assert.strictEqual(
+    stderr.filter((line) => line.startsWith('Debugger listening on ')).length,
+    1,
+  );
+}
+
+main().then(common.mustCall());
diff --git a/test/parallel/test-common-wpt-webworker-error.js b/test/parallel/test-common-wpt-webworker-error.js
new file mode 100644
index 000000000000..76738303cdf2
--- /dev/null
+++ b/test/parallel/test-common-wpt-webworker-error.js
@@ -0,0 +1,79 @@
+'use strict';
+
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { fork } = require('child_process');
+const { Worker } = require('worker_threads');
+
+const workerPath = path.join(__dirname, '../common/wpt/worker.js');
+const harnessPath = fixtures.path('wpt', 'resources', 'testharness.js');
+const execArgv = ['--experimental-web-worker'];
+const workerData = {
+  testRelativePath: 'workers/error-after-result.any.js',
+  wptRunner: path.join(__dirname, '../common/wpt.js'),
+  wptPath: 'workers',
+  initScript: null,
+  harness: {
+    code: fs.readFileSync(harnessPath, 'utf8'),
+    filename: harnessPath,
+  },
+  scriptsToRun: [],
+  webWorker: {
+    path: fixtures.path('web-worker', 'wpt-error-after-result.js'),
+    isAnyTest: true,
+    initScript: null,
+    variant: '',
+    scripts: [],
+    skippedTests: [],
+  },
+  needsGc: false,
+  skippedTests: [],
+};
+
+// Both backends have to report an error thrown by a Web Worker after a result
+// was already reported, and report it the same way.
+check('thread', () => {
+  const worker = new Worker(workerPath, { execArgv, workerData });
+  return { runner: worker, stop: () => worker.terminate() };
+});
+check('process', () => {
+  const child = fork(workerPath, { execArgv, serialization: 'advanced' });
+  child.send(workerData);
+  return { runner: child, stop: () => child.kill() };
+});
+
+function check(backend, start) {
+  const { runner, stop } = start();
+
+  const timeout = setTimeout(() => {
+    stop();
+    assert.fail(`WPT worker error was not reported on the ${backend} backend`);
+  }, common.platformTimeout(10_000));
+
+  const onCompletion = common.mustCall((status) => {
+    clearTimeout(timeout);
+    assert.strictEqual(status.status, 1);
+    assert.strictEqual(status.message, 'probe error after first result');
+    stop();
+  });
+
+  runner.on('error', common.mustNotCall());
+  // The error reaches the runner straight from the Web Worker while results
+  // travel through the harness, so it can arrive before them.
+  runner.on('message', common.mustCallAtLeast((message) => {
+    switch (message.type) {
+      case 'result':
+        assert.strictEqual(message.result.name, 'reported before error');
+        assert.strictEqual(message.result.status, 0);
+        break;
+      case 'completion':
+        onCompletion(message.status);
+        break;
+      default:
+        assert.fail(`Unexpected message type: ${message.type}`);
+    }
+  }, 1));
+}
diff --git a/test/parallel/test-crypto-aes-wrap.js b/test/parallel/test-crypto-aes-wrap.js
index 951e93d728e3..b6561524dc92 100644
--- a/test/parallel/test-crypto-aes-wrap.js
+++ b/test/parallel/test-crypto-aes-wrap.js
@@ -63,3 +63,146 @@ const key3 = Buffer.from('29c9eab5ed5ad44134a1437fe2e673b4d88a5b7c72e68454fea087
   const msg = decipher.update(cipher.update(text, 'utf8'), 'buffer', 'utf8');
   assert.strictEqual(msg, text, `${algorithm} test case failed`);
 });
+
+const kwIV = Buffer.alloc(8, 0xa6);
+const kwpIV = Buffer.from('a65959a6', 'hex');
+
+// NIST SP 800-38F known-answer vectors.
+[
+  {
+    algorithm: 'aes-128-wrap',
+    key: '000102030405060708090a0b0c0d0e0f',
+    plaintext: '00112233445566778899aabbccddeeff',
+    ciphertext: '1fa68b0a8112b447aef34bd8fb5a7b829d3e862371d2cfe5',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-192-wrap',
+    key: '000102030405060708090a0b0c0d0e0f1011121314151617',
+    plaintext: '00112233445566778899aabbccddeeff',
+    ciphertext: '96778b25ae6ca435f92b5b97c050aed2468ab8a17ad84e5d',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-256-wrap',
+    key: '000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f',
+    plaintext: '00112233445566778899aabbccddeeff',
+    ciphertext: '64e8c3f9ce0f5ba263e9777905818a2a93c8191e7d6e8ae7',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-128-wrap-pad',
+    key: '6decf10a1caf8e3b80c7a4be8c9c84e8',
+    plaintext: '49',
+    ciphertext: '01a7d657fc4a5b216f261cca4d052c2b',
+    iv: kwpIV,
+  },
+  {
+    algorithm: 'aes-192-wrap-pad',
+    key: '9ca11078baebc1597a68ce2fe3fc79a201626575252b8860',
+    plaintext: '76',
+    ciphertext: '866bc0ae30e290bb20a0dab31a6e7165',
+    iv: kwpIV,
+  },
+  {
+    algorithm: 'aes-256-wrap-pad',
+    key: '95da2700ca6fd9a52554ee2a8df1386f5b94a1a60ed8a4aef60a8d61ab5f225a',
+    plaintext: 'd1',
+    ciphertext: '06ba7ae6f3248cfdcf267507fa001bc4',
+    iv: kwpIV,
+  },
+  {
+    algorithm: 'aes-128-wrap-inv',
+    key: 'e88ba734ea243480a6129366753b58eb',
+    plaintext: 'd140ac16a44c1c2b3f47037ea8898a3e',
+    ciphertext: '600861ee14320006f0ae55c46d5e1ebf3303751df7f038df',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-192-wrap-inv',
+    key: '370c715135b44eb3773b1aff833bcd28b59aee866d4a36b3',
+    plaintext: 'eae0f60f1cf33d5b75869e84c764a04e',
+    ciphertext: 'ea4ba4add8add19950ca491d109ffa08f90312693055677a',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-256-wrap-inv',
+    key: 'de982f7c871f78e37462e2f48a62eecb2da81a10799c6ebf2bee8c786b624b0e',
+    plaintext: 'ecafc437d9f1643c7645c2416c14c003',
+    ciphertext: 'aec02ddb3f6de1f99103c6042dfc9001eb3cf56d9c2a11f7',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-128-wrap-pad-inv',
+    key: '1c321a356b0ee25e30de2d618c1facbe',
+    plaintext: '42',
+    ciphertext: '3ddf22da3080a1a5252574c76f833790',
+    iv: kwpIV,
+  },
+  {
+    algorithm: 'aes-192-wrap-pad-inv',
+    key: 'fe3fe235bb36dcf03f01cbf32cc98a3abf10ab3d608d3b30',
+    plaintext: '1d2b7fc29991bafaf7',
+    ciphertext: 'c11afb3c0de263dfb9b672a5f81fe0b9acfe9c407691f332',
+    iv: kwpIV,
+  },
+  {
+    algorithm: 'aes-256-wrap-pad-inv',
+    key: '148a3fa618a6998c30b9f0f67922354a3747f2fa2e4d2e0b7af9582d6f548fee',
+    plaintext: '441125592acf9e5208dcd558a7ac0034d15530dbad7a2913963da0cbf60aa3',
+    ciphertext: '23f26a9476829885055694062c89b86399e8d6125509c9e88bb0a5b5113f4bfc8d34a62cba3c9eee',
+    iv: kwpIV,
+  },
+].forEach(({ algorithm, key, plaintext, ciphertext, iv }) => {
+  if (!crypto.getCiphers().includes(algorithm)) {
+    common.printSkipMessage(`Skipping unsupported ${algorithm} test case`);
+    return;
+  }
+
+  const keyBuffer = Buffer.from(key, 'hex');
+  const plaintextBuffer = Buffer.from(plaintext, 'hex');
+  const expected = Buffer.from(ciphertext, 'hex');
+  const cipher = crypto.createCipheriv(algorithm, keyBuffer, iv);
+  const actual = Buffer.concat([
+    cipher.update(plaintextBuffer),
+    cipher.final(),
+  ]);
+  assert.deepStrictEqual(actual, expected, `${algorithm} wrap failed`);
+
+  const decipher = crypto.createDecipheriv(algorithm, keyBuffer, iv);
+  const unwrapped = Buffer.concat([
+    decipher.update(actual),
+    decipher.final(),
+  ]);
+  assert.deepStrictEqual(
+    unwrapped, plaintextBuffer, `${algorithm} unwrap failed`);
+});
+
+{
+  const algorithm = crypto.getCiphers().includes('aes-128-wrap-inv') ?
+    'aes-128-wrap-inv' : 'aes128-wrap';
+  if (!crypto.getCiphers().includes(algorithm)) {
+    common.printSkipMessage(`Skipping unsupported ${algorithm} state tests`);
+  } else {
+    const key = Buffer.from('e88ba734ea243480a6129366753b58eb', 'hex');
+    const iv = Buffer.alloc(8, 0xa6);
+    const plaintextParts = [Buffer.alloc(16), Buffer.alloc(16, 1)];
+    const wrappedParts = plaintextParts.map((plaintext) => {
+      const cipher = crypto.createCipheriv(algorithm, key, iv);
+      return Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    });
+
+    for (const [create, inputParts] of [
+      [crypto.createCipheriv, plaintextParts],
+      [crypto.createDecipheriv, wrappedParts],
+    ]) {
+      const withoutUpdate = create(algorithm, key, iv);
+      assert.throws(() => withoutUpdate.final(), /Unsupported state/);
+
+      const multipleUpdates = create(algorithm, key, iv);
+      multipleUpdates.update(inputParts[0]);
+      assert.throws(() => multipleUpdates.update(inputParts[1]),
+                    /Trying to add data in unsupported state/);
+    }
+  }
+}
diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js
index 1c5849b3f1d6..3ad34729f871 100644
--- a/test/parallel/test-crypto-authenticated.js
+++ b/test/parallel/test-crypto-authenticated.js
@@ -63,7 +63,7 @@ for (const test of TEST_CASES) {
     continue;
   }
 
-  const isCCM = /^aes-(128|192|256)-ccm$/.test(test.algo);
+  const isCCM = /^(?:aes-(?:128|192|256)|sm4)-ccm$/.test(test.algo);
   const isOCB = /^aes-(128|192|256)-ocb$/.test(test.algo);
   const isSIV = /^aes-(128|192|256)-siv$/.test(test.algo);
 
@@ -978,6 +978,7 @@ if (!fips3 && !process.features.openssl_is_boringssl) {
 if (ciphers.includes('aes-128-ccm')) {
   const key = crypto.randomBytes(16);
   const nonce = crypto.randomBytes(13);
+  const authError = /Unsupported state or unable to authenticate data/;
 
   const cipher = crypto.createCipheriv('aes-128-ccm', key, nonce, {
     authTagLength: 16,
@@ -1001,6 +1002,47 @@ if (ciphers.includes('aes-128-ccm')) {
     decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
     decipher.update(new DataView(new ArrayBuffer(0)));
     decipher.final();
+
+    const invalidTag = Buffer.from(tag);
+    invalidTag[0] ^= 0xff;
+
+    {
+      const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
+        authTagLength: 16,
+      });
+      decipher.setAuthTag(tag);
+      decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
+      assert.throws(() => decipher.final(), authError);
+    }
+
+    {
+      const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
+        authTagLength: 16,
+      });
+      decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
+      assert.throws(() => decipher.final(), authError);
+    }
+
+    {
+      const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
+        authTagLength: 16,
+      });
+      decipher.setAuthTag(invalidTag);
+      decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
+      decipher.update(Buffer.alloc(0));
+      assert.throws(() => decipher.final(), authError);
+    }
+
+    {
+      const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
+        authTagLength: 16,
+      });
+      decipher.setAuthTag(tag);
+      decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
+      decipher.update(Buffer.alloc(0));
+      assert.throws(() => decipher.update(Buffer.alloc(0)), errMessages.state);
+      decipher.final();
+    }
   }
 } else {
   common.printSkipMessage('Skipping unsupported aes-128-ccm test');
diff --git a/test/parallel/test-crypto-cipherbase-options-fast-path.js b/test/parallel/test-crypto-cipherbase-options-fast-path.js
new file mode 100644
index 000000000000..9649b61fa7c5
--- /dev/null
+++ b/test/parallel/test-crypto-cipherbase-options-fast-path.js
@@ -0,0 +1,130 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const {
+  createCipheriv,
+  createDecipheriv,
+} = require('crypto');
+
+const key = Buffer.alloc(16);
+const gcmIv = Buffer.alloc(12);
+const cbcIv = Buffer.alloc(16);
+
+for (const create of [createCipheriv, createDecipheriv]) {
+  // None of these supply either of the extended cipher options.
+  create('aes-128-gcm', key, gcmIv);
+  create('aes-128-gcm', key, gcmIv, null);
+  create('aes-128-gcm', key, gcmIv, {});
+  create('aes-128-gcm', key, gcmIv, undefined);
+  create('aes-128-gcm', key, gcmIv, { authTagLength: 16 });
+
+  for (const options of [
+    { ctsMode: null },
+    { ctsMode: undefined },
+    { xtsStandard: null },
+    { xtsStandard: undefined },
+    { ctsMode: null, xtsStandard: undefined },
+  ]) {
+    create('aes-128-gcm', key, gcmIv, options);
+  }
+
+  const accesses = [];
+  create('aes-128-gcm', key, gcmIv, {
+    get authTagLength() {
+      accesses.push('authTagLength');
+      return 16;
+    },
+    get ctsMode() {
+      accesses.push('ctsMode');
+      return null;
+    },
+    get xtsStandard() {
+      accesses.push('xtsStandard');
+      return undefined;
+    },
+  });
+  assert.deepStrictEqual(
+    accesses,
+    ['authTagLength', 'ctsMode', 'xtsStandard']);
+
+  const extendedAccesses = [];
+  assert.throws(
+    () => create('aes-128-cbc', key, cbcIv, {
+      get authTagLength() {
+        extendedAccesses.push('authTagLength');
+        return null;
+      },
+      get ctsMode() {
+        extendedAccesses.push('ctsMode');
+        return 'CS1';
+      },
+      get xtsStandard() {
+        extendedAccesses.push('xtsStandard');
+        return null;
+      },
+    }),
+    { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+  assert.deepStrictEqual(
+    extendedAccesses,
+    ['authTagLength', 'ctsMode', 'xtsStandard']);
+
+  const invalidAuthTagAccesses = [];
+  assert.throws(() => create('aes-128-cbc', key, cbcIv, {
+    get authTagLength() {
+      invalidAuthTagAccesses.push('authTagLength');
+      return -2;
+    },
+    get ctsMode() {
+      invalidAuthTagAccesses.push('ctsMode');
+      return undefined;
+    },
+  }), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.deepStrictEqual(invalidAuthTagAccesses, ['authTagLength']);
+
+  const invalidCtsTypeAccesses = [];
+  assert.throws(() => create('aes-128-cbc', key, cbcIv, {
+    get ctsMode() {
+      invalidCtsTypeAccesses.push('ctsMode');
+      return 1;
+    },
+    get xtsStandard() {
+      invalidCtsTypeAccesses.push('xtsStandard');
+      return undefined;
+    },
+  }), { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.deepStrictEqual(invalidCtsTypeAccesses, ['ctsMode']);
+
+  const invalidCtsValueAccesses = [];
+  assert.throws(() => create('aes-128-cbc', key, cbcIv, {
+    get ctsMode() {
+      invalidCtsValueAccesses.push('ctsMode');
+      return 'CS4';
+    },
+    get xtsStandard() {
+      invalidCtsValueAccesses.push('xtsStandard');
+      return undefined;
+    },
+  }), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.deepStrictEqual(
+    invalidCtsValueAccesses,
+    ['ctsMode', 'xtsStandard']);
+
+  assert.throws(
+    () => create('aes-128-cbc', key, cbcIv, { xtsStandard: 'GB' }),
+    { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+
+  for (const ctsMode of ['', 'CS4']) {
+    assert.throws(
+      () => create('aes-128-cbc', key, cbcIv, { ctsMode }),
+      { code: 'ERR_INVALID_ARG_VALUE' });
+  }
+  for (const xtsStandard of ['', 'IEEE-1619']) {
+    assert.throws(
+      () => create('aes-128-cbc', key, cbcIv, { xtsStandard }),
+      { code: 'ERR_INVALID_ARG_VALUE' });
+  }
+}
diff --git a/test/parallel/test-crypto-cipheriv-cbc-cts.js b/test/parallel/test-crypto-cipheriv-cbc-cts.js
new file mode 100644
index 000000000000..c3447b2908b3
--- /dev/null
+++ b/test/parallel/test-crypto-cipheriv-cbc-cts.js
@@ -0,0 +1,123 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const {
+  createCipheriv,
+  createDecipheriv,
+  getCiphers,
+} = require('crypto');
+
+const algorithm = 'aes-128-cbc-cts';
+const key = Buffer.from('636869636b656e207465726979616b69', 'hex');
+const iv = Buffer.alloc(16);
+
+for (const create of [createCipheriv, createDecipheriv]) {
+  for (const ctsMode of ['cs1', 'CS4', '']) {
+    assert.throws(
+      () => create('aes-128-cbc', key, iv, { ctsMode }),
+      { code: 'ERR_INVALID_ARG_VALUE' });
+  }
+  for (const ctsMode of [1, true, {}]) {
+    assert.throws(
+      () => create('aes-128-cbc', key, iv, { ctsMode }),
+      { code: 'ERR_INVALID_ARG_TYPE' });
+  }
+  assert.throws(
+    () => create('aes-128-cbc', key, iv, { ctsMode: 'CS1' }),
+    { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+}
+
+if (!getCiphers().includes(algorithm)) {
+  common.printSkipMessage(`unsupported ${algorithm}`);
+  return;
+}
+
+// OpenSSL AES-128-CBC-CTS CS1 test vector.
+const plaintext = Buffer.from('4920776f756c64206c696b652074686520',
+                              'hex');
+const expected = Buffer.from('97c6353568f2bf8cb4d8a580362da7ff7f',
+                             'hex');
+
+const cipher = createCipheriv(algorithm, key, iv);
+const ciphertext = Buffer.concat([
+  cipher.update(plaintext),
+  cipher.final(),
+]);
+assert.deepStrictEqual(ciphertext, expected);
+
+const decipher = createDecipheriv(algorithm, key, iv);
+const decrypted = Buffer.concat([
+  decipher.update(ciphertext),
+  decipher.final(),
+]);
+assert.deepStrictEqual(decrypted, plaintext);
+
+const vectors = [
+  {
+    plaintext,
+    ciphertext: {
+      CS1: expected,
+      CS2: Buffer.from('c6353568f2bf8cb4d8a580362da7ff7f97', 'hex'),
+      CS3: Buffer.from('c6353568f2bf8cb4d8a580362da7ff7f97', 'hex'),
+    },
+  },
+  {
+    plaintext: Buffer.from(
+      '4920776f756c64206c696b6520746865' +
+      '2047656e6572616c2047617527732043', 'hex'),
+    ciphertext: {
+      CS1: Buffer.from(
+        '97687268d6ecccc0c07b25e25ecfe584' +
+        '39312523a78662d5be7fcbcc98ebf5a8', 'hex'),
+      CS2: Buffer.from(
+        '97687268d6ecccc0c07b25e25ecfe584' +
+        '39312523a78662d5be7fcbcc98ebf5a8', 'hex'),
+      CS3: Buffer.from(
+        '39312523a78662d5be7fcbcc98ebf5a8' +
+        '97687268d6ecccc0c07b25e25ecfe584', 'hex'),
+    },
+  },
+];
+
+for (const { plaintext, ciphertext } of vectors) {
+  for (const ctsMode of ['CS1', 'CS2', 'CS3']) {
+    const cipher = createCipheriv(algorithm, key, iv, { ctsMode });
+    const encrypted = Buffer.concat([
+      cipher.update(plaintext),
+      cipher.final(),
+    ]);
+    assert.deepStrictEqual(encrypted, ciphertext[ctsMode]);
+
+    const decipher = createDecipheriv(algorithm, key, iv, { ctsMode });
+    const decrypted = Buffer.concat([
+      decipher.update(encrypted),
+      decipher.final(),
+    ]);
+    assert.deepStrictEqual(decrypted, plaintext);
+  }
+}
+
+const tooShort = createCipheriv(algorithm, key, iv);
+assert.throws(() => tooShort.update(Buffer.alloc(15)),
+              /Trying to add data in unsupported state/);
+assert.deepStrictEqual(Buffer.concat([
+  tooShort.update(plaintext),
+  tooShort.final(),
+]), expected);
+
+for (const [create, input] of [
+  [createCipheriv, plaintext],
+  [createDecipheriv, expected],
+]) {
+  const withoutUpdate = create(algorithm, key, iv);
+  assert.throws(() => withoutUpdate.final(), /Unsupported state/);
+
+  const multipleUpdates = create(algorithm, key, iv);
+  multipleUpdates.update(input.subarray(0, 16));
+  assert.throws(() => multipleUpdates.update(input.subarray(16)),
+                /Trying to add data in unsupported state/);
+}
diff --git a/test/parallel/test-crypto-cipheriv-decipheriv.js b/test/parallel/test-crypto-cipheriv-decipheriv.js
index b1965c5a80c1..d2c216924ea8 100644
--- a/test/parallel/test-crypto-cipheriv-decipheriv.js
+++ b/test/parallel/test-crypto-cipheriv-decipheriv.js
@@ -85,6 +85,84 @@ function testCipher3(key, iv) {
          `encryption/decryption with key ${key} and iv ${iv}`);
 }
 
+function testSm4Xts() {
+  const aesKey = Buffer.alloc(16);
+  const aesIv = Buffer.alloc(16);
+  for (const create of [crypto.createCipheriv, crypto.createDecipheriv]) {
+    for (const xtsStandard of ['gb', 'IEEE-1619', '']) {
+      assert.throws(
+        () => create('aes-128-cbc', aesKey, aesIv, { xtsStandard }),
+        { code: 'ERR_INVALID_ARG_VALUE' });
+    }
+    for (const xtsStandard of [1, true, {}]) {
+      assert.throws(
+        () => create('aes-128-cbc', aesKey, aesIv, { xtsStandard }),
+        { code: 'ERR_INVALID_ARG_TYPE' });
+    }
+    assert.throws(
+      () => create('aes-128-cbc', aesKey, aesIv, { xtsStandard: 'GB' }),
+      { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+  }
+
+  if (!crypto.getCiphers().includes('sm4-xts')) {
+    common.printSkipMessage('unsupported sm4-xts test');
+    return;
+  }
+
+  // GB/T 17964-2021
+  const key = Buffer.from(
+    '2B7E151628AED2A6ABF7158809CF4F3C' +
+    '000102030405060708090A0B0C0D0E0F', 'hex');
+  const iv = Buffer.from('F0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF', 'hex');
+  const plaintext = Buffer.from(
+    '6BC1BEE22E409F96E93D7E117393172A' +
+    'AE2D8A571E03AC9C9EB76FAC45AF8E51' +
+    '30C81C46A35CE411E5FBC1191A0A52EF' +
+    'F69F2445DF4F9B17', 'hex');
+  const vectors = [
+    {
+      options: undefined,
+      ciphertext: Buffer.from(
+        'E9538251C71D7B80BBE4483FEF497BD1' +
+        '2C5C581BD6242FC51E08964FB4F60FDB' +
+        '0BA42F63499279213D318D2C11F6886E' +
+        '903BE7F93A1B3479', 'hex'),
+    },
+    {
+      options: { xtsStandard: 'GB' },
+      ciphertext: Buffer.from(
+        'E9538251C71D7B80BBE4483FEF497BD1' +
+        '2C5C581BD6242FC51E08964FB4F60FDB' +
+        '0BA42F63499279213D318D2C11F6886E' +
+        '903BE7F93A1B3479', 'hex'),
+    },
+    {
+      options: { xtsStandard: 'IEEE' },
+      ciphertext: Buffer.from(
+        'E9538251C71D7B80BBE4483FEF497BD1' +
+        'B3DB1A3E60408C575D63FF7DB39F8326' +
+        '0869F9E2585FEC9F0B863BF8FD784B86' +
+        '27D16C0DB6D2CFC7', 'hex'),
+    },
+  ];
+
+  for (const { options, ciphertext } of vectors) {
+    const cipher = crypto.createCipheriv('sm4-xts', key, iv, options);
+    const encrypted = Buffer.concat([
+      cipher.update(plaintext),
+      cipher.final(),
+    ]);
+    assert.deepStrictEqual(encrypted, ciphertext);
+
+    const decipher = crypto.createDecipheriv('sm4-xts', key, iv, options);
+    const decrypted = Buffer.concat([
+      decipher.update(ciphertext),
+      decipher.final(),
+    ]);
+    assert.deepStrictEqual(decrypted, plaintext);
+  }
+}
+
 {
   const Cipheriv = crypto.Cipheriv;
   const algorithm = fips3 ? 'aes-128-cbc' : 'des-ede3-cbc';
@@ -167,6 +245,7 @@ if (!isFipsEnabled) {
   testCipher3(Buffer.from('000102030405060708090A0B0C0D0E0F', 'hex'),
               Buffer.from('A6A6A6A6A6A6A6A6', 'hex'));
 }
+testSm4Xts();
 
 // Zero-sized IV or null should be accepted in ECB mode.
 crypto.createCipheriv('aes-128-ecb', Buffer.alloc(16), Buffer.alloc(0));
diff --git a/test/parallel/test-crypto-cipheriv-xts.js b/test/parallel/test-crypto-cipheriv-xts.js
new file mode 100644
index 000000000000..236ff578f8f8
--- /dev/null
+++ b/test/parallel/test-crypto-cipheriv-xts.js
@@ -0,0 +1,71 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const {
+  createCipheriv,
+  createDecipheriv,
+  getCiphers,
+} = require('crypto');
+
+const iv = Buffer.from('f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff', 'hex');
+const plaintext = Buffer.from(
+  '000102030405060708090a0b0c0d0e0f10', 'hex');
+const cases = [
+  {
+    algorithm: 'aes-128-xts',
+    key: Buffer.from(
+      '000102030405060708090a0b0c0d0e0f' +
+      '101112131415161718191a1b1c1d1e1f', 'hex'),
+  },
+  {
+    algorithm: 'sm4-xts',
+    key: Buffer.from(
+      '2b7e151628aed2a6abf7158809cf4f3c' +
+      '000102030405060708090a0b0c0d0e0f', 'hex'),
+  },
+];
+
+for (const { algorithm, key } of cases) {
+  if (!getCiphers().includes(algorithm)) {
+    common.printSkipMessage(`unsupported ${algorithm} test`);
+    continue;
+  }
+
+  const cipher = createCipheriv(algorithm, key, iv);
+  const ciphertext = cipher.update(plaintext);
+  assert.strictEqual(ciphertext.length, plaintext.length);
+  assert.deepStrictEqual(cipher.final(), Buffer.alloc(0));
+
+  const decipher = createDecipheriv(algorithm, key, iv);
+  assert.deepStrictEqual(decipher.update(ciphertext), plaintext);
+  assert.deepStrictEqual(decipher.final(), Buffer.alloc(0));
+
+  for (const [create, input, expected] of [
+    [createCipheriv, plaintext, ciphertext],
+    [createDecipheriv, ciphertext, plaintext],
+  ]) {
+    const withoutUpdate = create(algorithm, key, iv);
+    assert.throws(() => withoutUpdate.final(), /Unsupported state/);
+
+    const failedUpdate = create(algorithm, key, iv);
+    assert.throws(() => failedUpdate.update(Buffer.alloc(15)),
+                  /Trying to add data in unsupported state/);
+    assert.throws(() => failedUpdate.final(), /Unsupported state/);
+
+    const retry = create(algorithm, key, iv);
+    assert.throws(() => retry.update(Buffer.alloc(15)),
+                  /Trying to add data in unsupported state/);
+    assert.deepStrictEqual(retry.update(input), expected);
+    assert.deepStrictEqual(retry.final(), Buffer.alloc(0));
+
+    const oneUpdate = create(algorithm, key, iv);
+    assert.deepStrictEqual(oneUpdate.update(input), expected);
+    assert.throws(() => oneUpdate.update(Buffer.alloc(16)),
+                  /Trying to add data in unsupported state/);
+    assert.deepStrictEqual(oneUpdate.final(), Buffer.alloc(0));
+  }
+}
diff --git a/test/parallel/test-crypto-dh-curves.js b/test/parallel/test-crypto-dh-curves.js
index ee8849163ae8..f7530aecfc5d 100644
--- a/test/parallel/test-crypto-dh-curves.js
+++ b/test/parallel/test-crypto-dh-curves.js
@@ -144,9 +144,15 @@ if (availableCurves.has('prime256v1') && availableCurves.has('secp256k1')) {
     ecdh4.setPrivateKey(ecdh1.getPrivateKey());
     ecdh4.setPublicKey(ecdh1.getPublicKey());
 
+    const ecdh4Secret = ecdh4.computeSecret(ecdh2.getPublicKey());
+    assert.deepStrictEqual(ecdh4.computeSecret(ecdh2.getPublicKey()),
+                           ecdh4Secret);
+
     assert.throws(() => {
       ecdh4.setPublicKey(ecdh3.getPublicKey());
     }, { message: 'Failed to convert Buffer to EC_POINT' });
+    assert.deepStrictEqual(ecdh4.computeSecret(ecdh2.getPublicKey()),
+                           ecdh4Secret);
 
     // Verify that we can use ECDH without having to use newly generated keys.
     const ecdh5 = crypto.createECDH('secp256k1');
@@ -190,6 +196,8 @@ if (availableCurves.has('prime256v1') && availableCurves.has('secp256k1')) {
                        sharedSecret);
     assert.strictEqual(ecdh5.computeSecret(peerPubPtUnComp, 'hex', 'hex'),
                        sharedSecret);
+    assert.strictEqual(ecdh5.computeSecret(peerPubPtComp, 'hex', 'hex'),
+                       sharedSecret);
 
     // Verify that we still have the same key pair as before the computation.
     assert.strictEqual(ecdh5.getPrivateKey('hex'), cafebabeKey);
@@ -260,3 +268,31 @@ if (availableCurves.has('prime256v1') && availableHashes.has('sha256')) {
     '-----END EC PRIVATE KEY-----';
   crypto.createSign('SHA256').sign(ecPrivateKey);
 }
+
+if (hasFIPS(3) && availableCurves.has('secp256k1')) {
+  const originalFips = crypto.getFips();
+
+  try {
+    crypto.setFips(0);
+    const local = crypto.createECDH('secp256k1');
+    const peer = crypto.createECDH('secp256k1');
+    local.generateKeys();
+    const peerPublicKey = peer.generateKeys();
+
+    local.computeSecret(peerPublicKey);
+    crypto.setFips(1);
+    assert.throws(() => local.computeSecret(peerPublicKey), {
+      code: 'ERR_CRYPTO_INVALID_KEYPAIR',
+      name: 'RangeError',
+    });
+
+    const installed = crypto.createECDH('secp256k1');
+    installed.setPrivateKey(Buffer.from('cafebabe'.repeat(8), 'hex'));
+    assert.throws(() => installed.computeSecret(peerPublicKey), {
+      code: 'ERR_CRYPTO_INVALID_KEYPAIR',
+      name: 'RangeError',
+    });
+  } finally {
+    crypto.setFips(originalFips);
+  }
+}
diff --git a/test/parallel/test-crypto-fips-indicator-strict.js b/test/parallel/test-crypto-fips-indicator-strict.js
new file mode 100644
index 000000000000..cc65d0016269
--- /dev/null
+++ b/test/parallel/test-crypto-fips-indicator-strict.js
@@ -0,0 +1,153 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+if (process.features.openssl_is_boringssl) {
+  common.skip('BoringSSL does not support FIPS');
+}
+
+const assert = require('node:assert');
+const diagnosticsChannel = require('node:diagnostics_channel');
+const { once } = require('node:events');
+const { createHmac, subtle } = require('node:crypto');
+const { Worker } = require('node:worker_threads');
+const {
+  spawnSyncAndExitWithoutError,
+} = require('../common/child_process');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
+
+const channelName = 'crypto.fips.indicator';
+const mode = process.env.NODE_TEST_FIPS_FORCE_MODE;
+
+if (!hasOpenSSL(3, 4)) {
+  common.skip('OpenSSL 3.4 or later is required');
+} else if (!hasFIPS(3, 4)) {
+  common.skip('an active OpenSSL 3.4+ FIPS provider is required');
+} else if (mode === 'provider') {
+  assertSerializedMode(mode);
+  assert.strictEqual(
+    createHmac('sha256', Buffer.alloc(13)).digest().byteLength, 32);
+} else if (mode === 'strict') {
+  assertSerializedMode(mode);
+  const subscriber = common.mustNotCall();
+  diagnosticsChannel.subscribe(channelName, subscriber);
+  assert.throws(
+    () => createHmac('sha256', Buffer.alloc(13)).digest(),
+    { code: /^ERR_OSSL_/ });
+  setImmediate(common.mustCall(() => {
+    assert.strictEqual(
+      diagnosticsChannel.unsubscribe(channelName, subscriber), true);
+  }));
+} else if (mode === 'strict-events') {
+  assertSerializedMode('strict');
+  testStrictEvents().then(common.mustCall());
+} else {
+  runParent();
+}
+
+function assertSerializedMode(expected) {
+  const { getOptionsAsFlagsFromBinding } = require('internal/options');
+  assert.ok(getOptionsAsFlagsFromBinding().includes(`--force-fips=${expected}`));
+}
+
+function nextIndicator() {
+  const keepAlive = setInterval(common.mustNotCall(), 10_000);
+  const { promise, resolve } = Promise.withResolvers();
+  const subscriber = common.mustCall((event, name) => {
+    assert.strictEqual(name, channelName);
+    clearInterval(keepAlive);
+    assert.strictEqual(
+      diagnosticsChannel.unsubscribe(channelName, subscriber), true);
+    resolve(event);
+  });
+  diagnosticsChannel.subscribe(channelName, subscriber);
+  return promise;
+}
+
+function runParent() {
+  try {
+    createHmac('sha256', Buffer.alloc(13)).digest();
+  } catch (error) {
+    assert.match(error.code, /^ERR_OSSL_/);
+    common.printSkipMessage(
+      'the FIPS provider rejects unapproved operations before signaling');
+    return;
+  }
+
+  for (const [args, childMode] of [
+    [['--force-fips'], 'provider'],
+    [['--force-fips=provider'], 'provider'],
+    [['--force-fips=strict'], 'strict'],
+    [[
+      '--force-fips=strict',
+      '--enable-fips-indicator-events',
+    ], 'strict-events'],
+  ]) {
+    spawnSyncAndExitWithoutError(
+      process.execPath, [...args, '--expose-internals', __filename], {
+        env: { ...process.env, NODE_TEST_FIPS_FORCE_MODE: childMode },
+      });
+  }
+}
+
+async function testStrictEvents() {
+  const key = Buffer.alloc(13);
+
+  assert.throws(
+    () => createHmac('sha256', key).digest(),
+    { code: /^ERR_OSSL_/ });
+
+  let eventPromise = nextIndicator();
+  assert.throws(
+    () => createHmac('sha256', key).digest(),
+    { code: /^ERR_OSSL_/ });
+  assert.deepStrictEqual(await eventPromise, {
+    operation: 'HMAC',
+    reason: 'keysize',
+    blocked: true,
+    count: 1,
+    dropped: 0,
+  });
+
+  const hmacKey = await subtle.importKey(
+    'raw', key, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  eventPromise = nextIndicator();
+  await assert.rejects(
+    subtle.sign('HMAC', hmacKey, Buffer.alloc(0)),
+    { name: 'OperationError' });
+  const webCryptoEvent = await eventPromise;
+  assert.strictEqual(webCryptoEvent.operation, 'HMAC');
+  assert.strictEqual(webCryptoEvent.reason, 'keysize');
+  assert.strictEqual(webCryptoEvent.blocked, true);
+
+  eventPromise = nextIndicator();
+  const worker = new Worker(`
+    'use strict';
+    const { createHmac } = require('node:crypto');
+    const { workerData } = require('node:worker_threads');
+    createHmac('sha256', workerData.key).digest();
+  `, {
+    eval: true,
+    workerData: { key },
+  });
+  const errorPromise = once(worker, 'error');
+  const exitPromise = new Promise((resolve) => worker.on('exit', resolve));
+  const [[error], workerEvent] = await Promise.all([
+    errorPromise,
+    eventPromise,
+  ]);
+  assert.match(error.code, /^ERR_OSSL_/);
+  assert.deepStrictEqual(workerEvent, {
+    operation: 'HMAC',
+    reason: 'keysize',
+    blocked: true,
+    count: 1,
+    dropped: 0,
+  });
+  const exitCode = await exitPromise;
+  assert.strictEqual(exitCode, 1);
+}
diff --git a/test/parallel/test-crypto-fips.js b/test/parallel/test-crypto-fips.js
index 8b2e1c9a3649..ea20d895b1c8 100644
--- a/test/parallel/test-crypto-fips.js
+++ b/test/parallel/test-crypto-fips.js
@@ -10,10 +10,11 @@ if (process.features.openssl_is_boringssl)
 const assert = require('assert');
 const spawnSync = require('child_process').spawnSync;
 const path = require('path');
+const { spawnSyncAndAssert } = require('../common/child_process');
 const fixtures = require('../common/fixtures');
 const { internalBinding } = require('internal/test/binding');
 const { testFipsCrypto } = internalBinding('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasOpenSSL3 } = require('../common/crypto');
 
 const FIPS_ENABLED = 1;
 const FIPS_DISABLED = 0;
@@ -94,6 +95,45 @@ testHelper(
   'require("crypto").getFips()',
   process.env);
 
+// Explicit provider mode should preserve the behavior of bare --force-fips.
+testHelper(
+  testFipsCrypto() ? 'stdout' : 'stderr',
+  ['--force-fips=provider'],
+  testFipsCrypto() ? kNoFailure : kGenericUserError,
+  testFipsCrypto() ? FIPS_ENABLED : FIPS_FORCE_ERROR_STRING,
+  'require("crypto").getFips()',
+  process.env);
+
+{
+  spawnSyncAndAssert(
+    process.execPath, ['--force-fips=invalid', '-e', '0'], {
+      status: 9,
+      stderr: /invalid value for --force-fips; expected 'provider' or 'strict'/,
+    });
+}
+
+if (hasOpenSSL(3, 4)) {
+  testHelper(
+    testFipsCrypto() ? 'stdout' : 'stderr',
+    ['--force-fips=strict'],
+    testFipsCrypto() ? kNoFailure : kGenericUserError,
+    testFipsCrypto() ? FIPS_ENABLED : FIPS_FORCE_ERROR_STRING,
+    'require("crypto").getFips()',
+    process.env);
+} else {
+  spawnSyncAndAssert(
+    process.execPath, ['--enable-fips-indicator-events', '-e', '0'], {
+      status: 9,
+      stderr: /--enable-fips-indicator-events requires OpenSSL 3\.4 or later/,
+    });
+
+  spawnSyncAndAssert(
+    process.execPath, ['--force-fips=strict', '-e', '0'], {
+      status: 9,
+      stderr: /--force-fips=strict requires OpenSSL 3\.4 or later/,
+    });
+}
+
 // By default FIPS should be off in both FIPS and non-FIPS builds
 // unless Node.js was configured using --shared-openssl in
 // which case it may be enabled by the system.
diff --git a/test/parallel/test-crypto-getcipherinfo.js b/test/parallel/test-crypto-getcipherinfo.js
index 0a984f0ce54e..5afd2e5a4208 100644
--- a/test/parallel/test-crypto-getcipherinfo.js
+++ b/test/parallel/test-crypto-getcipherinfo.js
@@ -5,11 +5,12 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const {
+  createCipheriv,
   createHash,
   getCiphers,
   getCipherInfo,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL3 } = require('../common/crypto');
 
 const assert = require('assert');
 
@@ -17,6 +18,42 @@ const ciphers = getCiphers();
 
 assert.strictEqual(getCipherInfo(-1), undefined);
 assert.strictEqual(getCipherInfo('cipher that does not exist'), undefined);
+if (hasOpenSSL3) {
+  assert.deepStrictEqual(
+    ciphers.filter((cipher) => cipher.includes('cbc-hmac')), []);
+  for (const cipher of [
+    'null',
+    'aes-128-cbc-hmac-sha1',
+    'aes-256-cbc-hmac-sha1',
+    'aes-128-cbc-hmac-sha256',
+    'aes-256-cbc-hmac-sha256',
+    'aes-128-cbc-hmac-sha1-etm',
+    'aes-192-cbc-hmac-sha1-etm',
+    'aes-256-cbc-hmac-sha1-etm',
+    'aes-128-cbc-hmac-sha256-etm',
+    'aes-192-cbc-hmac-sha256-etm',
+    'aes-256-cbc-hmac-sha256-etm',
+    'aes-128-cbc-hmac-sha512-etm',
+    'aes-192-cbc-hmac-sha512-etm',
+    'aes-256-cbc-hmac-sha512-etm',
+  ]) {
+    assert(!ciphers.includes(cipher));
+    assert.strictEqual(getCipherInfo(cipher), undefined);
+    assert.throws(
+      () => createCipheriv(cipher, Buffer.alloc(16), Buffer.alloc(16)), {
+        code: 'ERR_CRYPTO_UNKNOWN_CIPHER',
+      });
+  }
+}
+
+if (ciphers.includes('aes-128-wrap-inv')) {
+  const alias = 'aes128-wrap-inv';
+  assert(ciphers.includes(alias));
+  assert.deepStrictEqual(getCipherInfo(alias),
+                         getCipherInfo('aes-128-wrap-inv'));
+}
+assert(!ciphers.some((cipher) => /^\d+(?:\.\d+)+$/.test(cipher)));
+
 if (!process.features.openssl_is_boringssl) {
   // A failed provider fetch must not contaminate the OpenSSL error queue.
   assert.throws(() => createHash('sha256', { outputLength: 28 }), {
@@ -96,6 +133,19 @@ if (hasFIPS(3)) {
   common.printSkipMessage('Skipping unsupported aes-128-ocb test cases');
 }
 
+if (ciphers.includes('aes-128-cbc-cts')) {
+  const info = getCipherInfo('aes-128-cbc-cts');
+  assert.strictEqual(info.name, 'aes-128-cbc-cts');
+  assert.strictEqual(info.mode, 'cbc');
+  assert.strictEqual(info.keyLength, 16);
+  assert.strictEqual(info.blockSize, 16);
+  assert.strictEqual(info.ivLength, 16);
+  assert(getCipherInfo('aes-128-cbc-cts', { ivLength: 16 }));
+  assert(!getCipherInfo('aes-128-cbc-cts', { ivLength: 15 }));
+} else {
+  common.printSkipMessage('Skipping unsupported aes-128-cbc-cts test cases');
+}
+
 if (ciphers.includes('aes-128-siv')) {
   const info = getCipherInfo('aes-128-siv');
   assert.strictEqual(info.name, 'aes-128-siv');
@@ -119,3 +169,20 @@ if (ciphers.includes('aes-128-gcm-siv')) {
 } else {
   common.printSkipMessage('Skipping unsupported aes-128-gcm-siv test cases');
 }
+
+for (const [name, mode, keyLength, ivLength] of [
+  ['sm4-gcm', 'gcm', 16, 12],
+  ['sm4-ccm', 'ccm', 16, 12],
+  ['sm4-xts', 'xts', 32, 16],
+]) {
+  if (ciphers.includes(name)) {
+    const info = getCipherInfo(name);
+    assert.strictEqual(info.name, name);
+    assert.strictEqual(info.mode, mode);
+    assert.strictEqual(info.nid, undefined);
+    assert.strictEqual(info.keyLength, keyLength);
+    assert.strictEqual(info.ivLength, ivLength);
+  } else {
+    common.printSkipMessage(`Skipping unsupported ${name} test cases`);
+  }
+}
diff --git a/test/parallel/test-crypto-hmac.js b/test/parallel/test-crypto-hmac.js
index 29740a2fc247..ca6a424c5293 100644
--- a/test/parallel/test-crypto-hmac.js
+++ b/test/parallel/test-crypto-hmac.js
@@ -312,6 +312,26 @@ for (let i = 0, l = rfc4231.length; i < l; i++) {
   }
 }
 
+// Calling digest() after the Hmac has already been used as a stream must
+// return an empty buffer (the DEP0206 repeat-digest guard), not uninitialized
+// stack memory. The stream itself must still produce the correct digest.
+// See: https://github.com/nodejs/node/issues/28245
+{
+  const key = 'key';
+  const data = 'some data to hash';
+
+  const streamHmac = crypto.createHmac('sha256', key);
+  streamHmac.end(data);
+  const streamDigest = streamHmac.read();
+
+  // digest() after the stream already finalized must not return garbage.
+  assert.deepStrictEqual(streamHmac.digest(), Buffer.alloc(0));
+
+  // Sanity check: the stream itself produced the correct digest.
+  const expected = crypto.createHmac('sha256', key).update(data).digest();
+  assert.deepStrictEqual(streamDigest, expected);
+}
+
 // Test HMAC-MD5/SHA1 (rfc 2202 Test Cases)
 const rfc2202_md5 = [
   {
diff --git a/test/parallel/test-crypto-keyobject-clone-transfer.js b/test/parallel/test-crypto-keyobject-clone-transfer.js
index 6786df288589..2ac37ca201e7 100644
--- a/test/parallel/test-crypto-keyobject-clone-transfer.js
+++ b/test/parallel/test-crypto-keyobject-clone-transfer.js
@@ -53,23 +53,25 @@ async function roundTripViaMessageChannel(key) {
   return received;
 }
 
-async function roundTripViaWorker(key) {
-  const worker = new Worker(`
-    'use strict';
-    const { parentPort } = require('node:worker_threads');
-    const { types: { isKeyObject } } = require('node:util');
-
-    parentPort.once('message', ({ key, expectedType }) => {
-      try {
-        if (!isKeyObject(key) || key.type !== expectedType) {
-          throw new Error('KeyObject slot mismatch in worker');
-        }
-        parentPort.postMessage({ key });
-      } catch (err) {
-        parentPort.postMessage({ error: err.stack || err.message });
+function workerMain() {
+  const { parentPort } = require('node:worker_threads');
+  const { types: { isKeyObject: workerIsKeyObject } } = require('node:util');
+
+  parentPort.once('message', ({ key, expectedType }) => {
+    try {
+      if (!workerIsKeyObject(key) || key.type !== expectedType) {
+        throw new Error('KeyObject slot mismatch in worker');
       }
-    });
-  `, { eval: true });
+      parentPort.postMessage({ key });
+    } catch (err) {
+      parentPort.postMessage({ error: err.stack || err.message });
+    }
+  });
+}
+
+async function roundTripViaWorker(key) {
+  const worker = new Worker(
+    `'use strict';(${workerMain.toString()})()`, { eval: true });
 
   worker.postMessage({ key, expectedType: key.type });
   const [msg] = await once(worker, 'message');
diff --git a/test/parallel/test-crypto-mac-cache-snapshot.js b/test/parallel/test-crypto-mac-cache-snapshot.js
new file mode 100644
index 000000000000..1fd37367d2a8
--- /dev/null
+++ b/test/parallel/test-crypto-mac-cache-snapshot.js
@@ -0,0 +1,32 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const { hasOpenSSL3 } = require('../common/crypto');
+if (!hasOpenSSL3 || process.features.openssl_is_boringssl)
+  common.skip('this test requires OpenSSL 3 EVP_MAC support');
+
+const assert = require('node:assert');
+const { getMacs } = require('node:crypto');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+const { buildSnapshot, runWithSnapshot } = require('../common/snapshot');
+
+if (!getMacs().includes('poly1305'))
+  common.skip('Poly1305 is not supported');
+
+const entry = fixtures.path('snapshot', 'crypto-provider-mac-cache.js');
+const buildEnv = {
+  OPENSSL_CONF: fixtures.path(
+    'openssl3-conf', 'legacy_provider_enabled.cnf'),
+};
+const runEnv = {
+  OPENSSL_CONF: fixtures.path('openssl3-conf', 'default_only.cnf'),
+};
+
+tmpdir.refresh();
+buildSnapshot(entry, buildEnv);
+const { stdout } = runWithSnapshot(undefined, runEnv);
+assert.match(stdout, /provider MAC cache snapshot: ok/);
diff --git a/test/parallel/test-crypto-mac-cache.js b/test/parallel/test-crypto-mac-cache.js
new file mode 100644
index 000000000000..dfe99e943bb2
--- /dev/null
+++ b/test/parallel/test-crypto-mac-cache.js
@@ -0,0 +1,307 @@
+// Flags: --expose-internals --no-warnings
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const { hasOpenSSL3 } = require('../common/crypto');
+if (!hasOpenSSL3 || process.features.openssl_is_boringssl)
+  common.skip('this test requires OpenSSL 3 EVP_MAC support');
+
+const assert = require('node:assert');
+const { once } = require('node:events');
+const {
+  createMac,
+  getFips,
+  getMacs,
+  setFips,
+} = require('node:crypto');
+const { getMacCache } = require('internal/crypto/util');
+const { internalBinding } = require('internal/test/binding');
+const { Worker } = require('node:worker_threads');
+
+const binding = internalBinding('crypto');
+const algorithm = 'poly1305';
+const key = Buffer.from(
+  '85d6be7857556d337f4452fe42d506a8' +
+  '0103808afb0db2fd4abff6af4149f51b',
+  'hex',
+);
+const data = Buffer.from('Cryptographic Forum Research Group');
+const expected = 'a8061dc1305136c6c22b8baf0c0127a9';
+const originalFips = getFips();
+
+function getAliasId(aliases, name) {
+  const normalized = name.toLowerCase();
+  for (const [alias, id] of Object.entries(aliases)) {
+    if (alias.toLowerCase() === normalized) return id;
+  }
+  return undefined;
+}
+
+try {
+  setFips(0);
+} catch {
+  common.skip('FIPS mode cannot be disabled');
+}
+if (getFips() !== 0)
+  common.skip('FIPS mode cannot be disabled');
+
+const initialMacs = getMacs();
+if (!initialMacs.includes(algorithm))
+  common.skip(`${algorithm} is not supported`);
+
+let fipsMacs;
+let canToggleFips = false;
+const generationBeforeFipsProbe = binding.getFipsCryptoGeneration();
+try {
+  setFips(1);
+} catch {
+  // FIPS mode is optional, so the non-FIPS cache checks below still run.
+  assert.strictEqual(
+    binding.getFipsCryptoGeneration(),
+    generationBeforeFipsProbe,
+  );
+}
+if (getFips() === 1) {
+  fipsMacs = getMacs();
+  canToggleFips = true;
+}
+try {
+  setFips(0);
+} catch {
+  canToggleFips = false;
+}
+
+const generation = binding.getFipsCryptoGeneration();
+setFips(0);
+assert.strictEqual(binding.getFipsCryptoGeneration(), generation);
+
+const expectedMacs = getMacs();
+const disposableMacs = getMacs();
+assert.notStrictEqual(disposableMacs, expectedMacs);
+disposableMacs.length = 0;
+disposableMacs.push('not-a-real-mac');
+assert.deepStrictEqual(getMacs(), expectedMacs);
+
+const aliases = binding.getCachedMacAliases();
+const initialAlgorithmId = getAliasId(aliases, algorithm);
+assert.strictEqual(typeof initialAlgorithmId, 'number');
+
+const macCache = getMacCache();
+const cacheName = Object.keys(macCache).find(
+  (name) => name.toLowerCase() === algorithm,
+);
+assert(cacheName);
+const descriptor = Object.getOwnPropertyDescriptor(macCache, cacheName);
+assert(descriptor);
+assert.strictEqual(descriptor.value, initialAlgorithmId);
+const sentinel = new Error('mac cache setter');
+const throwsSentinel = (err) => err === sentinel;
+
+function installThrowingMacCacheEntry(id) {
+  Object.defineProperty(macCache, cacheName, {
+    __proto__: null,
+    configurable: true,
+    enumerable: descriptor.enumerable,
+    get() { return id; },
+    set() { throw sentinel; },
+  });
+}
+
+installThrowingMacCacheEntry(-1);
+assert.throws(() => createMac(cacheName, key), throwsSentinel);
+Object.defineProperty(macCache, cacheName, descriptor);
+
+// OpenSSL exposes two spellings for each KMAC implementation. They must map
+// to the same cached EVP_MAC rather than consume separate cache entries.
+const kmac128Id = getAliasId(aliases, 'kmac128');
+const kmac128HyphenatedId = getAliasId(aliases, 'kmac-128');
+if (kmac128Id === undefined || kmac128HyphenatedId === undefined) {
+  common.printSkipMessage('KMAC-128 aliases are not available');
+} else {
+  assert.strictEqual(kmac128Id, kmac128HyphenatedId);
+  const kmacAlgorithm = 'KMAC128';
+  const hyphenatedAlgorithm = 'KMAC-128';
+  const kmacOptions = { outputLength: 32 };
+  const kmacKey = Buffer.alloc(32, 0x42);
+  const kmacData = Buffer.from('cache alias test');
+  assert.deepStrictEqual(
+    createMac(kmacAlgorithm, kmacKey, kmacOptions)
+      .update(kmacData).final(),
+    createMac(hyphenatedAlgorithm, kmacKey, kmacOptions)
+      .update(kmacData).final(),
+  );
+  const aliasesAfterUse = binding.getCachedMacAliases();
+  assert.strictEqual(getAliasId(aliasesAfterUse, 'kmac128'), kmac128Id);
+  assert.strictEqual(
+    getAliasId(aliasesAfterUse, 'kmac-128'),
+    kmac128Id,
+  );
+}
+
+if (!canToggleFips || fipsMacs.includes(algorithm)) {
+  common.printSkipMessage('FIPS cache invalidation cannot be exercised');
+  try {
+    setFips(originalFips);
+  } catch {
+    // The process is about to exit and FIPS support is optional.
+  }
+} else {
+  const liveMac = createMac(algorithm, key).update(data);
+  const worker = new Worker(`
+    'use strict';
+    const {
+      createMac,
+      getFips,
+      getMacs,
+    } = require('node:crypto');
+    const { internalBinding } = require('internal/test/binding');
+    const { parentPort, workerData } = require('node:worker_threads');
+
+    function getAliasId(aliases, name) {
+      const normalized = name.toLowerCase();
+      for (const [alias, id] of Object.entries(aliases)) {
+        if (alias.toLowerCase() === normalized) return id;
+      }
+      return undefined;
+    }
+
+    const binding = internalBinding('crypto');
+    const key = Buffer.from(workerData.key);
+    const data = Buffer.from(workerData.data);
+    const liveMac = createMac(workerData.algorithm, key).update(data);
+    getMacs();
+    const initialAlgorithmId = getAliasId(
+      binding.getCachedMacAliases(),
+      workerData.algorithm,
+    );
+    parentPort.postMessage({
+      phase: 'warm',
+      algorithmId: initialAlgorithmId,
+      generation: binding.getFipsCryptoGeneration(),
+    });
+
+    parentPort.on('message', (phase) => {
+      if (phase === 'fips-on') {
+        let errorCode;
+        try {
+          createMac(workerData.algorithm, key);
+        } catch (error) {
+          errorCode = error.code;
+        }
+        const macs = getMacs();
+        parentPort.postMessage({
+          phase,
+          algorithmId: getAliasId(
+            binding.getCachedMacAliases(),
+            workerData.algorithm,
+          ),
+          errorCode,
+          fips: getFips(),
+          generation: binding.getFipsCryptoGeneration(),
+          hasAlgorithm: macs.includes(workerData.algorithm),
+          tag: liveMac.final('hex'),
+        });
+      } else if (phase === 'fips-off') {
+        const macs = getMacs();
+        parentPort.postMessage({
+          phase,
+          algorithmId: getAliasId(
+            binding.getCachedMacAliases(),
+            workerData.algorithm,
+          ),
+          fips: getFips(),
+          generation: binding.getFipsCryptoGeneration(),
+          hasAlgorithm: macs.includes(workerData.algorithm),
+          tag: createMac(workerData.algorithm, key)
+            .update(data).final('hex'),
+        });
+      } else {
+        parentPort.close();
+      }
+    });
+  `, {
+    eval: true,
+    workerData: { algorithm, data, key },
+  });
+  worker.on('error', common.mustNotCall());
+
+  (async () => {
+    const exitPromise = once(worker, 'exit');
+    try {
+      const [warm] = await once(worker, 'message');
+      assert.strictEqual(warm.phase, 'warm');
+      assert.strictEqual(typeof warm.algorithmId, 'number');
+      assert.strictEqual(warm.generation, generation);
+
+      installThrowingMacCacheEntry(descriptor.value);
+      try {
+        setFips(1);
+        assert.throws(() => createMac(cacheName, key), throwsSentinel);
+        installThrowingMacCacheEntry(-1);
+        assert.throws(() => createMac(cacheName, key), throwsSentinel);
+      } finally {
+        Object.defineProperty(macCache, cacheName, descriptor);
+      }
+      const enabledGeneration = binding.getFipsCryptoGeneration();
+      assert.strictEqual(enabledGeneration, generation + 1n);
+      assert.strictEqual(getFips(), 1);
+      assert(!getMacs().includes(algorithm));
+      assert.strictEqual(
+        getAliasId(binding.getCachedMacAliases(), algorithm),
+        undefined,
+      );
+      assert.throws(() => createMac(algorithm, key), {
+        code: 'ERR_CRYPTO_INVALID_MAC',
+      });
+      assert.strictEqual(liveMac.final('hex'), expected);
+
+      let responsePromise = once(worker, 'message');
+      worker.postMessage('fips-on');
+      const [enabled] = await responsePromise;
+      assert.strictEqual(enabled.phase, 'fips-on');
+      assert.strictEqual(enabled.algorithmId, undefined);
+      assert.strictEqual(enabled.errorCode, 'ERR_CRYPTO_INVALID_MAC');
+      assert.strictEqual(enabled.fips, 1);
+      assert.strictEqual(enabled.generation, enabledGeneration);
+      assert.strictEqual(enabled.hasAlgorithm, false);
+      assert.strictEqual(enabled.tag, expected);
+
+      setFips(0);
+      const disabledGeneration = binding.getFipsCryptoGeneration();
+      assert.strictEqual(disabledGeneration, enabledGeneration + 1n);
+      assert.strictEqual(getFips(), 0);
+      assert(getMacs().includes(algorithm));
+      const restoredAlgorithmId = getAliasId(
+        binding.getCachedMacAliases(),
+        algorithm,
+      );
+      assert.strictEqual(typeof restoredAlgorithmId, 'number');
+      assert.notStrictEqual(restoredAlgorithmId, initialAlgorithmId);
+      assert.strictEqual(
+        createMac(algorithm, key).update(data).final('hex'),
+        expected,
+      );
+
+      responsePromise = once(worker, 'message');
+      worker.postMessage('fips-off');
+      const [disabled] = await responsePromise;
+      assert.strictEqual(disabled.phase, 'fips-off');
+      assert.strictEqual(disabled.fips, 0);
+      assert.strictEqual(disabled.generation, disabledGeneration);
+      assert.strictEqual(disabled.hasAlgorithm, true);
+      assert.strictEqual(typeof disabled.algorithmId, 'number');
+      assert.notStrictEqual(disabled.algorithmId, warm.algorithmId);
+      assert.strictEqual(disabled.tag, expected);
+
+      worker.postMessage('done');
+      const [code] = await exitPromise;
+      assert.strictEqual(code, 0);
+    } finally {
+      if (worker.threadId !== -1) await worker.terminate();
+      setFips(originalFips);
+    }
+  })().then(common.mustCall());
+}
diff --git a/test/parallel/test-crypto-mac-errors.js b/test/parallel/test-crypto-mac-errors.js
new file mode 100644
index 000000000000..43e464bb737e
--- /dev/null
+++ b/test/parallel/test-crypto-mac-errors.js
@@ -0,0 +1,180 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const { hasOpenSSL } = require('../common/crypto');
+
+if (!hasOpenSSL(3) || process.features.openssl_is_boringssl) {
+  common.skip('OpenSSL 3 EVP_MAC support is required');
+}
+
+const assert = require('node:assert');
+const fixtures = require('../common/fixtures');
+const {
+  createMac,
+  createPublicKey,
+  createSecretKey,
+  getMacs,
+} = require('node:crypto');
+
+const key = Buffer.alloc(32, 0x42);
+const data = Buffer.from('data');
+const availableMacs = new Set(getMacs());
+
+function invalidType(fn) {
+  assert.throws(fn, { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
+function invalidValue(fn) {
+  assert.throws(fn, { code: 'ERR_INVALID_ARG_VALUE' });
+}
+
+for (const algorithm of [undefined, null, 1, true, [], {}]) {
+  invalidType(() => createMac(algorithm, key));
+}
+
+for (const algorithm of ['', 'hmac\0sha256']) {
+  invalidValue(() => createMac(algorithm, key));
+}
+
+for (const [algorithm, options] of [
+  ['hmac', { digest: 1 }],
+  ['cmac', { cipher: 1 }],
+  ['gmac', { iv: 'not a BufferSource' }],
+  ['kmac128', { customization: 'not a BufferSource' }],
+  ['blake2bmac', { salt: 'not a BufferSource' }],
+  ['kmac128', { outputLength: '32' }],
+]) {
+  invalidType(() => createMac(algorithm, key, options));
+}
+
+for (const [algorithm, options] of [
+  ['hmac', { digest: 'sha256\0sha512' }],
+  ['cmac', { cipher: 'aes-128-cbc\0aes-256-cbc' }],
+]) {
+  invalidValue(() => createMac(algorithm, key, options));
+}
+
+for (const outputLength of [-1, 0.5, 2 ** 32, Infinity, NaN]) {
+  assert.throws(
+    () => createMac('kmac128', key, { outputLength }),
+    { code: 'ERR_OUT_OF_RANGE' },
+  );
+}
+
+assert.throws(
+  () => createMac('definitely-not-a-mac', key),
+  { code: 'ERR_CRYPTO_INVALID_MAC' },
+);
+
+if (availableMacs.has('siphash')) {
+  assert.throws(() => createMac('siphash', Buffer.alloc(15)), (error) => {
+    assert.strictEqual(error.name, 'Error');
+    assert.strictEqual(error.message, 'Failed to initialize MAC');
+    assert.strictEqual(error.code, 'ERR_CRYPTO_OPERATION_FAILED');
+    for (const property of [
+      'function',
+      'library',
+      'reason',
+      'opensslErrorStack',
+    ]) {
+      assert.ok(!(property in error));
+    }
+    return true;
+  });
+}
+
+if (availableMacs.has('hmac')) {
+  const algorithm = 'hmac';
+  const options = { digest: 'sha256' };
+  assert.throws(
+    () => createMac(algorithm, key, { digest: 'definitely-not-a-digest' }),
+    {
+      code: 'ERR_OSSL_EVP_UNSUPPORTED',
+      library: 'digital envelope routines',
+      reason: 'unsupported',
+    },
+  );
+  const publicKey = createPublicKey(fixtures.readKey('rsa_public.pem'));
+  const cryptoKey = createSecretKey(key).toCryptoKey(
+    { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  for (const invalidKey of [
+    undefined,
+    null,
+    'key',
+    {},
+    publicKey,
+    cryptoKey,
+  ]) {
+    invalidType(() => createMac(algorithm, invalidKey, options));
+  }
+
+  for (const invalidData of [
+    undefined,
+    null,
+    1,
+    true,
+    {},
+    new ArrayBuffer(4),
+  ]) {
+    invalidType(() => createMac(algorithm, key, options).update(invalidData));
+  }
+
+  invalidType(() => createMac(algorithm, key, options).update('data', 1));
+  invalidType(() => createMac(algorithm, key, options).final(1));
+  invalidType(() => createMac(algorithm, key, 'hex'));
+
+  invalidValue(() => createMac(algorithm, key, options)
+    .update('data', 'not-an-encoding'));
+  const invalidFinalEncoding = createMac(algorithm, key, options);
+  invalidValue(() => invalidFinalEncoding.final('not-an-encoding'));
+  assert.deepStrictEqual(
+    invalidFinalEncoding.update(data).final(),
+    createMac(algorithm, key, options).update(data).final(),
+  );
+  invalidValue(() => createMac(algorithm, key, options).update('0', 'hex'));
+
+  invalidValue(() => createMac('hmac', key));
+  for (const extra of [
+    { cipher: 'aes-128-cbc' },
+    { iv: Buffer.alloc(12) },
+    { customization: Buffer.alloc(0) },
+    { salt: Buffer.alloc(16) },
+    { outputLength: 16 },
+  ]) {
+    invalidValue(() => createMac('hmac', key, {
+      ...options,
+      ...extra,
+    }));
+  }
+}
+
+if (availableMacs.has('cmac')) {
+  invalidValue(() => createMac('cmac', key));
+  invalidValue(() => createMac('cmac', key, { digest: 'sha256' }));
+  invalidValue(() => createMac('cmac', key, {
+    cipher: 'aes-256-cbc',
+    iv: Buffer.alloc(16),
+  }));
+}
+
+if (availableMacs.has('gmac')) {
+  invalidValue(() => createMac('gmac', key));
+  invalidValue(() => createMac('gmac', key, { cipher: 'aes-256-gcm' }));
+  invalidValue(() => createMac('gmac', key, { iv: Buffer.alloc(12) }));
+  invalidValue(() => createMac('gmac', key, {
+    cipher: 'aes-256-gcm',
+    iv: Buffer.alloc(12),
+    digest: 'sha256',
+  }));
+}
+
+if (availableMacs.has('poly1305')) {
+  invalidValue(() => createMac('poly1305', key, {
+    customization: Buffer.alloc(0),
+  }));
+}
diff --git a/test/parallel/test-crypto-mac-unsupported.js b/test/parallel/test-crypto-mac-unsupported.js
new file mode 100644
index 000000000000..68bb79f301e5
--- /dev/null
+++ b/test/parallel/test-crypto-mac-unsupported.js
@@ -0,0 +1,34 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const { hasOpenSSL3 } = require('../common/crypto');
+
+if (hasOpenSSL3 && !process.features.openssl_is_boringssl) {
+  common.skip('this test requires a build without EVP_MAC support');
+}
+
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+
+const algorithm = 'hmac';
+const options = { digest: 'sha256' };
+const key = Buffer.from('key');
+
+assert.strictEqual(typeof crypto.createMac, 'function');
+assert.strictEqual(typeof crypto.getMacs, 'function');
+assert.strictEqual(crypto.Mac, undefined);
+assert.deepStrictEqual(crypto.getMacs(), []);
+assert.throws(() => crypto.createMac(algorithm, key, options), {
+  code: 'ERR_CRYPTO_MAC_NOT_SUPPORTED',
+});
+(async () => {
+  const esmCrypto = await import('node:crypto');
+  assert.strictEqual(esmCrypto.createMac, crypto.createMac);
+  assert.strictEqual(esmCrypto.getMacs, crypto.getMacs);
+  assert.strictEqual(esmCrypto.Mac, undefined);
+})().then(common.mustCall());
diff --git a/test/parallel/test-crypto-mac-vectors.js b/test/parallel/test-crypto-mac-vectors.js
new file mode 100644
index 000000000000..ec9f0cffe877
--- /dev/null
+++ b/test/parallel/test-crypto-mac-vectors.js
@@ -0,0 +1,179 @@
+// Flags: --expose-internals
+
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const { hasOpenSSL } = require('../common/crypto');
+
+if (!hasOpenSSL(3) || process.features.openssl_is_boringssl) {
+  common.skip('OpenSSL 3 EVP_MAC support is required');
+}
+
+const assert = require('node:assert');
+const { encodingsMap } = require('internal/util');
+const {
+  createMac,
+  getCiphers,
+  getMacs,
+} = require('node:crypto');
+
+const availableMacs = new Set(getMacs());
+const availableCiphers = new Set(getCiphers());
+const kmacVectors = require('../fixtures/crypto/kmac')();
+const gmacIVStorage = Uint8Array.from([
+  0xff,
+  ...Buffer.alloc(12),
+  0xff,
+]);
+const blake2bSaltStorage = Uint8Array.from([
+  0xff,
+  ...Buffer.from('000102030405060708090a0b0c0d0e0f', 'hex'),
+  0xff,
+]);
+const blake2sSaltStorage = Uint8Array.from([
+  0xff,
+  ...Buffer.from('0001020304050607', 'hex'),
+  0xff,
+]);
+
+const vectors = [
+  {
+    label: 'CMAC-AES-128',
+    algorithm: 'cmac',
+    options: { cipher: 'aes-128-cbc' },
+    key: '2b7e151628aed2a6abf7158809cf4f3c',
+    data: '',
+    expected: 'bb1d6929e95937287fa37d129b756746',
+    cipher: 'aes-128-cbc',
+  },
+  {
+    label: 'GMAC-AES-128',
+    algorithm: 'gmac',
+    options: {
+      cipher: 'aes-128-gcm',
+      iv: new DataView(gmacIVStorage.buffer, 1, 12),
+    },
+    key: '00000000000000000000000000000000',
+    data: '',
+    expected: '58e2fccefa7e3061367f1d57a4e7455a',
+    cipher: 'aes-128-gcm',
+  },
+  {
+    label: 'Poly1305',
+    algorithm: 'poly1305',
+    key: '85d6be7857556d337f4452fe42d506a8' +
+         '0103808afb0db2fd4abff6af4149f51b',
+    data: Buffer.from('Cryptographic Forum Research Group').toString('hex'),
+    expected: 'a8061dc1305136c6c22b8baf0c0127a9',
+  },
+  {
+    label: 'SipHash-2-4',
+    algorithm: 'siphash',
+    options: { outputLength: 8 },
+    key: '000102030405060708090a0b0c0d0e0f',
+    data: '',
+    expected: '310e0edd47db6f72',
+  },
+  {
+    label: 'BLAKE2b MAC',
+    algorithm: 'blake2bmac',
+    options: {
+      outputLength: 32,
+      salt: new DataView(blake2bSaltStorage.buffer, 1, 16),
+    },
+    key: '000102030405060708090a0b0c0d0e0f',
+    data: Buffer.from('abc').toString('hex'),
+    expected: '6e583b101a126f2d1fb6d1fff9834f3a' +
+              '0d0e23c17b902cca4f1a0d7abfb327fa',
+  },
+  {
+    label: 'BLAKE2s MAC',
+    algorithm: 'blake2smac',
+    options: {
+      outputLength: 16,
+      salt: new DataView(blake2sSaltStorage.buffer, 1, 8),
+    },
+    key: '000102030405060708090a0b0c0d0e0f',
+    data: Buffer.from('abc').toString('hex'),
+    expected: '18adff242af55a56c7b7646df6c3d9ba',
+  },
+];
+
+for (const index of [0, 3]) {
+  const vector = kmacVectors[index];
+  const algorithm = vector.algorithm.toLowerCase();
+  const options = {
+    outputLength: vector.outputLength / 8,
+  };
+  if (vector.customization !== undefined) {
+    const storage = Uint8Array.from([
+      0xff,
+      ...vector.customization,
+      0xff,
+    ]);
+    options.customization = new DataView(
+      storage.buffer, 1, vector.customization.length);
+  }
+  vectors.push({
+    label: vector.algorithm,
+    algorithm,
+    options,
+    key: vector.key.toString('hex'),
+    data: vector.data.toString('hex'),
+    expected: vector.expected.toString('hex'),
+  });
+}
+
+for (const vector of vectors) {
+  if (!availableMacs.has(vector.algorithm) ||
+      (vector.cipher !== undefined &&
+       !availableCiphers.has(vector.cipher))) {
+    common.printSkipMessage(`${vector.label} is not available`);
+    continue;
+  }
+
+  const key = Buffer.from(vector.key, 'hex');
+  const data = Buffer.from(vector.data, 'hex');
+  const expected = Buffer.from(vector.expected, 'hex');
+  assert.deepStrictEqual(
+    createMac(vector.algorithm, key, vector.options).update(data).final(),
+    expected,
+  );
+}
+
+if (availableMacs.has('kmac128')) {
+  const vector = kmacVectors[0];
+  const algorithm = 'kmac128';
+  const options = { outputLength: 0 };
+  for (const outputEncoding of Object.keys(encodingsMap)) {
+    if (outputEncoding === 'buffer') continue;
+    assert.strictEqual(
+      createMac(algorithm, vector.key, options)
+        .update(vector.data)
+        .final(outputEncoding),
+      '',
+    );
+  }
+
+  for (const result of [
+    createMac(algorithm, vector.key, options)
+      .update(vector.data)
+      .final(),
+    createMac(algorithm, vector.key, options)
+      .update(vector.data)
+      .final('buffer'),
+  ]) {
+    assert(Buffer.isBuffer(result));
+    assert.deepStrictEqual(result, Buffer.alloc(0));
+  }
+
+  const streamed = createMac(algorithm, vector.key, options);
+  streamed.on('data', common.mustNotCall());
+  streamed.on('end', common.mustCall());
+  streamed.end(vector.data);
+}
diff --git a/test/parallel/test-crypto-mac.js b/test/parallel/test-crypto-mac.js
new file mode 100644
index 000000000000..f41bd86509eb
--- /dev/null
+++ b/test/parallel/test-crypto-mac.js
@@ -0,0 +1,225 @@
+// Flags: --expose-internals
+
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const { hasOpenSSL } = require('../common/crypto');
+
+if (!hasOpenSSL(3) || process.features.openssl_is_boringssl) {
+  common.skip('OpenSSL 3 EVP_MAC support is required');
+}
+
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+const { encodingsMap } = require('internal/util');
+const {
+  createHmac,
+  createMac,
+  createSecretKey,
+  getMacs,
+} = crypto;
+const { finished } = require('node:stream/promises');
+const { Transform } = require('node:stream');
+
+assert.strictEqual(crypto.Mac, undefined);
+
+const firstMacs = getMacs();
+const secondMacs = getMacs();
+
+assert.notStrictEqual(firstMacs, secondMacs);
+assert.deepStrictEqual(firstMacs, [...firstMacs].sort());
+assert.strictEqual(firstMacs.length, new Set(firstMacs).size);
+assert(firstMacs.every((name) => typeof name === 'string'));
+assert(firstMacs.every((name) => name === name.toLowerCase()));
+assert(firstMacs.every((name) => !/^\d+(?:\.\d+)+$/.test(name)));
+
+firstMacs.push('not-a-real-mac');
+assert(!getMacs().includes('not-a-real-mac'));
+
+const availableMacs = new Set(secondMacs);
+if (!availableMacs.has('hmac')) {
+  common.printSkipMessage('HMAC is not available from the active providers');
+} else {
+  const algorithm = 'HMAC';
+  const options = { digest: 'sha256' };
+  const key = Buffer.from('000102030405060708090a0b0c0d0e0f', 'hex');
+  const data = Buffer.from('The quick brown fox jumps over the lazy dog');
+  const expected = createHmac('sha256', key).update(data).digest();
+  const expectedEmpty = createHmac('sha256', key).digest();
+  const expectedEmptyKey = createHmac('sha256', Buffer.alloc(0))
+    .update(data)
+    .digest();
+
+  assert.deepStrictEqual(
+    createMac(algorithm, key, options).update(data.toString()).final(),
+    expected,
+  );
+  assert.deepStrictEqual(
+    createMac(algorithm, key, options).final(),
+    expectedEmpty,
+  );
+  assert.deepStrictEqual(
+    createMac(algorithm, Buffer.alloc(0), options).update(data).final(),
+    expectedEmptyKey,
+  );
+
+  const nullPrototypeOptions = Object.assign({ __proto__: null }, options);
+  assert.deepStrictEqual(
+    createMac(algorithm, key, nullPrototypeOptions).update(data).final(),
+    expected,
+  );
+  const inheritedUnknownOptions = Object.assign(
+    { __proto__: { unknown: true } }, options);
+  assert.deepStrictEqual(
+    createMac(algorithm, key, inheritedUnknownOptions).update(data).final(),
+    expected,
+  );
+  assert.deepStrictEqual(
+    createMac(algorithm, key, { ...options, unknown: true })
+      .update(data)
+      .final(),
+    expected,
+  );
+  const incremental = createMac(algorithm, key, options);
+  assert(incremental instanceof Transform);
+  assert.strictEqual(incremental.update(data.subarray(0, 10)), incremental);
+  assert.strictEqual(incremental.update(Buffer.alloc(0)), incremental);
+  incremental.update(data.subarray(10));
+  assert.deepStrictEqual(incremental.final(), expected);
+  assert.throws(
+    () => incremental.update(Buffer.alloc(0)),
+    { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+  );
+  assert.throws(
+    () => incremental.final(),
+    { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+  );
+
+  // Input encodings are handled by update(), while final() accepts an output
+  // encoding.
+  assert.strictEqual(
+    createMac(algorithm, key, options)
+      .update(data.toString('hex'), 'hex')
+      .final('hex'),
+    expected.toString('hex'),
+  );
+  assert.strictEqual(
+    createMac(algorithm, key, options)
+      .update(data.toString('base64'), 'base64')
+      .final('base64url'),
+    expected.toString('base64url'),
+  );
+  for (const outputEncoding of Object.keys(encodingsMap)) {
+    if (outputEncoding === 'buffer') continue;
+    assert.strictEqual(
+      createMac(algorithm, key, options)
+        .update(data)
+        .final(outputEncoding),
+      expected.toString(outputEncoding),
+    );
+  }
+  assert.deepStrictEqual(
+    createMac(algorithm, key, options)
+      .update(data, 'not-an-encoding')
+      .final(),
+    expected,
+  );
+  const explicitBuffer = createMac(algorithm, key, options)
+    .update(data)
+    .final('buffer');
+  assert(Buffer.isBuffer(explicitBuffer));
+  assert.deepStrictEqual(explicitBuffer, expected);
+
+  const encodedFinal = createMac(algorithm, key, options).update(data);
+  assert.strictEqual(encodedFinal.final('hex'), expected.toString('hex'));
+  assert.throws(
+    () => encodedFinal.update(data),
+    { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+  );
+  assert.throws(
+    () => encodedFinal.final('hex'),
+    { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+  );
+  // BufferSource keys and data must honor view offsets and lengths.
+  const keyStorage = Uint8Array.from([0xff, ...key, 0xff]);
+  const keyView = new Uint8Array(keyStorage.buffer, 1, key.length);
+  const keyDataView = new DataView(keyStorage.buffer, 1, key.length);
+  const dataStorage = Uint8Array.from([0xff, ...data, 0xff]);
+  const dataView = new DataView(dataStorage.buffer, 1, data.length);
+  assert.deepStrictEqual(
+    createMac(algorithm, keyView, options).update(dataView).final(),
+    expected,
+  );
+  assert.deepStrictEqual(
+    createMac(algorithm, keyDataView, options).update(dataView).final(),
+    expected,
+  );
+
+  const arrayBufferKey = key.buffer.slice(
+    key.byteOffset,
+    key.byteOffset + key.byteLength,
+  );
+  assert.deepStrictEqual(
+    createMac(algorithm, arrayBufferKey, options).update(data).final(),
+    expected,
+  );
+  const secretKey = createSecretKey(key);
+  assert.deepStrictEqual(
+    createMac(algorithm, secretKey, options).update(data).final(),
+    expected,
+  );
+
+  (async () => {
+    const esmCrypto = await import('node:crypto');
+    assert.strictEqual(esmCrypto.createMac, createMac);
+    assert.strictEqual(esmCrypto.getMacs, getMacs);
+    assert.strictEqual(esmCrypto.Mac, undefined);
+
+    const emptyStream = createMac(algorithm, key, options);
+    const emptyChunks = [];
+    emptyStream.on(
+      'data', common.mustCall((chunk) => emptyChunks.push(chunk), 1));
+    const emptyFinished = finished(emptyStream);
+    emptyStream.end();
+    await emptyFinished;
+    assert.deepStrictEqual(Buffer.concat(emptyChunks), expectedEmpty);
+
+    const streamed = createMac(algorithm, key, {
+      ...options,
+      highWaterMark: 1,
+    });
+    const chunks = [];
+    streamed.on('data', common.mustCall((chunk) => chunks.push(chunk), 1));
+    assert.strictEqual(streamed.writableHighWaterMark, 1);
+    assert.strictEqual(streamed.readableHighWaterMark, 1);
+    const streamedFinished = finished(streamed);
+    streamed.write(data.subarray(0, 10));
+    streamed.end(data.subarray(10));
+    await streamedFinished;
+    assert.deepStrictEqual(Buffer.concat(chunks), expected);
+    assert.throws(
+      () => streamed.update(Buffer.alloc(0)),
+      { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+    );
+    assert.throws(
+      () => streamed.final(),
+      { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+    );
+
+    // Direct finalization followed by stream finalization fails through the
+    // stream error path and does not emit a second tag.
+    const mixed = createMac(algorithm, key, options);
+    mixed.on('data', common.mustNotCall());
+    const mixedFinished = finished(mixed);
+    assert.deepStrictEqual(mixed.update(data).final(), expected);
+    mixed.end();
+    await assert.rejects(mixedFinished, {
+      code: 'ERR_CRYPTO_MAC_FINALIZED',
+    });
+  })().then(common.mustCall());
+}
diff --git a/test/parallel/test-crypto-provider-cipher-cache-snapshot.js b/test/parallel/test-crypto-provider-cipher-cache-snapshot.js
new file mode 100644
index 000000000000..1afc5df8d94d
--- /dev/null
+++ b/test/parallel/test-crypto-provider-cipher-cache-snapshot.js
@@ -0,0 +1,28 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const { hasOpenSSL3 } = require('../common/crypto');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+const { buildSnapshot, runWithSnapshot } = require('../common/snapshot');
+
+if (!hasOpenSSL3)
+  common.skip('this test requires OpenSSL 3.x');
+
+const entry = fixtures.path('snapshot', 'crypto-provider-cipher-cache.js');
+const buildEnv = {
+  OPENSSL_CONF: fixtures.path(
+    'openssl3-conf', 'legacy_provider_enabled.cnf'),
+};
+const runEnv = {
+  OPENSSL_CONF: fixtures.path('openssl3-conf', 'default_only.cnf'),
+};
+
+tmpdir.refresh();
+buildSnapshot(entry, buildEnv);
+const { stdout } = runWithSnapshot(undefined, runEnv);
+assert.match(stdout, /provider crypto caches snapshot: ok/);
diff --git a/test/parallel/test-crypto-provider-cipher-cache.js b/test/parallel/test-crypto-provider-cipher-cache.js
new file mode 100644
index 000000000000..bde9988480ed
--- /dev/null
+++ b/test/parallel/test-crypto-provider-cipher-cache.js
@@ -0,0 +1,183 @@
+// Flags: --expose-internals --no-warnings
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const { hasOpenSSL3 } = require('../common/crypto');
+if (!hasOpenSSL3)
+  common.skip('this test requires OpenSSL 3.x');
+
+const assert = require('assert');
+const {
+  createCipheriv,
+  getCipherInfo,
+  getCiphers,
+  getFips,
+  getHashes,
+  setFips,
+} = require('crypto');
+const { internalBinding } = require('internal/test/binding');
+const { isMainThread, Worker } = require('worker_threads');
+
+if (!isMainThread)
+  common.skip('crypto.setFips() is not supported in workers');
+
+const algorithm = 'camellia-128-cbc-cts';
+const hashAlgorithm = 'md5';
+const originalFips = getFips();
+setFips(0);
+
+if (!getCiphers().includes(algorithm)) {
+  common.skip(`${algorithm} is not supported`);
+}
+assert(getHashes().includes(hashAlgorithm));
+
+const binding = internalBinding('crypto');
+const generation = binding.getFipsCryptoGeneration();
+setFips(0);
+assert.strictEqual(binding.getFipsCryptoGeneration(), generation);
+
+const ciphers = getCiphers();
+ciphers.length = 0;
+assert(getCiphers().includes(algorithm));
+
+const info = getCipherInfo(algorithm);
+assert(info);
+assert.deepStrictEqual(getCipherInfo(algorithm.toUpperCase()), info);
+assert.deepStrictEqual(getCipherInfo(algorithm), info);
+assert.strictEqual(getCipherInfo('node-test-unknown-provider-cipher'), undefined);
+assert.strictEqual(getCipherInfo('node-test-unknown-provider-cipher'), undefined);
+
+const key = Buffer.alloc(16);
+const iv = Buffer.alloc(16);
+const plaintext = Buffer.alloc(32);
+const liveCipher = createCipheriv(algorithm, key, iv);
+
+const worker = new Worker(`
+  'use strict';
+  const {
+    createHash,
+    createCipheriv,
+    getCipherInfo,
+    getCiphers,
+    getHashes,
+  } = require('crypto');
+  const { internalBinding } = require('internal/test/binding');
+  const { parentPort, workerData } = require('worker_threads');
+
+  const binding = internalBinding('crypto');
+  const key = Buffer.from(workerData.key);
+  const iv = Buffer.from(workerData.iv);
+  const plaintext = Buffer.from(workerData.plaintext);
+  const liveCipher = createCipheriv(workerData.algorithm, key, iv);
+
+  getHashes();
+  getCiphers();
+  getCipherInfo(workerData.algorithm);
+  parentPort.postMessage({
+    phase: 'warm',
+    generation: binding.getFipsCryptoGeneration(),
+  });
+
+  parentPort.on('message', (phase) => {
+    if (phase === 'fips-on') {
+      let errorCode;
+      try {
+        createCipheriv(workerData.algorithm, key, iv);
+      } catch (error) {
+        errorCode = error.code;
+      }
+      const output = Buffer.concat([
+        liveCipher.update(plaintext),
+        liveCipher.final(),
+      ]);
+      parentPort.postMessage({
+        phase,
+        errorCode,
+        generation: binding.getFipsCryptoGeneration(),
+        hasCipher: getCiphers().includes(workerData.algorithm),
+        hasHash: getHashes().includes(workerData.hashAlgorithm),
+        hasInfo: getCipherInfo(workerData.algorithm) !== undefined,
+        outputLength: output.length,
+      });
+    } else if (phase === 'fips-off') {
+      const cipher = createCipheriv(workerData.algorithm, key, iv);
+      const hash = createHash(workerData.hashAlgorithm).digest('hex');
+      const output = Buffer.concat([
+        cipher.update(plaintext),
+        cipher.final(),
+      ]);
+      parentPort.postMessage({
+        phase,
+        generation: binding.getFipsCryptoGeneration(),
+        hasHash: getHashes().includes(workerData.hashAlgorithm),
+        hasCipher: getCiphers().includes(workerData.algorithm),
+        hasInfo: getCipherInfo(workerData.algorithm) !== undefined,
+        hash,
+        outputLength: output.length,
+      });
+    } else {
+      parentPort.close();
+    }
+  });
+`, {
+  eval: true,
+  workerData: { algorithm, hashAlgorithm, key, iv, plaintext },
+});
+
+let enabledGeneration;
+worker.on('message', common.mustCall((message) => {
+  if (message.phase === 'warm') {
+    assert.strictEqual(message.generation, generation);
+
+    setFips(1);
+    enabledGeneration = binding.getFipsCryptoGeneration();
+    assert.strictEqual(enabledGeneration, generation + 1n);
+    assert(!getCiphers().includes(algorithm));
+    assert(!getHashes().includes(hashAlgorithm));
+    assert.strictEqual(getCipherInfo(algorithm), undefined);
+    assert.throws(() => createCipheriv(algorithm, key, iv), {
+      code: 'ERR_CRYPTO_UNKNOWN_CIPHER',
+    });
+
+    const output = Buffer.concat([
+      liveCipher.update(plaintext),
+      liveCipher.final(),
+    ]);
+    assert.strictEqual(output.length, plaintext.length);
+    worker.postMessage('fips-on');
+  } else if (message.phase === 'fips-on') {
+    assert.strictEqual(message.generation, enabledGeneration);
+    assert.strictEqual(message.hasCipher, false);
+    assert.strictEqual(message.hasHash, false);
+    assert.strictEqual(message.hasInfo, false);
+    assert.strictEqual(message.errorCode, 'ERR_CRYPTO_UNKNOWN_CIPHER');
+    assert.strictEqual(message.outputLength, plaintext.length);
+
+    setFips(0);
+    assert.strictEqual(
+      binding.getFipsCryptoGeneration(), enabledGeneration + 1n);
+    assert(getHashes().includes(hashAlgorithm));
+    assert(getCiphers().includes(algorithm));
+    assert(getCipherInfo(algorithm));
+    worker.postMessage('fips-off');
+  } else {
+    assert.strictEqual(message.phase, 'fips-off');
+    assert.strictEqual(
+      message.generation, binding.getFipsCryptoGeneration());
+    assert.strictEqual(message.hasCipher, true);
+    assert.strictEqual(message.hasHash, true);
+    assert.strictEqual(message.hasInfo, true);
+    assert.strictEqual(
+      message.hash,
+      'd41d8cd98f00b204e9800998ecf8427e',
+    );
+    assert.strictEqual(message.outputLength, plaintext.length);
+    worker.postMessage('done');
+    setFips(originalFips);
+  }
+}, 3));
+worker.on('error', common.mustNotCall());
+worker.on('exit', common.mustCall((code) => assert.strictEqual(code, 0)));
diff --git a/test/parallel/test-crypto-provider-hash-options.js b/test/parallel/test-crypto-provider-hash-options.js
new file mode 100644
index 000000000000..609d00d7f7b0
--- /dev/null
+++ b/test/parallel/test-crypto-provider-hash-options.js
@@ -0,0 +1,387 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+if (Number(process.versions.openssl.split('.')[0]) < 4 ||
+    process.features.openssl_is_boringssl) {
+  common.skip('OpenSSL 4 provider support is required');
+}
+
+const assert = require('node:assert');
+const {
+  createHash,
+  getHashes,
+  hash,
+} = require('node:crypto');
+const { internalBinding } = require('internal/test/binding');
+const {
+  HashJob,
+  kCryptoJobSync,
+  kCryptoJobWebCrypto,
+} = internalBinding('crypto');
+
+const hashes = getHashes();
+const hashNames = new Map(
+  hashes.map((name) => [name.toLowerCase(), name]),
+);
+
+let exercised = false;
+
+function findHash(...names) {
+  for (const name of names) {
+    const result = hashNames.get(name);
+    if (result !== undefined) return result;
+  }
+  return undefined;
+}
+
+function testHashJob(args, expected) {
+  const { 0: err, 1: result } = new HashJob(
+    kCryptoJobSync,
+    ...args,
+  ).run();
+  assert.strictEqual(err, undefined);
+  assert.deepStrictEqual(Buffer.from(result), expected);
+
+  (async () => {
+    const asyncResult = await new HashJob(
+      kCryptoJobWebCrypto,
+      ...args,
+    ).run();
+    assert.deepStrictEqual(Buffer.from(asyncResult), expected);
+  })().then(common.mustCall());
+}
+
+const cshakeVectors = [
+  {
+    names: ['cshake-128', 'cshake128'],
+    shakeNames: ['shake128', 'shake-128'],
+    outputLength: 32,
+    input: Buffer.from('00010203', 'hex'),
+    expected: 'c1c36925b6409a04f1b504fcbca9d82b' +
+              '4017277cb5ed2b2065fc1d3814d5aaf5',
+  },
+  {
+    names: ['cshake-256', 'cshake256'],
+    shakeNames: ['shake256', 'shake-256'],
+    outputLength: 64,
+    input: Buffer.from('00010203', 'hex'),
+    expected: 'd008828e2b80ac9d2218ffee1d070c48' +
+              'b8e4c87bff32c9699d5b6896eee0edd1' +
+              '64020e2be0560858d9c00c037e34a96' +
+              '937c561a74c412bb4c746469527281c8c',
+  },
+];
+
+for (const vector of cshakeVectors) {
+  const algorithm = findHash(...vector.names);
+  if (algorithm === undefined) {
+    common.printSkipMessage(`${vector.names[0]} is not available`);
+    continue;
+  }
+
+  exercised = true;
+
+  const options = {
+    outputLength: vector.outputLength,
+    customization: 'Email Signature',
+  };
+  const streaming = createHash(algorithm, options)
+    .update(vector.input.subarray(0, 2))
+    .update(vector.input.subarray(2))
+    .digest('hex');
+  const partial = createHash(algorithm, options)
+    .update(vector.input.subarray(0, 2));
+  const copyOptionReads = [];
+  const copied = partial.copy({
+    get outputLength() {
+      copyOptionReads.push('outputLength');
+      return vector.outputLength;
+    },
+    get functionName() {
+      copyOptionReads.push('functionName');
+      return undefined;
+    },
+    get customization() {
+      copyOptionReads.push('customization');
+      return undefined;
+    },
+  })
+    .update(vector.input.subarray(2))
+    .digest('hex');
+
+  assert.strictEqual(streaming, vector.expected);
+  assert.strictEqual(copied, vector.expected);
+  assert.deepStrictEqual(copyOptionReads, ['outputLength']);
+  assert.strictEqual(hash(algorithm, vector.input, options), vector.expected);
+
+  // BufferSource parameters have the same semantics as their string form.
+  const bufferOptions = {
+    ...options,
+    customization: Buffer.from(options.customization),
+  };
+  assert.strictEqual(
+    createHash(algorithm, bufferOptions).update(vector.input).digest('hex'),
+    vector.expected,
+  );
+  assert.strictEqual(
+    hash(algorithm, vector.input, bufferOptions),
+    vector.expected,
+  );
+
+  // Without function-name and customization parameters, cSHAKE is SHAKE.
+  const withoutParameters = createHash(algorithm)
+    .update(vector.input)
+    .digest('hex');
+  assert.strictEqual(hash(algorithm, vector.input), withoutParameters);
+
+  // Explicit undefined parameters have the same semantics as omitted ones.
+  const undefinedOptions = {
+    outputLength: vector.outputLength,
+    functionName: undefined,
+    customization: undefined,
+  };
+  assert.strictEqual(
+    createHash(algorithm, undefinedOptions).update(vector.input).digest('hex'),
+    withoutParameters,
+  );
+  assert.strictEqual(
+    hash(algorithm, vector.input, undefinedOptions),
+    withoutParameters,
+  );
+
+  // Empty BufferSource parameters are still supplied to OpenSSL, but cSHAKE
+  // with two empty parameters is equivalent to SHAKE.
+  const emptyOptions = {
+    outputLength: vector.outputLength,
+    functionName: Buffer.alloc(0),
+    customization: new Uint8Array(0),
+  };
+  assert.strictEqual(
+    createHash(algorithm, emptyOptions).update(vector.input).digest('hex'),
+    withoutParameters,
+  );
+  assert.strictEqual(
+    hash(algorithm, vector.input, emptyOptions),
+    withoutParameters,
+  );
+  const emptyFunctionNameOptions = {
+    outputLength: vector.outputLength,
+    functionName: Buffer.alloc(0),
+  };
+  assert.strictEqual(
+    createHash(algorithm, emptyFunctionNameOptions)
+      .update(vector.input)
+      .digest('hex'),
+    withoutParameters,
+  );
+  assert.strictEqual(
+    hash(algorithm, vector.input, emptyFunctionNameOptions),
+    withoutParameters,
+  );
+
+  const createHashOptionReads = [];
+  assert.strictEqual(
+    createHash(algorithm, {
+      get outputLength() {
+        createHashOptionReads.push('outputLength');
+        return vector.outputLength;
+      },
+      get functionName() {
+        createHashOptionReads.push('functionName');
+        return undefined;
+      },
+      get customization() {
+        createHashOptionReads.push('customization');
+        return undefined;
+      },
+    }).update(vector.input).digest('hex'),
+    withoutParameters,
+  );
+  assert.deepStrictEqual(
+    createHashOptionReads,
+    ['outputLength', 'functionName', 'customization'],
+  );
+
+  const hashOptionReads = [];
+  assert.strictEqual(
+    hash(algorithm, vector.input, {
+      get outputLength() {
+        hashOptionReads.push('outputLength');
+        return vector.outputLength;
+      },
+      get outputEncoding() {
+        hashOptionReads.push('outputEncoding');
+        return 'hex';
+      },
+      get functionName() {
+        hashOptionReads.push('functionName');
+        return undefined;
+      },
+      get customization() {
+        hashOptionReads.push('customization');
+        return undefined;
+      },
+    }),
+    withoutParameters,
+  );
+  assert.deepStrictEqual(
+    hashOptionReads,
+    ['outputLength', 'outputEncoding', 'functionName', 'customization'],
+  );
+
+  for (const zeroLengthOptions of [
+    { outputLength: 0 },
+    {
+      outputLength: 0,
+      functionName: Buffer.alloc(0),
+      customization: new Uint8Array(0),
+    },
+  ]) {
+    assert.deepStrictEqual(
+      createHash(algorithm, zeroLengthOptions).update(vector.input).digest(),
+      Buffer.alloc(0),
+    );
+    assert.strictEqual(
+      hash(algorithm, vector.input, zeroLengthOptions),
+      '',
+    );
+  }
+
+  const shake = findHash(...vector.shakeNames);
+  if (shake !== undefined) {
+    assert.strictEqual(
+      withoutParameters,
+      createHash(shake, { outputLength: vector.outputLength })
+        .update(vector.input)
+        .digest('hex'),
+    );
+  }
+
+  const namedOptions = {
+    outputLength: vector.outputLength,
+    functionName: 'KMAC',
+    customization: 'Node.js',
+  };
+  let namedResult;
+  try {
+    namedResult = createHash(algorithm, namedOptions)
+      .update(vector.input)
+      .digest();
+  } catch {
+    common.printSkipMessage(
+      `${algorithm} does not support the KMAC function name`,
+    );
+  }
+  if (namedResult !== undefined) {
+    assert.deepStrictEqual(
+      hash(algorithm, vector.input, {
+        ...namedOptions,
+        outputEncoding: 'buffer',
+      }),
+      namedResult,
+    );
+    assert.deepStrictEqual(
+      createHash(algorithm, {
+        ...namedOptions,
+        functionName: Buffer.from(namedOptions.functionName),
+        customization: new Uint8Array(Buffer.from(namedOptions.customization)),
+      }).update(vector.input).digest(),
+      namedResult,
+    );
+    assert.deepStrictEqual(
+      hash(algorithm, vector.input, {
+        ...namedOptions,
+        functionName: Buffer.from(namedOptions.functionName),
+        customization: new Uint8Array(Buffer.from(namedOptions.customization)),
+        outputEncoding: 'buffer',
+      }),
+      namedResult,
+    );
+  }
+
+  for (const functionName of ['', 'TupleHash', 'ParallelHash', 'KMAC']) {
+    const functionOptions = {
+      outputLength: vector.outputLength,
+      functionName,
+    };
+    let functionResult;
+    try {
+      functionResult = createHash(algorithm, functionOptions)
+        .update(vector.input)
+        .digest();
+    } catch {
+      common.printSkipMessage(
+        `${algorithm} does not support the ${functionName} function name`,
+      );
+      continue;
+    }
+    assert.deepStrictEqual(
+      functionResult,
+      hash(algorithm, vector.input, {
+        ...functionOptions,
+        outputEncoding: 'buffer',
+      }),
+    );
+  }
+
+  testHashJob([
+    algorithm,
+    vector.input,
+    vector.outputLength * 8,
+    undefined,
+    Buffer.from(options.customization),
+  ], Buffer.from(vector.expected, 'hex'));
+
+  for (const invalidOptions of [
+    { functionName: 1 },
+    { customization: {} },
+  ]) {
+    const expected = { code: 'ERR_INVALID_ARG_TYPE' };
+    assert.throws(() => createHash(algorithm, invalidOptions), expected);
+    assert.throws(
+      () => hash(algorithm, vector.input, invalidOptions),
+      expected,
+    );
+  }
+
+  for (const invalidOptions of [
+    { functionName: 'KMAC\0' },
+    { customization: 'Node\0js' },
+    { customization: Buffer.from([0x61, 0x00, 0x62]) },
+  ]) {
+    const expected = { code: 'ERR_INVALID_ARG_VALUE' };
+    assert.throws(() => createHash(algorithm, invalidOptions), expected);
+    assert.throws(
+      () => hash(algorithm, vector.input, invalidOptions),
+      expected,
+    );
+  }
+}
+
+if (cshakeVectors.some(({ names }) => findHash(...names) !== undefined)) {
+  for (const mismatchedOptions of [
+    { functionName: 'KMAC' },
+    { customization: 'Node.js' },
+    { functionName: Buffer.alloc(0) },
+    { customization: new Uint8Array(0) },
+  ]) {
+    assert.throws(
+      () => createHash('sha256', mismatchedOptions),
+      { message: 'Digest method not supported' },
+    );
+    assert.throws(
+      () => hash('sha256', Buffer.from('abc'), mismatchedOptions),
+      { message: 'Digest options are not supported' },
+    );
+  }
+}
+
+if (!exercised) {
+  common.printSkipMessage('cSHAKE is not available');
+}
diff --git a/test/parallel/test-crypto-provider-hashes.js b/test/parallel/test-crypto-provider-hashes.js
new file mode 100644
index 000000000000..166efaa0d7fd
--- /dev/null
+++ b/test/parallel/test-crypto-provider-hashes.js
@@ -0,0 +1,258 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const assert = require('node:assert');
+const {
+  createHash,
+  createHmac,
+  createSign,
+  createVerify,
+  generateKeyPair,
+  generateKeyPairSync,
+  getHashes,
+  hash,
+  hkdf,
+  hkdfSync,
+  pbkdf2,
+  pbkdf2Sync,
+  privateDecrypt,
+  publicEncrypt,
+  sign,
+  verify,
+} = require('node:crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
+
+if (!hasOpenSSL3 || process.features.openssl_is_boringssl) {
+  common.skip('OpenSSL 3 provider support is required');
+}
+
+const { internalBinding } = require('internal/test/binding');
+const {
+  HashJob,
+  kCryptoJobSync,
+  kCryptoJobWebCrypto,
+} = internalBinding('crypto');
+
+const hashes = getHashes();
+const lowercaseHashes = hashes.map((name) => name.toLowerCase());
+const modifiedHashes = getHashes();
+modifiedHashes.length = 0;
+
+assert.deepStrictEqual(hashes, [...hashes].sort());
+assert.deepStrictEqual(getHashes(), hashes);
+assert.strictEqual(new Set(lowercaseHashes).size, hashes.length);
+if (lowercaseHashes.includes('sha1')) {
+  assert(hashes.includes('RSA-SHA1'));
+}
+assert(!lowercaseHashes.includes('null'));
+assert(!lowercaseHashes.includes('ml-dsa-mu'));
+assert(!hashes.some((name) => /^\d+(?:\.\d+)+$/.test(name)));
+
+for (const name of hashes) {
+  try {
+    createHash(name);
+  } catch (err) {
+    assert.strictEqual(err.code, 'ERR_OSSL_EVP_NOT_XOF_OR_INVALID_LENGTH');
+    createHash(name, { outputLength: 32 });
+  }
+}
+
+const input = Buffer.alloc(0);
+assert.throws(
+  () => createHash('ml-dsa-mu'),
+  /Digest method not supported/,
+);
+assert.throws(
+  () => hash('ml-dsa-mu', input),
+  { message: 'Digest method ml-dsa-mu is not supported' },
+);
+
+const providerVectors = {
+  'keccak-kmac-128': {
+    aliases: ['keccak-kmac-128', 'keccak-kmac128'],
+    expected: '83aa04c211dc19d16912571ed0a75130' +
+              'd36aebd58562dd080c1ea84a8c7d73f7',
+    options: { outputLength: 32 },
+  },
+  'keccak-256': {
+    aliases: ['keccak-256'],
+    expected: 'c5d2460186f7233c927e7db2dcc703c0' +
+              'e500b653ca82273b7bfad8045d85a470',
+  },
+  'sha256-192': {
+    aliases: ['sha2-256/192', 'sha-256/192', 'sha256-192'],
+    expected: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934c',
+  },
+};
+
+function testHashVector({ aliases, expected, options }) {
+  for (const alias of aliases) {
+    if (!hashes.includes(alias)) continue;
+    assert(!hashes.includes(alias.toUpperCase()));
+
+    for (const name of [alias, alias.toUpperCase()]) {
+      const streaming = createHash(name, options).update(input).digest('hex');
+      assert.strictEqual(streaming, expected);
+      assert.strictEqual(hash(name, input, options), expected);
+    }
+  }
+}
+
+// These digests are tested when the active provider advertises them.
+for (const name of ['keccak-kmac-128', 'keccak-256', 'sha256-192']) {
+  const vector = providerVectors[name];
+  if (vector.aliases.some((alias) => hashes.includes(alias))) {
+    testHashVector(vector);
+  } else {
+    common.printSkipMessage(`${name} is not available from the active provider`);
+  }
+}
+
+const keccakKmacName = providerVectors['keccak-kmac-128'].aliases
+  .find((alias) => hashes.includes(alias));
+if (keccakKmacName !== undefined) {
+  (async () => {
+    const { expected } = providerVectors['keccak-kmac-128'];
+    const { 0: err, 1: syncResult } = new HashJob(
+      kCryptoJobSync,
+      keccakKmacName,
+      input,
+      256,
+    ).run();
+    assert.strictEqual(err, undefined);
+    assert.strictEqual(Buffer.from(syncResult).toString('hex'), expected);
+
+    const result = await new HashJob(
+      kCryptoJobWebCrypto,
+      keccakKmacName,
+      input,
+      256,
+    ).run();
+    assert.strictEqual(Buffer.from(result).toString('hex'), expected);
+  })().then(common.mustCall());
+}
+
+if (hashes.includes('sha256-192')) {
+  const operationInput = Buffer.from('abc');
+
+  assert.strictEqual(
+    createHmac('sha256-192', 'key').update(operationInput).digest('hex'),
+    'd7774e586190fa2d2f4d4be4bc86ccd459a9170d52c38809',
+  );
+
+  const hkdfExpected = 'ef23757b94b5e1e46c3f981d87828d7aeb0207733ab5c78' +
+                       'c60df321c9e8c88e0ad54b4eecfef8c258ccd';
+  assert.strictEqual(
+    Buffer.from(hkdfSync('sha256-192', 'key', 'salt', 'info', 42))
+      .toString('hex'),
+    hkdfExpected,
+  );
+  hkdf(
+    'sha256-192',
+    'key',
+    'salt',
+    'info',
+    42,
+    common.mustSucceed((result) => {
+      assert.strictEqual(Buffer.from(result).toString('hex'), hkdfExpected);
+    }),
+  );
+
+  const pbkdf2Expected = '1fee3dd5ea13d5b563d3cc88fbc6dcf7' +
+                         '3497aeffc3b3e6358ab3d3d1aa2aa0ee';
+  assert.strictEqual(
+    pbkdf2Sync('password', 'salt', 2, 32, 'sha256-192').toString('hex'),
+    pbkdf2Expected,
+  );
+  pbkdf2(
+    'password',
+    'salt',
+    2,
+    32,
+    'sha256-192',
+    common.mustSucceed((result) => {
+      assert.strictEqual(result.toString('hex'), pbkdf2Expected);
+    }),
+  );
+
+  const { privateKey: ecPrivateKey, publicKey: ecPublicKey } =
+    generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+  const signature = sign('sha256-192', operationInput, ecPrivateKey);
+  assert(verify('sha256-192', operationInput, ecPublicKey, signature));
+
+  const streamingSignature = createSign('sha256-192')
+    .update(operationInput)
+    .sign(ecPrivateKey);
+  const verifier = createVerify('sha256-192');
+  verifier.update(operationInput);
+  assert(verifier.verify(ecPublicKey, streamingSignature));
+
+  sign(
+    'sha256-192',
+    operationInput,
+    ecPrivateKey,
+    common.mustSucceed((asyncSignature) => {
+      verify(
+        'sha256-192',
+        operationInput,
+        ecPublicKey,
+        asyncSignature,
+        common.mustSucceed((result) => assert(result)),
+      );
+    }),
+  );
+
+  const { privateKey: rsaPrivateKey, publicKey: rsaPublicKey } =
+    generateKeyPairSync('rsa', { modulusLength: 2048 });
+  const plaintext = Buffer.from('provider digest');
+
+  assert.throws(
+    () => sign('sha256-192', plaintext, rsaPrivateKey),
+    { code: 'ERR_OSSL_DIGEST_NOT_ALLOWED' },
+  );
+  assert.deepStrictEqual(
+    privateDecrypt(
+      { key: rsaPrivateKey, oaepHash: 'sha256-192' },
+      publicEncrypt(
+        { key: rsaPublicKey, oaepHash: 'sha256-192' },
+        plaintext,
+      ),
+    ),
+    plaintext,
+  );
+
+  const pssOptions = [
+    {
+      hashAlgorithm: 'sha256-192',
+      modulusLength: 2048,
+    },
+    {
+      hashAlgorithm: 'sha256',
+      mgf1HashAlgorithm: 'sha256-192',
+      modulusLength: 2048,
+    },
+  ];
+  const keyGenerationFailed = { message: 'Key generation job failed' };
+
+  for (const options of pssOptions) {
+    assert.throws(
+      () => generateKeyPairSync('rsa-pss', options),
+      keyGenerationFailed,
+    );
+    generateKeyPair(
+      'rsa-pss',
+      options,
+      common.mustCall((err, publicKey, privateKey) => {
+        assert.strictEqual(err?.message, keyGenerationFailed.message);
+        assert.strictEqual(publicKey, undefined);
+        assert.strictEqual(privateKey, undefined);
+      }),
+    );
+  }
+}
diff --git a/test/parallel/test-crypto-rsa-multiprime-jwk.js b/test/parallel/test-crypto-rsa-multiprime-jwk.js
new file mode 100644
index 000000000000..be434c76e828
--- /dev/null
+++ b/test/parallel/test-crypto-rsa-multiprime-jwk.js
@@ -0,0 +1,62 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const fixtures = require('../common/fixtures');
+const { hasFIPS } = require('../common/crypto');
+const {
+  createPrivateKey,
+} = require('crypto');
+const { subtle } = globalThis.crypto;
+
+if (process.features.openssl_is_boringssl)
+  common.skip('multi-prime RSA is not available with BoringSSL');
+if (hasFIPS())
+  common.skip('multi-prime RSA is not available in FIPS mode');
+
+const privateKey = createPrivateKey(
+  fixtures.readKey('rsa_private_2048_3_primes.pem'));
+const pkcs8 = privateKey.export({ format: 'der', type: 'pkcs8' });
+const jwk = privateKey.export({ format: 'jwk' });
+
+assert.strictEqual(jwk.oth.length, 1);
+assert.deepStrictEqual(Object.keys(jwk.oth[0]), ['r', 'd', 't']);
+
+const importedKey = createPrivateKey({ key: jwk, format: 'jwk' });
+assert.deepStrictEqual(importedKey.export({ format: 'jwk' }), jwk);
+assert.deepStrictEqual(
+  importedKey.export({ format: 'der', type: 'pkcs8' }),
+  pkcs8);
+
+for (const field of ['r', 'd', 't']) {
+  const invalidJwk = {
+    ...jwk,
+    oth: [{ ...jwk.oth[0] }],
+  };
+  delete invalidJwk.oth[0][field];
+  assert.throws(
+    () => createPrivateKey({ key: invalidJwk, format: 'jwk' }),
+    { code: 'ERR_CRYPTO_INVALID_JWK' });
+}
+
+(async () => {
+  const algorithm = { name: 'RSA-PSS', hash: 'SHA-256' };
+  const cryptoKey = await subtle.importKey(
+    'pkcs8', pkcs8, algorithm, true, ['sign']);
+  const exportedJwk = await subtle.exportKey('jwk', cryptoKey);
+
+  const exportedKeyMaterial = { ...exportedJwk };
+  delete exportedKeyMaterial.key_ops;
+  delete exportedKeyMaterial.ext;
+  delete exportedKeyMaterial.alg;
+  assert.deepStrictEqual(exportedKeyMaterial, jwk);
+
+  const importedCryptoKey = await subtle.importKey(
+    'jwk', exportedJwk, algorithm, true, ['sign']);
+  assert.deepStrictEqual(
+    Buffer.from(await subtle.exportKey('pkcs8', importedCryptoKey)),
+    pkcs8);
+})().then(common.mustCall());
diff --git a/test/parallel/test-crypto-x509-brand-check.js b/test/parallel/test-crypto-x509-brand-check.js
new file mode 100644
index 000000000000..a0bd64ed8037
--- /dev/null
+++ b/test/parallel/test-crypto-x509-brand-check.js
@@ -0,0 +1,145 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('node:assert');
+const { X509Certificate } = require('node:crypto');
+const { readFileSync } = require('node:fs');
+const fixtures = require('../common/fixtures');
+const {
+  isX509Certificate,
+} = require('internal/crypto/x509');
+
+const certData = readFileSync(fixtures.path('keys', 'agent1-cert.pem'));
+const cert = new X509Certificate(certData);
+const invalidThis = { code: 'ERR_INVALID_THIS', name: 'TypeError' };
+
+const getterNames = [
+  'subject',
+  'subjectAltName',
+  'issuer',
+  'issuerCertificate',
+  'infoAccess',
+  'validFrom',
+  'validTo',
+  'validFromDate',
+  'validToDate',
+  'fingerprint',
+  'fingerprint256',
+  'fingerprint512',
+  'keyUsage',
+  'serialNumber',
+  'signatureAlgorithm',
+  'signatureAlgorithmOid',
+  'raw',
+  'publicKey',
+  'ca',
+];
+
+const methodNames = [
+  'toString',
+  'toJSON',
+  'checkHost',
+  'checkEmail',
+  'checkIP',
+  'checkIssued',
+  'checkPrivateKey',
+  'verify',
+  'toLegacyObject',
+];
+
+assert.strictEqual(isX509Certificate(cert), true);
+assert.strictEqual(cert instanceof X509Certificate, true);
+assert.strictEqual(Object.getPrototypeOf(X509Certificate.prototype),
+                   Object.prototype);
+for (const name of ['pem', 'checkCA', 'getIssuerCert', 'toLegacy']) {
+  assert.strictEqual(name in cert, false);
+}
+
+for (const value of [
+  {},
+  { __proto__: null },
+  1,
+  null,
+  undefined,
+  Buffer.alloc(1),
+  function() {},
+]) {
+  assert.strictEqual(isX509Certificate(value), false);
+  for (const name of getterNames) {
+    const getter = Object.getOwnPropertyDescriptor(
+      X509Certificate.prototype, name).get;
+    assert.throws(() => getter.call(value), invalidThis);
+  }
+  for (const name of methodNames) {
+    assert.throws(
+      () => X509Certificate.prototype[name].call(value),
+      invalidThis);
+  }
+}
+
+const spoofed = { __proto__: X509Certificate.prototype };
+assert.strictEqual(spoofed instanceof X509Certificate, true);
+assert.strictEqual(isX509Certificate(spoofed), false);
+assert.throws(() => spoofed.subject, invalidThis);
+assert.throws(() => spoofed.toString(), invalidThis);
+
+const originalHasInstance =
+  Object.getOwnPropertyDescriptor(X509Certificate, Symbol.hasInstance);
+Object.defineProperty(X509Certificate, Symbol.hasInstance, {
+  configurable: true,
+  value: () => true,
+});
+try {
+  const buffer = Buffer.alloc(1);
+  assert.strictEqual(buffer instanceof X509Certificate, true);
+  assert.strictEqual(isX509Certificate(buffer), false);
+  assert.throws(() => X509Certificate.prototype.toString.call(buffer),
+                invalidThis);
+} finally {
+  if (originalHasInstance === undefined) {
+    delete X509Certificate[Symbol.hasInstance];
+  } else {
+    Object.defineProperty(
+      X509Certificate, Symbol.hasInstance, originalHasInstance);
+  }
+}
+
+class DerivedX509Certificate extends X509Certificate {}
+const derived = new DerivedX509Certificate(certData);
+assert.strictEqual(derived instanceof DerivedX509Certificate, true);
+assert.strictEqual(derived instanceof X509Certificate, true);
+assert.strictEqual(isX509Certificate(derived), true);
+assert.strictEqual(derived.subject, cert.subject);
+
+function PrimitivePrototype() {}
+PrimitivePrototype.prototype = 1;
+const primitivePrototype = Reflect.construct(
+  X509Certificate, [certData], PrimitivePrototype);
+assert.strictEqual(Object.getPrototypeOf(primitivePrototype), Object.prototype);
+assert.strictEqual(isX509Certificate(primitivePrototype), true);
+assert.strictEqual(
+  Object.getOwnPropertyDescriptor(
+    X509Certificate.prototype, 'subject').get.call(primitivePrototype),
+  cert.subject);
+
+const firstPrototype = { __proto__: X509Certificate.prototype };
+const secondPrototype = { __proto__: X509Certificate.prototype };
+let prototypeReads = 0;
+const ProxyNewTarget = new Proxy(function() {}, {
+  get(target, property, receiver) {
+    if (property === 'prototype') {
+      prototypeReads++;
+      return prototypeReads === 1 ? firstPrototype : secondPrototype;
+    }
+    return Reflect.get(target, property, receiver);
+  },
+});
+const proxyNewTarget = Reflect.construct(
+  X509Certificate, [certData], ProxyNewTarget);
+assert.strictEqual(prototypeReads, 1);
+assert.strictEqual(Object.getPrototypeOf(proxyNewTarget), firstPrototype);
+assert.strictEqual(proxyNewTarget.subject, cert.subject);
diff --git a/test/parallel/test-crypto-x509-clone-transfer.js b/test/parallel/test-crypto-x509-clone-transfer.js
new file mode 100644
index 000000000000..4ab6ea59b5f2
--- /dev/null
+++ b/test/parallel/test-crypto-x509-clone-transfer.js
@@ -0,0 +1,119 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('node:assert');
+const { once } = require('node:events');
+const {
+  X509Certificate,
+  createPrivateKey,
+} = require('node:crypto');
+const { readFileSync } = require('node:fs');
+const {
+  markAsUncloneable,
+  MessageChannel,
+  Worker,
+} = require('node:worker_threads');
+const fixtures = require('../common/fixtures');
+const {
+  isX509Certificate,
+} = require('internal/crypto/x509');
+
+const certData = readFileSync(fixtures.path('keys', 'agent1-cert.pem'));
+const keyData = readFileSync(fixtures.path('keys', 'agent1-key.pem'));
+const caData = readFileSync(fixtures.path('keys', 'ca1-cert.pem'));
+
+const cert = new X509Certificate(certData);
+const ca = new X509Certificate(caData);
+const privateKey = createPrivateKey(keyData);
+
+const dataCloneError = {
+  code: 25,
+  name: 'DataCloneError',
+};
+
+{
+  const uncloneable = new X509Certificate(certData);
+  markAsUncloneable(uncloneable);
+  assert.throws(() => structuredClone(uncloneable), dataCloneError);
+
+  const { port1, port2 } = new MessageChannel();
+  assert.throws(() => port1.postMessage(uncloneable), dataCloneError);
+  port1.close();
+  port2.close();
+}
+
+function assertSameCertificate(original, clone) {
+  assert.notStrictEqual(clone, original);
+  assert.strictEqual(clone instanceof X509Certificate, true);
+  assert.strictEqual(isX509Certificate(clone), true);
+  assert.strictEqual(clone.subject, original.subject);
+  assert.strictEqual(clone.issuer, original.issuer);
+  assert.strictEqual(clone.fingerprint256, original.fingerprint256);
+  assert.deepStrictEqual(clone.raw, original.raw);
+  assert.deepStrictEqual(Reflect.ownKeys(clone), []);
+  assert.strictEqual(clone.checkPrivateKey(privateKey), true);
+  assert.strictEqual(clone.checkIssued(ca), true);
+  assert.strictEqual(clone.verify(ca.publicKey), true);
+}
+
+async function roundTripViaMessageChannel(value) {
+  const { port1, port2 } = new MessageChannel();
+  port1.postMessage(value);
+  const [received] = await once(port2, 'message');
+  port1.close();
+  port2.close();
+  return received;
+}
+
+function workerMain() {
+  const {
+    X509Certificate: WorkerX509Certificate,
+  } = require('node:crypto');
+  const { parentPort } = require('node:worker_threads');
+
+  parentPort.once('message', (cert) => {
+    try {
+      if (!(cert instanceof WorkerX509Certificate)) {
+        throw new Error('X509Certificate brand was not preserved');
+      }
+      parentPort.postMessage({
+        cert,
+        ownKeyCount: Reflect.ownKeys(cert).length,
+        subject: cert.subject,
+      });
+    } catch (error) {
+      parentPort.postMessage({ error: error.stack || error.message });
+    }
+  });
+}
+
+async function roundTripViaWorker(value) {
+  const worker = new Worker(
+    `'use strict';(${workerMain.toString()})()`, { eval: true });
+
+  worker.postMessage(value);
+  const [message] = await once(worker, 'message');
+  await worker.terminate();
+  assert.strictEqual(message.error, undefined, message.error);
+  assert.strictEqual(message.ownKeyCount, 0);
+  assert.strictEqual(message.subject, value.subject);
+  return message.cert;
+}
+
+(async () => {
+  const cloned = structuredClone(cert);
+  assertSameCertificate(cert, cloned);
+
+  const viaPort = await roundTripViaMessageChannel(cert);
+  assertSameCertificate(cert, viaPort);
+
+  const clonedAgain = structuredClone(viaPort);
+  assertSameCertificate(cert, clonedAgain);
+
+  const viaWorker = await roundTripViaWorker(cert);
+  assertSameCertificate(cert, viaWorker);
+})().then(common.mustCall());
diff --git a/test/parallel/test-crypto-x509-hidden-slots.js b/test/parallel/test-crypto-x509-hidden-slots.js
new file mode 100644
index 000000000000..fead69935287
--- /dev/null
+++ b/test/parallel/test-crypto-x509-hidden-slots.js
@@ -0,0 +1,117 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('node:assert');
+const {
+  X509Certificate,
+  createPrivateKey,
+} = require('node:crypto');
+const { readFileSync } = require('node:fs');
+const { inspect } = require('node:util');
+const fixtures = require('../common/fixtures');
+
+const certData = readFileSync(fixtures.path('keys', 'agent1-cert.pem'));
+const keyData = readFileSync(fixtures.path('keys', 'agent1-key.pem'));
+const caData = readFileSync(fixtures.path('keys', 'ca1-cert.pem'));
+
+const cert = new X509Certificate(certData);
+const ca = new X509Certificate(caData);
+const privateKey = createPrivateKey(keyData);
+const expectedPem = cert.toString();
+const expectedSubject = cert.subject;
+
+function assertNoOwnKeys(value) {
+  assert.deepStrictEqual(Object.getOwnPropertyNames(value), []);
+  assert.deepStrictEqual(Object.getOwnPropertySymbols(value), []);
+  assert.deepStrictEqual(Reflect.ownKeys(value), []);
+}
+
+for (const name of [
+  'subject',
+  'subjectAltName',
+  'issuer',
+  'issuerCertificate',
+  'infoAccess',
+  'validFrom',
+  'validTo',
+  'validFromDate',
+  'validToDate',
+  'fingerprint',
+  'fingerprint256',
+  'fingerprint512',
+  'keyUsage',
+  'serialNumber',
+  'signatureAlgorithm',
+  'signatureAlgorithmOid',
+  'raw',
+  'publicKey',
+  'ca',
+]) {
+  // Populate every private lazy-cache entry before checking reflection.
+  Reflect.get(cert, name);
+}
+cert.toString();
+cert.toJSON();
+assertNoOwnKeys(cert);
+
+const getterNames = [
+  'subject',
+  'subjectAltName',
+  'issuer',
+  'infoAccess',
+  'validFrom',
+  'validTo',
+  'validFromDate',
+  'validToDate',
+  'fingerprint',
+  'fingerprint256',
+  'fingerprint512',
+  'keyUsage',
+  'serialNumber',
+  'signatureAlgorithm',
+  'signatureAlgorithmOid',
+];
+const originals = new Map();
+for (const name of getterNames) {
+  originals.set(name,
+                Object.getOwnPropertyDescriptor(
+                  X509Certificate.prototype, name));
+  Object.defineProperty(X509Certificate.prototype, name, {
+    configurable: true,
+    get() { return `FORGED-${name}`; },
+  });
+}
+const originalToString =
+  Object.getOwnPropertyDescriptor(X509Certificate.prototype, 'toString');
+Object.defineProperty(X509Certificate.prototype, 'toString', {
+  configurable: true,
+  value() { return 'FORGED-PEM'; },
+});
+
+try {
+  assert.strictEqual(cert.subject, 'FORGED-subject');
+  assert.strictEqual(cert.toString(), 'FORGED-PEM');
+
+  const rendered = inspect(cert, { depth: 4 });
+  assert.match(rendered, /CN=agent1/);
+  assert.doesNotMatch(rendered, /FORGED/);
+  assert.strictEqual(cert.toJSON(), expectedPem);
+  assert.strictEqual(JSON.parse(JSON.stringify(cert)), expectedPem);
+
+  assert.strictEqual(cert.checkIssued(ca), true);
+  assert.strictEqual(cert.checkPrivateKey(privateKey), true);
+  assert.strictEqual(cert.verify(ca.publicKey), true);
+  assertNoOwnKeys(cert);
+} finally {
+  for (const [name, descriptor] of originals) {
+    Object.defineProperty(X509Certificate.prototype, name, descriptor);
+  }
+  Object.defineProperty(
+    X509Certificate.prototype, 'toString', originalToString);
+}
+
+assert.strictEqual(cert.subject, expectedSubject);
+assert.strictEqual(cert.toString(), expectedPem);
diff --git a/test/parallel/test-diagnostics-channel-crypto-fips-indicator.js b/test/parallel/test-diagnostics-channel-crypto-fips-indicator.js
new file mode 100644
index 000000000000..0d7366dd3438
--- /dev/null
+++ b/test/parallel/test-diagnostics-channel-crypto-fips-indicator.js
@@ -0,0 +1,184 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const assert = require('node:assert');
+const diagnosticsChannel = require('node:diagnostics_channel');
+const { once } = require('node:events');
+const { Worker } = require('node:worker_threads');
+const {
+  spawnSyncAndExitWithoutError,
+} = require('../common/child_process');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
+const {
+  createHmac,
+  generateKeyPairSync,
+  sign,
+  subtle,
+} = require('node:crypto');
+
+const channelName = 'crypto.fips.indicator';
+
+if (!hasOpenSSL(3, 4)) {
+  common.skip('OpenSSL 3.4 or later is required');
+} else if (!hasFIPS(3, 4)) {
+  common.skip('an active OpenSSL 3.4+ FIPS provider is required');
+} else if (!process.execArgv.includes('--enable-fips-indicator-events')) {
+  spawnSyncAndExitWithoutError(
+    process.execPath,
+    ['--enable-fips-indicator-events', __filename],
+  );
+} else {
+  run().then(common.mustCall());
+}
+
+function nextIndicator() {
+  const keepAlive = setInterval(common.mustNotCall(), 10_000);
+  const { promise, resolve } = Promise.withResolvers();
+  const subscriber = common.mustCall((event, name) => {
+    assert.strictEqual(name, channelName);
+    clearInterval(keepAlive);
+    assert.strictEqual(
+      diagnosticsChannel.unsubscribe(channelName, subscriber), true);
+    resolve(event);
+  });
+  diagnosticsChannel.subscribe(channelName, subscriber);
+  return promise;
+}
+
+function testUnsubscribeDuringDrain(key, privateKey) {
+  const keepAlive = setInterval(common.mustNotCall(), 10_000);
+  const { promise, resolve } = Promise.withResolvers();
+  const subscriber = common.mustCall(() => {
+    clearInterval(keepAlive);
+    assert.strictEqual(
+      diagnosticsChannel.unsubscribe(channelName, subscriber), true);
+    setImmediate(common.mustCall(resolve));
+  });
+  diagnosticsChannel.subscribe(channelName, subscriber);
+  createHmac('sha256', key).digest();
+  sign('sha1', Buffer.alloc(0), privateKey);
+  return promise;
+}
+
+async function testNoStaleIndicator(key) {
+  createHmac('sha256', key).digest();
+  const subscriber = common.mustNotCall();
+  diagnosticsChannel.subscribe(channelName, subscriber);
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.strictEqual(
+    diagnosticsChannel.unsubscribe(channelName, subscriber), true);
+}
+
+async function run() {
+  const key = Buffer.alloc(13);
+
+  const keepAlive = setInterval(common.mustNotCall(), 10_000);
+  const { promise, resolve: resolveProbe } = Promise.withResolvers();
+  const probeSubscriber = (event) => {
+    clearInterval(keepAlive);
+    diagnosticsChannel.unsubscribe(channelName, probeSubscriber);
+    resolveProbe(event);
+  };
+  diagnosticsChannel.subscribe(channelName, probeSubscriber);
+
+  let output;
+  try {
+    output = createHmac('sha256', key).digest();
+  } catch (error) {
+    clearInterval(keepAlive);
+    diagnosticsChannel.unsubscribe(channelName, probeSubscriber);
+    assert.match(error.code, /^ERR_OSSL_/);
+    common.printSkipMessage(
+      'the FIPS provider rejects unapproved operations before signaling');
+    return;
+  }
+
+  assert.strictEqual(output.byteLength, 32);
+  assert.deepStrictEqual(await promise, {
+    operation: 'HMAC',
+    reason: 'keysize',
+    blocked: false,
+    count: 1,
+    dropped: 0,
+  });
+
+  await testNoStaleIndicator(key);
+
+  let eventPromise = nextIndicator();
+  createHmac('sha256', key).digest();
+  createHmac('sha256', key).digest();
+  assert.deepStrictEqual(await eventPromise, {
+    operation: 'HMAC',
+    reason: 'keysize',
+    blocked: false,
+    count: 2,
+    dropped: 0,
+  });
+
+  const secondSubscriber = common.mustCall();
+  diagnosticsChannel.subscribe(channelName, secondSubscriber);
+  eventPromise = nextIndicator();
+  createHmac('sha256', key).digest();
+  await eventPromise;
+  assert.strictEqual(
+    diagnosticsChannel.unsubscribe(channelName, secondSubscriber), true);
+
+  const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+  await testUnsubscribeDuringDrain(key, privateKey);
+
+  const hmacKey = await subtle.importKey(
+    'raw', Buffer.alloc(13), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  eventPromise = nextIndicator();
+  const [signature, hmacEvent] = await Promise.all([
+    subtle.sign('HMAC', hmacKey, Buffer.alloc(0)),
+    eventPromise,
+  ]);
+  assert.strictEqual(signature.byteLength, 32);
+  assert.strictEqual(hmacEvent.operation, 'HMAC');
+  assert.strictEqual(hmacEvent.reason, 'keysize');
+  assert.strictEqual(hmacEvent.blocked, false);
+
+  eventPromise = nextIndicator();
+  const worker = new Worker(`
+    'use strict';
+    const diagnosticsChannel = require('node:diagnostics_channel');
+    const { parentPort, workerData } = require('node:worker_threads');
+    const { createHmac } = require('node:crypto');
+
+    let indicatorCount = 0;
+    diagnosticsChannel.subscribe('crypto.fips.indicator', () => {
+      indicatorCount++;
+    });
+    const result = createHmac('sha256', workerData.key).digest();
+    setImmediate(() => {
+      parentPort.postMessage({
+        indicatorCount,
+        length: result.byteLength,
+      });
+    });
+  `, {
+    eval: true,
+    workerData: { key },
+  });
+  worker.on('error', common.mustNotCall());
+  const exitPromise = once(worker, 'exit');
+  const [[message], workerEvent] = await Promise.all([
+    once(worker, 'message'),
+    eventPromise,
+  ]);
+  assert.deepStrictEqual(message, { indicatorCount: 0, length: 32 });
+  assert.deepStrictEqual(workerEvent, {
+    operation: 'HMAC',
+    reason: 'keysize',
+    blocked: false,
+    count: 1,
+    dropped: 0,
+  });
+  const [exitCode] = await exitPromise;
+  assert.strictEqual(exitCode, 0);
+}
diff --git a/test/parallel/test-diagnostics-channel-tracing-channel-context.js b/test/parallel/test-diagnostics-channel-tracing-channel-context.js
new file mode 100644
index 000000000000..e0e605854032
--- /dev/null
+++ b/test/parallel/test-diagnostics-channel-tracing-channel-context.js
@@ -0,0 +1,85 @@
+'use strict';
+
+const common = require('../common');
+
+// This test ensures that tracing channels create an independent mutable
+// context for each call while preserving explicitly provided contexts.
+
+const assert = require('node:assert');
+const dc = require('node:diagnostics_channel');
+
+const lengthChannel = dc.tracingChannel('test:length');
+assert.strictEqual(lengthChannel.traceSync.length, 1);
+assert.strictEqual(lengthChannel.tracePromise.length, 1);
+
+function subscribe(channel, contexts, isPromise = false) {
+  let endCalls = 0;
+  let asyncStartCalls = 0;
+  let asyncEndCalls = 0;
+
+  channel.subscribe({
+    start: common.mustCall((context) => {
+      context.invocation = contexts.length;
+      contexts.push(context);
+    }, 4),
+    end: common.mustCall((context) => {
+      assert.strictEqual(context.invocation, endCalls++);
+    }, 4),
+    asyncStart: common.mustCall((context) => {
+      assert.strictEqual(context.invocation, asyncStartCalls++);
+    }, isPromise ? 4 : 0),
+    asyncEnd: common.mustCall((context) => {
+      assert.strictEqual(context.invocation, asyncEndCalls++);
+    }, isPromise ? 4 : 0),
+  });
+}
+
+const syncChannel = dc.tracingChannel('test:sync-context');
+const syncContexts = [];
+subscribe(syncChannel, syncContexts);
+
+const syncProvided = { provided: true };
+assert.strictEqual(syncChannel.traceSync(() => 'omitted'), 'omitted');
+assert.strictEqual(syncChannel.traceSync(() => 'undefined', undefined),
+                   'undefined');
+assert.strictEqual(syncChannel.traceSync(() => 'provided', syncProvided),
+                   'provided');
+
+assert.strictEqual(Object.getPrototypeOf(syncContexts[0]), null);
+assert.strictEqual(Object.getPrototypeOf(syncContexts[1]), null);
+assert.notStrictEqual(syncContexts[0], syncContexts[1]);
+assert.strictEqual(syncContexts[2], syncProvided);
+assert.deepStrictEqual(syncContexts.slice(0, 3).map(({ result }) => result),
+                       ['omitted', 'undefined', 'provided']);
+
+const syncError = new Error('sync');
+assert.throws(() => syncChannel.traceSync(() => {
+  throw syncError;
+}), (error) => error === syncError);
+assert.strictEqual(syncContexts[3].error, syncError);
+
+const promiseChannel = dc.tracingChannel('test:promise-context');
+const promiseContexts = [];
+subscribe(promiseChannel, promiseContexts, true);
+
+const promiseProvided = { provided: true };
+const promiseError = new Error('promise');
+Promise.resolve()
+  .then(() => promiseChannel.tracePromise(() => Promise.resolve('omitted')))
+  .then(() => promiseChannel.tracePromise(
+    () => Promise.resolve('undefined'), undefined))
+  .then(() => promiseChannel.tracePromise(
+    () => Promise.resolve('provided'), promiseProvided))
+  .then(() => assert.rejects(
+    promiseChannel.tracePromise(() => Promise.reject(promiseError)),
+    promiseError))
+  .then(common.mustCall(() => {
+    assert.strictEqual(Object.getPrototypeOf(promiseContexts[0]), null);
+    assert.strictEqual(Object.getPrototypeOf(promiseContexts[1]), null);
+    assert.notStrictEqual(promiseContexts[0], promiseContexts[1]);
+    assert.strictEqual(promiseContexts[2], promiseProvided);
+    assert.deepStrictEqual(
+      promiseContexts.slice(0, 3).map(({ result }) => result),
+      ['omitted', 'undefined', 'provided']);
+    assert.strictEqual(promiseContexts[3].error, promiseError);
+  }));
diff --git a/test/parallel/test-dlopen-binary.js b/test/parallel/test-dlopen-binary.js
new file mode 100644
index 000000000000..8a575a52c975
--- /dev/null
+++ b/test/parallel/test-dlopen-binary.js
@@ -0,0 +1,51 @@
+// Flags: --expose-internals
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { internalBinding } = require('internal/test/binding');
+
+// dlopenBinary() loads a native addon from bytes already in memory, for an
+// addon that the dynamic loader cannot open by path (e.g. one served by a
+// virtual file system). It is internal: process.dlopen() keeps its documented
+// (module, filename[, flags]) signature and never takes the bytes.
+const { dlopenBinary } = internalBinding('process_methods');
+assert.strictEqual(typeof dlopenBinary, 'function');
+assert.strictEqual(process.dlopen.length, 0);
+
+const addonPath = path.join(
+  __dirname, '..', 'addons', 'hello-world', 'build', 'Release', 'binding.node');
+if (!fs.existsSync(addonPath)) common.skip('the hello-world addon is not built');
+const bytes = fs.readFileSync(addonPath);
+const flags = (os.constants.dlopen?.RTLD_LAZY) || 0;
+
+// A path that does not exist on disk, as a VFS-resident addon would be.
+const fakePath = path.join(os.tmpdir(), 'nonexistent-vfs-dir', 'binding.node');
+assert.ok(!fs.existsSync(fakePath));
+
+const m = { exports: {} };
+dlopenBinary(m, fakePath, flags, bytes);
+assert.strictEqual(typeof m.exports.hello, 'function');
+assert.strictEqual(m.exports.hello(), 'world');
+
+// The flags argument may be left undefined when passing bytes.
+const m2 = { exports: {} };
+dlopenBinary(m2, fakePath, undefined, bytes);
+assert.strictEqual(m2.exports.hello(), 'world');
+
+// Without the bytes, that nonexistent path cannot be loaded.
+assert.throws(() => dlopenBinary({ exports: {} }, fakePath, flags),
+              { code: 'ERR_DLOPEN_FAILED' });
+
+// A non-buffer binary is rejected.
+assert.throws(
+  () => dlopenBinary({ exports: {} }, fakePath, flags, 'nope'),
+  { code: 'ERR_INVALID_ARG_TYPE' });
+
+// process.dlopen() ignores a fourth argument rather than loading from it: the
+// public signature is unchanged, so this still fails on the missing path.
+assert.throws(
+  () => process.dlopen({ exports: {} }, fakePath, flags, bytes),
+  { code: 'ERR_DLOPEN_FAILED' });
diff --git a/test/parallel/test-dtls-accessors.mjs b/test/parallel/test-dtls-accessors.mjs
new file mode 100644
index 000000000000..bb93eeaebe6e
--- /dev/null
+++ b/test/parallel/test-dtls-accessors.mjs
@@ -0,0 +1,101 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: DTLSEndpoint/DTLSSession state fields and callback accessors reflect
+// what is set and the connection lifecycle.
+
+import {
+  hasCrypto, skip, mustCall, mustNotCall, mustCallAtLeast,
+} from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+const gotServerSession = Promise.withResolvers();
+
+const server = listen(mustCall((session) => {
+  gotServerSession.resolve(session);
+}), { cert, key, port: 0, host: '127.0.0.1' });
+
+// --- Endpoint state after listen(): bound and listening. ---
+const es = server.state;
+assert.strictEqual(es.bound, true);
+assert.strictEqual(es.listening, true);
+assert.strictEqual(es.closing, false);
+assert.strictEqual(es.destroyed, false);
+assert.strictEqual(es.sessionCount, 0);
+
+// The busy property is settable via the endpoint and reflected in the state view.
+assert.strictEqual(server.busy, false);
+assert.strictEqual(es.busy, false);
+server.busy = true;
+assert.strictEqual(server.busy, true);
+assert.strictEqual(es.busy, true);
+server.busy = false;
+assert.strictEqual(es.busy, false);
+
+// --- Endpoint onerror accessor. ---
+assert.strictEqual(server.onerror, undefined);
+const onEndpointError = mustNotCall();
+server.onerror = onEndpointError;
+assert.strictEqual(server.onerror, onEndpointError);
+
+const client = connect('127.0.0.1', server.address.port, {
+  ca: [ca],
+  rejectUnauthorized: false,
+});
+
+// --- Session state during the handshake. ---
+const cs = client.state;
+assert.strictEqual(cs.handshaking, true);
+assert.strictEqual(cs.open, false);
+assert.strictEqual(cs.closing, false);
+assert.strictEqual(cs.destroyed, false);
+assert.strictEqual(cs.hasMessageListener, false);
+
+// --- Session callback accessors: unset, then set. ---
+assert.strictEqual(client.onmessage, undefined);
+assert.strictEqual(client.onerror, undefined);
+assert.strictEqual(client.onhandshake, undefined);
+assert.strictEqual(client.onkeylog, undefined);
+// A connect() session owns its internal endpoint.
+assert.strictEqual(client.ownsEndpoint, true);
+
+client.onmessage = mustNotCall();
+assert.strictEqual(typeof client.onmessage, 'function');
+// Attaching a message listener flips the shared flag.
+assert.strictEqual(cs.hasMessageListener, true);
+
+client.onerror = mustNotCall();
+assert.strictEqual(typeof client.onerror, 'function');
+
+client.onhandshake = mustCall();
+assert.strictEqual(typeof client.onhandshake, 'function');
+
+client.onkeylog = mustCallAtLeast();
+assert.strictEqual(typeof client.onkeylog, 'function');
+
+await client.opened;
+
+// --- Session state after the handshake completes. ---
+assert.strictEqual(cs.handshaking, false);
+assert.strictEqual(cs.open, true);
+
+const serverSession = await gotServerSession.promise;
+await serverSession.opened;
+assert.strictEqual(es.sessionCount, 1);
+
+await client.close();
+await server.close();
diff --git a/test/parallel/test-dtls-alpn.mjs b/test/parallel/test-dtls-alpn.mjs
new file mode 100644
index 000000000000..01054dd6432b
--- /dev/null
+++ b/test/parallel/test-dtls-alpn.mjs
@@ -0,0 +1,82 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: ALPN negotiation in DTLS.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const serverCert = fixtures.readKey('agent1-cert.pem');
+const serverKey = fixtures.readKey('agent1-key.pem');
+const ca = fixtures.readKey('ca1-cert.pem');
+
+const serverAlpnChecked = Promise.withResolvers();
+
+const endpoint = listen(mustCall(async (session) => {
+  await session.opened;
+  // Server should see the negotiated ALPN protocol.
+  assert.strictEqual(session.alpnProtocol, 'coap');
+  serverAlpnChecked.resolve();
+}), {
+  cert: serverCert.toString(),
+  key: serverKey.toString(),
+  port: 0,
+  host: '127.0.0.1',
+  alpn: ['coap', 'h2'],
+});
+
+const session = connect('127.0.0.1', endpoint.address.port, {
+  ca: [ca.toString()],
+  rejectUnauthorized: false,
+  alpn: ['coap'],
+});
+
+await session.opened;
+
+// Client should see the negotiated protocol.
+assert.strictEqual(session.alpnProtocol, 'coap');
+
+await serverAlpnChecked.promise;
+
+await session.close();
+await endpoint.close();
+
+// ALPN with no protocol in common: the handshake still completes and neither
+// peer reports a negotiated protocol.
+{
+  const gotServerSession = Promise.withResolvers();
+
+  const server = listen(mustCall((s) => gotServerSession.resolve(s)), {
+    cert: serverCert.toString(),
+    key: serverKey.toString(),
+    port: 0,
+    host: '127.0.0.1',
+    alpn: ['bar'],
+  });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca.toString()],
+    rejectUnauthorized: false,
+    alpn: ['foo'],
+  });
+
+  await client.opened;
+  const serverSession = await gotServerSession.promise;
+  await serverSession.opened;
+
+  assert.strictEqual(client.alpnProtocol, undefined);
+  assert.strictEqual(serverSession.alpnProtocol, undefined);
+
+  await client.close();
+  await server.close();
+}
diff --git a/test/parallel/test-dtls-async-dispose.mjs b/test/parallel/test-dtls-async-dispose.mjs
new file mode 100644
index 000000000000..7fdf43445cc1
--- /dev/null
+++ b/test/parallel/test-dtls-async-dispose.mjs
@@ -0,0 +1,47 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: Symbol.asyncDispose for DTLSEndpoint and DTLSSession.
+
+import { hasCrypto, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const serverCert = fixtures.readKey('agent1-cert.pem');
+const serverKey = fixtures.readKey('agent1-key.pem');
+const ca = fixtures.readKey('ca1-cert.pem');
+
+const endpoint = listen(mustCall((session) => {
+  session.onmessage = mustNotCall();
+}), {
+  cert: serverCert.toString(),
+  key: serverKey.toString(),
+  port: 0,
+  host: '127.0.0.1',
+});
+
+const session = connect('127.0.0.1', endpoint.address.port, {
+  ca: [ca.toString()],
+  rejectUnauthorized: false,
+});
+
+await session.opened;
+
+// Test that Symbol.asyncDispose exists.
+assert.strictEqual(typeof session[Symbol.asyncDispose], 'function');
+assert.strictEqual(typeof endpoint[Symbol.asyncDispose], 'function');
+
+// Dispose the session.
+await session[Symbol.asyncDispose]();
+
+// Dispose the endpoint.
+await endpoint[Symbol.asyncDispose]();
diff --git a/test/parallel/test-dtls-basic.mjs b/test/parallel/test-dtls-basic.mjs
new file mode 100644
index 000000000000..9df0eff0dcc6
--- /dev/null
+++ b/test/parallel/test-dtls-basic.mjs
@@ -0,0 +1,87 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: Basic DTLS handshake and bidirectional data exchange.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const serverCert = fixtures.readKey('agent1-cert.pem');
+const serverKey = fixtures.readKey('agent1-key.pem');
+const ca = fixtures.readKey('ca1-cert.pem');
+
+const serverReceivedData = Promise.withResolvers();
+const clientReceivedData = Promise.withResolvers();
+
+let serverHandshakeDone = false;
+let clientHandshakeDone = false;
+
+// Start server.
+const endpoint = listen(mustCall((session) => {
+  session.onmessage = mustCall((data) => {
+    assert.strictEqual(data.toString(), 'hello from client');
+    serverReceivedData.resolve();
+
+    // Send response back to client.
+    session.send('hello from server');
+  });
+
+  session.onhandshake = mustCall((protocol) => {
+    assert.ok(protocol);
+    assert.match(protocol, /DTLS/i);
+    serverHandshakeDone = true;
+  });
+}), {
+  cert: serverCert.toString(),
+  key: serverKey.toString(),
+  port: 0,
+  host: '127.0.0.1',
+});
+
+const serverAddress = endpoint.address;
+assert.ok(serverAddress);
+assert.ok(serverAddress.port > 0);
+
+// Connect client.
+const clientSession = connect('127.0.0.1', serverAddress.port, {
+  ca: [ca.toString()],
+  rejectUnauthorized: false,
+});
+
+clientSession.onmessage = mustCall((data) => {
+  assert.strictEqual(data.toString(), 'hello from server');
+  clientReceivedData.resolve();
+});
+
+clientSession.onhandshake = mustCall((protocol) => {
+  assert.ok(protocol);
+  clientHandshakeDone = true;
+});
+
+// Wait for handshake.
+const { protocol } = await clientSession.opened;
+assert.match(protocol, /DTLS/i);
+
+// Send data.
+clientSession.send('hello from client');
+
+// Wait for bidirectional exchange.
+await Promise.all([serverReceivedData.promise, clientReceivedData.promise]);
+
+// Verify handshakes completed.
+assert.ok(clientHandshakeDone);
+assert.ok(serverHandshakeDone);
+
+// Clean up.
+await clientSession.close();
+await endpoint.close();
diff --git a/test/parallel/test-dtls-ciphers.mjs b/test/parallel/test-dtls-ciphers.mjs
new file mode 100644
index 000000000000..074c33f64b9b
--- /dev/null
+++ b/test/parallel/test-dtls-ciphers.mjs
@@ -0,0 +1,76 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: cipher and ECDH-curve selection and validation.
+
+import { hasCrypto, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+const CIPHER = 'ECDHE-RSA-AES128-GCM-SHA256';
+
+// Case 1: a specific cipher is negotiated and reported on both peers.
+{
+  const gotServerSession = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    gotServerSession.resolve(session);
+  }), { cert, key, port: 0, host: '127.0.0.1', ciphers: CIPHER });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+    ciphers: CIPHER,
+  });
+
+  await client.opened;
+  const serverSession = await gotServerSession.promise;
+  await serverSession.opened;
+
+  assert.strictEqual(client.cipher.name, CIPHER);
+  assert.strictEqual(serverSession.cipher.name, CIPHER);
+
+  await client.close();
+  await server.close();
+}
+
+// Case 2: an invalid cipher list is rejected.
+assert.throws(() => listen(mustNotCall(), {
+  cert, key, port: 0, host: '127.0.0.1', ciphers: 'THIS-IS-NOT-A-CIPHER',
+}), { code: 'ERR_CRYPTO_OPERATION_FAILED' });
+
+// Case 3: a valid ECDH curve completes a handshake.
+{
+  const server = listen(mustCall(), {
+    cert, key, port: 0, host: '127.0.0.1', ecdhCurve: 'P-256',
+  });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+    ecdhCurve: 'P-256',
+  });
+
+  await client.opened;
+
+  await client.close();
+  await server.close();
+}
+
+// Case 4: an invalid ECDH curve is rejected.
+assert.throws(() => listen(mustNotCall(), {
+  cert, key, port: 0, host: '127.0.0.1', ecdhCurve: 'not-a-curve',
+}), { code: 'ERR_CRYPTO_OPERATION_FAILED' });
diff --git a/test/parallel/test-dtls-client-cert.mjs b/test/parallel/test-dtls-client-cert.mjs
new file mode 100644
index 000000000000..271bd7e322ab
--- /dev/null
+++ b/test/parallel/test-dtls-client-cert.mjs
@@ -0,0 +1,70 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: DTLS mutual authentication. A server with requestCert verifies the
+// client's certificate; a client that presents no certificate is rejected.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+// Case 1: the client presents a certificate the server can verify.
+{
+  const gotServerSession = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    gotServerSession.resolve(session);
+  }), {
+    cert, key, ca: [ca], requestCert: true, port: 0, host: '127.0.0.1',
+  });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    cert, key, ca: [ca], rejectUnauthorized: false,
+  });
+
+  await client.opened;
+  const serverSession = await gotServerSession.promise;
+  await serverSession.opened;
+
+  // The server received and verified the client's certificate.
+  const clientCert = serverSession.peerCertificate;
+  assert.ok(clientCert);
+  assert.ok(clientCert.includes('BEGIN CERTIFICATE'));
+
+  await client.close();
+  await server.close();
+}
+
+// Case 2: the client presents no certificate; the server requires one and
+// rejects the handshake.
+{
+  const server = listen(mustCall(), {
+    cert, key, ca: [ca], requestCert: true, port: 0, host: '127.0.0.1',
+  });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca], rejectUnauthorized: false,
+  });
+
+  // The exact alert text varies, so assert only that the handshake is rejected.
+  await assert.rejects(client.opened, {
+    message: /handshake failure/
+  });
+
+  // The failed client tears down its internally-owned endpoint.
+  await client.endpoint.closed;
+  await server.close();
+}
diff --git a/test/parallel/test-dtls-close.mjs b/test/parallel/test-dtls-close.mjs
new file mode 100644
index 000000000000..a71e0938b7d0
--- /dev/null
+++ b/test/parallel/test-dtls-close.mjs
@@ -0,0 +1,107 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: Graceful close (close_notify) and forced destroy.
+
+import { hasCrypto, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const serverCert = fixtures.readKey('agent1-cert.pem');
+const serverKey = fixtures.readKey('agent1-key.pem');
+const ca = fixtures.readKey('ca1-cert.pem');
+
+// Test 1: Graceful close from client side.
+{
+  const serverSessionClosed = Promise.withResolvers();
+
+  const endpoint = listen(mustCall((session) => {
+    session.onmessage = mustNotCall();
+    session.closed.then(mustCall(() => {
+      serverSessionClosed.resolve();
+    }));
+  }), {
+    cert: serverCert.toString(),
+    key: serverKey.toString(),
+    port: 0,
+    host: '127.0.0.1',
+  });
+
+  const session = connect('127.0.0.1', endpoint.address.port, {
+    ca: [ca.toString()],
+    rejectUnauthorized: false,
+  });
+
+  await session.opened;
+
+  // Graceful close.
+  const closedPromise = session.close();
+  assert.ok(closedPromise instanceof Promise);
+  await closedPromise;
+
+  // Wait for server to see the close.
+  await serverSessionClosed.promise;
+
+  endpoint.close();
+  await endpoint.closed;
+}
+
+// Test 2: Forced destroy.
+{
+  const endpoint = listen(mustCall((session) => {
+    session.onmessage = mustNotCall();
+  }), {
+    cert: serverCert.toString(),
+    key: serverKey.toString(),
+    port: 0,
+    host: '127.0.0.1',
+  });
+
+  const session = connect('127.0.0.1', endpoint.address.port, {
+    ca: [ca.toString()],
+    rejectUnauthorized: false,
+  });
+
+  await session.opened;
+
+  // Forced destroy - no close_notify.
+  session.destroy();
+
+  // After destroy, send should fail.
+  assert.throws(() => {
+    session.send('should fail');
+  }, /destroyed/i);
+
+  endpoint.destroy();
+}
+
+// Test 3: Endpoint close closes all sessions.
+{
+  const endpoint = listen(mustCall((session) => {
+    session.onmessage = mustNotCall();
+  }), {
+    cert: serverCert.toString(),
+    key: serverKey.toString(),
+    port: 0,
+    host: '127.0.0.1',
+  });
+
+  const session = connect('127.0.0.1', endpoint.address.port, {
+    ca: [ca.toString()],
+    rejectUnauthorized: false,
+  });
+
+  await session.opened;
+
+  // Close the endpoint - this should close all sessions.
+  await endpoint.close();
+}
diff --git a/test/parallel/test-dtls-connect-error-cleanup.mjs b/test/parallel/test-dtls-connect-error-cleanup.mjs
new file mode 100644
index 000000000000..13dcf8da26bc
--- /dev/null
+++ b/test/parallel/test-dtls-connect-error-cleanup.mjs
@@ -0,0 +1,43 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: a client connect() whose handshake fails must tear down its internally
+// owned endpoint, so the event loop can drain. Regression test for a failed
+// connect leaking the endpoint (and hanging the process).
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+// The client rejects the certificate mid-handshake, so this server session
+// never opens; its opened rejection is handled internally by the library.
+const server = listen(mustCall(), { cert, key, port: 0, host: '127.0.0.1' });
+
+// A servername that does not match the certificate, under rejectUnauthorized,
+// makes the client's handshake fail during verification.
+const session = connect('127.0.0.1', server.address.port, {
+  ca: [ca],
+  rejectUnauthorized: true,
+  servername: 'wrong.example.com',
+});
+
+await assert.rejects(session.opened, /certificate verify failed/i);
+
+// The failed connect must have closed its internally-owned endpoint. Without
+// that, this await never settles and the test times out.
+await session.endpoint.closed;
+
+await server.close();
diff --git a/test/parallel/test-dtls-default-ca.mjs b/test/parallel/test-dtls-default-ca.mjs
new file mode 100644
index 000000000000..7c3475ddbbe9
--- /dev/null
+++ b/test/parallel/test-dtls-default-ca.mjs
@@ -0,0 +1,38 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test that DTLS uses Node's configurable default CA set when no explicit
+// `ca` option is provided.
+
+import { hasCrypto, mustCall, skip } from '../common/index.mjs';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { connect, listen } = await import('node:dtls');
+const { setDefaultCACertificates } = await import('node:tls');
+
+const serverCert = fixtures.readKey('agent1-cert.pem');
+const serverKey = fixtures.readKey('agent1-key.pem');
+const ca = fixtures.readKey('ca1-cert.pem');
+
+setDefaultCACertificates([ca]);
+
+const endpoint = listen(mustCall(), {
+  // Also cover the shared certificate-chain loader adopted by DTLS.
+  cert: Buffer.concat([serverCert, ca]),
+  key: serverKey,
+  host: '127.0.0.1',
+  port: 0,
+});
+
+const client = connect('127.0.0.1', endpoint.address.port);
+await client.opened;
+
+await client.close();
+await endpoint.close();
diff --git a/test/parallel/test-dtls-destroy-in-callback.mjs b/test/parallel/test-dtls-destroy-in-callback.mjs
new file mode 100644
index 000000000000..7915742ca01d
--- /dev/null
+++ b/test/parallel/test-dtls-destroy-in-callback.mjs
@@ -0,0 +1,77 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: destroying a DTLS session synchronously from within a callback that is
+// dispatched from the session's own I/O pump must not crash. The endpoint's
+// session table holds the only strong reference to the session, so a reentrant
+// destroy() removes it mid-pump; the implementation must keep the object alive
+// until the pump unwinds (regression test for a use-after-free).
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+// ---------------------------------------------------------------------------
+// Case 1: destroy the (server) session from inside onmessage. The datagram
+// carrying the message drives receive -> pump -> onmessage -> destroy(), which
+// frees the session's map entry while ClearOut() is still looping over ssl_.
+{
+  const destroyed = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    session.onmessage = mustCall(() => {
+      session.destroy();
+      destroyed.resolve();
+    });
+  }), { cert, key, port: 0, host: '127.0.0.1' });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+  });
+
+  await client.opened;
+  client.send('destroy me from onmessage');
+
+  await destroyed.promise;
+
+  await client.close();
+  await server.close();
+}
+
+// ---------------------------------------------------------------------------
+// Case 2: destroy the (server) session from inside onhandshake. Handshake
+// completion is emitted from the middle of the pump (Cycle), so destroying
+// there must not free the session before the pump finishes unwinding.
+{
+  const destroyed = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    session.onhandshake = mustCall(() => {
+      session.destroy();
+      destroyed.resolve();
+    });
+  }), { cert, key, port: 0, host: '127.0.0.1' });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+  });
+
+  await destroyed.promise;
+
+  await client.close();
+  await server.close();
+}
diff --git a/test/parallel/test-dtls-errors.mjs b/test/parallel/test-dtls-errors.mjs
new file mode 100644
index 000000000000..e65c90abd4e0
--- /dev/null
+++ b/test/parallel/test-dtls-errors.mjs
@@ -0,0 +1,45 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: DTLS error handling for invalid certificate/key material and endpoint
+// state.
+
+import { hasCrypto, skip, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, DTLSEndpoint } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const mismatchedKey = fixtures.readKey('agent2-key.pem').toString();
+
+// A malformed certificate PEM is rejected.
+assert.throws(() => listen(mustNotCall(), {
+  cert: 'not a certificate', key, port: 0,
+}), { code: 'ERR_CRYPTO_OPERATION_FAILED' });
+
+// A malformed private key PEM is rejected.
+assert.throws(() => listen(mustNotCall(), {
+  cert, key: 'not a key', port: 0,
+}), { code: 'ERR_CRYPTO_OPERATION_FAILED' });
+
+// A private key that does not match the certificate is rejected.
+assert.throws(() => listen(mustNotCall(), {
+  cert, key: mismatchedKey, port: 0,
+}), { code: 'ERR_CRYPTO_OPERATION_FAILED' });
+
+// Binding the same endpoint twice fails.
+{
+  const endpoint = new DTLSEndpoint();
+  endpoint.bind('127.0.0.1', 0);
+  assert.throws(() => endpoint.bind('127.0.0.1', 0), { code: 'ERR_INVALID_STATE' });
+  await endpoint.close();
+}
diff --git a/test/parallel/test-dtls-keylog.mjs b/test/parallel/test-dtls-keylog.mjs
new file mode 100644
index 000000000000..f32c1142b4c6
--- /dev/null
+++ b/test/parallel/test-dtls-keylog.mjs
@@ -0,0 +1,46 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: the onkeylog callback delivers NSS-format key material during the
+// handshake (useful for decrypting captures in Wireshark).
+
+import { hasCrypto, skip, mustCall, mustCallAtLeast } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+const gotKeylog = Promise.withResolvers();
+
+const server = listen(mustCall(), {
+  cert, key, port: 0, host: '127.0.0.1',
+});
+
+const client = connect('127.0.0.1', server.address.port, {
+  ca: [ca],
+  rejectUnauthorized: false,
+});
+
+// A keylog line is "<LABEL> <hex> <hex>" (e.g. "CLIENT_RANDOM ...").
+client.onkeylog = mustCallAtLeast((line) => {
+  assert.strictEqual(typeof line, 'string');
+  assert.match(line, /^\S+ [0-9a-f]+ [0-9a-f]+$/i);
+  gotKeylog.resolve();
+});
+
+await client.opened;
+await gotKeylog.promise;
+
+await client.close();
+await server.close();
diff --git a/test/parallel/test-dtls-mtu.mjs b/test/parallel/test-dtls-mtu.mjs
new file mode 100644
index 000000000000..58bf9098d00e
--- /dev/null
+++ b/test/parallel/test-dtls-mtu.mjs
@@ -0,0 +1,65 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: MTU option validation and that a small (but valid) MTU still completes
+// a handshake and data exchange (exercising DTLS record fragmentation).
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect, DTLSEndpoint } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+// MTU must be within [256, 65535].
+assert.throws(() => new DTLSEndpoint({ mtu: 255 }), { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => new DTLSEndpoint({ mtu: 65536 }), { code: 'ERR_OUT_OF_RANGE' });
+
+// A valid boundary MTU is accepted.
+{
+  const endpoint = new DTLSEndpoint({ mtu: 256 });
+  await endpoint.close();
+}
+
+// A small valid MTU forces the handshake flights (e.g. the certificate) to be
+// fragmented across records, and the exchange still succeeds.
+{
+  const received = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    session.onmessage = mustCall((data) => {
+      assert.strictEqual(data.toString(), 'hello');
+      session.send('world');
+    });
+  }), {
+    cert, key, port: 0, host: '127.0.0.1', mtu: 256,
+  });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+    mtu: 256,
+  });
+
+  client.onmessage = mustCall((data) => {
+    assert.strictEqual(data.toString(), 'world');
+    received.resolve();
+  });
+
+  await client.opened;
+  client.send('hello');
+  await received.promise;
+
+  await client.close();
+  await server.close();
+}
diff --git a/test/parallel/test-dtls-multiple-clients.mjs b/test/parallel/test-dtls-multiple-clients.mjs
new file mode 100644
index 000000000000..6ef5435295d0
--- /dev/null
+++ b/test/parallel/test-dtls-multiple-clients.mjs
@@ -0,0 +1,78 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: Multiple clients connecting to the same DTLS server.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const serverCert = fixtures.readKey('agent1-cert.pem');
+const serverKey = fixtures.readKey('agent1-key.pem');
+const ca = fixtures.readKey('ca1-cert.pem');
+
+const NUM_CLIENTS = 3;
+let sessionsAccepted = 0;
+const allClientsConnected = Promise.withResolvers();
+
+const endpoint = listen(mustCall((session) => {
+  session.onmessage = (data) => {
+    // Echo back with session identifier.
+    session.send(`echo:${data.toString()}`);
+  };
+
+  if (++sessionsAccepted === NUM_CLIENTS) {
+    allClientsConnected.resolve();
+  }
+}, NUM_CLIENTS), {
+  cert: serverCert.toString(),
+  key: serverKey.toString(),
+  port: 0,
+  host: '127.0.0.1',
+});
+
+const serverAddress = endpoint.address;
+const clients = [];
+const clientResponses = [];
+
+for (let i = 0; i < NUM_CLIENTS; i++) {
+  const received = Promise.withResolvers();
+  clientResponses.push(received);
+
+  const session = connect('127.0.0.1', serverAddress.port, {
+    ca: [ca.toString()],
+    rejectUnauthorized: false,
+  });
+
+  session.onmessage = mustCall((data) => {
+    assert.strictEqual(data.toString(), `echo:client${i}`);
+    received.resolve();
+  });
+
+  clients.push(session);
+}
+
+// Wait for all handshakes.
+await Promise.all(clients.map((c) => c.opened));
+
+// Send data from each client.
+for (let i = 0; i < NUM_CLIENTS; i++) {
+  clients[i].send(`client${i}`);
+}
+
+// Wait for all echoes.
+await Promise.all(clientResponses.map((r) => r.promise));
+
+// Clean up.
+await Promise.all(clients.map((c) => c.close()));
+
+await endpoint.close();
diff --git a/test/parallel/test-dtls-options.mjs b/test/parallel/test-dtls-options.mjs
new file mode 100644
index 000000000000..f071c3adc208
--- /dev/null
+++ b/test/parallel/test-dtls-options.mjs
@@ -0,0 +1,65 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: Option validation for DTLS API.
+
+import { hasCrypto, skip, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+// Test: listen() requires a callback.
+assert.throws(() => {
+  listen(undefined, { cert: 'x', key: 'y', port: 0 });
+}, { code: 'ERR_INVALID_ARG_TYPE' });
+
+// Test: listen() requires cert.
+assert.throws(() => {
+  listen(mustNotCall(), { key: 'y', port: 0 });
+}, { code: 'ERR_MISSING_ARGS' });
+
+// Test: listen() requires key.
+assert.throws(() => {
+  listen(mustNotCall(), { cert: 'x', port: 0 });
+}, { code: 'ERR_MISSING_ARGS' });
+
+// Test: listen() requires port.
+assert.throws(() => {
+  listen(mustNotCall(), { cert: 'x', key: 'y' });
+}, { code: 'ERR_MISSING_ARGS' });
+
+// Test: connect() requires valid host.
+assert.throws(() => {
+  connect(123, 4433);
+}, { code: 'ERR_INVALID_ARG_TYPE' });
+
+// Test: connect() requires valid port.
+assert.throws(() => {
+  connect('localhost', 'invalid');
+}, { code: 'ERR_INVALID_ARG_TYPE' });
+
+// Test: connect() rejects out-of-range port.
+assert.throws(() => {
+  connect('localhost', 99999);
+}, { code: 'ERR_OUT_OF_RANGE' });
+
+// Test: mtu must be an integer within [256, 65535].
+assert.throws(() => {
+  connect('127.0.0.1', 4433, { mtu: 100 });
+}, { code: 'ERR_OUT_OF_RANGE' });
+
+assert.throws(() => {
+  connect('127.0.0.1', 4433, { mtu: 70000 });
+}, { code: 'ERR_OUT_OF_RANGE' });
+
+// Test: alpn must be a string array or Buffer.
+assert.throws(() => {
+  connect('127.0.0.1', 4433, { alpn: 123 });
+}, { code: 'ERR_INVALID_ARG_TYPE' });
diff --git a/test/parallel/test-dtls-reject-unauthorized.mjs b/test/parallel/test-dtls-reject-unauthorized.mjs
new file mode 100644
index 000000000000..3ed625de30cd
--- /dev/null
+++ b/test/parallel/test-dtls-reject-unauthorized.mjs
@@ -0,0 +1,60 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: rejectUnauthorized gates certificate-chain verification. A certificate
+// that does not chain to a trusted CA is rejected when rejectUnauthorized is
+// true and accepted when it is false.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+
+// Case 1: with rejectUnauthorized, a certificate that does not chain to a
+// trusted CA fails verification. The servername matches the certificate, so
+// the failure is the untrusted chain and not an identity mismatch. No `ca` is
+// supplied, so only the system-default CAs are trusted (which do not include
+// this test's CA).
+{
+  const server = listen(mustCall(), {
+    cert, key, port: 0, host: '127.0.0.1',
+  });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    rejectUnauthorized: true,
+    servername: 'agent1',
+  });
+
+  await assert.rejects(client.opened, /certificate verify failed/i);
+
+  await client.endpoint.closed;
+  await server.close();
+}
+
+// Case 2: the same untrusted certificate is accepted when verification is off.
+{
+  const server = listen(mustCall(), {
+    cert, key, port: 0, host: '127.0.0.1',
+  });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    rejectUnauthorized: false,
+  });
+
+  const { protocol } = await client.opened;
+  assert.match(protocol, /DTLS/i);
+
+  await client.close();
+  await server.close();
+}
diff --git a/test/parallel/test-dtls-robustness.mjs b/test/parallel/test-dtls-robustness.mjs
new file mode 100644
index 000000000000..a2bc7c541f23
--- /dev/null
+++ b/test/parallel/test-dtls-robustness.mjs
@@ -0,0 +1,47 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: a listening DTLS server drops a non-DTLS (junk) datagram without
+// crashing, and still accepts a real client afterwards.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import dgram from 'node:dgram';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+const server = listen(mustCall((session) => {
+  session.onhandshake = mustCall();
+}), { cert, key, port: 0, host: '127.0.0.1' });
+
+const { port } = server.address;
+
+// Fire a datagram that is not a ClientHello at the server.
+const raw = dgram.createSocket('udp4');
+await new Promise((resolve, reject) => {
+  raw.send(Buffer.from('this is not a DTLS ClientHello'), port, '127.0.0.1',
+           (err) => (err ? reject(err) : resolve()));
+});
+await new Promise((resolve) => raw.close(resolve));
+
+// A real client still completes a handshake against the same server.
+const client = connect('127.0.0.1', port, {
+  ca: [ca],
+  rejectUnauthorized: false,
+});
+
+await client.opened;
+
+await client.close();
+await server.close();
diff --git a/test/parallel/test-dtls-send.mjs b/test/parallel/test-dtls-send.mjs
new file mode 100644
index 000000000000..7c559eaef75e
--- /dev/null
+++ b/test/parallel/test-dtls-send.mjs
@@ -0,0 +1,67 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: DTLSSession.send() return values and the single-record size limit.
+
+import { hasCrypto, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+// The largest application payload that fits in a single DTLS record (2^14).
+const MAX_RECORD = 16384;
+
+// Case 1: send() before the handshake returns -1; afterwards it returns the
+// number of bytes written and the message is delivered whole.
+{
+  const received = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    session.onmessage = mustCall((data) => received.resolve(data.length));
+  }), { cert, key, port: 0, host: '127.0.0.1' });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+  });
+
+  assert.strictEqual(client.send('before handshake'), -1);
+
+  await client.opened;
+
+  assert.strictEqual(client.send(Buffer.alloc(MAX_RECORD, 0x61)), MAX_RECORD);
+  assert.strictEqual(await received.promise, MAX_RECORD);
+
+  await client.close();
+  await server.close();
+}
+
+// Case 2: a payload larger than a single record cannot be sent.
+{
+  const server = listen(mustCall((session) => {
+    session.onmessage = mustNotCall();
+  }), { cert, key, port: 0, host: '127.0.0.1' });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+  });
+
+  await client.opened;
+  assert.strictEqual(client.send(Buffer.alloc(MAX_RECORD + 1, 0x61)), -1);
+
+  await client.close();
+  await server.close();
+}
diff --git a/test/parallel/test-dtls-servername-invalid.mjs b/test/parallel/test-dtls-servername-invalid.mjs
new file mode 100644
index 000000000000..a15752345cc7
--- /dev/null
+++ b/test/parallel/test-dtls-servername-invalid.mjs
@@ -0,0 +1,27 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: connect() surfaces a failure to set the SNI servername (for example a
+// name longer than the TLS maximum of 255 bytes) as an error, rather than
+// silently ignoring it.
+
+import { hasCrypto, skip } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { connect } = await import('node:dtls');
+
+// SNI host names are limited to 255 bytes; a longer one must throw.
+assert.throws(
+  () => connect('127.0.0.1', 12345, {
+    servername: 'a'.repeat(256),
+    rejectUnauthorized: false,
+  }),
+  { code: 'ERR_CRYPTO_OPERATION_FAILED' },
+);
diff --git a/test/parallel/test-dtls-session-properties.mjs b/test/parallel/test-dtls-session-properties.mjs
new file mode 100644
index 000000000000..2089dc6de6c0
--- /dev/null
+++ b/test/parallel/test-dtls-session-properties.mjs
@@ -0,0 +1,61 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: DTLSSession properties after handshake.
+
+import { hasCrypto, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const serverCert = fixtures.readKey('agent1-cert.pem');
+const serverKey = fixtures.readKey('agent1-key.pem');
+const ca = fixtures.readKey('ca1-cert.pem');
+
+const endpoint = listen(mustCall((session) => {
+  session.onmessage = mustNotCall();
+}), {
+  cert: serverCert.toString(),
+  key: serverKey.toString(),
+  port: 0,
+  host: '127.0.0.1',
+});
+
+const session = connect('127.0.0.1', endpoint.address.port, {
+  ca: [ca.toString()],
+  rejectUnauthorized: false,
+});
+
+await session.opened;
+
+// Protocol should be DTLSv1.2.
+assert.match(session.protocol, /DTLS/i);
+
+// Cipher should be an object with name, standardName, version.
+const cipher = session.cipher;
+assert.strictEqual(typeof cipher?.name, 'string');
+assert.strictEqual(typeof cipher?.standardName, 'string');
+assert.strictEqual(typeof cipher?.version, 'string');
+
+// Remote address should be defined.
+const addr = session.remoteAddress;
+assert.ok(addr);
+
+// Peer certificate should be available (PEM string).
+const peerCert = session.peerCertificate;
+assert.ok(peerCert);
+assert.ok(peerCert.includes('BEGIN CERTIFICATE'));
+
+// State should reflect open connection.
+assert.ok(session.state);
+
+await session.close();
+await endpoint.close();
diff --git a/test/parallel/test-dtls-session-table-cleanup.mjs b/test/parallel/test-dtls-session-table-cleanup.mjs
new file mode 100644
index 000000000000..e6cfd458099a
--- /dev/null
+++ b/test/parallel/test-dtls-session-table-cleanup.mjs
@@ -0,0 +1,74 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: a session is removed from its endpoint's session table when it closes,
+// whether closed locally or by the peer. Regression test for closed sessions
+// leaking in the table (which also blocks reuse of the peer's address).
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+// ---------------------------------------------------------------------------
+// Case 1: the server closes its own session -> removed from the table.
+{
+  const gotSession = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    gotSession.resolve(session);
+  }), { cert, key, port: 0, host: '127.0.0.1' });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+  });
+
+  await client.opened;
+  const session = await gotSession.promise;
+
+  assert.strictEqual(server.state.sessionCount, 1);
+  await session.close();
+  assert.strictEqual(server.state.sessionCount, 0);
+
+  await client.close();
+  await server.close();
+}
+
+// ---------------------------------------------------------------------------
+// Case 2: the client closes -> the server sees the peer close_notify and
+// removes the session from the table.
+{
+  const gotSession = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    gotSession.resolve(session);
+  }), { cert, key, port: 0, host: '127.0.0.1' });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+  });
+
+  await client.opened;
+  const session = await gotSession.promise;
+
+  assert.strictEqual(server.state.sessionCount, 1);
+  await client.close();   // Sends close_notify to the server
+  await session.closed;   // Server processes it, detaches, and emits its close
+  assert.strictEqual(server.state.sessionCount, 0);
+
+  await server.close();
+}
diff --git a/test/parallel/test-dtls-srtp.mjs b/test/parallel/test-dtls-srtp.mjs
new file mode 100644
index 000000000000..602ad3552ffd
--- /dev/null
+++ b/test/parallel/test-dtls-srtp.mjs
@@ -0,0 +1,75 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: SRTP profile negotiation and keying-material export (DTLS-SRTP). Both
+// peers must negotiate the same SRTP profile and derive identical keying
+// material from exportKeyingMaterial.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+const SRTP_PROFILE = 'SRTP_AEAD_AES_128_GCM';
+
+const gotServerSession = Promise.withResolvers();
+
+const server = listen(mustCall((session) => {
+  gotServerSession.resolve(session);
+}), {
+  cert,
+  key,
+  port: 0,
+  host: '127.0.0.1',
+  srtp: SRTP_PROFILE,
+});
+
+const client = connect('127.0.0.1', server.address.port, {
+  ca: [ca],
+  rejectUnauthorized: false,
+  srtp: SRTP_PROFILE,
+});
+
+await client.opened;
+const serverSession = await gotServerSession.promise;
+await serverSession.opened;
+
+// Both peers negotiate the same SRTP profile.
+assert.strictEqual(client.srtpProfile, SRTP_PROFILE);
+assert.strictEqual(serverSession.srtpProfile, SRTP_PROFILE);
+
+// Both peers derive identical keying material for the same label and length.
+const label = 'EXTRACTOR-dtls_srtp';
+const clientKM = client.exportKeyingMaterial(60, label);
+const serverKM = serverSession.exportKeyingMaterial(60, label);
+assert.strictEqual(clientKM.length, 60);
+assert.deepStrictEqual(clientKM, serverKM);
+
+// The optional context is bound into the derivation: the same context yields
+// the same material on both peers, and a different context yields different
+// material.
+const contextA = Buffer.from('context-a');
+const contextB = Buffer.from('context-b');
+assert.deepStrictEqual(
+  client.exportKeyingMaterial(32, label, contextA),
+  serverSession.exportKeyingMaterial(32, label, contextA),
+);
+assert.notDeepStrictEqual(
+  client.exportKeyingMaterial(32, label, contextA),
+  client.exportKeyingMaterial(32, label, contextB),
+);
+
+await client.close();
+await server.close();
diff --git a/test/parallel/test-dtls-stats.mjs b/test/parallel/test-dtls-stats.mjs
new file mode 100644
index 000000000000..a68c4a1d215e
--- /dev/null
+++ b/test/parallel/test-dtls-stats.mjs
@@ -0,0 +1,151 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: DTLS endpoint and session stats increment with data transfer.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const serverCert = fixtures.readKey('agent1-cert.pem');
+const serverKey = fixtures.readKey('agent1-key.pem');
+const ca = fixtures.readKey('ca1-cert.pem');
+
+const serverReceivedData = Promise.withResolvers();
+const clientReceivedData = Promise.withResolvers();
+
+let serverSession;
+
+// Start server.
+const endpoint = listen(mustCall((session) => {
+  serverSession = session;
+
+  session.onmessage = mustCall((data) => {
+    assert.strictEqual(data.toString(), 'hello from client');
+    session.send('hello from server');
+    serverReceivedData.resolve();
+  });
+
+  session.onhandshake = mustCall();
+}), {
+  cert: serverCert.toString(),
+  key: serverKey.toString(),
+  port: 0,
+  host: '127.0.0.1',
+});
+
+// --- Endpoint stats should be available immediately ---
+
+const epStats = endpoint.stats;
+assert.ok(epStats, 'endpoint.stats should be defined');
+assert.ok(epStats.isConnected, 'stats should be connected');
+assert.ok(epStats.createdAt > 0n, 'createdAt should be set');
+assert.strictEqual(epStats.destroyedAt, 0n);
+assert.strictEqual(epStats.clientSessions, 0n);
+assert.strictEqual(epStats.serverSessions, 0n);
+assert.strictEqual(epStats.serverBusyCount, 0n);
+
+// Connect client.
+const clientSession = connect('127.0.0.1', endpoint.address.port, {
+  ca: [ca.toString()],
+  rejectUnauthorized: false,
+});
+
+clientSession.onmessage = mustCall((data) => {
+  assert.strictEqual(data.toString(), 'hello from server');
+  clientReceivedData.resolve();
+});
+
+clientSession.onhandshake = mustCall();
+
+// Wait for handshake.
+await clientSession.opened;
+
+// --- Client session stats after handshake ---
+
+const csStats = clientSession.stats;
+assert.ok(csStats, 'session.stats should be defined');
+assert.ok(csStats.isConnected, 'session stats should be connected');
+assert.ok(csStats.createdAt > 0n, 'createdAt should be set');
+assert.ok(csStats.handshakeCompletedAt > 0n, 'handshake timestamp should be set');
+assert.ok(csStats.handshakeCompletedAt >= csStats.createdAt,
+          'handshake should complete after creation');
+assert.strictEqual(csStats.closingAt, 0n);
+assert.strictEqual(csStats.destroyedAt, 0n);
+
+// Record bytes before sending application data.
+const csBytesSentBefore = csStats.bytesSent;
+const csMessagesSentBefore = csStats.messagesSent;
+
+// Send data.
+clientSession.send('hello from client');
+
+// Wait for bidirectional exchange.
+await Promise.all([serverReceivedData.promise, clientReceivedData.promise]);
+
+// --- Client session stats after data exchange ---
+
+assert.ok(csStats.bytesSent > csBytesSentBefore,
+          'bytesSent should increase after send');
+assert.ok(csStats.messagesSent > csMessagesSentBefore,
+          'messagesSent should increase after send');
+assert.ok(csStats.bytesReceived > 0n, 'bytesReceived should be non-zero');
+assert.ok(csStats.messagesReceived > 0n, 'messagesReceived should be non-zero');
+
+// --- Server session stats after data exchange ---
+
+assert.ok(serverSession, 'server session should exist');
+const ssStats = serverSession.stats;
+assert.ok(ssStats.bytesReceived > 0n, 'server bytesReceived should be non-zero');
+assert.ok(ssStats.messagesReceived > 0n, 'server messagesReceived should be non-zero');
+assert.ok(ssStats.bytesSent > 0n, 'server bytesSent should be non-zero');
+assert.ok(ssStats.messagesSent > 0n, 'server messagesSent should be non-zero');
+assert.ok(ssStats.handshakeCompletedAt > 0n, 'server handshake timestamp should be set');
+
+// --- Endpoint stats after data exchange ---
+
+assert.ok(epStats.bytesReceived > 0n, 'endpoint bytesReceived should be non-zero');
+assert.ok(epStats.bytesSent > 0n, 'endpoint bytesSent should be non-zero');
+assert.ok(epStats.packetsReceived > 0n, 'endpoint packetsReceived should be non-zero');
+assert.ok(epStats.packetsSent > 0n, 'endpoint packetsSent should be non-zero');
+assert.strictEqual(epStats.serverSessions, 1n);
+
+// The client's own endpoint should track the client session.
+const clientEpStats = clientSession.endpoint.stats;
+assert.strictEqual(clientEpStats.clientSessions, 1n);
+assert.ok(clientEpStats.bytesSent > 0n);
+assert.ok(clientEpStats.bytesReceived > 0n);
+
+// --- toJSON / toString ---
+
+const epJson = epStats.toJSON();
+assert.ok(epJson);
+assert.strictEqual(typeof epJson.bytesReceived, 'string');
+assert.strictEqual(typeof epJson.bytesSent, 'string');
+assert.strictEqual(typeof epJson.connected, 'boolean');
+
+const ssJson = csStats.toJSON();
+assert.ok(ssJson);
+assert.strictEqual(typeof ssJson.handshakeCompletedAt, 'string');
+assert.strictEqual(typeof ssJson.messagesReceived, 'string');
+
+const epStr = epStats.toString();
+assert.ok(typeof epStr === 'string');
+assert.ok(epStr.includes('bytesReceived'));
+
+// Clean up.
+await clientSession.close();
+
+// After close, session closing timestamp should be set.
+assert.notStrictEqual(csStats.closingAt, 0n);
+
+await endpoint.close();
diff --git a/test/parallel/test-dtls-unhandled-rejection.mjs b/test/parallel/test-dtls-unhandled-rejection.mjs
new file mode 100644
index 000000000000..e7cb4e069985
--- /dev/null
+++ b/test/parallel/test-dtls-unhandled-rejection.mjs
@@ -0,0 +1,48 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: using the callback style (onerror) without awaiting opened/closed must
+// not produce an unhandled promise rejection when the session errors.
+
+import { hasCrypto, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+// Any unhandled rejection fails the test.
+process.on('unhandledRejection', mustNotCall());
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+const server = listen(mustCall(), {
+  cert, key, port: 0, host: '127.0.0.1',
+});
+
+const errored = Promise.withResolvers();
+
+// A verification failure makes connect() reject its opened promise. Handle the
+// error only through the callback API and never touch opened/closed.
+const session = connect('127.0.0.1', server.address.port, {
+  ca: [ca],
+  rejectUnauthorized: true,
+  servername: 'wrong.example.com',
+});
+session.onerror = mustCall(() => errored.resolve());
+
+await errored.promise;
+
+// The failed session tears itself down; awaiting its closed promise is a real
+// boundary that also gives any (incorrectly) unhandled opened rejection a turn
+// to surface before the process exits.
+await session.closed;
+
+await server.close();
diff --git a/test/parallel/test-dtls-verify-identity.mjs b/test/parallel/test-dtls-verify-identity.mjs
new file mode 100644
index 000000000000..4940f5693a85
--- /dev/null
+++ b/test/parallel/test-dtls-verify-identity.mjs
@@ -0,0 +1,80 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: the DTLS client verifies the server certificate's identity (hostname
+// or IP address) against the expected name, not merely that the certificate
+// chains to a trusted CA. Also exercises that SNI is actually carried in the
+// ClientHello (it is applied before the handshake begins).
+
+import { hasCrypto, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+// The agent1 certificate has CN=agent1 and no subjectAltName, so OpenSSL
+// matches the identity "agent1" (via the subject CN) and rejects other names.
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+// ---------------------------------------------------------------------------
+// Case 1: a matching servername with rejectUnauthorized succeeds, and the
+// server observes the SNI the client sent (proving it is in the ClientHello).
+{
+  const sawServername = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    session.onhandshake = mustCall(() => {
+      sawServername.resolve(session.servername);
+    });
+  }), { cert, key, port: 0, host: '127.0.0.1' });
+
+  const { port } = server.address;
+
+  const session = connect('127.0.0.1', port, {
+    ca: [ca],
+    rejectUnauthorized: true,
+    servername: 'agent1',
+  });
+
+  const { protocol } = await session.opened;
+  assert.match(protocol, /DTLS/i);
+
+  assert.strictEqual(await sawServername.promise, 'agent1');
+
+  await session.close();
+  await server.close();
+}
+
+// ---------------------------------------------------------------------------
+// Case 2: a servername that does not match the certificate is rejected during
+// the handshake, even though the certificate chain is otherwise valid.
+{
+  const server = listen(mustCall((session) => {
+    // The client aborts after verifying the certificate, so the server-side
+    // handshake never completes.
+    session.onhandshake = mustNotCall();
+  }), { cert, key, port: 0, host: '127.0.0.1' });
+
+  const { port } = server.address;
+
+  const session = connect('127.0.0.1', port, {
+    ca: [ca],
+    rejectUnauthorized: true,
+    servername: 'wrong.example.com',
+  });
+
+  await assert.rejects(session.opened, /certificate verify failed/i);
+
+  // Closing the session tears down the internally-owned client endpoint.
+  await session.close();
+  await server.close();
+}
diff --git a/test/parallel/test-error-value-type-detection.mjs b/test/parallel/test-error-value-type-detection.mjs
index e44b19297a96..cb794514ed39 100644
--- a/test/parallel/test-error-value-type-detection.mjs
+++ b/test/parallel/test-error-value-type-detection.mjs
@@ -209,3 +209,58 @@ assert.strictEqual(
   determineSpecificType(new WeakSet()),
   'an instance of WeakSet',
 );
+
+// Anonymous classes have an empty `name`, so the value is inspected instead.
+// `inspect(..., { depth: -1 })` prints this one as `{}` because it has no own
+// properties; the values below carry a `constructor` property of their own and
+// print as `[Object]`.
+assert.strictEqual(
+  determineSpecificType(new (class {})()),
+  '{}',
+);
+
+// `constructor` is an ordinary, user-controlled property that need not be a
+// function. Describing such a value must not throw.
+assert.strictEqual(
+  determineSpecificType(JSON.parse('{"constructor": 5}')),
+  '[Object]',
+);
+
+assert.strictEqual(
+  determineSpecificType({ constructor: { name: '' } }),
+  '[Object]',
+);
+
+// A `constructor.name` that is not a usable string must not be interpolated
+// into the message.
+assert.strictEqual(
+  determineSpecificType({ constructor: { name: Symbol('x') } }),
+  '[Object]',
+);
+
+assert.strictEqual(
+  determineSpecificType({ constructor: { name: 42 } }),
+  '[Object]',
+);
+
+// `constructor` and its `name` are each read once. Both may be accessors, so
+// repeated reads are observable, and a `name` validated by one read and
+// interpolated from another need not be the same value twice.
+let constructorReads = 0;
+let nameReads = 0;
+const named = {
+  get constructor() {
+    constructorReads++;
+    return { get name() { nameReads++; return 'Foo'; } };
+  },
+};
+assert.strictEqual(determineSpecificType(named), 'an instance of Foo');
+assert.strictEqual(constructorReads, 1);
+assert.strictEqual(nameReads, 1);
+
+// Building the error must not fail when `constructor` is a truthy primitive.
+assert.strictEqual(
+  new errorsModule.codes.ERR_INVALID_ARG_TYPE(
+    'arg', 'string', JSON.parse('{"constructor": 5}')).code,
+  'ERR_INVALID_ARG_TYPE',
+);
diff --git a/test/parallel/test-eslint-no-crypto-class-instanceof.js b/test/parallel/test-eslint-no-crypto-class-instanceof.js
new file mode 100644
index 000000000000..379b133b3818
--- /dev/null
+++ b/test/parallel/test-eslint-no-crypto-class-instanceof.js
@@ -0,0 +1,55 @@
+'use strict';
+
+const common = require('../common');
+common.skipIfEslintMissing();
+
+const RuleTester = require('../../tools/eslint/node_modules/eslint').RuleTester;
+const rule = require('../../tools/eslint-rules/no-crypto-class-instanceof');
+
+new RuleTester().run('no-crypto-class-instanceof', rule, {
+  valid: [
+    'value instanceof Buffer;',
+    'value instanceof KeyObject;',
+    `
+    const { isKeyObject } = require('internal/crypto/keys');
+    isKeyObject(key);
+    `,
+    `
+    function isCryptoKey(value, CryptoKey) {
+      return value instanceof CryptoKey;
+    }
+    `,
+    `
+    function isCryptoKey(value, globalThis) {
+      return value instanceof globalThis.CryptoKey;
+    }
+    `,
+  ],
+  invalid: [
+    {
+      code: `
+      const { KeyObject: KO } = require('internal/crypto/keys');
+      key instanceof KO;
+      `,
+      errors: [{ messageId: 'noKeyObjectInstanceof' }],
+    },
+    {
+      code: `
+      const webcrypto = require('internal/crypto/webcrypto');
+      key instanceof webcrypto.CryptoKey;
+      `,
+      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
+    },
+    {
+      code: 'key instanceof globalThis.CryptoKey;',
+      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
+    },
+    {
+      code: `
+      const { X509Certificate } = require('internal/crypto/x509');
+      cert instanceof X509Certificate;
+      `,
+      errors: [{ messageId: 'noX509CertificateInstanceof' }],
+    },
+  ],
+});
diff --git a/test/parallel/test-eslint-no-keyobject-cryptokey-instanceof.js b/test/parallel/test-eslint-no-keyobject-cryptokey-instanceof.js
deleted file mode 100644
index 29b70c9ec58a..000000000000
--- a/test/parallel/test-eslint-no-keyobject-cryptokey-instanceof.js
+++ /dev/null
@@ -1,78 +0,0 @@
-'use strict';
-
-const common = require('../common');
-common.skipIfEslintMissing();
-
-const RuleTester = require('../../tools/eslint/node_modules/eslint').RuleTester;
-const rule = require('../../tools/eslint-rules/no-keyobject-cryptokey-instanceof');
-
-new RuleTester().run('no-keyobject-cryptokey-instanceof', rule, {
-  valid: [
-    'key instanceof Buffer;',
-    'key instanceof KeyObject;',
-    `
-    const { isKeyObject } = require('internal/crypto/keys');
-    isKeyObject(key);
-    `,
-    `
-    const { isCryptoKey } = require('internal/crypto/keys');
-    isCryptoKey(key);
-    `,
-  ],
-  invalid: [
-    {
-      code: `
-      const { KeyObject } = require('internal/crypto/keys');
-      key instanceof KeyObject;
-      `,
-      errors: [{ messageId: 'noKeyObjectInstanceof' }],
-    },
-    {
-      code: `
-      const { KeyObject: KO } = require('internal/crypto/keys');
-      key instanceof KO;
-      `,
-      errors: [{ messageId: 'noKeyObjectInstanceof' }],
-    },
-    {
-      code: `
-      const keys = require('internal/crypto/keys');
-      key instanceof keys.KeyObject;
-      `,
-      errors: [{ messageId: 'noKeyObjectInstanceof' }],
-    },
-    {
-      code: `
-      key instanceof CryptoKey;
-      `,
-      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
-    },
-    {
-      code: `
-      const { CryptoKey } = require('internal/crypto/keys');
-      key instanceof CryptoKey;
-      `,
-      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
-    },
-    {
-      code: `
-      const { CryptoKey: CK } = require('internal/crypto/webcrypto');
-      key instanceof CK;
-      `,
-      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
-    },
-    {
-      code: `
-      const webcrypto = require('internal/crypto/webcrypto');
-      key instanceof webcrypto.CryptoKey;
-      `,
-      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
-    },
-    {
-      code: `
-      key instanceof globalThis.CryptoKey;
-      `,
-      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
-    },
-  ],
-});
diff --git a/test/parallel/test-eventtarget.js b/test/parallel/test-eventtarget.js
index d0b3ad03a1df..ed6590176d31 100644
--- a/test/parallel/test-eventtarget.js
+++ b/test/parallel/test-eventtarget.js
@@ -419,6 +419,20 @@ let asyncTest = Promise.resolve();
   target.removeEventListener('foo', a, { capture: false });
   target.dispatchEvent(new Event('foo'));
 }
+
+{
+  const target = new EventTarget();
+  const a = common.mustCall(3);
+
+  target.addEventListener('foo', a, true);
+  target.addEventListener('foo', a, false);
+
+  target.dispatchEvent(new Event('foo'));
+  target.removeEventListener('foo', a, true);
+  target.dispatchEvent(new Event('foo'));
+  target.removeEventListener('foo', a, false);
+  target.dispatchEvent(new Event('foo'));
+}
 {
   const target = new EventTarget();
   assert.strictEqual(target.toString(), '[object EventTarget]');
@@ -685,7 +699,21 @@ let asyncTest = Promise.resolve();
     et.dispatchEvent(new Event('foo'));
   });
 }
-
+{
+  // Two listeners sharing the same retainer key must NOT evict each
+  // other from the weak retention map — both must survive a GC cycle
+  // and both must be removable independently.
+  // Regression test for https://github.com/nodejs/node/issues/63954
+  const et = new EventTarget();
+  const aCalled = common.mustNotCall();
+  const bCalled = common.mustCall();
+  et.addEventListener('a', aCalled, { [kWeakHandler]: et });
+  et.addEventListener('b', bCalled, { [kWeakHandler]: et });
+  globalThis.gc();
+  et.removeEventListener('a', aCalled);
+  et.dispatchEvent(new Event('a'));
+  et.dispatchEvent(new Event('b'));
+}
 {
   const et = new EventTarget();
 
diff --git a/test/parallel/test-external-memory-reasonable-size.js b/test/parallel/test-external-memory-reasonable-size.js
new file mode 100644
index 000000000000..f9ff1af8e5a1
--- /dev/null
+++ b/test/parallel/test-external-memory-reasonable-size.js
@@ -0,0 +1,34 @@
+'use strict';
+
+// V8 aborts the process when external memory grows by more than
+// --external-memory-max-reasonable-size gigabytes in a single step. Node
+// disables that check by default, but an explicit value on the command line
+// must still be honored.
+// Refs: https://github.com/nodejs/node/issues/65534
+
+const common = require('../common');
+const assert = require('assert');
+const { execSync } = require('child_process');
+const { totalmem } = require('os');
+
+// The smallest limit V8 accepts is 1 GB, so the child has to allocate more
+// than that before the check can fire.
+if (totalmem() < 4 * 1024 ** 3)
+  common.skip('not enough memory to exceed a 1 GB external memory limit');
+
+for (const flag of [
+  '--external-memory-max-reasonable-size=1',
+  '--external_memory_max_reasonable_size=1',
+]) {
+  // The child aborts with over a gigabyte resident, so keep it from writing a
+  // core file; on some hosts that dump alone outlasts the test timeout.
+  const [cmd, opts] = common.escapePOSIXShell`"${process.execPath}" ${flag} -e "new Float64Array(150_000_000)"`;
+  assert.throws(
+    () => execSync(common.isWindows ? cmd : `ulimit -c 0; ${cmd}`, { ...opts, stdio: 'pipe' }),
+    (err) => {
+      assert.notStrictEqual(err.status, 0, `${flag} was not honored, the child exited cleanly`);
+      assert.match(err.stderr.toString(), /kMaxReasonableBytes/);
+      return true;
+    },
+  );
+}
diff --git a/test/parallel/test-fastutf8stream-destroy.js b/test/parallel/test-fastutf8stream-destroy.js
index bdf401f330ef..04f7cad8088f 100644
--- a/test/parallel/test-fastutf8stream-destroy.js
+++ b/test/parallel/test-fastutf8stream-destroy.js
@@ -34,8 +34,11 @@ function getTempFile() {
 
   assert.throws(() => stream.write('hello world\n'), Error);
 
-  readFile(dest, 'utf8', common.mustSucceed((data) => {
-    assert.strictEqual(data, 'hello world\n');
+  // Reading now would race the fs.write() still in flight.
+  stream.once('write', common.mustCall(() => {
+    readFile(dest, 'utf8', common.mustSucceed((data) => {
+      assert.strictEqual(data, 'hello world\n');
+    }));
   }));
 
   stream.on('finish', common.mustNotCall());
diff --git a/test/parallel/test-fastutf8stream-reopen.js b/test/parallel/test-fastutf8stream-reopen.js
index d706a737c2cd..99c62ca267ac 100644
--- a/test/parallel/test-fastutf8stream-reopen.js
+++ b/test/parallel/test-fastutf8stream-reopen.js
@@ -8,6 +8,7 @@ const {
   openSync,
   readFile,
   renameSync,
+  write,
 } = require('node:fs');
 const { Utf8Stream } = require('node:fs');
 const { join } = require('node:path');
@@ -27,6 +28,47 @@ function getTempFile() {
 runTests(false);
 runTests(true);
 
+// A write started by a 'ready' listener after reopen() must complete before
+// 'drain' is emitted. Deferring the reopened file's write by one setImmediate
+// makes the write land after the nextTick on which reopen() used to emit a
+// premature 'drain'. Async mode only: sync mode writes before 'ready'.
+{
+  const dest = getTempFile();
+  const after = dest + '-new';
+  const stream = new Utf8Stream({
+    dest,
+    minLength: 0,
+    sync: false,
+    fs: {
+      write(fd, buf, enc, cb) {
+        if (stream.file === after) {
+          setImmediate(() => write(fd, buf, enc, cb));
+          return;
+        }
+        return write(fd, buf, enc, cb);
+      },
+    },
+  });
+
+  assert.ok(stream.write('hello world\n'));
+
+  stream.once('drain', common.mustCall(() => {
+    stream.reopen(after);
+
+    stream.once('ready', common.mustCall(() => {
+      assert.ok(stream.write('after reopen\n'));
+
+      stream.once('drain', common.mustCall(() => {
+        assert.strictEqual(stream.writing, false);
+        readFile(after, 'utf8', common.mustSucceed((data) => {
+          assert.strictEqual(data, 'after reopen\n');
+          stream.end();
+        }));
+      }));
+    }));
+  }));
+}
+
 function runTests(sync) {
 
   {
@@ -43,9 +85,9 @@ function runTests(sync) {
       stream.reopen();
 
       stream.once('ready', common.mustCall(() => {
-        assert.ok(stream.write('after reopen\n'));
-
-        stream.once('drain', common.mustCall(() => {
+        // 'drain' can come from reopen() before this write completes. 'write'
+        // is emitted synchronously in sync mode, so attach before writing.
+        stream.once('write', common.mustCall(() => {
           readFile(after, 'utf8', common.mustSucceed((data) => {
             assert.strictEqual(data, 'hello world\nsomething else\n');
             readFile(dest, 'utf8', common.mustSucceed((data) => {
@@ -54,6 +96,8 @@ function runTests(sync) {
             }));
           }));
         }));
+
+        assert.ok(stream.write('after reopen\n'));
       }));
     }));
   }
@@ -85,9 +129,8 @@ function runTests(sync) {
       assert.strictEqual(stream.file, after);
 
       stream.once('ready', common.mustCall(() => {
-        assert.ok(stream.write('after reopen\n'));
-
-        stream.once('drain', common.mustCall(() => {
+        // As above: 'drain' can come from reopen() before the write completes.
+        stream.once('write', common.mustCall(() => {
           readFile(dest, 'utf8', common.mustSucceed((data) => {
             assert.strictEqual(data, 'hello world\nsomething else\n');
             readFile(after, 'utf8', common.mustSucceed((data) => {
@@ -96,6 +139,8 @@ function runTests(sync) {
             }));
           }));
         }));
+
+        assert.ok(stream.write('after reopen\n'));
       }));
     }));
   }
diff --git a/test/parallel/test-fs-cp-async-destination-appears-late.mjs b/test/parallel/test-fs-cp-async-destination-appears-late.mjs
new file mode 100644
index 000000000000..40ec15e1ef39
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-destination-appears-late.mjs
@@ -0,0 +1,35 @@
+// This tests that cp() into a destination that did not exist when it was
+// checked, but does by the time the copy starts, fails with EEXIST instead
+// of copying through whatever appeared there.
+import '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { createHook } from 'node:async_hooks';
+import { existsSync, lstatSync, mkdirSync, symlinkSync, writeFileSync, promises } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+tmpdir.refresh();
+const src = nextdir();
+const dest = nextdir();
+const target = nextdir();
+mkdirSync(src);
+mkdirSync(target);
+writeFileSync(join(src, 'file'), 'x');
+
+let injected = false;
+const hook = createHook({
+  init(id, type) {
+    if (!injected && type === 'FSREQCALLBACK' && !existsSync(dest)) {
+      injected = true;
+      symlinkSync(target, dest, 'dir');
+    }
+  },
+}).enable();
+const outcome = await promises.cp(src, dest, { recursive: true }).then(() => null, (err) => err);
+hook.disable();
+assert.ok(injected, 'the hook found no request to inject the symbolic link at');
+assert.strictEqual(outcome?.code, 'EEXIST');
+assert.strictEqual(outcome?.syscall, 'mkdir');
+assert.ok(lstatSync(dest).isSymbolicLink());
+assert.ok(!existsSync(join(target, 'file')));
diff --git a/test/parallel/test-fs-cp-async-file-modes.mjs b/test/parallel/test-fs-cp-async-file-modes.mjs
new file mode 100644
index 000000000000..358f6c339b7b
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-file-modes.mjs
@@ -0,0 +1,35 @@
+// This tests that cp() gives copied files the mode of their source, including
+// the setuid, setgid and sticky bits, as cpSync() does.
+import { isWindows, skip } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { chmodSync, cpSync, mkdirSync, statSync, writeFileSync, promises } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+if (isWindows)
+  skip('file modes are not meaningful on Windows');
+
+tmpdir.refresh();
+const modes = { suid: 0o4755, sgid: 0o2755, sticky: 0o1755, private: 0o600 };
+const src = nextdir();
+mkdirSync(src);
+for (const [name, mode] of Object.entries(modes)) {
+  writeFileSync(join(src, name), 'x');
+  chmodSync(join(src, name), mode);
+}
+const modesIn = (dir) => Object.fromEntries(
+  Object.keys(modes).map((name) => [name, statSync(join(dir, name)).mode & 0o7777]));
+const expected = modesIn(src);
+
+const viaCp = nextdir();
+await promises.cp(src, viaCp, { recursive: true });
+assert.deepStrictEqual(modesIn(viaCp), expected);
+
+const viaCpTimestamps = nextdir();
+await promises.cp(src, viaCpTimestamps, { recursive: true, preserveTimestamps: true });
+assert.deepStrictEqual(modesIn(viaCpTimestamps), expected);
+
+const viaCpSync = nextdir();
+cpSync(src, viaCpSync, { recursive: true });
+assert.deepStrictEqual(modesIn(viaCpSync), expected);
diff --git a/test/parallel/test-fs-cp-async-preserve-timestamps-dir.mjs b/test/parallel/test-fs-cp-async-preserve-timestamps-dir.mjs
new file mode 100644
index 000000000000..ae93a7427e8a
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-preserve-timestamps-dir.mjs
@@ -0,0 +1,43 @@
+// This tests that cp() preserves directory timestamps
+// when preserveTimestamps is true.
+import { mustCall } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { cp, mkdirSync, writeFileSync, utimesSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+tmpdir.refresh();
+
+// Build a source tree with a known past timestamp on directories.
+const src = nextdir();
+mkdirSync(join(src, 'subdir'), { recursive: true });
+writeFileSync(join(src, 'subdir', 'file.txt'), 'hello');
+
+const pastDate = new Date('2020-01-01T00:00:00Z');
+utimesSync(join(src, 'subdir', 'file.txt'), pastDate, pastDate);
+utimesSync(join(src, 'subdir'), pastDate, pastDate);
+utimesSync(src, pastDate, pastDate);
+
+// Copy with preserveTimestamps.
+const dest = nextdir();
+cp(src, dest, {
+  recursive: true,
+  preserveTimestamps: true,
+}, mustCall((err) => {
+  assert.strictEqual(err, null);
+
+  // Verify file timestamps are preserved (existing behaviour).
+  const srcFileStat = statSync(join(src, 'subdir', 'file.txt'));
+  const destFileStat = statSync(join(dest, 'subdir', 'file.txt'));
+  assert.strictEqual(srcFileStat.mtime.getTime(), destFileStat.mtime.getTime());
+
+  // Verify directory timestamps are preserved (the bug fix).
+  const srcDirStat = statSync(join(src, 'subdir'));
+  const destDirStat = statSync(join(dest, 'subdir'));
+  assert.strictEqual(srcDirStat.mtime.getTime(), destDirStat.mtime.getTime());
+
+  const srcRootStat = statSync(src);
+  const destRootStat = statSync(dest);
+  assert.strictEqual(srcRootStat.mtime.getTime(), destRootStat.mtime.getTime());
+}));
diff --git a/test/parallel/test-fs-cp-async-special-files-in-tree.mjs b/test/parallel/test-fs-cp-async-special-files-in-tree.mjs
new file mode 100644
index 000000000000..9a028f297caa
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-special-files-in-tree.mjs
@@ -0,0 +1,53 @@
+// This tests that cp() rejects a socket or a FIFO found inside the copied
+// tree with the same errors as for a top-level one, while cpSync() skips them.
+
+import * as common from '../common/index.mjs';
+import assert from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import { cpSync, existsSync, mkdirSync, writeFileSync, promises } from 'node:fs';
+import { createServer } from 'node:net';
+import { join } from 'node:path';
+import { nextdir } from '../common/fs.js';
+import tmpdir from '../common/tmpdir.js';
+
+if (common.isWindows)
+  common.skip('No socket/FIFO support on Windows');
+if (common.isInsideDirWithUnusualChars)
+  common.skip('Test is broken in directories with unusual characters');
+
+tmpdir.refresh();
+
+{
+  const src = nextdir();
+  mkdirSync(join(src, 'd'), { recursive: true });
+  writeFileSync(join(src, 'd', 'file'), 'x');
+  const server = createServer();
+  // The socket path can exceed the platform limit in a deep tmpdir; skip then.
+  const listening = await new Promise((resolve) => {
+    server.on('error', () => resolve(false));
+    server.listen(join(src, 'd', 's.sock'), () => resolve(true));
+  });
+  if (!listening) {
+    common.printSkipMessage('socket path too long');
+  } else {
+    await assert.rejects(promises.cp(src, nextdir(), { recursive: true }), { code: 'ERR_FS_CP_SOCKET' });
+    const dest = nextdir();
+    cpSync(src, dest, { recursive: true });
+    assert.ok(existsSync(join(dest, 'd', 'file')));
+    server.close();
+  }
+}
+
+{
+  const src = nextdir();
+  mkdirSync(join(src, 'dir'), { recursive: true });
+  writeFileSync(join(src, 'dir', 'file'), 'x');
+  if (spawnSync('mkfifo', [join(src, 'dir', 'fifo')]).status !== 0) {
+    common.printSkipMessage('mkfifo not available');
+  } else {
+    await assert.rejects(promises.cp(src, nextdir(), { recursive: true }), { code: 'ERR_FS_CP_FIFO_PIPE' });
+    const dest = nextdir();
+    cpSync(src, dest, { recursive: true });
+    assert.ok(existsSync(join(dest, 'dir', 'file')));
+  }
+}
diff --git a/test/parallel/test-fs-cp-async-symlink-targets.mjs b/test/parallel/test-fs-cp-async-symlink-targets.mjs
new file mode 100644
index 000000000000..81e861c90859
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-symlink-targets.mjs
@@ -0,0 +1,29 @@
+// This tests that cp() into a new destination writes the same link targets
+// as path.resolve() of the original ones: relative targets made absolute
+// lexically (intermediate links kept), absolute targets left as they are.
+import { isWindows, skip } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { mkdirSync, readlinkSync, symlinkSync, writeFileSync, promises } from 'node:fs';
+import { join, resolve } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+if (isWindows)
+  skip('symbolic links need elevated privileges on Windows');
+
+tmpdir.refresh();
+const src = nextdir();
+mkdirSync(join(src, 'real'), { recursive: true });
+writeFileSync(join(src, 'real', 'file'), 'data');
+symlinkSync('real', join(src, 'alias'));
+symlinkSync('alias/file', join(src, 'link'));
+const absoluteTarget = join(tmpdir.path, 'x', '..', 'elsewhere');
+symlinkSync(absoluteTarget, join(src, 'abs'));
+
+for (const filter of [undefined, () => true]) {
+  const dest = nextdir();
+  await promises.cp(src, dest, { recursive: true, filter });
+  assert.strictEqual(readlinkSync(join(dest, 'link')), resolve(src, 'alias/file'));
+  assert.strictEqual(readlinkSync(join(dest, 'alias')), resolve(src, 'real'));
+  assert.strictEqual(readlinkSync(join(dest, 'abs')), absoluteTarget);
+}
diff --git a/test/parallel/test-fs-cp-async-with-mode-flags.mjs b/test/parallel/test-fs-cp-async-with-mode-flags.mjs
index 99f6b5fe09d9..6e10d5859ef1 100644
--- a/test/parallel/test-fs-cp-async-with-mode-flags.mjs
+++ b/test/parallel/test-fs-cp-async-with-mode-flags.mjs
@@ -29,3 +29,14 @@ cp(src, dest, mustNotMutateObjectDeep({
   assert(err.code === 'ENOTSUP' || err.code === 'ENOTTY' ||
     err.code === 'ENOSYS' || err.code === 'EXDEV');
 }));
+
+// The mode flags reach copyFile() whether or not a filter is given.
+{
+  const { promises } = await import('node:fs');
+  const outcome = (filter) => promises.cp(src, nextdir(), {
+    recursive: true,
+    mode: constants.COPYFILE_FICLONE_FORCE,
+    filter,
+  }).then(() => 'copied', (err) => `${err.code} ${err.syscall}`);
+  assert.strictEqual(await outcome(undefined), await outcome(() => true));
+}
diff --git a/test/parallel/test-fs-cp-sync-directory-mode.mjs b/test/parallel/test-fs-cp-sync-directory-mode.mjs
new file mode 100644
index 000000000000..f022af268f1e
--- /dev/null
+++ b/test/parallel/test-fs-cp-sync-directory-mode.mjs
@@ -0,0 +1,64 @@
+// This tests that cpSync gives the directories it creates the mode of the
+// corresponding source directory, as cp does.
+import { mustNotMutateObjectDeep, isWindows, skip } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { chmodSync, cpSync, mkdirSync, statSync, writeFileSync, promises } from 'node:fs';
+import { join } from 'node:path';
+import { isMainThread } from 'node:worker_threads';
+import tmpdir from '../common/tmpdir.js';
+
+if (isWindows)
+  skip('directory modes are not meaningful on Windows');
+if (!isMainThread)
+  skip('process.umask() is not available in workers');
+
+tmpdir.refresh();
+const mask = process.umask(0o022);
+
+const src = nextdir();
+mkdirSync(join(src, 'private', 'inner'), { recursive: true, mode: 0o700 });
+mkdirSync(join(src, 'shared'), { mode: 0o775 });
+writeFileSync(join(src, 'private', 'inner', 'file'), 'x', { mode: 0o600 });
+
+function modes(root) {
+  return ['.', 'private', 'private/inner', 'shared', 'private/inner/file']
+    .map((p) => (statSync(join(root, p)).mode & 0o777).toString(8));
+}
+
+const destSync = nextdir();
+cpSync(src, destSync, mustNotMutateObjectDeep({ recursive: true }));
+assert.deepStrictEqual(modes(destSync), modes(src));
+
+const destAsync = nextdir();
+await promises.cp(src, destAsync, { recursive: true });
+assert.deepStrictEqual(modes(destAsync), modes(src));
+
+// A read-only source directory can still be copied; its copy ends up read-only too.
+{
+  const roSrc = nextdir();
+  mkdirSync(join(roSrc, 'sub'), { recursive: true });
+  writeFileSync(join(roSrc, 'sub', 'file'), 'x');
+  chmodSync(join(roSrc, 'sub'), 0o555);
+  chmodSync(roSrc, 0o555);
+  const readOnly = [roSrc, join(roSrc, 'sub')];
+  for (const copy of [(dest) => cpSync(roSrc, dest, { recursive: true }),
+                      (dest) => promises.cp(roSrc, dest, { recursive: true })]) {
+    const dest = nextdir();
+    await copy(dest);
+    assert.strictEqual(statSync(join(dest, 'sub', 'file')).size, 1);
+    assert.deepStrictEqual(
+      [dest, join(dest, 'sub')].map((p) => (statSync(p).mode & 0o777).toString(8)), ['555', '555']);
+    readOnly.push(dest, join(dest, 'sub'));
+  }
+  // Let tmpdir clean up.
+  for (const dir of readOnly) chmodSync(dir, 0o755);
+}
+
+// An existing destination directory keeps its own mode.
+const existing = nextdir();
+mkdirSync(existing, { mode: 0o711 });
+cpSync(src, existing, mustNotMutateObjectDeep({ recursive: true }));
+assert.strictEqual((statSync(existing).mode & 0o777).toString(8), '711');
+assert.deepStrictEqual(modes(existing).slice(1), modes(src).slice(1));
+process.umask(mask);
diff --git a/test/parallel/test-fs-cp-sync-preserve-timestamps-dir.mjs b/test/parallel/test-fs-cp-sync-preserve-timestamps-dir.mjs
new file mode 100644
index 000000000000..20d889075988
--- /dev/null
+++ b/test/parallel/test-fs-cp-sync-preserve-timestamps-dir.mjs
@@ -0,0 +1,42 @@
+// This tests that cpSync with a filter preserves directory timestamps
+// when preserveTimestamps is true.
+import '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { cpSync, mkdirSync, writeFileSync, utimesSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+tmpdir.refresh();
+
+// Build a source tree with a known past timestamp on directories.
+const src = nextdir();
+mkdirSync(join(src, 'subdir'), { recursive: true });
+writeFileSync(join(src, 'subdir', 'file.txt'), 'hello');
+
+const pastDate = new Date('2020-01-01T00:00:00Z');
+utimesSync(join(src, 'subdir', 'file.txt'), pastDate, pastDate);
+utimesSync(join(src, 'subdir'), pastDate, pastDate);
+utimesSync(src, pastDate, pastDate);
+
+// Copy with preserveTimestamps and a filter (to exercise the JS fallback path).
+const dest = nextdir();
+cpSync(src, dest, {
+  recursive: true,
+  preserveTimestamps: true,
+  filter: () => true,
+});
+
+// Verify file timestamps are preserved (existing behaviour).
+const srcFileStat = statSync(join(src, 'subdir', 'file.txt'));
+const destFileStat = statSync(join(dest, 'subdir', 'file.txt'));
+assert.strictEqual(srcFileStat.mtime.getTime(), destFileStat.mtime.getTime());
+
+// Verify directory timestamps are preserved (the bug fix).
+const srcDirStat = statSync(join(src, 'subdir'));
+const destDirStat = statSync(join(dest, 'subdir'));
+assert.strictEqual(srcDirStat.mtime.getTime(), destDirStat.mtime.getTime());
+
+const srcRootStat = statSync(src);
+const destRootStat = statSync(dest);
+assert.strictEqual(srcRootStat.mtime.getTime(), destRootStat.mtime.getTime());
diff --git a/test/parallel/test-fs-cp-unreadable-directory.mjs b/test/parallel/test-fs-cp-unreadable-directory.mjs
new file mode 100644
index 000000000000..c6343e6b277e
--- /dev/null
+++ b/test/parallel/test-fs-cp-unreadable-directory.mjs
@@ -0,0 +1,33 @@
+// This tests that cp() and cpSync() report an unreadable directory inside the
+// source tree as an error instead of terminating the process.
+import { isWindows, skip } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { chmodSync, cpSync, mkdirSync, readdirSync, writeFileSync, promises } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+if (isWindows)
+  skip('no way to make a directory unreadable');
+if (process.getuid() === 0)
+  skip('root can read the directory anyway');
+
+tmpdir.refresh();
+const src = nextdir();
+mkdirSync(join(src, 'locked'), { recursive: true });
+writeFileSync(join(src, 'file'), 'x');
+chmodSync(join(src, 'locked'), 0o000);
+try {
+  readdirSync(join(src, 'locked'));
+  chmodSync(join(src, 'locked'), 0o700);
+  skip('the directory is still readable');
+} catch {
+  // Expected: it is unreadable.
+}
+
+try {
+  assert.throws(() => cpSync(src, nextdir(), { recursive: true }), { code: 'EACCES' });
+  await assert.rejects(promises.cp(src, nextdir(), { recursive: true }), { code: 'EACCES' });
+} finally {
+  chmodSync(join(src, 'locked'), 0o700);
+}
diff --git a/test/parallel/test-fs-glob-no-follow-symlink-globstar.mjs b/test/parallel/test-fs-glob-no-follow-symlink-globstar.mjs
new file mode 100644
index 000000000000..b1b3cda8d016
--- /dev/null
+++ b/test/parallel/test-fs-glob-no-follow-symlink-globstar.mjs
@@ -0,0 +1,81 @@
+import * as common from '../common/index.mjs';
+import tmpdir from '../common/tmpdir.js';
+import assert from 'node:assert';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { glob as globPromise, mkdir, symlink, writeFile } from 'node:fs/promises';
+import { globSync, glob as asyncGlob } from 'node:fs';
+
+if (common.isWindows) {
+  // Directory symlinks require elevated privileges on Windows.
+  common.skip('symlinks are unreliable on Windows');
+}
+
+tmpdir.refresh();
+
+// Layout:
+//   root/visible.txt
+//   root/link  ->  outside   (outside/ holds files that must NOT be listed)
+const base = tmpdir.resolve('globstar-symlink');
+const root = path.resolve(base, 'workspace');
+const outside = path.resolve(base, 'outside');
+const outsideNested = path.resolve(outside, 'nested');
+
+await mkdir(root, { recursive: true });
+await mkdir(outsideNested, { recursive: true });
+await writeFile(path.resolve(root, 'visible.txt'), 'visible');
+await writeFile(path.resolve(outside, 'secret-one.txt'), 'secret one');
+await writeFile(path.resolve(outsideNested, 'secret-two.txt'), 'secret two');
+await symlink(outside, path.resolve(root, 'link'), 'dir');
+
+const expected = ['link', 'visible.txt'].map((e) => e.replaceAll('/', path.sep)).sort();
+
+// `**/*` must not descend into the symlinked directory, neither by default nor
+// with followSymlinks explicitly disabled.
+assert.deepStrictEqual(globSync('**/*', { cwd: root }).sort(), expected);
+assert.deepStrictEqual(
+  globSync('**/*', { cwd: root, followSymlinks: false }).sort(),
+  expected,
+);
+
+const promiseMatches = [];
+for await (const entry of globPromise('**/*', { cwd: root, followSymlinks: false })) {
+  promiseMatches.push(entry);
+}
+assert.deepStrictEqual(promiseMatches.sort(), expected);
+
+const callbackMatches = await new Promise((resolve, reject) => {
+  asyncGlob('**/*', { cwd: root, followSymlinks: false }, (err, matches) => {
+    if (err) reject(err);
+    else resolve(matches);
+  });
+});
+assert.deepStrictEqual(callbackMatches.sort(), expected);
+
+// Under the permission model, `**/*` must not expose entries from a symlink
+// target that is outside the granted read set.
+if (common.hasCrypto) {
+  const child = `
+    const assert = require('node:assert');
+    const fs = require('node:fs');
+    const path = require('node:path');
+    const root = ${JSON.stringify(root)};
+    const outside = ${JSON.stringify(outside)};
+    const expected = ['link', 'visible.txt'].map((e) => e.replaceAll('/', path.sep)).sort();
+    assert.strictEqual(process.permission.has('fs.read', root), true);
+    assert.strictEqual(process.permission.has('fs.read', outside), false);
+    assert.throws(() => fs.readdirSync(outside), { code: 'ERR_ACCESS_DENIED' });
+    assert.deepStrictEqual(fs.globSync('**/*', { cwd: root }).sort(), expected);
+    assert.deepStrictEqual(
+      fs.globSync('**/*', { cwd: root, followSymlinks: false }).sort(),
+      expected,
+    );
+  `;
+  const { status, stdout, stderr } = spawnSync(process.execPath, [
+    '--permission',
+    `--allow-fs-read=${root}`,
+    '-e',
+    child,
+  ], { encoding: 'utf8' });
+  assert.strictEqual(status, 0, stderr || stdout);
+}
diff --git a/test/parallel/test-fs-glob.mjs b/test/parallel/test-fs-glob.mjs
index 9226e491358d..ed7317508087 100644
--- a/test/parallel/test-fs-glob.mjs
+++ b/test/parallel/test-fs-glob.mjs
@@ -1,9 +1,19 @@
 import * as common from '../common/index.mjs';
 import tmpdir from '../common/tmpdir.js';
-import { spawnSync } from 'node:child_process';
+import { spawnSyncAndExitWithoutError } from '../common/child_process.js';
 import { resolve, dirname, sep, relative, join, isAbsolute } from 'node:path';
 import { mkdir, writeFile, symlink, glob as asyncGlob } from 'node:fs/promises';
-import { glob, globSync, Dirent, chmodSync, writeFileSync, rmSync } from 'node:fs';
+import {
+  glob,
+  globSync,
+  Dirent,
+  chmodSync,
+  writeFileSync,
+  rmSync,
+  realpathSync,
+  mkdirSync,
+  existsSync,
+} from 'node:fs';
 import { test, describe } from 'node:test';
 import { pathToFileURL } from 'node:url';
 import { promisify } from 'node:util';
@@ -16,10 +26,12 @@ function assertDirents(dirents) {
 tmpdir.refresh();
 
 const fixtureDir = tmpdir.resolve('fixtures');
+const caseVariantFixtureDir = tmpdir.resolve('FIXTURES');
 const absDir = tmpdir.resolve('abs');
 
 async function setup() {
   await mkdir(fixtureDir, { recursive: true });
+  await mkdir(caseVariantFixtureDir, { recursive: true });
   await mkdir(absDir, { recursive: true });
   const files = [
     'a/.abcdef/x/y/z/a',
@@ -68,6 +80,21 @@ async function setup() {
 
 await setup();
 
+const isCaseSensitiveFileSystem =
+  realpathSync.native(fixtureDir) !== realpathSync.native(caseVariantFixtureDir);
+
+let differentWindowsVolume;
+if (common.isWindows) {
+  const currentRoot = resolve(fixtureDir).slice(0, 3).toLowerCase();
+  for (let code = 65; code <= 90; code++) {
+    const root = `${String.fromCharCode(code)}:\\`;
+    if (root.toLowerCase() !== currentRoot && existsSync(root)) {
+      differentWindowsVolume = root;
+      break;
+    }
+  }
+}
+
 const patterns = {
   'a/c/d/*/b': ['a/c/d/c/b'],
   'a//c//d//*//b': ['a/c/d/c/b'],
@@ -119,7 +146,7 @@ const patterns = {
     'a/x',
     'a/z',
   ],
-  './**/a': common.isWindows ? ['a'] : ['a', 'a/symlink/a', 'a/symlink/a/b/c/a'],
+  './**/a': common.isWindows ? ['a'] : ['a', 'a/symlink/a'],
   './**/a/**/': [
     'a',
     'a/abcdef',
@@ -139,10 +166,6 @@ const patterns = {
       'a/symlink',
       'a/symlink/a',
       'a/symlink/a/b',
-      'a/symlink/a/b/c',
-      'a/symlink/a/b/c/a',
-      'a/symlink/a/b/c/a/b',
-      'a/symlink/a/b/c/a/b/c',
     ]),
     'a/x',
     'a/z',
@@ -173,9 +196,6 @@ const patterns = {
       'a/symlink/a',
       'a/symlink/a/b',
       'a/symlink/a/b/c',
-      'a/symlink/a/b/c/a',
-      'a/symlink/a/b/c/a/b',
-      'a/symlink/a/b/c/a/b/c',
     ]),
     'a/x',
     'a/z',
@@ -183,13 +203,6 @@ const patterns = {
   './**/a/**/a/**/': common.isWindows ? [] : [
     'a/symlink/a',
     'a/symlink/a/b',
-    'a/symlink/a/b/c',
-    'a/symlink/a/b/c/a',
-    'a/symlink/a/b/c/a/b',
-    'a/symlink/a/b/c/a/b/c',
-    'a/symlink/a/b/c/a/b/c/a',
-    'a/symlink/a/b/c/a/b/c/a/b',
-    'a/symlink/a/b/c/a/b/c/a/b/c',
   ],
   '+(a|b|c)/a{/,bc*}/**': [
     'a/abcdef',
@@ -268,7 +281,6 @@ const patterns = {
   'a/symlink/a/**/*': common.isWindows ? [] : [
     'a/symlink/a/b',
     'a/symlink/a/b/c',
-    'a/symlink/a/b/c/a',
   ],
   'a/!(symlink)/**/..': [
     'a',
@@ -539,6 +551,233 @@ describe('fsPromises glob - exclude', function() {
   }
 });
 
+const maxDepthExpected = [
+  '.',
+  'a',
+  'a/abcdef',
+  'a/abcfed',
+  'a/b',
+  'a/bc',
+  'a/c',
+  'a/cb',
+  ...(common.isWindows ? [] : ['a/symlink']),
+  'a/x',
+  'a/z',
+  'follow',
+  'follow/cycle',
+  'follow/link',
+  'follow/target',
+].map((item) => item.replaceAll('/', sep)).sort();
+
+async function collectAsyncGlob(pattern, options) {
+  const results = [];
+  for await (const item of asyncGlob(pattern, options)) {
+    results.push(item);
+  }
+  return results;
+}
+
+const maxDepthApis = [
+  ['globSync', globSync],
+  ['fsPromises glob', collectAsyncGlob],
+];
+
+for (const [name, runGlob] of maxDepthApis) {
+  describe(`${name} - maxDepth`, function() {
+    test('limits traversal depth', async () => {
+      const actual = (await runGlob('**', { cwd: fixtureDir, maxDepth: 2 })).sort();
+      assert.deepStrictEqual(actual, maxDepthExpected);
+      assert.deepStrictEqual(
+        await runGlob('../**', { cwd: fixtureDir, maxDepth: 0 }),
+        [],
+      );
+    });
+
+    test('limits literal patterns', async () => {
+      assert.deepStrictEqual(
+        await runGlob('a/b/c/d', { cwd: fixtureDir, maxDepth: 3 }),
+        [],
+      );
+      assert.deepStrictEqual(
+        await runGlob(fixtureDir, { cwd: fixtureDir, maxDepth: 0 }),
+        [fixtureDir],
+      );
+
+      const absolutePattern = resolve(fixtureDir, 'a/b/c/d');
+      assert.deepStrictEqual(
+        await runGlob(absolutePattern, { cwd: fixtureDir, maxDepth: 3 }),
+        [],
+      );
+      assert.deepStrictEqual(
+        await runGlob(absolutePattern, { cwd: fixtureDir, maxDepth: 4 }),
+        [absolutePattern],
+      );
+    });
+
+    test('limits absolute wildcard patterns rooted above cwd', async () => {
+      assert.deepStrictEqual(
+        await runGlob(join(dirname(fixtureDir), '*'), {
+          cwd: fixtureDir,
+          maxDepth: 0,
+        }),
+        [fixtureDir],
+      );
+    });
+
+    test('supports case-variant descendants', {
+      skip: isCaseSensitiveFileSystem,
+    }, async () => {
+      const expected = [
+        join(caseVariantFixtureDir, 'a'),
+        join(caseVariantFixtureDir, 'follow'),
+      ].sort();
+      const actual = await runGlob(
+        join(caseVariantFixtureDir, '*'),
+        { cwd: fixtureDir, maxDepth: 1 },
+      );
+      assert.deepStrictEqual(actual.sort(), expected);
+    });
+
+    test('supports absolute alternatives after brace expansion', async () => {
+      const pattern = `{${join(dirname(fixtureDir), '*')},other}`;
+      assert.deepStrictEqual(
+        await runGlob(pattern, { cwd: fixtureDir, maxDepth: 0 }),
+        [fixtureDir],
+      );
+    });
+
+    test('preserves filesystem case sensitivity', {
+      skip: !isCaseSensitiveFileSystem,
+    }, async () => {
+      assert.deepStrictEqual(
+        await runGlob(join(dirname(fixtureDir), '*'), {
+          cwd: fixtureDir,
+          maxDepth: 0,
+        }),
+        [fixtureDir],
+      );
+    });
+
+    test('recognizes equivalent path casing', {
+      skip: isCaseSensitiveFileSystem,
+    }, async () => {
+      assert.deepStrictEqual(
+        await runGlob(caseVariantFixtureDir, {
+          cwd: fixtureDir,
+          maxDepth: 0,
+        }),
+        [caseVariantFixtureDir],
+      );
+    });
+
+    test('rejects paths on a different Windows volume', {
+      skip: differentWindowsVolume === undefined,
+    }, async () => {
+      assert.deepStrictEqual(
+        await runGlob(differentWindowsVolume, {
+          cwd: fixtureDir,
+          maxDepth: 100,
+        }),
+        [],
+      );
+    });
+  });
+}
+
+test('glob forwards maxDepth', async () => {
+  assert.deepStrictEqual(
+    await promisify(glob)('**', { cwd: fixtureDir, maxDepth: 0 }),
+    ['.'],
+  );
+});
+
+function runNodeScript(script) {
+  const { child } = spawnSyncAndExitWithoutError(
+    process.execPath,
+    ['--expose-internals', '-e', script],
+    { encoding: 'utf8' },
+  );
+  return child.stdout;
+}
+
+test('async glob does not use synchronous path identity calls', () => {
+  const script = `
+      const fs = require('fs');
+      const path = require('path');
+      const { promisify } = require('util');
+      const fail = () => {
+        throw new Error('unexpected synchronous filesystem call');
+      };
+      fs.lstatSync = fail;
+      fs.realpathSync.native = fail;
+      (async () => {
+        const pattern = path.join(${JSON.stringify(caseVariantFixtureDir)}, '*');
+        const options = {
+          cwd: ${JSON.stringify(fixtureDir)},
+          maxDepth: 1,
+        };
+        await promisify(fs.glob)(pattern, options);
+        for await (const entry of fs.promises.glob(pattern, options)) {
+          void entry;
+        }
+      })().catch((error) => {
+        console.error(error);
+        process.exitCode = 1;
+      });
+    `;
+  runNodeScript(script);
+});
+
+function assertDoesNotTraverse(sibling, cwd) {
+  const script = `
+      const fs = require('fs');
+      const path = require('path');
+      const sibling = ${JSON.stringify(sibling)};
+      const original = fs.readdirSync;
+      let reads = 0;
+      fs.readdirSync = function(pathname, ...args) {
+        const resolved = path.resolve(pathname);
+        if (resolved === sibling || resolved.startsWith(sibling + path.sep)) {
+          reads++;
+        }
+        return Reflect.apply(original, this, [pathname, ...args]);
+      };
+      fs.globSync(path.join(sibling, '**'), {
+        cwd: ${JSON.stringify(cwd)},
+        maxDepth: 0,
+      });
+      process.stdout.write(String(reads));
+    `;
+  assert.strictEqual(runNodeScript(script), '0');
+}
+
+describe('globSync - maxDepth traversal', function() {
+  test('does not traverse absolute sibling subtrees', () => {
+    const siblingDir = tmpdir.resolve('sibling');
+    mkdirSync(join(siblingDir, 'nested'), { recursive: true });
+    assertDoesNotTraverse(siblingDir, fixtureDir);
+  });
+
+  test('does not traverse case-variant sibling subtrees', {
+    skip: !isCaseSensitiveFileSystem,
+  }, () => {
+    assertDoesNotTraverse(caseVariantFixtureDir, join(fixtureDir, 'a'));
+  });
+});
+
+test('globSync validates maxDepth', () => {
+  assert.deepStrictEqual(
+    globSync('a', { cwd: fixtureDir, maxDepth: Infinity }),
+    ['a'],
+  );
+
+  for (const maxDepth of [-1, 1.5, NaN, '1']) {
+    assert.throws(() => globSync('**', { cwd: fixtureDir, maxDepth }), {
+      code: typeof maxDepth === 'string' ? 'ERR_INVALID_ARG_TYPE' : 'ERR_OUT_OF_RANGE',
+    });
+  }
+});
+
 const followSymlinkPattern = 'follow/**';
 const followSymlinkExpected = [
   'follow',
@@ -737,11 +976,38 @@ describe('glob - seen cache', function() {
     `;
 
     const seenDir = tmpdir.resolve('glob-seen');
-    const child = spawnSync(
+    spawnSyncAndExitWithoutError(
       process.execPath,
       ['--expose-internals', '-e', script, seenDir],
       { encoding: 'utf8' },
     );
-    assert.strictEqual(child.status, 0, child.stderr || child.stdout);
+  });
+});
+
+// gh-58991: exclude patterns must apply the same case-sensitivity as include
+// patterns. On case-insensitive filesystems include patterns match entries
+// regardless of case, so literal exclude patterns must match that behavior.
+const skipCaseTests = { skip: !common.isWindows && !common.isMacOS };
+describe('glob - exclude case-insensitive consistency', skipCaseTests, function() {
+  test('literal exclude ignores case (sync)', () => {
+    assert.deepStrictEqual(
+      globSync('a/b', { cwd: fixtureDir, exclude: ['A/B'] }), []);
+  });
+  test('literal exclude matches differently-cased results (sync)', () => {
+    assert.deepStrictEqual(
+      globSync('A/b', { cwd: fixtureDir, exclude: ['a/b'] }), []);
+  });
+  test('literal exclude ignores case (async)', async () => {
+    const promisified = promisify(glob);
+    assert.deepStrictEqual(
+      await promisified('a/b', { cwd: fixtureDir, exclude: ['A/B'] }), []);
+  });
+  test('literal exclude ignores case (promise)', async () => {
+    const actual = [];
+    for await (const entry of asyncGlob(
+      'a/b', { cwd: fixtureDir, exclude: ['A/B'] })) {
+      actual.push(entry);
+    }
+    assert.deepStrictEqual(actual, []);
   });
 });
diff --git a/test/parallel/test-fs-promises-file-handle-aggregate-errors.js b/test/parallel/test-fs-promises-file-handle-aggregate-errors.js
index 36ebc23491ca..b299a7d5d572 100644
--- a/test/parallel/test-fs-promises-file-handle-aggregate-errors.js
+++ b/test/parallel/test-fs-promises-file-handle-aggregate-errors.js
@@ -67,7 +67,9 @@ async function checkAggregateError(op) {
   tmpdir.refresh();
   await checkAggregateError((filePath) => truncate(filePath));
   await checkAggregateError((filePath) => readFile(filePath));
-  await checkAggregateError((filePath) => writeFile(filePath, '123'));
+  // More than one write chunk (512 KiB), so that writeFile(path) goes through
+  // a FileHandle as well.
+  await checkAggregateError((filePath) => writeFile(filePath, '123'.repeat(200_000)));
   if (common.isMacOS) {
     await checkAggregateError((filePath) => lchmod(filePath, 0o777));
   }
diff --git a/test/parallel/test-fs-promises-file-handle-close-errors.js b/test/parallel/test-fs-promises-file-handle-close-errors.js
index 901e71c15ac5..c368f3acb931 100644
--- a/test/parallel/test-fs-promises-file-handle-close-errors.js
+++ b/test/parallel/test-fs-promises-file-handle-close-errors.js
@@ -62,7 +62,9 @@ async function checkCloseError(op) {
   tmpdir.refresh();
   await checkCloseError((filePath) => truncate(filePath));
   await checkCloseError((filePath) => readFile(filePath));
-  await checkCloseError((filePath) => writeFile(filePath, '123'));
+  // More than one write chunk (512 KiB), so that writeFile(path) goes through
+  // a FileHandle as well.
+  await checkCloseError((filePath) => writeFile(filePath, '123'.repeat(200_000)));
   if (common.isMacOS) {
     await checkCloseError((filePath) => lchmod(filePath, 0o777));
   }
diff --git a/test/parallel/test-fs-promises-file-handle-op-errors.js b/test/parallel/test-fs-promises-file-handle-op-errors.js
index 46b4acd0b8ff..d36056227841 100644
--- a/test/parallel/test-fs-promises-file-handle-op-errors.js
+++ b/test/parallel/test-fs-promises-file-handle-op-errors.js
@@ -56,7 +56,9 @@ async function checkOperationError(op) {
   tmpdir.refresh();
   await checkOperationError((filePath) => truncate(filePath));
   await checkOperationError((filePath) => readFile(filePath));
-  await checkOperationError((filePath) => writeFile(filePath, '123'));
+  // More than one write chunk (512 KiB), so that writeFile(path) goes through
+  // a FileHandle as well.
+  await checkOperationError((filePath) => writeFile(filePath, '123'.repeat(200_000)));
   if (common.isMacOS) {
     await checkOperationError((filePath) => lchmod(filePath, 0o777));
   }
diff --git a/test/parallel/test-fs-promises-file-handle-writer.js b/test/parallel/test-fs-promises-file-handle-writer.js
index ff90716400ef..d43bababad1e 100644
--- a/test/parallel/test-fs-promises-file-handle-writer.js
+++ b/test/parallel/test-fs-promises-file-handle-writer.js
@@ -1060,6 +1060,27 @@ async function testWriterArgumentValidation() {
   }
 }
 
+async function testWriterWebIDLConversion() {
+  const filePath = path.join(tmpDir, 'writer-webidl.txt');
+  const fh = await open(filePath, 'w');
+  const w = fh.writer();
+
+  await w.write(42, null);
+  await w.writev(new Set([true, { toString: () => 'object' }]));
+  assert.throws(
+    () => w.write(Symbol('invalid')),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.throws(
+    () => w.write('invalid options', 1),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.strictEqual(await w.end(null), 12);
+  await fh.close();
+
+  assert.strictEqual(fs.readFileSync(filePath, 'utf8'), '42trueobject');
+}
+
 // =============================================================================
 // Run all tests
 // =============================================================================
@@ -1114,4 +1135,5 @@ Promise.all([
   testWriterLimitWritevSync(),
   testWriterLimitAndStart(),
   testWriterArgumentValidation(),
+  testWriterWebIDLConversion(),
 ]).then(common.mustCall());
diff --git a/test/known_issues/test-fs-readdir-promise-recursive-with-buffer.js b/test/parallel/test-fs-readdir-promise-recursive-with-buffer.js
similarity index 56%
rename from test/known_issues/test-fs-readdir-promise-recursive-with-buffer.js
rename to test/parallel/test-fs-readdir-promise-recursive-with-buffer.js
index 314d6dda9a2d..5231b7248f3a 100644
--- a/test/known_issues/test-fs-readdir-promise-recursive-with-buffer.js
+++ b/test/parallel/test-fs-readdir-promise-recursive-with-buffer.js
@@ -1,9 +1,6 @@
 'use strict';
 
-// This test will fail because the implementation does not properly
-// handle the case when the path is a Buffer and the function is called
-// in recursive mode.
-
+// Recursive readdir accepts a Buffer path.
 // Refs: https://github.com/nodejs/node/issues/58892
 
 const common = require('../common');
@@ -11,5 +8,5 @@ const common = require('../common');
 const { readdir } = require('node:fs/promises');
 const { join } = require('node:path');
 
-const testDirPath = join(__dirname, '..', '..');
+const testDirPath = join(__dirname, '..', 'common');
 readdir(Buffer.from(testDirPath), { recursive: true }).then(common.mustCall());
diff --git a/test/parallel/test-fs-readdir-recursive-permission.js b/test/parallel/test-fs-readdir-recursive-permission.js
new file mode 100644
index 000000000000..b44454a213ce
--- /dev/null
+++ b/test/parallel/test-fs-readdir-recursive-permission.js
@@ -0,0 +1,89 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+
+const allowed = tmpdir.resolve('allowed');
+const blocked = tmpdir.resolve('blocked');
+fs.mkdirSync(path.join(allowed, 'a', 'b'), { recursive: true });
+fs.mkdirSync(path.join(allowed, 'c'));
+fs.mkdirSync(blocked);
+fs.writeFileSync(path.join(allowed, 'top'), '');
+fs.writeFileSync(path.join(allowed, 'a', '1'), '');
+fs.writeFileSync(path.join(allowed, 'a', 'b', '2'), '');
+fs.writeFileSync(path.join(blocked, 'secret'), '');
+if (common.canCreateSymLink()) {
+  fs.symlinkSync(path.join(allowed, 'a'), path.join(allowed, 'c', 'link-to-a'), 'dir');
+}
+
+// Computed without the permission model, so by the native walk.
+const expected = fs.readdirSync(allowed, { recursive: true });
+assert(expected.includes(path.join('a', 'b', '2')));
+
+const { status, stderr } = spawnSync(process.execPath, [
+  '--permission',
+  `--allow-fs-read=${allowed}`,
+  '-e',
+  `
+    const assert = require('assert');
+    const fs = require('fs');
+    const path = require('path');
+    const { ALLOWED, BLOCKED } = process.env;
+    const expected = JSON.parse(process.env.EXPECTED);
+    const denied = {
+      code: 'ERR_ACCESS_DENIED',
+      permission: 'FileSystemRead',
+      resource: path.toNamespacedPath(BLOCKED),
+    };
+
+    function check(result, withFileTypes) {
+      if (!withFileTypes) {
+        assert.deepStrictEqual(result, expected);
+        return;
+      }
+      assert(result.every((dirent) => dirent instanceof fs.Dirent));
+      assert.deepStrictEqual(
+        result.map((dirent) => path.join(path.relative(ALLOWED, dirent.parentPath), dirent.name)),
+        expected,
+      );
+    }
+
+    let pending = 0;
+    process.on('exit', () => assert.strictEqual(pending, 0));
+    for (const withFileTypes of [false, true]) {
+      const options = { recursive: true, withFileTypes };
+      check(fs.readdirSync(ALLOWED, options), withFileTypes);
+      assert.throws(() => fs.readdirSync(BLOCKED, options), denied);
+
+      pending += 4;
+      fs.readdir(ALLOWED, options, (err, result) => {
+        assert.ifError(err);
+        check(result, withFileTypes);
+        pending--;
+      });
+      fs.readdir(BLOCKED, options, (err) => {
+        assert.throws(() => { throw err; }, denied);
+        pending--;
+      });
+      fs.promises.readdir(ALLOWED, options).then((result) => {
+        check(result, withFileTypes);
+        pending--;
+      });
+      assert.rejects(fs.promises.readdir(BLOCKED, options), denied).then(() => pending--);
+    }
+  `,
+], {
+  env: {
+    ...process.env,
+    ALLOWED: allowed,
+    BLOCKED: blocked,
+    EXPECTED: JSON.stringify(expected),
+  },
+});
+assert.strictEqual(status, 0, stderr.toString());
diff --git a/test/parallel/test-fs-readdir-recursive-tree.js b/test/parallel/test-fs-readdir-recursive-tree.js
new file mode 100644
index 000000000000..2c10f63f0748
--- /dev/null
+++ b/test/parallel/test-fs-readdir-recursive-tree.js
@@ -0,0 +1,230 @@
+'use strict';
+
+// Exercises the native recursive readdir (sync, callback and promise forms)
+// against a reference walk built from the non-recursive API.
+
+const common = require('../common');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+
+const root = tmpdir.resolve('tree');
+fs.mkdirSync(path.join(root, 'a', 'b', 'c'), { recursive: true });
+fs.mkdirSync(path.join(root, 'd'));
+fs.mkdirSync(path.join(root, '.hidden'));
+fs.mkdirSync(path.join(root, 'empty'));
+fs.writeFileSync(path.join(root, 'top'), '');
+fs.writeFileSync(path.join(root, 'a', '1'), '');
+fs.writeFileSync(path.join(root, 'a', 'b', '2'), '');
+fs.writeFileSync(path.join(root, 'a', 'b', 'c', '3'), '');
+fs.writeFileSync(path.join(root, 'd', '4'), '');
+fs.writeFileSync(path.join(root, '.hidden', '5'), '');
+
+const canSymlink = common.canCreateSymLink();
+if (canSymlink) {
+  fs.symlinkSync(path.join(root, 'a'), path.join(root, 'd', 'link-to-a'), 'dir');
+  fs.symlinkSync(path.join(root, 'a', '1'), path.join(root, 'd', 'link-to-file'));
+  fs.symlinkSync(path.join(root, 'nowhere'), path.join(root, 'd', 'dangling'));
+}
+
+// Reference implementation: breadth-first, entries in readdir order,
+// directory symlinks followed (fs.readdir semantics).
+function reference(basePath) {
+  const entries = [];
+  const queue = [basePath];
+  for (let i = 0; i < queue.length; i++) {
+    const dir = queue[i];
+    for (const dirent of fs.readdirSync(dir, { withFileTypes: true })) {
+      const full = path.join(dir, dirent.name);
+      entries.push({
+        relative: path.relative(basePath, full),
+        isDirent: true,
+        name: dirent.name,
+        parentPath: dir,
+        isDirectory: dirent.isDirectory(),
+        isSymbolicLink: dirent.isSymbolicLink(),
+        isFile: dirent.isFile(),
+      });
+      let isDir = dirent.isDirectory();
+      if (!isDir && dirent.isSymbolicLink()) {
+        try {
+          isDir = fs.statSync(full).isDirectory();
+        } catch {
+          isDir = false;
+        }
+      }
+      if (isDir) queue.push(full);
+    }
+  }
+  return entries;
+}
+
+function fromDirents(dirents) {
+  return dirents.map((dirent) => {
+    return {
+      isDirent: dirent instanceof fs.Dirent,
+      name: dirent.name,
+      parentPath: dirent.parentPath,
+      isDirectory: dirent.isDirectory(),
+      isSymbolicLink: dirent.isSymbolicLink(),
+      isFile: dirent.isFile(),
+    };
+  });
+}
+
+function stripRelative(entries) {
+  return entries.map(({ relative, ...rest }) => rest);
+}
+
+const expected = reference(root);
+const expectedPaths = expected.map((entry) => entry.relative);
+const expectedDirents = stripRelative(expected);
+
+// The tree is only interesting if symlinks were followed.
+if (canSymlink) {
+  assert(expectedPaths.includes(path.join('d', 'link-to-a', 'b', 'c', '3')));
+  assert(!expectedPaths.includes(path.join('d', 'link-to-file', '1')));
+}
+assert(expectedPaths.includes(path.join('.hidden', '5')));
+assert(expectedPaths.includes('empty'));
+
+// Sync.
+assert.deepStrictEqual(fs.readdirSync(root, { recursive: true }), expectedPaths);
+assert.deepStrictEqual(
+  fromDirents(fs.readdirSync(root, { recursive: true, withFileTypes: true })),
+  expectedDirents,
+);
+
+// Callback.
+fs.readdir(root, { recursive: true }, common.mustSucceed((paths) => {
+  assert.deepStrictEqual(paths, expectedPaths);
+}));
+fs.readdir(root, { recursive: true, withFileTypes: true }, common.mustSucceed((dirents) => {
+  assert.deepStrictEqual(fromDirents(dirents), expectedDirents);
+}));
+
+// Promises.
+(async () => {
+  assert.deepStrictEqual(
+    await fs.promises.readdir(root, { recursive: true }),
+    expectedPaths,
+  );
+  assert.deepStrictEqual(
+    fromDirents(await fs.promises.readdir(root, { recursive: true, withFileTypes: true })),
+    expectedDirents,
+  );
+})().then(common.mustCall());
+
+// Mutating the options object after the call must not affect the result.
+{
+  const options = { recursive: true, withFileTypes: true };
+  fs.readdir(root, options, common.mustSucceed((dirents) => {
+    assert.deepStrictEqual(fromDirents(dirents), expectedDirents);
+  }));
+  options.withFileTypes = false;
+  options.recursive = false;
+}
+
+// Relative paths are relative to the path as given, while parentPath is the
+// path as given for the top level and a joined path below it.
+{
+  const relativeRoot = path.relative(process.cwd(), root) + path.sep;
+  const paths = fs.readdirSync(relativeRoot, { recursive: true });
+  assert.deepStrictEqual(paths, expectedPaths);
+  const dirents = fs.readdirSync(relativeRoot, { recursive: true, withFileTypes: true });
+  assert.strictEqual(dirents[0].parentPath, relativeRoot);
+  const nested = dirents.find((dirent) => dirent.name === '1');
+  assert.strictEqual(nested.parentPath, path.join(relativeRoot, 'a'));
+}
+
+// Buffer encodings and Buffer paths.
+{
+  const buffers = fs.readdirSync(root, { recursive: true, encoding: 'buffer' });
+  assert(buffers.every((entry) => Buffer.isBuffer(entry)));
+  assert.deepStrictEqual(buffers.map(String), expectedPaths);
+
+  const stringify = (dirent) => ({
+    ...fromDirents([dirent])[0],
+    name: String(dirent.name),
+    parentPath: String(dirent.parentPath),
+  });
+  const dirents = fs.readdirSync(root, { recursive: true, encoding: 'buffer', withFileTypes: true });
+  assert(dirents.every((dirent) => Buffer.isBuffer(dirent.name)));
+  assert(dirents.every((dirent) => dirent.parentPath === root || Buffer.isBuffer(dirent.parentPath)));
+  assert.deepStrictEqual(dirents.map(stringify), expectedDirents);
+
+  // A Buffer path keeps parentPath a Buffer, whatever the encoding.
+  const bufferRoot = Buffer.from(root);
+  assert.deepStrictEqual(fs.readdirSync(bufferRoot, { recursive: true }), expectedPaths);
+  const bufferDirents = fs.readdirSync(bufferRoot, { recursive: true, withFileTypes: true });
+  assert(bufferDirents.every((dirent) => typeof dirent.name === 'string'));
+  assert(bufferDirents.every((dirent) => Buffer.isBuffer(dirent.parentPath)));
+  assert.strictEqual(bufferDirents[0].parentPath, bufferRoot);
+  assert.deepStrictEqual(bufferDirents.map(stringify), expectedDirents);
+
+  fs.readdir(bufferRoot, { recursive: true }, common.mustSucceed((paths) => {
+    assert.deepStrictEqual(paths, expectedPaths);
+  }));
+  fs.readdir(bufferRoot, { recursive: true, withFileTypes: true, encoding: 'buffer' }, common.mustSucceed((dirents) => {
+    assert(dirents.every((dirent) => Buffer.isBuffer(dirent.name) && Buffer.isBuffer(dirent.parentPath)));
+    assert.deepStrictEqual(dirents.map(stringify), expectedDirents);
+  }));
+  fs.promises.readdir(bufferRoot, { recursive: true, encoding: 'buffer' }).then(common.mustCall((paths) => {
+    assert.deepStrictEqual(paths.map(String), expectedPaths);
+  }));
+  fs.promises.readdir(bufferRoot, { recursive: true, withFileTypes: true }).then(common.mustCall((dirents) => {
+    assert(dirents.every((dirent) => Buffer.isBuffer(dirent.parentPath)));
+    assert.deepStrictEqual(dirents.map(stringify), expectedDirents);
+  }));
+}
+
+// Errors carry the directory that failed, for the root and below it.
+{
+  const missing = path.join(root, 'missing');
+  assert.throws(() => fs.readdirSync(missing, { recursive: true }), {
+    code: 'ENOENT',
+    syscall: 'scandir',
+    path: missing,
+  });
+  const file = path.join(root, 'top');
+  assert.throws(() => fs.readdirSync(file, { recursive: true }), {
+    code: 'ENOTDIR',
+    syscall: 'scandir',
+    path: file,
+  });
+  fs.readdir(missing, { recursive: true }, common.mustCall((err) => {
+    assert.strictEqual(err.code, 'ENOENT');
+    assert.strictEqual(err.syscall, 'scandir');
+    assert.strictEqual(err.path, missing);
+  }));
+  assert.rejects(fs.promises.readdir(file, { recursive: true }), {
+    code: 'ENOTDIR',
+    syscall: 'scandir',
+    path: file,
+  }).then(common.mustCall());
+}
+
+if (!common.isWindows && !common.isIBMi && process.getuid() !== 0) {
+  const locked = tmpdir.resolve('locked');
+  const inner = path.join(locked, 'inner');
+  fs.mkdirSync(inner, { recursive: true });
+  fs.chmodSync(inner, 0);
+  try {
+    assert.throws(() => fs.readdirSync(locked, { recursive: true }), {
+      code: 'EACCES',
+      syscall: 'scandir',
+      path: inner,
+    });
+    fs.readdir(locked, { recursive: true }, common.mustCall((err) => {
+      assert.strictEqual(err.code, 'EACCES');
+      assert.strictEqual(err.path, inner);
+      fs.chmodSync(inner, 0o755);
+    }));
+  } catch (err) {
+    fs.chmodSync(inner, 0o755);
+    throw err;
+  }
+}
diff --git a/test/known_issues/test-fs-readdir-recursive-with-buffer.js b/test/parallel/test-fs-readdir-recursive-with-buffer.js
similarity index 55%
rename from test/known_issues/test-fs-readdir-recursive-with-buffer.js
rename to test/parallel/test-fs-readdir-recursive-with-buffer.js
index c2eae8f428fe..e3e17de10f27 100644
--- a/test/known_issues/test-fs-readdir-recursive-with-buffer.js
+++ b/test/parallel/test-fs-readdir-recursive-with-buffer.js
@@ -1,9 +1,6 @@
 'use strict';
 
-// This test will fail because the implementation does not properly
-// handle the case when the path is a Buffer and the function is called
-// in recursive mode.
-
+// Recursive readdir accepts a Buffer path.
 // Refs: https://github.com/nodejs/node/issues/58892
 
 const common = require('../common');
@@ -11,5 +8,5 @@ const common = require('../common');
 const { readdir } = require('node:fs');
 const { join } = require('node:path');
 
-const testDirPath = join(__dirname, '..', '..');
+const testDirPath = join(__dirname, '..', 'common');
 readdir(Buffer.from(testDirPath), { recursive: true }, common.mustSucceed());
diff --git a/test/known_issues/test-fs-readdir-sync-recursive-with-buffer.js b/test/parallel/test-fs-readdir-sync-recursive-with-buffer.js
similarity index 52%
rename from test/known_issues/test-fs-readdir-sync-recursive-with-buffer.js
rename to test/parallel/test-fs-readdir-sync-recursive-with-buffer.js
index 0f60c290f15d..1ff966c3b7ea 100644
--- a/test/known_issues/test-fs-readdir-sync-recursive-with-buffer.js
+++ b/test/parallel/test-fs-readdir-sync-recursive-with-buffer.js
@@ -1,9 +1,6 @@
 'use strict';
 
-// This test will fail because the implementation does not properly
-// handle the case when the path is a Buffer and the function is called
-// in recursive mode.
-
+// Recursive readdir accepts a Buffer path.
 // Refs: https://github.com/nodejs/node/issues/58892
 
 require('../common');
@@ -11,5 +8,5 @@ require('../common');
 const { readdirSync } = require('node:fs');
 const { join } = require('node:path');
 
-const testDirPath = join(__dirname, '..', '..');
+const testDirPath = join(__dirname, '..', 'common');
 readdirSync(Buffer.from(testDirPath), { recursive: true });
diff --git a/test/parallel/test-fs-rmSync-special-char-additional-error.js b/test/parallel/test-fs-rmSync-special-char-additional-error.js
new file mode 100644
index 000000000000..9b4de3c84d62
--- /dev/null
+++ b/test/parallel/test-fs-rmSync-special-char-additional-error.js
@@ -0,0 +1,69 @@
+'use strict';
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const { execSync } = require('child_process');
+
+tmpdir.refresh(); // Prepare a clean temporary directory
+
+function countOccurrences(haystack, needle) {
+  let count = 0;
+  let offset = 0;
+
+  while ((offset = haystack.indexOf(needle, offset)) !== -1) {
+    count++;
+    offset += needle.length;
+  }
+
+  return count;
+}
+
+const dirPath = path.join(tmpdir.path, '速_dir');
+const filePath = path.join(dirPath, 'test_file.txt');
+
+// Create a directory and a file within it
+fs.mkdirSync(dirPath, { recursive: true });
+fs.writeFileSync(filePath, 'This is a test file.');
+
+// Set permissions to simulate a permission denied scenario
+if (process.platform === 'win32') {
+  // Windows: Deny delete permissions
+  execSync(`icacls "${filePath}" /deny Everyone:(D)`);
+} else {
+  // Unix/Linux: Remove write permissions from the directory
+  fs.chmodSync(dirPath, 0o555); // Read and execute permissions only
+}
+
+try {
+  // Attempt to delete the directory which should now fail
+  assert.throws(() => {
+    fs.rmSync(dirPath, { recursive: true });
+  }, (err) => {
+    // Verify that the error is due to permission restrictions
+    let expectedCode = 'EACCES';
+    if (common.isMacOS) {
+      expectedCode = 'ENOTEMPTY';
+    } else if (common.isWindows) {
+      expectedCode = 'EPERM';
+    }
+    assert.strictEqual(err.code, expectedCode);
+    assert.strictEqual(err.syscall, 'rm');
+    assert.strictEqual(err.path, dirPath);
+    assert.strictEqual(countOccurrences(err.message, dirPath), 1);
+    return true;
+  });
+} finally {
+  // Cleanup - resetting permissions and removing the directory safely
+  if (process.platform === 'win32') {
+    // Remove the explicit permissions before attempting to delete
+    execSync(`icacls "${filePath}" /remove:d Everyone`);
+  } else {
+    // Reset permissions to allow deletion
+    fs.chmodSync(dirPath, 0o755); // Restore full permissions to the directory
+  }
+
+  // Attempt to clean up
+  fs.rmSync(dirPath, { recursive: true }); // This should now succeed
+}
diff --git a/test/parallel/test-fs-stat-cancel-inflight.js b/test/parallel/test-fs-stat-cancel-inflight.js
new file mode 100644
index 000000000000..4ed6ed810525
--- /dev/null
+++ b/test/parallel/test-fs-stat-cancel-inflight.js
@@ -0,0 +1,39 @@
+'use strict';
+
+// Aborting a queued stat must cancel the libuv request instead of running it.
+// The threadpool is saturated so the request is still queued when it is
+// cancelled; the queue is FIFO, so the stat cannot start before the blocker.
+
+const common = require('../common');
+
+if (!common.hasCrypto) common.skip('missing crypto');
+
+const assert = require('assert');
+const crypto = require('crypto');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
+
+if (process.argv[2] !== 'child') {
+  spawnSyncAndExitWithoutError(
+    process.execPath,
+    ['--expose-internals', __filename, 'child'],
+    { env: { ...process.env, UV_THREADPOOL_SIZE: '1' } },
+  );
+  return;
+}
+
+// A single worker is what keeps the stat queued behind the blocker below.
+assert.strictEqual(process.env.UV_THREADPOOL_SIZE, '1');
+
+const { internalBinding } = require('internal/test/binding');
+const binding = internalBinding('fs');
+
+// Occupy the only worker thread so the stat below cannot start.
+crypto.pbkdf2('secret', 'salt', 500_000, 32, 'sha512', common.mustCall());
+
+const req = new binding.FSReqCallback(false);
+req.oncomplete = common.mustCall((err) => {
+  // Without cancellation the stat would run and report success.
+  assert.strictEqual(err?.code, 'ECANCELED');
+});
+binding.stat(__filename, false, req, true);
+req.cancel();
diff --git a/test/parallel/test-fs-watch-enoent.js b/test/parallel/test-fs-watch-enoent.js
index e363b3e9325c..2a4befa72b3c 100644
--- a/test/parallel/test-fs-watch-enoent.js
+++ b/test/parallel/test-fs-watch-enoent.js
@@ -17,6 +17,8 @@ const {
   UV_ENODEV,
   UV_ENOENT
 } = internalBinding('uv');
+const { FSWatcher: RecursiveFSWatcher } = require('internal/fs/recursive_watch');
+const { kFSWatchStart } = require('internal/fs/watchers');
 
 tmpdir.refresh();
 
@@ -66,6 +68,60 @@ tmpdir.refresh();
   }
 }
 
+{
+  assert.throws(
+    () => fs.watch(nonexistentFile, {
+      recursive: true,
+      throwIfNoEntry: true,
+    }, common.mustNotCall()),
+    {
+      path: nonexistentFile,
+      filename: nonexistentFile,
+      code: 'ENOENT',
+    },
+  );
+}
+
+{
+  const watcher = fs.watch(nonexistentFile, {
+    recursive: true,
+    throwIfNoEntry: false,
+  }, common.mustNotCall());
+  watcher.close();
+}
+
+{
+  const directory = tmpdir.resolve('recursive-watch-error');
+  const expected = new Error('recursive watcher failed');
+  const originalWatch = fs.watch;
+  const watcher = new RecursiveFSWatcher({ recursive: true });
+  const close = common.mustCall();
+  let calls = 0;
+
+  expected.code = 'ENOSPC';
+  fs.mkdirSync(`${directory}/subdirectory`, { recursive: true });
+  fs.watch = common.mustCall(() => {
+    if (calls++ === 0) {
+      return { close };
+    }
+    throw expected;
+  }, 2);
+
+  try {
+    assert.throws(
+      () => watcher[kFSWatchStart](directory),
+      (error) => {
+        assert.strictEqual(error, expected);
+        assert.strictEqual(error.filename, directory);
+        return true;
+      },
+    );
+  } finally {
+    fs.watch = originalWatch;
+    watcher.close();
+  }
+}
+
 {
   if (common.isMacOS || common.isWindows) {
     const file = tmpdir.resolve('file-to-watch');
diff --git a/test/parallel/test-fs-watch-recursive-aix-preserve-watch-error.js b/test/parallel/test-fs-watch-recursive-aix-preserve-watch-error.js
new file mode 100644
index 000000000000..2573f582a312
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-aix-preserve-watch-error.js
@@ -0,0 +1,53 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (!common.isAIX)
+  common.skip('AIX-specific ENODEV handling');
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('preserve-watch-error');
+const originalStatSync = fs.statSync;
+const originalWatch = fs.watch;
+const expected = new Error('watch failed');
+const verificationError = new Error('stat failed');
+const watcher = new FSWatcher({ recursive: true, throwIfNoEntry: false });
+const failVerification = common.mustCall(() => {
+  throw verificationError;
+});
+
+expected.code = 'ENODEV';
+verificationError.code = 'EIO';
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename) => {
+  assert.strictEqual(filename, directory);
+  throw expected;
+});
+fs.statSync = (filename, options) => {
+  if (filename === directory && options?.throwIfNoEntry === false) {
+    return failVerification();
+  }
+  return Reflect.apply(originalStatSync, fs, [filename, options]);
+};
+
+try {
+  assert.throws(
+    () => watcher[kFSWatchStart](directory),
+    (error) => {
+      assert.strictEqual(error, expected);
+      return true;
+    },
+  );
+} finally {
+  watcher.close();
+  fs.statSync = originalStatSync;
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-linux-directory-watchers.js b/test/parallel/test-fs-watch-recursive-linux-directory-watchers.js
new file mode 100644
index 000000000000..bb68893f2d40
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-linux-directory-watchers.js
@@ -0,0 +1,108 @@
+'use strict';
+const common = require('../common');
+
+// This tests the JavaScript recursive fs.watch() implementation (used where
+// there is no native one, e.g. Linux): handle count, event reporting, ref/unref.
+
+if (!common.isLinux)
+  common.skip('the recursive watcher is native on this platform');
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { setTimeout: wait } = require('timers/promises');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+const delay = () => wait(common.platformTimeout(100));
+
+function countFSEventHandles() {
+  return process.getActiveResourcesInfo().filter((type) => type === 'FSEventWrap').length;
+}
+
+// Collects events until `done(events)` returns true, then closes the watcher.
+function watchUntil(target, done) {
+  return new Promise((resolve) => {
+    const events = [];
+    const watcher = fs.watch(target, { recursive: true });
+    watcher.on('change', (eventType, filename) => {
+      events.push(`${eventType} ${filename}`);
+      if (done(events)) {
+        watcher.close();
+        resolve(events);
+      }
+    });
+  });
+}
+
+(async () => {
+  const root = tmpdir.resolve('root');
+  fs.mkdirSync(path.join(root, 'sub'), { recursive: true });
+  for (let i = 0; i < 20; i++) {
+    fs.writeFileSync(path.join(root, `file-${i}.txt`), 'x');
+    fs.writeFileSync(path.join(root, 'sub', `file-${i}.txt`), 'x');
+  }
+  fs.symlinkSync(path.join(root, 'sub', 'file-1.txt'), path.join(root, 'link'));
+
+  {
+    // One handle per directory (root, sub) plus one for the symbolic link.
+    const before = countFSEventHandles();
+    const watcher = fs.watch(root, { recursive: true });
+    assert.strictEqual(countFSEventHandles() - before, 3);
+    watcher.unref();
+    watcher.ref();
+    watcher.close();
+  }
+
+  {
+    // A file replaced by rename() keeps being reported.
+    const file = path.join(root, 'sub', 'file-0.txt');
+    const changed = `change ${path.join('sub', 'file-0.txt')}`;
+    const events = watchUntil(root, (seen) => seen.filter((e) => e === changed).length === 2);
+    await delay();
+    fs.writeFileSync(`${file}.tmp`, 'replaced');
+    fs.renameSync(`${file}.tmp`, file);
+    await delay();
+    fs.appendFileSync(file, ' and modified');
+    await events;
+  }
+
+  {
+    // A write behind a symbolic link is reported as a rename of the link, and
+    // touching a known subdirectory itself does not throw or emit.
+    const events = watchUntil(root, (seen) => seen.includes('rename link'));
+    await delay();
+    fs.chmodSync(path.join(root, 'sub'), 0o775);
+    fs.appendFileSync(path.join(root, 'sub', 'file-1.txt'), 'more');
+    assert.ok(!(await events).some((e) => e.endsWith(' sub')));
+  }
+
+  {
+    // Removing the watched root directory is reported.
+    const doomed = tmpdir.resolve('doomed');
+    fs.mkdirSync(doomed);
+    fs.writeFileSync(path.join(doomed, 'inside'), 'x');
+    const events = watchUntil(doomed, (seen) => seen.includes('rename '));
+    await delay();
+    fs.rmSync(doomed, { recursive: true });
+    await events;
+  }
+
+  {
+    // So is removing a watched root that is a file (with an empty filename,
+    // as before).
+    const lone = tmpdir.resolve('lone.txt');
+    fs.writeFileSync(lone, 'x');
+    const events = watchUntil(lone, (seen) => seen.includes('rename '));
+    await delay();
+    fs.rmSync(lone);
+    await events;
+  }
+
+  {
+    const watcher = fs.watch(root, { recursive: true });
+    watcher.unref();
+    // The process exits although this watcher is never closed.
+    process.on('exit', () => assert.ok(watcher));
+  }
+})().then(common.mustCall());
diff --git a/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-read.js b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-read.js
new file mode 100644
index 000000000000..b91dbe625aeb
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-read.js
@@ -0,0 +1,54 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+function createWatcher() {
+  return { close() {} };
+}
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('retry-directory-disappears-before-read');
+const child = path.join(directory, 'child');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true });
+let childWatchCalls = 0;
+let directoryListener;
+let staleWatcherCloseCalls = 0;
+
+fs.mkdirSync(child, { recursive: true });
+fs.watch = common.mustCall((filename, options, listener) => {
+  if (filename === directory) {
+    directoryListener = listener;
+    return createWatcher();
+  }
+
+  assert.strictEqual(filename, child);
+  childWatchCalls++;
+  if (childWatchCalls === 1) {
+    fs.rmSync(child, { recursive: true });
+    return { close: () => staleWatcherCloseCalls++ };
+  }
+  return createWatcher();
+}, 3);
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.strictEqual(childWatchCalls, 1);
+  assert.strictEqual(staleWatcherCloseCalls, 1);
+
+  fs.mkdirSync(child);
+  directoryListener('rename', null);
+
+  assert.strictEqual(childWatchCalls, 2);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-watch.js b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-watch.js
new file mode 100644
index 000000000000..8f570180a855
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-watch.js
@@ -0,0 +1,66 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (common.isIBMi)
+  common.skip('IBMi does not support `fs.watch()`');
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+function createWatcher() {
+  return { close() {} };
+}
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('retry-directory-disappears-before-watch');
+const child = path.join(directory, 'child');
+const originalWatch = fs.watch;
+const changes = [];
+const watcher = new FSWatcher({ recursive: true });
+let childWatchCalls = 0;
+let directoryListener;
+let watchError;
+
+fs.mkdirSync(child, { recursive: true });
+watcher.on('change', (eventType, filename) => changes.push([eventType, filename]));
+fs.watch = common.mustCall((filename, options, listener) => {
+  if (filename === directory) {
+    directoryListener = listener;
+    return createWatcher();
+  }
+
+  assert.strictEqual(filename, child);
+  childWatchCalls++;
+  if (childWatchCalls === 1) {
+    fs.rmSync(child, { recursive: true });
+    try {
+      return Reflect.apply(originalWatch, fs, [filename, options, listener]);
+    } catch (error) {
+      watchError = error;
+      throw error;
+    }
+  }
+  return createWatcher();
+}, 3);
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.strictEqual(childWatchCalls, 1);
+  assert.match(watchError?.code, /^(ENOENT|ENODEV)$/);
+
+  fs.mkdirSync(child);
+  directoryListener('rename', null);
+
+  assert.strictEqual(childWatchCalls, 2);
+  assert.deepStrictEqual(changes, [['rename', 'child']]);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-root-disappears-before-read.js b/test/parallel/test-fs-watch-recursive-root-disappears-before-read.js
new file mode 100644
index 000000000000..7692c86a3abe
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-root-disappears-before-read.js
@@ -0,0 +1,37 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('root-disappears-before-read');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true });
+let closeCalls = 0;
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename) => {
+  assert.strictEqual(filename, directory);
+  fs.rmSync(directory, { recursive: true });
+  return { close: () => closeCalls++ };
+});
+
+try {
+  assert.throws(
+    () => watcher[kFSWatchStart](directory),
+    {
+      code: 'ENOENT',
+      filename: directory,
+    },
+  );
+  assert.strictEqual(closeCalls, 1);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-root-disappears-before-watch-no-throw.js b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch-no-throw.js
new file mode 100644
index 000000000000..c43f3e275184
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch-no-throw.js
@@ -0,0 +1,40 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (common.isIBMi)
+  common.skip('IBMi does not support `fs.watch()`');
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('root-disappears-before-watch-no-throw');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true, throwIfNoEntry: false });
+let watchError;
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename, ...args) => {
+  assert.strictEqual(filename, directory);
+  fs.rmSync(directory, { recursive: true });
+  try {
+    return Reflect.apply(originalWatch, fs, [filename, ...args]);
+  } catch (error) {
+    watchError = error;
+    throw error;
+  }
+});
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.match(watchError?.code, /^(ENOENT|ENODEV)$/);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-root-disappears-before-watch.js b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch.js
new file mode 100644
index 000000000000..917489004650
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch.js
@@ -0,0 +1,46 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (common.isIBMi)
+  common.skip('IBMi does not support `fs.watch()`');
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('root-disappears-before-watch');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true });
+let watchError;
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename, ...args) => {
+  assert.strictEqual(filename, directory);
+  fs.rmSync(directory, { recursive: true });
+  try {
+    return Reflect.apply(originalWatch, fs, [filename, ...args]);
+  } catch (error) {
+    watchError = error;
+    throw error;
+  }
+});
+
+try {
+  assert.throws(
+    () => watcher[kFSWatchStart](directory),
+    (error) => {
+      assert.strictEqual(error, watchError);
+      assert.match(error.code, /^(ENOENT|ENODEV)$/);
+      return true;
+    },
+  );
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-watch-before-read.js b/test/parallel/test-fs-watch-recursive-watch-before-read.js
new file mode 100644
index 000000000000..4faeb5b8efbe
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-watch-before-read.js
@@ -0,0 +1,42 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+function createWatcher() {
+  return { close() {} };
+}
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('watch-before-read');
+const originalReaddirSync = fs.readdirSync;
+const originalWatch = fs.watch;
+const operations = [];
+const watcher = new FSWatcher({ recursive: true });
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename) => {
+  assert.strictEqual(filename, directory);
+  operations.push('watch');
+  return createWatcher();
+});
+fs.readdirSync = common.mustCall((filename, ...args) => {
+  assert.strictEqual(filename, directory);
+  operations.push('read');
+  return Reflect.apply(originalReaddirSync, fs, [filename, ...args]);
+});
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.deepStrictEqual(operations, ['watch', 'read']);
+} finally {
+  watcher.close();
+  fs.readdirSync = originalReaddirSync;
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-writefile-one-roundtrip.js b/test/parallel/test-fs-writefile-one-roundtrip.js
new file mode 100644
index 000000000000..bab6940eec26
--- /dev/null
+++ b/test/parallel/test-fs-writefile-one-roundtrip.js
@@ -0,0 +1,85 @@
+'use strict';
+// fs.writeFile() and fs.promises.writeFile() with a path perform
+// open + write + close as one thread pool request. This covers what that
+// request must keep doing: honor flags and mode, append, report the
+// failing syscall, accept every ArrayBufferView, write the data as it was at
+// the call even if the buffer is resized or detached right after, and write
+// buffers larger than one write() call in full.
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { isMainThread } = require('worker_threads');
+
+tmpdir.refresh();
+let counter = 0;
+const next = () => tmpdir.resolve(`file-${counter++}`);
+
+async function check(write) {
+  {
+    const file = next();
+    await write(file, 'hello');
+    await write(file, ' world', { flag: 'a' });
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'hello world');
+    await assert.rejects(write(file, 'again', { flag: 'wx' }), { code: 'EEXIST', syscall: 'open', path: file });
+  }
+  {
+    const file = path.join(next(), 'missing-dir', 'file');
+    await assert.rejects(write(file, 'x'), { code: 'ENOENT', syscall: 'open', path: file });
+  }
+  {
+    const file = next();
+    await write(file, '');
+    assert.strictEqual(fs.statSync(file).size, 0);
+  }
+  if (!common.isWindows && isMainThread) {
+    const file = next();
+    const mask = process.umask(0o022);
+    await write(file, 'x', { mode: 0o640 });
+    process.umask(mask);
+    assert.strictEqual(fs.statSync(file).mode & 0o777, 0o640);
+  }
+  {
+    const file = next();
+    const units = new Uint16Array([0x6968]);
+    await write(file, units);
+    await write(file, new DataView(new TextEncoder().encode('!?').buffer, 1, 1), { flag: 'a' });
+    assert.deepStrictEqual(fs.readFileSync(file),
+                           Buffer.concat([Buffer.from(units.buffer), Buffer.from('?')]));
+  }
+  if (fs.existsSync('/dev/full')) {
+    // open() succeeds, write() fails.
+    await assert.rejects(write('/dev/full', 'x'), { code: 'ENOSPC', syscall: 'write' });
+  }
+  {
+    const file = next();
+    const resizable = new ArrayBuffer(64 * 1024, { maxByteLength: 128 * 1024 });
+    const view = new Uint8Array(resizable).fill(97);
+    const done = write(file, view);
+    resizable.resize(0);
+    await done;
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'a'.repeat(64 * 1024));
+  }
+  {
+    const file = next();
+    const detached = new ArrayBuffer(1024);
+    const done = write(file, new Uint8Array(detached).fill(98));
+    detached.transfer(8);
+    await done;
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'b'.repeat(1024));
+  }
+  {
+    const file = next();
+    const big = Buffer.alloc(3 * 1024 * 1024 + 7, 'z');
+    await write(file, big);
+    assert.deepStrictEqual(fs.readFileSync(file), big);
+  }
+}
+
+(async () => {
+  await check((file, data, options) => new Promise((resolve, reject) => {
+    fs.writeFile(file, data, options, (err) => (err ? reject(err) : resolve()));
+  }));
+  await check(fs.promises.writeFile);
+})().then(common.mustCall());
diff --git a/test/parallel/test-http-1.0.js b/test/parallel/test-http-1.0.js
index 639bd228df00..2df00633eafb 100644
--- a/test/parallel/test-http-1.0.js
+++ b/test/parallel/test-http-1.0.js
@@ -127,9 +127,12 @@ function test(handler, request_generator, response_validator) {
     assert.strictEqual(req.httpVersionMinor, 1);
     res.sendDate = false;
     res.writeHead(200, { 'Content-Type': 'text/plain' });
-    res.write('Hello, '); res._send('');
+    assert.throws(() => res.write('ignored', 'invalid'), {
+      code: 'ERR_UNKNOWN_ENCODING',
+    });
+    res.write('Hello, ', common.mustCall()); res._send('');
     res.write('world!'); res._send('');
-    res.end();
+    process.nextTick(() => res.end('X'));
   }
 
   function request_generator() {
@@ -148,10 +151,10 @@ function test(handler, request_generator, response_validator) {
                               'Connection: close\r\n' +
                               'Transfer-Encoding: chunked\r\n' +
                               '\r\n' +
-                              '7\r\n' +
-                              'Hello, \r\n' +
-                              '6\r\n' +
-                              'world!\r\n' +
+                              'd\r\n' +
+                              'Hello, world!\r\n' +
+                              '1\r\n' +
+                              'X\r\n' +
                               '0\r\n' +
                               '\r\n';
 
diff --git a/test/parallel/test-http-byteswritten.js b/test/parallel/test-http-byteswritten.js
index 32495613afa6..003b7dfbd049 100644
--- a/test/parallel/test-http-byteswritten.js
+++ b/test/parallel/test-http-byteswritten.js
@@ -44,10 +44,10 @@ const httpServer = http.createServer(common.mustCall(function(req, res) {
     res.write(bchunk);
     res.write(chunk, 'hex');
   }
-  // Get .bytesWritten while buffer is not empty
-  assert(res.connection.bytesWritten > 0);
-
   res.end(body);
+
+  // Get .bytesWritten while the socket buffer is not empty.
+  assert(res.connection.bytesWritten > 0);
 }));
 
 httpServer.listen(0, function() {
diff --git a/test/parallel/test-http-outgoing-destroyed.js b/test/parallel/test-http-outgoing-destroyed.js
index b60b6594c765..e6f533d22448 100644
--- a/test/parallel/test-http-outgoing-destroyed.js
+++ b/test/parallel/test-http-outgoing-destroyed.js
@@ -66,6 +66,9 @@ const { OutgoingMessage } = require('http');
       });
     }));
     const err = new Error('Destroy test');
+    res.write('x', common.mustCall((writeErr) => {
+      assert.strictEqual(writeErr, err);
+    }));
     res.destroy(err);
     assert.strictEqual(res.errored, err);
   })).listen(0, common.mustCall(() => {
diff --git a/test/parallel/test-http2-async-local-storage.js b/test/parallel/test-http2-async-local-storage.js
index 22ed71388d59..76e42fea1570 100644
--- a/test/parallel/test-http2-async-local-storage.js
+++ b/test/parallel/test-http2-async-local-storage.js
@@ -10,46 +10,56 @@ const async_hooks = require('async_hooks');
 const storage = new async_hooks.AsyncLocalStorage();
 
 const {
-  HTTP2_HEADER_CONTENT_TYPE,
   HTTP2_HEADER_PATH,
   HTTP2_HEADER_STATUS,
 } = http2.constants;
 
-const server = http2.createServer();
-server.on('stream', (stream) => {
-  stream.respond({
-    [HTTP2_HEADER_CONTENT_TYPE]: 'text/plain; charset=utf-8',
-    [HTTP2_HEADER_STATUS]: 200
-  });
-  stream.on('error', common.mustNotCall());
+function runTest(serverHandler) {
+  const server = http2.createServer();
+  server.on('stream', serverHandler);
+
+  server.listen(0, common.mustCall(() => {
+    const client = storage.run({ id: 0 }, () =>
+      http2.connect(`http://localhost:${server.address().port}`));
+
+    let ended = 0;
+    function doReq(id) {
+      const req = client.request({ [HTTP2_HEADER_PATH]: '/' });
+
+      req.on('response', common.mustCall((headers) => {
+        assert.strictEqual(headers[HTTP2_HEADER_STATUS], 200);
+        assert.strictEqual(storage.getStore().id, id);
+      }));
+      req.on('data', common.mustCall(() => {
+        assert.strictEqual(storage.getStore().id, id);
+      }));
+      req.on('end', common.mustCall(() => {
+        assert.strictEqual(storage.getStore().id, id);
+        if (++ended === 2) {
+          server.close();
+          client.close();
+        }
+      }));
+    }
+
+    storage.run({ id: 1 }, () => doReq(1));
+    storage.run({ id: 2 }, () => doReq(2));
+  }));
+}
+
+// Response without trailers: END_STREAM on the DATA frame.
+runTest((stream) => {
+  stream.respond({ [HTTP2_HEADER_STATUS]: 200 });
   stream.end('data');
 });
 
-server.listen(0, common.mustCall(async () => {
-  const client = storage.run({ id: 0 }, () => http2.connect(`http://localhost:${server.address().port}`));
-
-  async function doReq(id) {
-    const req = client.request({ [HTTP2_HEADER_PATH]: '/' });
-
-    req.on('response', common.mustCall((headers) => {
-      assert.strictEqual(headers[HTTP2_HEADER_STATUS], 200);
-      assert.strictEqual(id, storage.getStore().id);
-    }));
-    req.on('data', common.mustCall((data) => {
-      assert.strictEqual(data.toString(), 'data');
-      assert.strictEqual(id, storage.getStore().id);
-    }));
-    req.on('end', common.mustCall(() => {
-      assert.strictEqual(id, storage.getStore().id);
-      server.close();
-      client.close();
-    }));
-  }
-
-  function doReqWith(id) {
-    storage.run({ id }, () => doReq(id));
-  }
-
-  doReqWith(1);
-  doReqWith(2);
-}));
+// Response with trailers (as gRPC uses): END_STREAM on the trailing HEADERS
+// frame. The 'end' event must still run in the request's context.
+runTest((stream) => {
+  stream.respond({ [HTTP2_HEADER_STATUS]: 200 }, { waitForTrailers: true });
+  stream.on('wantTrailers', () => {
+    stream.sendTrailers({ 'grpc-status': '0' });
+  });
+  stream.write('data');
+  stream.end();
+});
diff --git a/test/parallel/test-http2-bidirectional-write-deadlock.js b/test/parallel/test-http2-bidirectional-write-deadlock.js
new file mode 100644
index 000000000000..9dd4b91c5234
--- /dev/null
+++ b/test/parallel/test-http2-bidirectional-write-deadlock.js
@@ -0,0 +1,107 @@
+'use strict';
+
+// Regression test against deadlocks between two HTTP/2 peers that are both
+// writing at the same time.
+//
+// To bound how much it buffered while output was backed up, an Http2Session
+// used to stop reading from its socket whenever a write was in flight, and
+// resume only once that write completed. When the peer was itself blocked
+// writing, that write never completed, so the session never read again and
+// the connection hung forever with no error and no timeout.
+//
+// Rather than relying on kernel socket buffers filling up - which depends on
+// the platform and configured window sizes - this models one half of that
+// cycle directly. The client's socket forwards a write but does not report it
+// as complete, substituting for a write blocked because the peer is not
+// reading. Only after that write is stalled does the server send its response
+// body. A session that stops reading while writing never sees it.
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const assert = require('assert');
+const http2 = require('http2');
+const net = require('net');
+const { Duplex } = require('stream');
+
+const BODY = 'the response body';
+
+const heldCallbacks = [];
+let serverStream;
+
+let stallWrites = false;
+
+// Client-side socket that forwards writes to a real connection, but can leave
+// their completion callbacks pending to model a transport-blocked write.
+class StalledClientSocket extends Duplex {
+  constructor(port) {
+    super();
+    this.inner = net.connect(port, common.localhostIPv4);
+    this.inner.on('data', (chunk) => this.push(chunk));
+  }
+  _read() {
+    // Incoming data is pushed as it arrives.
+  }
+  _write(chunk, encoding, callback) {
+    this.inner.write(chunk, encoding);
+    if (stallWrites) {
+      heldCallbacks.push(callback);
+      // Avoid writing from the server re-entrantly inside _write(). The
+      // ordering is still explicit: this callback is already held.
+      setImmediate(() => serverStream.end(BODY));
+      return;
+    }
+    callback();
+  }
+  _final(callback) {
+    callback();
+  }
+  _destroy(err, callback) {
+    this.inner.destroy();
+    callback(err);
+  }
+}
+
+const server = http2.createServer();
+
+server.on('stream', common.mustCall((stream) => {
+  // Send headers first. Their response event starts the stalled client write.
+  stream.respond();
+  serverStream = stream;
+}));
+
+server.listen(0, common.mustCall(() => {
+  const port = server.address().port;
+
+  const client = http2.connect(`http://${common.localhostIPv4}:${port}`, {
+    createConnection: () => new StalledClientSocket(port),
+  });
+
+  const req = client.request({ ':method': 'POST' });
+
+  let received = '';
+
+  req.on('response', common.mustCall(() => {
+    // _write() will schedule the response body only after it has retained the
+    // callback, guaranteeing that the native write is still in progress.
+    stallWrites = true;
+    req.write(Buffer.alloc(256));
+  }));
+
+  req.on('data', (chunk) => {
+    received += chunk;
+  });
+
+  req.on('end', common.mustCall(() => {
+    assert.strictEqual(received, BODY);
+    assert.ok(heldCallbacks.length > 0,
+              'test did not actually stall a socket write');
+
+    // Let the stalled writes complete so that everything can shut down.
+    stallWrites = false;
+    for (const callback of heldCallbacks) callback();
+
+    client.destroy();
+    server.close();
+  }));
+}));
diff --git a/test/parallel/test-http2-reset-buffered-read.js b/test/parallel/test-http2-reset-buffered-read.js
new file mode 100644
index 000000000000..0f3cafc768cb
--- /dev/null
+++ b/test/parallel/test-http2-reset-buffered-read.js
@@ -0,0 +1,46 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const assert = require('assert');
+const http2 = require('http2');
+
+// A clean peer reset must retain 26.x's buffered reads and readable 'end',
+// rather than introducing the reset errors and immediate destroy from main.
+const body = 'buffered response';
+const server = http2.createServer();
+server.on('stream', common.mustCall((stream) => {
+  stream.on('error', common.mustNotCall());
+  stream.resume();
+  stream.respond();
+  stream.write(body, common.mustCall(() => stream.close()));
+}));
+
+server.listen(0, common.mustCall(() => {
+  const client = http2.connect(`http://localhost:${server.address().port}`);
+  const request = client.request({ ':method': 'POST' });
+  request.write('request body');
+  request.pause();
+  request.read(0);
+  request.on('response', common.mustCall());
+  request.on('error', common.mustNotCall());
+  request.on('aborted', common.mustCall(() => {
+    setImmediate(common.mustCall(() => {
+      assert.strictEqual(request.destroyed, false);
+      assert.strictEqual(request.readableLength, Buffer.byteLength(body));
+      let received = '';
+      request.on('data', (chunk) => { received += chunk; });
+      request.on('end', common.mustCall(() => {
+        assert.strictEqual(received, body);
+      }));
+      request.resume();
+    }));
+  }));
+  request.on('close', common.mustCall(() => {
+    assert.strictEqual(request.readableEnded, true);
+    assert.strictEqual(request.rstCode, http2.constants.NGHTTP2_NO_ERROR);
+    client.close();
+    server.close();
+  }));
+}));
diff --git a/test/parallel/test-http2-reset-pending-write.js b/test/parallel/test-http2-reset-pending-write.js
new file mode 100644
index 000000000000..ddb5dcd918ff
--- /dev/null
+++ b/test/parallel/test-http2-reset-pending-write.js
@@ -0,0 +1,67 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const assert = require('assert');
+const http2 = require('http2');
+
+// A peer reset may leave a write unfinished. Preserve the clean readable
+// end in 26.x, but do not wait for writable 'finish' to destroy the stream.
+for (const compat of [false, true]) {
+  const server = http2.createServer();
+  let client;
+  let request;
+
+  function onRequest(readable, writable, stream) {
+    readable.on('error', common.mustNotCall());
+    if (writable !== readable)
+      writable.on('error', common.mustNotCall());
+    stream.on('error', common.mustNotCall());
+    readable.resume();
+    readable.on('end', common.mustCall());
+    stream.on('aborted', common.mustCall());
+    stream.on('finish', common.mustNotCall());
+    if (compat) {
+      // The compat response retains its existing finish-on-close behavior.
+      writable.on('finish', common.mustCall());
+    }
+    stream.on('close', common.mustCall(() => {
+      assert.strictEqual(stream.rstCode, http2.constants.NGHTTP2_NO_ERROR);
+      assert.strictEqual(stream.readableEnded, true);
+      assert.strictEqual(stream.writableFinished, false);
+      assert.strictEqual(stream.destroyed, true);
+      client.close();
+      server.close();
+    }));
+
+    writable.write('first response', common.mustCall(() => {
+      // Model a write whose callback cannot finish after the peer resets.
+      // Start the reset only once the write is pending.
+      stream._write = common.mustCall(() => {
+        setImmediate(() => request.destroy());
+      });
+      writable.write('pending response');
+    }));
+  }
+
+  if (compat) {
+    server.on('request', common.mustCall((req, res) => {
+      onRequest(req, res, req.stream);
+    }));
+  } else {
+    server.on('stream', common.mustCall((stream) => {
+      stream.respond();
+      onRequest(stream, stream, stream);
+    }));
+  }
+
+  server.listen(0, common.mustCall(() => {
+    client = http2.connect(`http://localhost:${server.address().port}`);
+    request = client.request({ ':method': 'POST' });
+    request.on('close', common.mustCall());
+    request.on('error', common.mustNotCall());
+    request.resume();
+    request.write('request body');
+  }));
+}
diff --git a/test/parallel/test-http2-stream-backpressure-unread-peer.js b/test/parallel/test-http2-stream-backpressure-unread-peer.js
new file mode 100644
index 000000000000..543aba02eba2
--- /dev/null
+++ b/test/parallel/test-http2-stream-backpressure-unread-peer.js
@@ -0,0 +1,133 @@
+'use strict';
+
+// CVE-2019-9517 describes a peer that offers HTTP/2 flow-control credit
+// but then doesn't read from its TCP connection (blocking TCP flow).
+// A streaming response must stop producing data when the resulting server
+// write becomes blocked by the transport.
+
+// We use a raw client here to directly control the flow of requests and
+// stall responses to deterministically reproduce this on all platforms.
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const assert = require('assert');
+const http2 = require('http2');
+const { Duplex, Readable } = require('stream');
+
+const { MAX_INITIAL_WINDOW_SIZE } = http2.constants;
+
+const FRAME_HEADERS = 1;
+const FRAME_SETTINGS = 4;
+const FRAME_WINDOW_UPDATE = 8;
+const FLAG_END_STREAM = 1;
+const FLAG_END_HEADERS = 4;
+const INITIAL_CONNECTION_WINDOW_SIZE = 65_535;
+
+const preface = Buffer.from('PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n');
+
+function frame(type, flags, streamID, payload = Buffer.alloc(0)) {
+  const header = Buffer.alloc(9);
+  header.writeUIntBE(payload.length, 0, 3);
+  header[3] = type;
+  header[4] = flags;
+  header.writeUInt32BE(streamID, 5);
+  return Buffer.concat([header, payload]);
+}
+
+function settings() {
+  const payload = http2.getPackedSettings({
+    initialWindowSize: MAX_INITIAL_WINDOW_SIZE,
+  });
+  return frame(FRAME_SETTINGS, 0, 0, payload);
+}
+
+function connectionWindowUpdate() {
+  const payload = Buffer.alloc(4);
+  payload.writeUInt32BE(
+    MAX_INITIAL_WINDOW_SIZE - INITIAL_CONNECTION_WINDOW_SIZE, 0);
+  return frame(FRAME_WINDOW_UPDATE, 0, 0, payload);
+}
+
+function request() {
+  return frame(
+    FRAME_HEADERS,
+    FLAG_END_HEADERS | FLAG_END_STREAM,
+    1,
+    Buffer.from([
+      0x82,  // :method: GET
+      0x86,  // :scheme: http
+      0x84,  // :path: /
+      0x41, 0x01, 0x78,  // :authority: x
+    ]));
+}
+
+let onWriteStalled;
+const socket = new Duplex({
+  read() {},
+  write(_data, _encoding, callback) {
+    if (onWriteStalled === undefined) {
+      callback();
+      return;
+    }
+
+    // Leave the write pending to model a peer that has stopped reading.
+    onWriteStalled();
+  },
+});
+
+// The 1MB body is well within the client's stream and connection windows
+// (2^31-1), so HTTP/2 flow control will not limit the response.
+const CHUNK_SIZE = 16 * 1024;
+const RESPONSE_SIZE = 1024 * 1024;
+const chunk = Buffer.alloc(CHUNK_SIZE);
+
+const serverSession = http2.performServerHandshake(socket);
+serverSession.on('stream', common.mustCall((stream) => {
+  let produced = 0;
+
+  // A datasource that produces chunks on demand
+  const source = new Readable({
+    highWaterMark: CHUNK_SIZE,
+    read() {
+      if (produced === RESPONSE_SIZE) {
+        this.push(null);
+        return;
+      }
+      produced += CHUNK_SIZE;
+      this.push(chunk);
+    },
+  });
+
+  // We set this once the stream opens, to stall all future writes once the
+  // initial preface & SETTINGS dance is completed.
+  onWriteStalled = common.mustCall(() => {
+    setImmediate(common.mustCall(() => {
+      // Backpressure should have been applied to the source when the
+      // socket writable writes stalled, even though there is still
+      // H2 flow-control credit available:
+      assert(source.isPaused());
+      assert(stream.writableNeedDrain);
+
+      // Exact amount produced depends on platform-specific variables but
+      // backpressure must stop the source well before it completes:
+      assert.ok(produced <= RESPONSE_SIZE / 4,
+                `produced ${produced} of ${RESPONSE_SIZE} bytes`);
+
+      serverSession.destroy();
+      socket.destroy();
+      source.destroy();
+    }));
+  });
+
+  stream.respond();
+  source.pipe(stream);
+}));
+
+// Manually send a single request with all required preamble:
+socket.push(Buffer.concat([
+  preface,
+  settings(),
+  connectionWindowUpdate(),
+  request(),
+]));
diff --git a/test/parallel/test-internal-net-isLoopback.js b/test/parallel/test-internal-net-isLoopback.js
index df63bfc262ea..d54533ec0dd5 100644
--- a/test/parallel/test-internal-net-isLoopback.js
+++ b/test/parallel/test-internal-net-isLoopback.js
@@ -10,7 +10,9 @@ const loopback = [
   '127.0.0.255',
   '127.1.2.3',
   '[::1]',
+  '::1',
   '[0:0:0:0:0:0:0:1]',
+  '0:0:0:0:0:0:0:1',
 ];
 
 const loopbackNot = [
@@ -21,6 +23,10 @@ const loopbackNot = [
   '[2001:db8::1]',
   '[fe80::1]',
   '8.8.8.8',
+  '::2',
+  '[::2]',
+  '0:0:0:0:0:0:0:2',
+  '[0:0:0:0:0:0:0:2]',
 ];
 
 for (const address of loopback) {
diff --git a/test/parallel/test-module-builtin-experimental.js b/test/parallel/test-module-builtin-experimental.js
new file mode 100644
index 000000000000..282701e7a0ae
--- /dev/null
+++ b/test/parallel/test-module-builtin-experimental.js
@@ -0,0 +1,48 @@
+'use strict';
+
+const common = require('../common');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+const experimentalBuiltins = [
+  ['bench', '--experimental-bench', true],
+  ['bench/reporters', '--experimental-bench', true],
+  ['dtls', '--experimental-dtls', common.hasDtls],
+  ['quic', '--experimental-quic', common.hasQuic],
+  ['vfs', '--experimental-vfs', true],
+].filter(([, , available]) => available);
+
+for (const [id, flag] of experimentalBuiltins) {
+  const builtin = `node:${id}`;
+
+  spawnSyncAndAssert(process.execPath, [
+    '-e', `const m = require('node:module'); if (m.builtinModules.includes('${builtin}')) process.exit(1); try { require('${builtin}'); } catch (e) { if (e.code === 'ERR_UNKNOWN_BUILTIN_MODULE') process.exit(0); } process.exit(1);`,
+  ], { status: 0 });
+
+  spawnSyncAndAssert(process.execPath, [
+    flag,
+    '-e', `const m = require('node:module'); if (!m.builtinModules.includes('${builtin}')) process.exit(1); require('${builtin}');`,
+  ], { status: 0 });
+}
+
+// node:ffi is enabled by default in builds with FFI support and can be
+// disabled with --no-experimental-ffi.
+if (common.hasFFI) {
+  spawnSyncAndAssert(process.execPath, [
+    '--no-experimental-ffi',
+    '-e', `const m = require('node:module'); if (m.builtinModules.includes('node:ffi')) process.exit(1); try { require('node:ffi'); } catch (e) { if (e.code === 'ERR_UNKNOWN_BUILTIN_MODULE') process.exit(0); } process.exit(1);`,
+  ], { status: 0 });
+}
+
+const schemeOnlyBuiltins = ['node:test', 'node:sea'];
+if (common.hasFFI) {
+  schemeOnlyBuiltins.push('node:ffi');
+}
+if (common.hasSQLite) {
+  schemeOnlyBuiltins.push('node:sqlite');
+}
+
+for (const id of schemeOnlyBuiltins) {
+  spawnSyncAndAssert(process.execPath, [
+    '-e', `const m = require('node:module'); if (!m.builtinModules.includes('${id}')) process.exit(1); require('${id}');`,
+  ], { status: 0 });
+}
diff --git a/test/parallel/test-module-isBuiltin.js b/test/parallel/test-module-isBuiltin.js
index a7815a8dfc1c..58290e935ca2 100644
--- a/test/parallel/test-module-isBuiltin.js
+++ b/test/parallel/test-module-isBuiltin.js
@@ -9,8 +9,12 @@ assert(isBuiltin('sys'));
 assert(isBuiltin('node:fs'));
 assert(isBuiltin('node:test'));
 
-// Does not include internal modules
+// Does not include internal or disabled experimental modules
 assert(!isBuiltin('internal/errors'));
+assert(!isBuiltin('node:bench'));
+assert(!isBuiltin('node:bench/reporters'));
+assert(!isBuiltin('bench'));
+assert(!isBuiltin('bench/reporters'));
 assert(!isBuiltin('test'));
 assert(!isBuiltin(''));
 assert(!isBuiltin(undefined));
diff --git a/test/parallel/test-module-unreadable-package-json.js b/test/parallel/test-module-unreadable-package-json.js
index 4261dad85580..7de221612d9d 100644
--- a/test/parallel/test-module-unreadable-package-json.js
+++ b/test/parallel/test-module-unreadable-package-json.js
@@ -18,6 +18,7 @@ const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
+const { spawnSyncAndAssert } = require('../common/child_process');
 const tmpdir = require('../common/tmpdir');
 
 tmpdir.refresh();
@@ -38,11 +39,10 @@ const entry = tmpdir.resolve('main.mjs');
 fs.writeFileSync(entry, 'import { which } from "dep"; console.log(which);');
 
 // Sanity check: the export resolves while the package config is readable.
-{
-  const child = spawnSync(process.execPath, [entry], { encoding: 'utf8' });
-  assert.strictEqual(child.stdout.trim(), 'real');
-  assert.strictEqual(child.status, 0, child.stderr);
-}
+spawnSyncAndAssert(process.execPath, [entry], { encoding: 'utf8' }, {
+  stdout: 'real',
+  trim: true,
+});
 
 fs.chmodSync(depPackageJson, 0o000);
 
diff --git a/test/parallel/test-node-run.js b/test/parallel/test-node-run.js
index bac90cf5db58..57faa80b9f82 100644
--- a/test/parallel/test-node-run.js
+++ b/test/parallel/test-node-run.js
@@ -301,4 +301,39 @@ describe('node --run [command]', { concurrency: !process.env.TEST_PARALLEL }, ()
     assert.strictEqual(child.stderr, '');
     assert.strictEqual(child.code, 0);
   });
+
+  it('lists available scripts when no command is given', async () => {
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ '--run'],
+      { cwd: fixtures.path('run-script') },
+    );
+    assert.match(child.stderr, /Available scripts are:/);
+    assert.match(child.stderr, /test: echo "Error: no test specified" && exit 1/);
+    assert.strictEqual(child.stdout, '');
+    assert.strictEqual(child.code, 9);
+  });
+
+  it('does not consume a following flag as the script name', async () => {
+    // `--run` followed by a flag lists scripts rather than treating the flag
+    // as a script name.
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ '--run', '--no-warnings'],
+      { cwd: fixtures.path('run-script') },
+    );
+    assert.match(child.stderr, /Available scripts are:/);
+    assert.strictEqual(child.code, 9);
+  });
+
+  it('errors when listing scripts without a package.json', async () => {
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ '--run'],
+      { cwd: __dirname },
+    );
+    assert.match(child.stderr, /Can't find package\.json/);
+    assert.strictEqual(child.stdout, '');
+    assert.strictEqual(child.code, 1);
+  });
 });
diff --git a/test/parallel/test-perf-hooks-histogram-analysis.js b/test/parallel/test-perf-hooks-histogram-analysis.js
index acc2b5a7eb2d..7069ec92ac92 100644
--- a/test/parallel/test-perf-hooks-histogram-analysis.js
+++ b/test/parallel/test-perf-hooks-histogram-analysis.js
@@ -229,7 +229,24 @@ const { inspect } = require('util');
   const unsorted = h.percentilesAt([99, 50, 90]);
   assert.strictEqual(unsorted.get(50), h.percentile(50));
 
-  // Validation
+  // Validation: non-array input must throw the same error regardless of how
+  // the check is implemented internally.
+  for (const [value, received] of [
+    ['x', "type string ('x')"],
+    [123, 'type number (123)'],
+    [{}, 'an instance of Object'],
+    [null, 'null'],
+    [undefined, 'undefined'],
+    [1n, 'type bigint (1n)'],
+    [true, 'type boolean (true)'],
+  ]) {
+    assert.throws(() => h.percentilesAt(value), {
+      code: 'ERR_INVALID_ARG_TYPE',
+      name: 'TypeError',
+      message: 'The "percentiles" argument must be an instance of Array. ' +
+               `Received ${received}`,
+    });
+  }
   assert.throws(() => h.percentilesAt('not array'),
                 { code: 'ERR_INVALID_ARG_TYPE' });
   assert.throws(() => h.percentilesAt([0]),
diff --git a/test/parallel/test-perf-hooks-histogram-stats.js b/test/parallel/test-perf-hooks-histogram-stats.js
index 9b05a1061682..581579d12686 100644
--- a/test/parallel/test-perf-hooks-histogram-stats.js
+++ b/test/parallel/test-perf-hooks-histogram-stats.js
@@ -3,7 +3,86 @@
 
 require('../common');
 const assert = require('assert');
-const { createHistogram } = require('perf_hooks');
+const { createHistogram, importHistogram } = require('perf_hooks');
+
+// ---------------------------------------------------------------------------
+// meanCI([options]) — confidence interval for the mean
+// ---------------------------------------------------------------------------
+{
+  const empty = createHistogram();
+  const emptyCI = empty.meanCI();
+  assert.strictEqual(Object.getPrototypeOf(emptyCI), null);
+  assert.ok(Number.isNaN(emptyCI.mean));
+  assert.ok(Number.isNaN(emptyCI.lower));
+  assert.ok(Number.isNaN(emptyCI.upper));
+
+  // A confidence interval is undefined with fewer than two samples.
+  const one = createHistogram();
+  one.record(42);
+  const oneCI = one.meanCI();
+  assert.strictEqual(oneCI.mean, 42);
+  assert.ok(Number.isNaN(oneCI.lower));
+  assert.ok(Number.isNaN(oneCI.upper));
+
+  // This known sample has a 95% Student's t confidence interval of
+  // approximately [3.334149, 7.665851].
+  const h = createHistogram();
+  for (let i = 1; i <= 10; i++) h.record(i);
+  const ci95 = h.meanCI();
+  assert.strictEqual(ci95.mean, h.mean);
+  assert.ok(Math.abs(ci95.lower - 3.3341494103866087) < 1e-6);
+  assert.ok(Math.abs(ci95.upper - 7.665850589613392) < 1e-6);
+
+  // Higher confidence produces a wider interval.
+  const ci90 = h.meanCI({ confidence: 0.90 });
+  const ci99 = h.meanCI({ confidence: 0.99 });
+  assert.ok((ci99.upper - ci99.lower) > (ci90.upper - ci90.lower));
+
+  // Very low confidence levels retain precision near the center of the
+  // distribution. With two samples, the t-distribution has one degree of
+  // freedom and the expected interval width is tan(pi * confidence / 2).
+  const two = createHistogram();
+  two.record(1);
+  two.record(2);
+  const lowConfidence = 1e-9;
+  const narrowCI = two.meanCI({ confidence: lowConfidence });
+  const expectedWidth = Math.tan(Math.PI * lowConfidence / 2);
+  const actualWidth = narrowCI.upper - narrowCI.lower;
+  assert.ok(Math.abs(actualWidth - expectedWidth) / expectedWidth < 1e-4);
+
+  // Very high confidence levels are not truncated by the quantile search.
+  const extremeCI = two.meanCI({ confidence: 0.9999999 });
+  assert.ok(extremeCI.lower < -3_000_000);
+  assert.ok(extremeCI.upper > 3_000_000);
+
+  const highestCI = two.meanCI({
+    confidence: 1 - Number.EPSILON / 2,
+  });
+  assert.ok(Number.isFinite(highestCI.lower));
+  assert.ok(Number.isFinite(highestCI.upper));
+
+  // Constant values have no sampling uncertainty.
+  const constant = createHistogram();
+  for (let i = 0; i < 100; i++) constant.record(7);
+  assert.deepStrictEqual(constant.meanCI(), {
+    __proto__: null,
+    mean: 7,
+    lower: 7,
+    upper: 7,
+  });
+
+  // Validation.
+  assert.throws(() => h.meanCI({ confidence: 0 }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.meanCI({ confidence: 1 }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.meanCI({ confidence: NaN }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.meanCI({ confidence: 'high' }),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h.meanCI(null),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
 
 // ---------------------------------------------------------------------------
 // welchTest(other) — Welch's t-test
@@ -440,6 +519,142 @@ const { createHistogram } = require('perf_hooks');
                 { code: 'ERR_INVALID_ARG_TYPE' });
 }
 
+// ---------------------------------------------------------------------------
+// export() / importHistogram() — CBOR round-trip
+// ---------------------------------------------------------------------------
+{
+  // Basic round-trip
+  const h = createHistogram();
+  for (let i = 1; i <= 1000; i++) h.record(i);
+
+  const buf = h.export();
+  assert.ok(buf instanceof Uint8Array, 'export should return Uint8Array');
+  assert.ok(buf.length > 0, 'export should not be empty');
+
+  const h2 = importHistogram(buf);
+  assert.strictEqual(h2.count, h.count);
+  assert.strictEqual(h2.min, h.min);
+  assert.strictEqual(h2.max, h.max);
+  assert.strictEqual(h2.mean, h.mean);
+  assert.strictEqual(h2.stddev, h.stddev);
+  assert.strictEqual(h2.percentile(50), h.percentile(50));
+  assert.strictEqual(h2.percentile(99), h.percentile(99));
+  assert.strictEqual(h2.percentile(99.9), h.percentile(99.9));
+
+  // Imported histogram is recordable
+  h2.record(9999);
+  assert.strictEqual(h2.count, h.count + 1);
+
+  // Round-trip with EWMA and threshold
+  const h3 = createHistogram({ halfLife: 10, threshold: 500 });
+  for (let i = 1; i <= 200; i++) h3.record(i);
+  const buf3 = h3.export();
+  const h4 = importHistogram(buf3);
+  assert.strictEqual(h4.count, h3.count);
+  assert.strictEqual(h4.ewmaMean, h3.ewmaMean);
+  assert.strictEqual(h4.ewmaStddev, h3.ewmaStddev);
+  assert.strictEqual(h4.ewmaErrorRate, h3.ewmaErrorRate);
+
+  // Empty histogram round-trip
+  const empty = createHistogram();
+  const emptyBuf = empty.export();
+  const empty2 = importHistogram(emptyBuf);
+  assert.strictEqual(empty2.count, 0);
+  assert.strictEqual(empty2.min, 9223372036854776000);  // INT64_MAX as double
+
+  // Sparse: only a few distinct values
+  const sparse = createHistogram();
+  sparse.record(1);
+  sparse.record(1000000);
+  const sparseBuf = sparse.export();
+  const sparse2 = importHistogram(sparseBuf);
+  assert.strictEqual(sparse2.count, 2);
+  assert.strictEqual(sparse2.percentile(1), sparse.percentile(1));
+  assert.strictEqual(sparse2.percentile(100), sparse.percentile(100));
+
+  // Size scales with distinct values, not total bucket count
+  assert.ok(sparseBuf.length < 200,
+            `Sparse export should be small, got ${sparseBuf.length}`);
+
+  // Validation — type and format
+  assert.throws(() => importHistogram('not a uint8array'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => importHistogram(new Uint8Array(0)),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => importHistogram(new Uint8Array([0xff, 0xff])),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+
+  // --- hdr_init failures (invalid histogram options) ---
+
+  // lowest=0 violates lowest>=1.
+  assert.throws(() => importHistogram(new Uint8Array([0xa1, 0x01, 0x00])),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+  // figures=0 violates figures>=1.
+  assert.throws(() => importHistogram(new Uint8Array([0xa1, 0x03, 0x00])),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+  // figures=6 violates figures<=5.
+  assert.throws(() => importHistogram(new Uint8Array([0xa1, 0x03, 0x06])),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+  // lowest=100, highest=100: lowest*2 > highest.
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa2,                                         // map(2)
+    0x01, 0x18, 100,                              // 1 (lowest) = 100
+    0x02, 0x18, 100,                              // 2 (highest) = 100
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+  // Large values that trigger hdr_init internal overflow
+  // (unit_magnitude + sub_bucket_half_count_magnitude > 61).
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa3,                                         // map(3)
+    0x01, 0x1b, 0, 0, 0x20, 0, 0, 0, 0, 0,       // 1 (lowest) = 2**45
+    0x02, 0x1b, 0, 0, 0x40, 0, 0, 0, 0, 0,       // 2 (highest) = 2**46
+    0x03, 0x05,                                   // 3 (figures) = 5
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+
+  // --- Structural CBOR validation ---
+
+  // Wrong version number (version=99).
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa1,                                         // map(1)
+    0x00, 0x18, 99,                               // 0 (version) = 99
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+  // Unknown top-level key (key=255).
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa1,                                         // map(1)
+    0x18, 0xff, 0x00,                             // 255 (unknown) = 0
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+  // Counts array with odd length (must be even: delta/count pairs).
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa1,                                         // map(1)
+    0x0a, 0x81, 0x01,                             // 10 (counts) = [1]
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+
+  // --- Post-construction validation ---
+
+  // counts_len mismatch: valid options but declared counts_len
+  // doesn't match what hdr_init actually produces.
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa2,                                         // map(2)
+    0x09, 0x01,                                   // 9 (countsLen) = 1
+    0x0a, 0x80,                                   // 10 (counts) = []
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+  // Oversized counts array: declared length exceeds remaining buffer.
+  // Without bounds checking, reserve() would OOM-crash.
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa1,                                         // map(1)
+    0x0a, 0x9b,                                   // 10 (counts) = array(
+    0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, //   2**52 elements)
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+  // Sparse count index out of bounds: lowest=1, highest=100, figures=1
+  // produces counts_len=64. Index 100 exceeds it.
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa4,                                         // map(4)
+    0x02, 0x18, 0x64,                             // 2 (highest) = 100
+    0x03, 0x01,                                   // 3 (figures) = 1
+    0x09, 0x18, 0x40,                             // 9 (countsLen) = 64
+    0x0a, 0x82, 0x18, 0x64, 0x01,                 // 10 (counts) = [100, 1]
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+}
+
 // ---------------------------------------------------------------------------
 // ERR_INVALID_THIS for all new methods on wrong receiver
 // ---------------------------------------------------------------------------
@@ -450,6 +665,7 @@ const { createHistogram } = require('perf_hooks');
   const wrongThis = {};
 
   const methods = [
+    ['meanCI', []],
     ['welchTest', [h]],
     ['mannWhitneyTest', [h]],
     ['cohensD', [h]],
@@ -497,6 +713,7 @@ const { createHistogram } = require('perf_hooks');
   stub[kHandle] = null;
 
   assert.strictEqual(stub.welchTest(h), undefined);
+  assert.strictEqual(stub.meanCI(), undefined);
   assert.strictEqual(stub.mannWhitneyTest(h), undefined);
   assert.strictEqual(stub.percentileCI(50), undefined);
   assert.strictEqual(stub.burnRate(0.999), undefined);
diff --git a/test/parallel/test-perf-hooks-resourcetiming-attributes.js b/test/parallel/test-perf-hooks-resourcetiming-attributes.js
new file mode 100644
index 000000000000..66fee5265cd4
--- /dev/null
+++ b/test/parallel/test-perf-hooks-resourcetiming-attributes.js
@@ -0,0 +1,116 @@
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const {
+  PerformanceResourceTiming,
+  performance,
+} = require('perf_hooks');
+
+// Covers the IDL attributes finalResponseHeadersStart,
+// firstInterimResponseStart, renderBlockingStatus, contentType and contentEncoding,
+// and the spec requirement that responseStart prefers a non-zero
+// firstInterimResponseStart over finalResponseHeadersStart.
+
+function createTimingInfo(overrides = {}) {
+  return {
+    startTime: 0,
+    redirectStartTime: 0,
+    redirectEndTime: 0,
+    postRedirectStartTime: 0,
+    finalServiceWorkerStartTime: 0,
+    finalNetworkRequestStartTime: 0,
+    finalNetworkResponseStartTime: 0,
+    endTime: 0,
+    encodedBodySize: 0,
+    decodedBodySize: 0,
+    finalConnectionTimingInfo: null,
+    ...overrides,
+  };
+}
+
+function markResourceTiming(timingInfo, bodyInfo) {
+  return performance.markResourceTiming(
+    timingInfo,
+    'http://localhost:8080',
+    'fetch',
+    {},
+    '',
+    bodyInfo,
+    200,
+    '',
+  );
+}
+
+// Default values when no optional timing or body metadata is present.
+{
+  const resource = markResourceTiming(createTimingInfo(), {});
+
+  assert.strictEqual(resource.finalResponseHeadersStart, 0);
+  assert.strictEqual(resource.firstInterimResponseStart, 0);
+  assert.strictEqual(resource.responseStart, 0);
+  assert.strictEqual(resource.renderBlockingStatus, 'non-blocking');
+  assert.strictEqual(resource.contentType, '');
+  assert.strictEqual(resource.contentEncoding, '');
+}
+
+// responseStart falls back to the final response when no interim response timing was recorded.
+{
+  const resource = markResourceTiming(createTimingInfo({
+    finalNetworkResponseStartTime: 123,
+    firstInterimNetworkResponseStartTime: 0,
+  }), {});
+
+  assert.strictEqual(resource.finalResponseHeadersStart, 123);
+  assert.strictEqual(resource.firstInterimResponseStart, 0);
+  assert.strictEqual(resource.responseStart, 123);
+}
+
+// Values reflected from timing info and body info.
+{
+  const timingInfo = createTimingInfo({
+    finalNetworkResponseStartTime: 123,
+    firstInterimNetworkResponseStartTime: 45,
+    renderBlocking: true,
+  });
+  const bodyInfo = {
+    contentType: 'text/html',
+    contentEncoding: 'gzip',
+  };
+  const resource = markResourceTiming(timingInfo, bodyInfo);
+
+  assert.strictEqual(resource.finalResponseHeadersStart, 123);
+  assert.strictEqual(resource.firstInterimResponseStart, 45);
+  assert.strictEqual(resource.responseStart, 45);
+  assert.strictEqual(resource.renderBlockingStatus, 'blocking');
+  assert.strictEqual(resource.contentType, 'text/html');
+  assert.strictEqual(resource.contentEncoding, 'gzip');
+
+  const json = resource.toJSON();
+  assert.strictEqual(json.finalResponseHeadersStart, 123);
+  assert.strictEqual(json.firstInterimResponseStart, 45);
+  assert.strictEqual(json.responseStart, 45);
+  assert.strictEqual(json.renderBlockingStatus, 'blocking');
+  assert.strictEqual(json.contentType, 'text/html');
+  assert.strictEqual(json.contentEncoding, 'gzip');
+}
+
+// The attributes are enumerable getters on the prototype and perform a
+// brand check like the other PerformanceResourceTiming attributes.
+for (const name of [
+  'finalResponseHeadersStart',
+  'firstInterimResponseStart',
+  'renderBlockingStatus',
+  'contentType',
+  'contentEncoding',
+]) {
+  const desc = Object.getOwnPropertyDescriptor(
+    PerformanceResourceTiming.prototype, name);
+  assert.strictEqual(desc.enumerable, true, name);
+  assert.strictEqual(typeof desc.get, 'function', name);
+  assert.throws(() => desc.get.call({}), {
+    code: 'ERR_INVALID_THIS',
+  }, name);
+}
+
+performance.clearResourceTimings();
diff --git a/test/parallel/test-perf-hooks-resourcetiming-fetch.mjs b/test/parallel/test-perf-hooks-resourcetiming-fetch.mjs
new file mode 100644
index 000000000000..40bcd1184a7d
--- /dev/null
+++ b/test/parallel/test-perf-hooks-resourcetiming-fetch.mjs
@@ -0,0 +1,67 @@
+// The ESM common wrapper does not export localhostIPv4.
+// eslint-disable-next-line node-core/require-common-first
+import common from '../common/index.js';
+
+import assert from 'node:assert';
+import { once } from 'node:events';
+import { createServer } from 'node:http';
+import {
+  PerformanceResourceTiming,
+  performance,
+} from 'node:perf_hooks';
+
+// This test ensures that built-in fetch creates a PerformanceResourceTiming
+// entry with the resource timing attributes exposed by Node.js.
+
+const responseBody = 'Hello world';
+const server = createServer(common.mustCall((req, res) => {
+  res.end(responseBody);
+}));
+
+server.listen(0, common.localhostIPv4);
+await once(server, 'listening');
+
+async function closeServer() {
+  if (server.listening) {
+    await new Promise((resolve) => server.close(resolve));
+  }
+}
+
+try {
+  performance.clearResourceTimings();
+
+  const url = `http://${common.localhostIPv4}:${server.address().port}/`;
+  const response = await fetch(url);
+  assert.strictEqual(await response.text(), responseBody);
+  await closeServer();
+
+  const entries = performance.getEntriesByName(url, 'resource');
+  assert.strictEqual(entries.length, 1);
+
+  const [entry] = entries;
+  assert(entry instanceof PerformanceResourceTiming);
+  assert.strictEqual(entry.initiatorType, 'fetch');
+  assert.strictEqual(entry.responseStatus, 200);
+  assert(entry.finalResponseHeadersStart > 0);
+  assert.strictEqual(entry.firstInterimResponseStart, 0);
+  assert.strictEqual(entry.responseStart, entry.finalResponseHeadersStart);
+  assert(entry.responseEnd >= entry.responseStart);
+  assert.strictEqual(entry.renderBlockingStatus, 'non-blocking');
+  assert.strictEqual(entry.contentType, '');
+  assert.strictEqual(entry.contentEncoding, '');
+
+  const json = entry.toJSON();
+  for (const name of [
+    'finalResponseHeadersStart',
+    'firstInterimResponseStart',
+    'responseStart',
+    'renderBlockingStatus',
+    'contentType',
+    'contentEncoding',
+  ]) {
+    assert.strictEqual(json[name], entry[name], name);
+  }
+} finally {
+  performance.clearResourceTimings();
+  await closeServer();
+}
diff --git a/test/parallel/test-perf-hooks-resourcetiming.js b/test/parallel/test-perf-hooks-resourcetiming.js
index f76cd669004e..9a94ba795e95 100644
--- a/test/parallel/test-perf-hooks-resourcetiming.js
+++ b/test/parallel/test-perf-hooks-resourcetiming.js
@@ -174,6 +174,8 @@ function createTimingInfo({
     connectEnd: 0,
     secureConnectionStart: 0,
     requestStart: 0,
+    finalResponseHeadersStart: 0,
+    firstInterimResponseStart: 0,
     responseStart: 0,
     responseEnd: 0,
     transferSize: 0,
@@ -181,6 +183,9 @@ function createTimingInfo({
     decodedBodySize: 0,
     responseStatus: 200,
     deliveryType: '',
+    renderBlockingStatus: 'non-blocking',
+    contentType: '',
+    contentEncoding: '',
   });
   assert.strictEqual(util.inspect(performance.getEntries()), `[
   PerformanceResourceTiming {
@@ -200,13 +205,18 @@ function createTimingInfo({
     connectEnd: 0,
     secureConnectionStart: 0,
     requestStart: 0,
+    finalResponseHeadersStart: 0,
+    firstInterimResponseStart: 0,
     responseStart: 0,
     responseEnd: 0,
     transferSize: 0,
     encodedBodySize: 0,
     decodedBodySize: 0,
     deliveryType: '',
-    responseStatus: 200
+    responseStatus: 200,
+    renderBlockingStatus: 'non-blocking',
+    contentType: '',
+    contentEncoding: ''
   }
 ]`);
   assert.strictEqual(util.inspect(resource), `PerformanceResourceTiming {
@@ -226,13 +236,18 @@ function createTimingInfo({
   connectEnd: 0,
   secureConnectionStart: 0,
   requestStart: 0,
+  finalResponseHeadersStart: 0,
+  firstInterimResponseStart: 0,
   responseStart: 0,
   responseEnd: 0,
   transferSize: 0,
   encodedBodySize: 0,
   decodedBodySize: 0,
   deliveryType: '',
-  responseStatus: 200
+  responseStatus: 200,
+  renderBlockingStatus: 'non-blocking',
+  contentType: '',
+  contentEncoding: ''
 }`);
 
   assert(resource instanceof PerformanceEntry);
diff --git a/test/parallel/test-permission-allow-inspector.js b/test/parallel/test-permission-allow-inspector.js
index 7d8b2aba8357..05022ff24044 100644
--- a/test/parallel/test-permission-allow-inspector.js
+++ b/test/parallel/test-permission-allow-inspector.js
@@ -38,7 +38,6 @@ session.connect();
   });
 
   assert.throws(() => {
-    // eslint-disable-next-line no-undef
     new Worker(`
       const child_process = require("node:child_process");
       console.log(child_process.execSync("ls -l").toString());
diff --git a/test/parallel/test-permission-audit-addons-does-not-deny.js b/test/parallel/test-permission-audit-addons-does-not-deny.js
new file mode 100644
index 000000000000..dd08058ab3ff
--- /dev/null
+++ b/test/parallel/test-permission-audit-addons-does-not-deny.js
@@ -0,0 +1,65 @@
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+// This test ensures that --permission-audit does not disable native addon
+// loading. In audit mode process.dlopen() must reach the regular loading
+// path (failing with ERR_DLOPEN_FAILED for a missing file, after publishing
+// the denial to the diagnostics channel) instead of being rejected upfront
+// with ERR_DLOPEN_DISABLED, which is still the expected behavior under
+// --permission.
+
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const { test } = require('node:test');
+
+function run(flag) {
+  const childScript = `
+    const dc = require('node:diagnostics_channel');
+    const msgs = [];
+    dc.subscribe('node:permission-model:addon', (m) => msgs.push({
+      permission: m.permission,
+      resource: m.resource,
+    }));
+    try {
+      process.dlopen({ exports: {} }, '/nonexistent/audit-test.node');
+      console.log('RESULT NO_THROW');
+    } catch (e) {
+      console.log('RESULT THREW ' + e.code);
+    }
+    console.log('AUDIT ' + JSON.stringify(msgs));
+  `;
+
+  const { status, stdout, stderr } = spawnSync(
+    process.execPath,
+    [flag, '-e', childScript],
+    { encoding: 'utf8' },
+  );
+  assert.strictEqual(status, 0, stderr);
+  const lines = stdout.split('\n');
+  const resultLine = lines.find((l) => l.startsWith('RESULT '));
+  assert.ok(resultLine, stdout);
+  const auditLine = lines.find((l) => l.startsWith('AUDIT '));
+  assert.ok(auditLine, stdout);
+  return {
+    result: resultLine.replace('RESULT ', ''),
+    msgs: JSON.parse(auditLine.replace('AUDIT ', '')),
+  };
+}
+
+test('audit mode reaches the real dlopen and logs the denial', () => {
+  const { result, msgs } = run('--permission-audit');
+  assert.strictEqual(result, 'THREW ERR_DLOPEN_FAILED');
+  assert.strictEqual(msgs.length, 1);
+  assert.strictEqual(msgs[0].permission, 'Addon');
+});
+
+test('enforce mode still disables dlopen upfront', () => {
+  const { result } = run('--permission');
+  assert.strictEqual(result, 'THREW ERR_DLOPEN_DISABLED');
+});
diff --git a/test/parallel/test-permission-audit-fs-lstat-symlink-does-not-deny.js b/test/parallel/test-permission-audit-fs-lstat-symlink-does-not-deny.js
new file mode 100644
index 000000000000..f2d98a0b6f83
--- /dev/null
+++ b/test/parallel/test-permission-audit-fs-lstat-symlink-does-not-deny.js
@@ -0,0 +1,144 @@
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+// This test ensures that --permission-audit does not deny fs.lstat() and
+// fs.symlink(), whose permission checks live in the JavaScript layer, while
+// --permission still denies them. Audit mode must publish the denial through
+// the diagnostics channel and let the operation continue. Each API is covered
+// in its three flavours (sync, callback and promise), since every flavour
+// carries its own copy of the check.
+
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const { test } = require('node:test');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+const blockedFile = fixtures.path('permission', 'deny', 'protected-file.md');
+
+function run(flag, { op, name }) {
+  const childScript = `
+    const dc = require('node:diagnostics_channel');
+    const msgs = [];
+    dc.subscribe('node:permission-model:fs', (m) => msgs.push({
+      permission: m.permission,
+      resource: m.resource,
+    }));
+    (async () => {
+      try {
+        await (${op});
+        console.log('RESULT NO_THROW');
+      } catch (e) {
+        console.log('RESULT THREW ' + e.code);
+      }
+      console.log('AUDIT ' + JSON.stringify(msgs));
+    })();
+  `;
+
+  const env = {
+    ...process.env,
+    BLOCKED_FILE: blockedFile,
+    LINK_PATH: tmpdir.resolve(`audit-symlink-${flag.replace(/\W/g, '')}-${name}`),
+  };
+  const { status, stdout, stderr } = spawnSync(
+    process.execPath,
+    [flag, '-e', childScript],
+    { encoding: 'utf8', env },
+  );
+  assert.strictEqual(status, 0, stderr);
+  const lines = stdout.split('\n');
+  const resultLine = lines.find((l) => l.startsWith('RESULT '));
+  assert.ok(resultLine, stdout);
+  const auditLine = lines.find((l) => l.startsWith('AUDIT '));
+  assert.ok(auditLine, stdout);
+  return {
+    result: resultLine.replace('RESULT ', ''),
+    msgs: JSON.parse(auditLine.replace('AUDIT ', '')),
+  };
+}
+
+const lstatOps = [
+  {
+    name: 'lstatSync',
+    api: 'fs.lstatSync()',
+    op: 'require("node:fs").lstatSync(process.env.BLOCKED_FILE)',
+  },
+  {
+    name: 'lstatCallback',
+    api: 'fs.lstat()',
+    op: 'new Promise((resolve, reject) => require("node:fs").lstat(' +
+      'process.env.BLOCKED_FILE, (err) => err ? reject(err) : resolve()))',
+  },
+  {
+    name: 'lstatPromises',
+    api: 'fsPromises.lstat()',
+    op: 'require("node:fs").promises.lstat(process.env.BLOCKED_FILE)',
+  },
+];
+
+const symlinkOps = [
+  {
+    name: 'symlinkSync',
+    api: 'fs.symlinkSync()',
+    op: 'require("node:fs").symlinkSync(process.env.BLOCKED_FILE, ' +
+      'process.env.LINK_PATH)',
+  },
+  {
+    name: 'symlinkCallback',
+    api: 'fs.symlink()',
+    op: 'new Promise((resolve, reject) => require("node:fs").symlink(' +
+      'process.env.BLOCKED_FILE, process.env.LINK_PATH, ' +
+      '(err) => err ? reject(err) : resolve()))',
+  },
+  {
+    name: 'symlinkPromises',
+    api: 'fsPromises.symlink()',
+    op: 'require("node:fs").promises.symlink(process.env.BLOCKED_FILE, ' +
+      'process.env.LINK_PATH)',
+  },
+];
+
+tmpdir.refresh();
+
+for (const entry of lstatOps) {
+  test(`audit mode does not deny ${entry.api} but logs the denial`, () => {
+    const { result, msgs } = run('--permission-audit', entry);
+    assert.strictEqual(result, 'NO_THROW');
+    assert.strictEqual(msgs.length, 1);
+    assert.strictEqual(msgs[0].permission, 'FileSystemRead');
+    assert.ok(msgs[0].resource.endsWith('protected-file.md'));
+  });
+
+  test(`enforce mode still denies ${entry.api}`, () => {
+    const { result } = run('--permission', entry);
+    assert.strictEqual(result, 'THREW ERR_ACCESS_DENIED');
+  });
+}
+
+for (const entry of symlinkOps) {
+  test(`audit mode does not deny ${entry.api} but logs the denial`, (t) => {
+    if (!common.canCreateSymLink()) {
+      return t.skip('insufficient privileges to create symlinks');
+    }
+    const { result, msgs } = run('--permission-audit', entry);
+    assert.strictEqual(result, 'NO_THROW');
+    assert.ok(
+      msgs.some((m) => m.permission === 'FileSystem'),
+      JSON.stringify(msgs),
+    );
+  });
+
+  test(`enforce mode still denies ${entry.api}`, (t) => {
+    if (!common.canCreateSymLink()) {
+      return t.skip('insufficient privileges to create symlinks');
+    }
+    const { result } = run('--permission', entry);
+    assert.strictEqual(result, 'THREW ERR_ACCESS_DENIED');
+  });
+}
diff --git a/test/parallel/test-permission-dlopen-binary.js b/test/parallel/test-permission-dlopen-binary.js
new file mode 100644
index 000000000000..3bf2321564fc
--- /dev/null
+++ b/test/parallel/test-permission-dlopen-binary.js
@@ -0,0 +1,113 @@
+// Flags: --expose-internals
+'use strict';
+
+// Loading an addon from bytes materializes them into an image in the temporary
+// directory, so dlopenBinary() requires file-system write access on top of the
+// addon permission every dlopen already needs. Granting only one of the two is
+// not enough.
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const addonPath = path.join(
+  __dirname, '..', 'addons', 'hello-world', 'build', 'Release', 'binding.node');
+if (!fs.existsSync(addonPath)) common.skip('the hello-world addon is not built');
+
+// Loads the addon from bytes at a path that does not exist on disk, as an
+// addon served by a virtual file system would be, and reports what happened.
+const child = `
+  const { internalBinding } = require('internal/test/binding');
+  const fs = require('fs');
+  const os = require('os');
+  const path = require('path');
+  const { dlopenBinary } = internalBinding('process_methods');
+  const bytes = fs.readFileSync(${JSON.stringify(addonPath)});
+  const target = path.join(os.tmpdir(), 'nonexistent-vfs-dir', 'binding.node');
+  const m = { exports: {} };
+  try {
+    dlopenBinary(m, target, undefined, bytes);
+    console.log('LOADED', m.exports.hello());
+  } catch (err) {
+    console.log('DENIED', err.code, err.permission ?? '');
+  }
+`;
+
+function run(...permissions) {
+  return spawnSync(
+    process.execPath,
+    ['--expose-internals', '--permission', '--allow-fs-read=*',
+     ...permissions, '-e', child],
+    { encoding: 'utf8' });
+}
+
+// Both permissions granted: the addon loads.
+{
+  const res = run('--allow-addons', '--allow-fs-write=*');
+  assert.strictEqual(res.status, 0, res.stderr);
+  assert.match(res.stdout, /LOADED world/);
+}
+
+// Addons allowed but no write access: refused by the file-system check, so the
+// bytes are never materialized.
+{
+  const res = run('--allow-addons');
+  assert.strictEqual(res.status, 0, res.stderr);
+  assert.match(res.stdout, /DENIED ERR_ACCESS_DENIED FileSystemWrite/);
+}
+
+// Write access but addons disallowed: refused before the bytes are looked at,
+// the same as any other dlopen under the permission model.
+{
+  const res = run('--allow-fs-write=*');
+  assert.strictEqual(res.status, 0, res.stderr);
+  assert.match(res.stdout, /DENIED ERR_DLOPEN_DISABLED/);
+}
+
+// Without the permission model neither check applies.
+{
+  const res = spawnSync(process.execPath, ['--expose-internals', '-e', child],
+                        { encoding: 'utf8' });
+  assert.strictEqual(res.status, 0, res.stderr);
+  assert.match(res.stdout, /LOADED world/);
+}
+
+// The same, reached the way a program actually gets here: an addon inside a
+// mounted VFS. Mounting one under the permission model needs --allow-fs-vfs.
+{
+  const mounted = `
+    const fs = require('fs');
+    const vfs = require('node:vfs');
+    const myVfs = vfs.create();
+    myVfs.writeFileSync('/binding.node',
+                        fs.readFileSync(${JSON.stringify(addonPath)}));
+    const mountPoint = myVfs.mount();
+    try {
+      console.log('LOADED', require(mountPoint + '/binding.node').hello());
+    } catch (err) {
+      console.log('DENIED', err.code, err.permission ?? '');
+    }
+  `;
+  const vfsRun = (...permissions) => spawnSync(
+    process.execPath,
+    ['--experimental-vfs', '--permission', '--allow-fs-read=*',
+     ...permissions, '-e', mounted],
+    { encoding: 'utf8' });
+
+  const ok = vfsRun('--allow-fs-vfs', '--allow-addons', '--allow-fs-write=*');
+  assert.strictEqual(ok.status, 0, ok.stderr);
+  assert.match(ok.stdout, /LOADED world/);
+
+  // Mounting itself is refused without --allow-fs-vfs.
+  const noVfs = vfsRun('--allow-addons', '--allow-fs-write=*');
+  assert.notStrictEqual(noVfs.status, 0);
+  assert.match(noVfs.stderr, /ERR_INVALID_STATE/);
+  assert.match(noVfs.stderr, /--allow-fs-vfs/);
+
+  // Mounted, addons allowed, but no write access: the addon is refused.
+  const noWrite = vfsRun('--allow-fs-vfs', '--allow-addons');
+  assert.strictEqual(noWrite.status, 0, noWrite.stderr);
+  assert.match(noWrite.stdout, /DENIED ERR_ACCESS_DENIED FileSystemWrite/);
+}
diff --git a/test/parallel/test-permission-drop-ffi.js b/test/parallel/test-permission-drop-ffi.js
index f0d4093b6d84..84d5877b1e0d 100644
--- a/test/parallel/test-permission-drop-ffi.js
+++ b/test/parallel/test-permission-drop-ffi.js
@@ -1,4 +1,4 @@
-// Flags: --permission --allow-ffi --experimental-ffi --allow-fs-read=*
+// Flags: --permission --allow-ffi --allow-fs-read=*
 'use strict';
 
 const common = require('../common');
diff --git a/test/parallel/test-permission-fs-filehandle-sync.js b/test/parallel/test-permission-fs-filehandle-sync.js
new file mode 100644
index 000000000000..28e9da734c85
--- /dev/null
+++ b/test/parallel/test-permission-fs-filehandle-sync.js
@@ -0,0 +1,33 @@
+// Flags: --permission --allow-fs-read=*
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+const assert = require('assert');
+const { open } = require('fs/promises');
+const fixtures = require('../common/fixtures');
+
+const regularFile = fixtures.path('permission', 'deny', 'regular-file.md');
+
+// FileHandle sync operations must be blocked when the permission model is
+// enabled, consistent with fs.fsync() / fs.fsyncSync() and fdatasync variants.
+(async () => {
+  const fh = await open(regularFile, 'r');
+  try {
+    await assert.rejects(
+      fh.sync(),
+      common.expectsError({ code: 'ERR_ACCESS_DENIED' }),
+    );
+    await assert.rejects(
+      fh.datasync(),
+      common.expectsError({ code: 'ERR_ACCESS_DENIED' }),
+    );
+  } finally {
+    await fh.close();
+  }
+})().then(common.mustCall());
diff --git a/test/parallel/test-permission-fs-write-v8.js b/test/parallel/test-permission-fs-write-v8.js
index a8b8fd4d579b..8e4810e8e2bb 100644
--- a/test/parallel/test-permission-fs-write-v8.js
+++ b/test/parallel/test-permission-fs-write-v8.js
@@ -43,3 +43,12 @@ const path = require('path');
     permission: 'FileSystemWrite',
   }));
 }
+
+{
+  assert.throws(() => {
+    v8.setHeapProfileNearHeapLimit(1);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+}
diff --git a/test/parallel/test-permission-has-reference-types.js b/test/parallel/test-permission-has-reference-types.js
new file mode 100644
index 000000000000..8509046dc5ee
--- /dev/null
+++ b/test/parallel/test-permission-has-reference-types.js
@@ -0,0 +1,48 @@
+'use strict';
+
+// Test that process.permission.has()/drop() accept a URL or Uint8Array reference.
+
+require('../common');
+const { spawnSync } = require('child_process');
+const assert = require('assert');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  process.exit(0);
+}
+
+const tmpdir = require('../common/tmpdir');
+const fixtures = require('../common/fixtures');
+const fs = require('fs');
+const path = require('path');
+
+tmpdir.refresh();
+
+const allowedDir = path.join(tmpdir.path, 'allowed');
+const deniedDir = path.join(tmpdir.path, 'denied');
+fs.mkdirSync(allowedDir);
+fs.mkdirSync(deniedDir);
+
+const allowedFile = path.join(allowedDir, 'a.txt');
+const deniedFile = path.join(deniedDir, 'b.txt');
+fs.writeFileSync(allowedFile, 'allowed');
+fs.writeFileSync(deniedFile, 'denied');
+
+const { status, stderr } = spawnSync(
+  process.execPath,
+  [
+    '--permission',
+    `--allow-fs-read=${allowedDir}`,
+    fixtures.path('permission', 'has-reference-types.js'),
+  ],
+  {
+    env: {
+      ...process.env,
+      ALLOWED_DIR: allowedDir,
+      ALLOWED_FILE: allowedFile,
+      DENIED_FILE: deniedFile,
+    },
+  },
+);
+
+assert.strictEqual(status, 0, stderr.toString());
diff --git a/test/parallel/test-permission-net-dtls.mjs b/test/parallel/test-permission-net-dtls.mjs
new file mode 100644
index 000000000000..54c6235b3df1
--- /dev/null
+++ b/test/parallel/test-permission-net-dtls.mjs
@@ -0,0 +1,66 @@
+// Flags: --permission --allow-fs-read=* --experimental-dtls --no-warnings
+import { hasCrypto, skip, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { connect, listen, DTLSEndpoint } = await import('node:dtls');
+
+// Verify that the permission system correctly reports no net access.
+assert.ok(!process.permission.has('net'));
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const fixturesDir = join(__dirname, '..', 'fixtures', 'keys');
+const cert = readFileSync(join(fixturesDir, 'agent1-cert.pem')).toString();
+const key = readFileSync(join(fixturesDir, 'agent1-key.pem')).toString();
+const ca = readFileSync(join(fixturesDir, 'ca1-cert.pem')).toString();
+
+// Test: connect() should throw ERR_ACCESS_DENIED
+{
+  assert.throws(
+    () => connect('127.0.0.1', 12345, { ca: [ca], rejectUnauthorized: false }),
+    {
+      code: 'ERR_ACCESS_DENIED',
+      permission: 'Net',
+    },
+  );
+}
+
+// Test: listen() should throw ERR_ACCESS_DENIED
+{
+  assert.throws(
+    () => listen(mustNotCall('onsession should not be called'), {
+      cert,
+      key,
+      port: 0,
+      host: '127.0.0.1',
+    }),
+    {
+      code: 'ERR_ACCESS_DENIED',
+      permission: 'Net',
+    },
+  );
+}
+
+// Test: Creating a DTLSEndpoint is allowed (no network I/O at construction
+// time), but bind() requires net permission.
+{
+  const endpoint = new DTLSEndpoint();
+  assert.ok(endpoint);
+  assert.throws(
+    () => endpoint.bind('127.0.0.1', 0),
+    {
+      code: 'ERR_ACCESS_DENIED',
+      permission: 'Net',
+    },
+  );
+}
diff --git a/test/parallel/test-process-env-allowed-flags-are-documented.js b/test/parallel/test-process-env-allowed-flags-are-documented.js
index 6028bbab787e..8349d4c3af6f 100644
--- a/test/parallel/test-process-env-allowed-flags-are-documented.js
+++ b/test/parallel/test-process-env-allowed-flags-are-documented.js
@@ -72,6 +72,7 @@ const conditionalOpts = [
         '--secure-heap',
         '--secure-heap-min',
         '--enable-fips',
+        '--enable-fips-indicator-events',
         '--force-fips',
       ].includes(opt);
     }
diff --git a/test/parallel/test-process-features.js b/test/parallel/test-process-features.js
index 2af4808b6c59..e12ae0029080 100644
--- a/test/parallel/test-process-features.js
+++ b/test/parallel/test-process-features.js
@@ -10,6 +10,7 @@ const expectedKeys = new Map([
   ['uv', ['boolean']],
   ['ipv6', ['boolean']],
   ['openssl_is_boringssl', ['boolean']],
+  ['dtls', ['boolean', 'undefined']],
   ['quic', ['boolean', 'undefined']],
   ['tls_alpn', ['boolean']],
   ['tls_sni', ['boolean']],
diff --git a/test/parallel/test-process-get-builtin.mjs b/test/parallel/test-process-get-builtin.mjs
index 5cbf28430109..7dd7b641bbf9 100644
--- a/test/parallel/test-process-get-builtin.mjs
+++ b/test/parallel/test-process-get-builtin.mjs
@@ -36,6 +36,8 @@ if (!hasIntl) {
   publicBuiltins.delete('inspector');
   publicBuiltins.delete('trace_events');
 }
+// TODO(@jasnell): Remove this once node:dtls graduates from unflagged.
+publicBuiltins.delete('node:dtls');
 // TODO(@jasnell): Remove this once node:quic graduates from unflagged.
 publicBuiltins.delete('node:quic');
 // Remove this once node:vfs graduates from unflagged.
@@ -49,9 +51,6 @@ if (!hasSQLite) {
   publicBuiltins.delete('node:sqlite');
 }
 
-// TODO: Remove this once node:ffi graduates from unflagged.
-publicBuiltins.delete('node:ffi');
-
 for (const id of publicBuiltins) {
   assert.strictEqual(process.getBuiltinModule(id), require(id));
 }
diff --git a/test/parallel/test-quic-alpn.mjs b/test/parallel/test-quic-alpn.mjs
index a7680dd05a5a..9ca3d40e4fef 100644
--- a/test/parallel/test-quic-alpn.mjs
+++ b/test/parallel/test-quic-alpn.mjs
@@ -1,6 +1,6 @@
 // Flags: --experimental-quic --no-warnings
 
-import { hasQuic, skip, mustCall } from '../common/index.mjs';
+import { hasQuic, skip, mustCall, mustNotCall } from '../common/index.mjs';
 import assert from 'node:assert';
 import * as fixtures from '../common/fixtures.mjs';
 
@@ -44,3 +44,10 @@ const clientSession = await connect(serverEndpoint.address, {
 await Promise.all([serverOpened.promise, checkSession(clientSession)]);
 await clientSession.close();
 await serverEndpoint.close();
+
+// QUIC requires an application protocol, so a server that offers none is
+// rejected when the endpoint is configured rather than at handshake time.
+await assert.rejects(listen(mustNotCall(), {
+  sni: { '*': { keys: [key], certs: [cert] } },
+  alpn: [],
+}), { code: 'ERR_INVALID_ARG_VALUE' });
diff --git a/test/parallel/test-quic-early-selection-order.mjs b/test/parallel/test-quic-early-selection-order.mjs
new file mode 100644
index 000000000000..f7cc89fb04c0
--- /dev/null
+++ b/test/parallel/test-quic-early-selection-order.mjs
@@ -0,0 +1,118 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: the server stops the TLS handshake at the ClientHello, so a session
+// reaches JavaScript before anything that belongs to it - even a 0-RTT
+// request the client put in its very first flight. The stop also has to
+// survive the ClientHello being seen more than once.
+
+import { hasQuic, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect } = await import('../common/quic.mjs');
+const { bytes } = await import('stream/iter');
+
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+
+// Send two requests, the 2nd via 0RTT, make sure the stream event always
+// fires _after_ the session event has completed (even though 0RTT is
+// delivered already in the first flight - delivery must be deferred).
+{
+  let ticket;
+  let token;
+  const gotTicket = Promise.withResolvers();
+  const gotToken = Promise.withResolvers();
+
+  const endpoint = await listen(mustCall((ss) => {
+    // No streams initially, stream must arrive in the onstream event, for
+    // both the normal and the 0RTT sessions:
+    assert.strictEqual(ss.stats.bidiInStreamCount, 0n);
+    ss.onstream = mustCall(async (stream) => {
+      await stream.closed;
+      ss.close();
+    });
+  }, 2), {
+    alpn: ['h3'],
+    onheaders: mustCall(function() {
+      this.sendHeaders({ ':status': '200' });
+      this.writer.writeSync(encoder.encode('hello'));
+      this.writer.endSync();
+    }, 2),
+  });
+
+  const request = {
+    ':method': 'GET',
+    ':path': '/',
+    ':scheme': 'https',
+    ':authority': 'localhost',
+  };
+
+  // Open a 1st session, send a request, get session ticket & token:
+  const cs1 = await connect(endpoint.address, {
+    servername: 'localhost',
+    alpn: 'h3',
+    onsessionticket: mustCall((t) => { ticket = t; gotTicket.resolve(); }, 2),
+    onnewtoken: mustCall((t) => { token = t; gotToken.resolve(); }),
+  });
+  await cs1.opened;
+  await Promise.all([gotTicket.promise, gotToken.promise]);
+  const s1 = await cs1.createBidirectionalStream({
+    headers: request,
+    onheaders: mustCall(),
+  });
+  await bytes(s1);
+  await Promise.all([s1.closed, cs1.closed]);
+
+  // Open 2nd session, reusing the ticket & token:
+  const cs2 = await connect(endpoint.address, {
+    servername: 'localhost',
+    alpn: 'h3',
+    sessionTicket: ticket,
+    token,
+  });
+
+  // Send a 0RTT request immediately, before the handshake completes:
+  const s2 = await cs2.createBidirectionalStream({
+    headers: request,
+    onheaders: mustCall(),
+  });
+
+  const info = await cs2.opened;
+  assert.strictEqual(info.earlyDataAccepted, true);
+  assert.strictEqual(decoder.decode(await bytes(s2)), 'hello');
+  await Promise.all([s2.closed, cs2.closed]);
+  await endpoint.close();
+}
+
+// When a handshake does HelloRetryRequest (HRR) and runs the hello flow twice,
+// we must preserve the ALPN and server name selection from the first hello. To
+// trigger this, we send a hello with an offer for X25519 & P-521, but only a
+// key share for X25519 (the *) so an automatic HRR is required.
+{
+  const serverDone = Promise.withResolvers();
+  const endpoint = await listen(mustCall((ss) => {
+    ss.opened.then(mustCall((info) => {
+      assert.strictEqual(info.servername, 'example.test');
+      assert.strictEqual(info.protocol, 'quic-test');
+      serverDone.resolve();
+    }));
+  }), { groups: 'P-521' });
+
+  const cs = await connect(endpoint.address, {
+    servername: 'example.test',
+    groups: '*X25519:P-521',
+  });
+
+  const info = await cs.opened;
+  assert.strictEqual(info.protocol, 'quic-test');
+  // Validate the HRR happened: we fell back to 2nd group
+  assert.strictEqual(cs.ephemeralKeyInfo.name, 'secp521r1');
+
+  await serverDone.promise;
+  cs.close();
+  await endpoint.close();
+}
diff --git a/test/parallel/test-quic-flow-control-bidi-simultaneous-volume.mjs b/test/parallel/test-quic-flow-control-bidi-simultaneous-volume.mjs
new file mode 100644
index 000000000000..24919cea1181
--- /dev/null
+++ b/test/parallel/test-quic-flow-control-bidi-simultaneous-volume.mjs
@@ -0,0 +1,102 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: large simultaneous transfers in both directions on one stream,
+// through constrained windows in both directions.
+//
+// Each direction of a bidirectional stream has its own independent flow
+// control window, governed by different transport parameters:
+//
+//   client -> server  is limited by the server's
+//                     initialMaxStreamDataBidiRemote
+//   server -> client  is limited by the client's
+//                     initialMaxStreamDataBidiLocal
+//
+// Running both directions at volume at the same time means credit is being
+// consumed and returned in both directions concurrently on the same stream.
+// A bug that credits the wrong direction, or that lets one direction's
+// accounting interfere with the other's, shows up here but not in the
+// one-direction-at-a-time tests.
+//
+// This exercises the raw QUIC application: the test helpers negotiate the
+// 'quic-test' ALPN, not HTTP/3. See test-quic-h3-flow-control-volume.mjs for
+// the HTTP/3 equivalent.
+
+import { hasQuic, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect, makePayload, hashBytes } =
+  await import('../common/quic.mjs');
+const { bytes } = await import('stream/iter');
+
+const kTotal = 4 * 1024 * 1024;         // per direction
+const kStreamWindow = 16 * 1024;
+const kConnWindow = 32 * 1024;
+
+assert.ok(kTotal / kConnWindow >= 100,
+          'payload must require >=100 connection window refills');
+
+// Distinct payloads per direction so a direction mixup is detectable.
+const toServer = makePayload(kTotal, 11);
+const toClient = makePayload(kTotal, 22);
+const toServerHash = hashBytes(toServer);
+const toClientHash = hashBytes(toClient);
+
+const serverDone = Promise.withResolvers();
+
+const serverEndpoint = await listen(mustCall((serverSession) => {
+  serverSession.onstream = mustCall(async (stream) => {
+    // Start sending before reading, so both directions are in flight at
+    // once. If the server read to completion first, the two directions
+    // would be sequential and the test would prove much less.
+    stream.setBody(toClient);
+
+    const received = await bytes(stream);
+    assert.strictEqual(received.byteLength, kTotal);
+    // Must be the client->server payload, not an echo of our own.
+    assert.strictEqual(hashBytes(received), toServerHash);
+
+    await stream.closed;
+    serverSession.close();
+    serverDone.resolve();
+  });
+}), {
+  transportParams: {
+    // Limits client -> server.
+    initialMaxStreamDataBidiRemote: kStreamWindow,
+    initialMaxData: kConnWindow,
+  },
+  maxStreamWindow: kStreamWindow,
+  maxWindow: kConnWindow,
+});
+
+const clientSession = await connect(serverEndpoint.address, {
+  transportParams: {
+    // Limits server -> client.
+    initialMaxStreamDataBidiLocal: kStreamWindow,
+    initialMaxData: kConnWindow,
+  },
+  maxStreamWindow: kStreamWindow,
+  maxWindow: kConnWindow,
+});
+await clientSession.opened;
+
+const stream = await clientSession.createBidirectionalStream();
+stream.setBody(toServer);
+
+// Read the server's payload while our own body is still being sent.
+const received = await bytes(stream);
+assert.strictEqual(received.byteLength, kTotal);
+// Must be the server->client payload, not an echo of our own.
+assert.strictEqual(hashBytes(received), toClientHash);
+
+// Sanity: the two directions carried genuinely different data, so the
+// assertions above could not both be satisfied by one payload echoed back.
+assert.notStrictEqual(toServerHash, toClientHash);
+
+await Promise.all([stream.closed, serverDone.promise]);
+await clientSession.close();
+await serverEndpoint.close();
diff --git a/test/parallel/test-quic-flow-control-concurrent-volume.mjs b/test/parallel/test-quic-flow-control-concurrent-volume.mjs
new file mode 100644
index 000000000000..b3f2c9a62450
--- /dev/null
+++ b/test/parallel/test-quic-flow-control-concurrent-volume.mjs
@@ -0,0 +1,130 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: many concurrent streams contending for one constrained
+// connection-level flow control window, at volume.
+//
+// The connection-level window (initialMaxData) is shared by every stream on
+// the session, while each stream also has its own window. When several
+// streams are all trying to move data through a connection window smaller
+// than any single stream's payload, the connection-level credit has to be
+// recycled continuously and shared across them.
+//
+// This is the configuration most likely to expose credit accounting errors:
+// per-stream bugs that cancel out on a single stream become visible when
+// several streams draw on the same pool, and any net under-crediting
+// deadlocks every stream at once rather than just slowing one down.
+//
+// This exercises the raw QUIC application: the test helpers negotiate the
+// 'quic-test' ALPN, not HTTP/3. See test-quic-h3-flow-control-volume.mjs for
+// the HTTP/3 equivalent.
+
+import { hasQuic, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect, makePayload, hashBytes } =
+  await import('../common/quic.mjs');
+const { bytes } = await import('stream/iter');
+
+const kStreams = 8;
+const kPerStream = 512 * 1024;          // 4 MB total
+const kStreamWindow = 16 * 1024;
+const kConnWindow = 32 * 1024;          // Shared by all 8 streams
+
+const kTotal = kStreams * kPerStream;
+
+assert.ok(kConnWindow < kPerStream,
+          'connection window must be smaller than a single stream payload');
+assert.ok(kTotal / kConnWindow >= 100,
+          'aggregate payload must require >=100 connection window refills');
+
+// Distinct payload per stream so a cross-stream mixup is detectable, not
+// just a wrong byte total.
+const payloads = [];
+const hashes = [];
+for (let i = 0; i < kStreams; i++) {
+  const p = makePayload(kPerStream, i + 1);
+  payloads.push(p);
+  hashes.push(hashBytes(p));
+}
+
+// Map each received payload back to the stream that sent it. The server has
+// no ordering guarantee across streams, so match by hash rather than by
+// arrival order.
+const remaining = new Set(hashes);
+const serverDone = Promise.withResolvers();
+let completed = 0;
+
+// Track how many streams are being read at the same time. The whole premise
+// of this test is contention for the shared connection window, so if the
+// streams end up serialized the test still passes but proves much less.
+// Assert the overlap explicitly rather than trusting it.
+let openStreams = 0;
+let maxOpenStreams = 0;
+
+const serverEndpoint = await listen(mustCall((serverSession) => {
+  serverSession.onstream = mustCall(async (stream) => {
+    openStreams++;
+    maxOpenStreams = Math.max(maxOpenStreams, openStreams);
+
+    const received = await bytes(stream);
+    openStreams--;
+    assert.strictEqual(received.byteLength, kPerStream);
+
+    const h = hashBytes(received);
+    // Each payload must arrive exactly once, intact. This catches data from
+    // one stream being credited or delivered onto another.
+    assert.ok(remaining.has(h),
+              'received payload did not match any expected stream payload');
+    remaining.delete(h);
+
+    stream.writer.endSync();
+    await stream.closed;
+    if (++completed === kStreams) {
+      serverSession.close();
+      serverDone.resolve();
+    }
+  }, kStreams);
+}), {
+  transportParams: {
+    initialMaxStreamDataBidiRemote: kStreamWindow,
+    initialMaxData: kConnWindow,
+    // Allow all streams to be open at once; the point is contention.
+    initialMaxStreamsBidi: kStreams,
+  },
+  maxStreamWindow: kStreamWindow,
+  maxWindow: kConnWindow,
+});
+
+const clientSession = await connect(serverEndpoint.address);
+await clientSession.opened;
+
+// Start every stream before draining any of them, so they genuinely contend
+// for the shared connection window rather than running one after another.
+const streams = [];
+for (let i = 0; i < kStreams; i++) {
+  const stream = await clientSession.createBidirectionalStream();
+  stream.setBody(payloads[i]);
+  streams.push(stream);
+}
+
+await Promise.all(streams.map(async (stream) => {
+  for await (const _ of stream) { /* drain */ } // eslint-disable-line no-unused-vars
+  await stream.closed;
+}));
+
+await serverDone.promise;
+// Every stream's payload must have arrived exactly once.
+assert.strictEqual(remaining.size, 0);
+// All streams are created before any is drained, so all of them should be
+// open simultaneously. Anything less means they serialized and the window
+// contention this test exists to exercise did not actually happen.
+assert.strictEqual(maxOpenStreams, kStreams,
+                   'all streams must be open simultaneously to contend for ' +
+                   'the shared connection window');
+
+await clientSession.close();
+await serverEndpoint.close();
diff --git a/test/parallel/test-quic-flow-control-credit-reclaim.mjs b/test/parallel/test-quic-flow-control-credit-reclaim.mjs
new file mode 100644
index 000000000000..f5dcedad1cce
--- /dev/null
+++ b/test/parallel/test-quic-flow-control-credit-reclaim.mjs
@@ -0,0 +1,98 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: connection-level flow control credit is reclaimed for inbound data
+// that is never consumed.
+//
+// Every byte QUIC delivers to us is charged against both the stream-level
+// and the connection-level receive window. The stream-level window dies with
+// the stream, but the connection-level window (`initialMaxData`) is shared by
+// every stream on the session and is only replenished when we send MAX_DATA.
+//
+// If a stream is destroyed while inbound data is still sitting unread, that
+// credit must still be returned, otherwise the session's receive window
+// shrinks a little on every such stream until the connection deadlocks.
+//
+// This test destroys many streams without reading their responses, moving far
+// more data in total than `initialMaxData` allows to be outstanding at once.
+// It only completes if the credit is reclaimed on destroy.
+
+import { hasQuic, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect } = await import('../common/quic.mjs');
+
+const encoder = new TextEncoder();
+
+// Each response is 16 KB and the connection-level window is 64 KB, so the
+// session can only ever have 4 unread responses outstanding. Running 20
+// streams pushes 320 KB total -- 5x the window -- which can only work if the
+// window is replenished as each stream is discarded.
+const kPayloadSize = 16 * 1024;
+const kInitialMaxData = 64 * 1024;
+const kStreamCount = 20;
+
+const payload = encoder.encode('a'.repeat(kPayloadSize));
+
+const serverEndpoint = await listen(mustCall((serverSession) => {
+  // One response per client stream, plus the final health-check stream.
+  serverSession.onstream = mustCall((stream) => {
+    // Respond and immediately finish. We never read the request body.
+    stream.setBody(payload);
+  }, kStreamCount + 1);
+}));
+
+const clientSession = await connect(serverEndpoint.address, {
+  transportParams: {
+    // Connection-level receive window, shared by all streams.
+    initialMaxData: kInitialMaxData,
+    // Give each individual stream enough room for a whole response so that
+    // the connection-level window is the only thing that can throttle us.
+    initialMaxStreamDataBidiLocal: kPayloadSize * 2,
+  },
+});
+await clientSession.opened;
+
+for (let i = 0; i < kStreamCount; i++) {
+  const stream = await clientSession.createBidirectionalStream({
+    body: encoder.encode('request'),
+  });
+
+  // Wait until the whole response has actually been received, so that the
+  // bytes are genuinely holding flow control credit at the point we destroy
+  // the stream. If credit is leaked, this loop is where later iterations
+  // stall: the server runs out of connection-level window and can no longer
+  // send, so bytesReceived never reaches the payload size.
+  while (stream.stats.bytesReceived < kPayloadSize) {
+    await new Promise((resolve) => setTimeout(resolve, 5));
+  }
+
+  // Destroy with the response still buffered and unread. This is the case
+  // that used to leak: the backpressure listener is detached, so nothing
+  // would ever return the credit for these bytes.
+  stream.destroy();
+}
+
+// Getting here at all is the assertion -- a leak manifests as a timeout
+// above. Verify the session is still healthy and able to move data, which
+// confirms the window was replenished rather than merely limping along.
+{
+  const stream = await clientSession.createBidirectionalStream({
+    body: encoder.encode('request'),
+  });
+  let received = 0;
+  for await (const chunks of stream) {
+    for (const chunk of chunks) received += chunk.byteLength;
+  }
+  assert.strictEqual(received, kPayloadSize);
+}
+
+await clientSession.close();
+await serverEndpoint.close();
+
+// Sanity check that the test actually exercised the intended path.
+assert.ok(kPayloadSize * kStreamCount > kInitialMaxData,
+          'test must move more data than the connection window allows');
diff --git a/test/parallel/test-quic-flow-control-large-constrained.mjs b/test/parallel/test-quic-flow-control-large-constrained.mjs
new file mode 100644
index 000000000000..db73141528b1
--- /dev/null
+++ b/test/parallel/test-quic-flow-control-large-constrained.mjs
@@ -0,0 +1,121 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: high volume transfer through a deliberately constrained flow
+// control window.
+//
+// The existing flow control tests either move a small amount of data through
+// a tiny window, or a large amount of data through the default (large)
+// window. Neither combination stresses the credit accounting: a bug that
+// mis-credits a few bytes per window extension is invisible over 8KB but
+// fatal over several megabytes.
+//
+// Here the payload is orders of magnitude larger than both the stream-level
+// and connection-level receive windows, so completing the transfer requires
+// hundreds of MAX_STREAM_DATA / MAX_DATA extensions. If any extension
+// under-credits, the transfer stalls and the test times out; if any
+// over-credits or misorders data, the hash check fails.
+
+import { hasQuic, skip, mustCall, mustCallAtLeast } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect, makePayload, hashBytes } =
+  await import('../common/quic.mjs');
+const { bytes } = await import('stream/iter');
+
+// 4 MB through a 16 KB stream window and a 32 KB connection window. The
+// windows are capped via maxStreamWindow/maxWindow as well, otherwise
+// ngtcp2's window auto-tuning grows them and the transfer stops being
+// flow-control bound.
+const kTotal = 4 * 1024 * 1024;
+const kStreamWindow = 16 * 1024;
+const kConnWindow = 32 * 1024;
+
+// Guard: the point of this test is that the window has to be recycled many
+// times over. If someone lowers kTotal or raises the windows to speed the
+// test up, this makes the loss of coverage explicit rather than silent.
+assert.ok(kTotal / kConnWindow >= 100,
+          'payload must require >=100 connection window refills');
+assert.ok(kTotal / kStreamWindow >= 100,
+          'payload must require >=100 stream window refills');
+
+const transportParams = {
+  initialMaxStreamDataBidiRemote: kStreamWindow,
+  initialMaxStreamDataUni: kStreamWindow,
+  initialMaxData: kConnWindow,
+};
+const windowCaps = {
+  maxStreamWindow: kStreamWindow,
+  maxWindow: kConnWindow,
+};
+
+// Bidirectional: client sends a large body, server verifies it.
+{
+  const payload = makePayload(kTotal);
+  const expectedHash = hashBytes(payload);
+  const serverDone = Promise.withResolvers();
+
+  const serverEndpoint = await listen(mustCall((serverSession) => {
+    serverSession.onstream = mustCall(async (stream) => {
+      const received = await bytes(stream);
+      assert.strictEqual(received.byteLength, kTotal);
+      // Order-sensitive hash: catches duplicated, dropped, or reordered
+      // regions that preserve the total length.
+      assert.strictEqual(hashBytes(received), expectedHash);
+      stream.writer.endSync();
+      await stream.closed;
+      serverSession.close();
+      serverDone.resolve();
+    });
+  }), { transportParams, ...windowCaps });
+
+  const clientSession = await connect(serverEndpoint.address);
+  await clientSession.opened;
+
+  const stream = await clientSession.createBidirectionalStream();
+
+  // Assert the sender actually hit the window. Without this the test could
+  // pass trivially if the windows were silently widened, and we would lose
+  // the coverage without noticing.
+  stream.onblocked = mustCallAtLeast(1);
+
+  stream.setBody(payload);
+
+  for await (const _ of stream) { /* drain */ } // eslint-disable-line no-unused-vars
+  await Promise.all([stream.closed, serverDone.promise]);
+  await clientSession.close();
+  await serverEndpoint.close();
+}
+
+// Unidirectional: same volume, exercises the uni credit path, which uses
+// different transport parameters and a different stream type.
+{
+  const payload = makePayload(kTotal, 7);
+  const expectedHash = hashBytes(payload);
+  const serverDone = Promise.withResolvers();
+
+  const serverEndpoint = await listen(mustCall((serverSession) => {
+    serverSession.onstream = mustCall(async (stream) => {
+      const received = await bytes(stream);
+      assert.strictEqual(received.byteLength, kTotal);
+      assert.strictEqual(hashBytes(received), expectedHash);
+      await stream.closed;
+      serverSession.close();
+      serverDone.resolve();
+    });
+  }), { transportParams, ...windowCaps });
+
+  const clientSession = await connect(serverEndpoint.address);
+  await clientSession.opened;
+
+  const stream = await clientSession.createUnidirectionalStream();
+  stream.onblocked = mustCallAtLeast(1);
+  stream.setBody(payload);
+
+  await Promise.all([stream.closed, serverDone.promise]);
+  await clientSession.close();
+  await serverEndpoint.close();
+}
diff --git a/test/parallel/test-quic-flow-control-slow-consumer-volume.mjs b/test/parallel/test-quic-flow-control-slow-consumer-volume.mjs
new file mode 100644
index 000000000000..52e6a92512ef
--- /dev/null
+++ b/test/parallel/test-quic-flow-control-slow-consumer-volume.mjs
@@ -0,0 +1,116 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: a slow consumer keeps buffered data bounded by the flow control
+// window, over a transfer far larger than that window.
+//
+// The existing slow-consumer test only checks that a small transfer still
+// completes and that onblocked fired. The stronger property -- that the
+// receiver never buffers more than the window allows, no matter how far
+// behind the consumer falls -- needs volume to be meaningful, because it is
+// the *repeated* refusal to over-credit that keeps memory bounded.
+//
+// Credit for inbound data is only returned once the consumer actually reads
+// it, so if the receiver ever credited data it had merely buffered, the
+// sender would be free to run arbitrarily far ahead and buffered bytes would
+// grow without bound. Asserting a ceiling on maxBytesAccumulated over a
+// multi-megabyte transfer is a direct check that this does not happen.
+
+import { hasQuic, skip, mustCall, mustCallAtLeast } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect, makePayload, hashBytes } =
+  await import('../common/quic.mjs');
+const { setImmediate: yieldToLoop } = await import('node:timers/promises');
+
+const kTotal = 4 * 1024 * 1024;
+const kStreamWindow = 16 * 1024;
+const kConnWindow = 32 * 1024;
+
+// Yield to the event loop every few reads. This lets the sender run as far
+// ahead as flow control permits without adding wall-clock delay to the test.
+const kYieldEvery = 4;
+
+assert.ok(kTotal / kStreamWindow >= 100,
+          'payload must be far larger than the window to be meaningful');
+
+const payload = makePayload(kTotal, 5);
+const expectedHash = hashBytes(payload);
+
+const serverDone = Promise.withResolvers();
+let peakAccumulated = 0;
+let received = 0;
+const parts = [];
+
+const serverEndpoint = await listen(mustCall((serverSession) => {
+  serverSession.onstream = mustCall(async (stream) => {
+    let reads = 0;
+    for await (const chunks of stream) {
+      for (const chunk of chunks) {
+        received += chunk.byteLength;
+        parts.push(chunk);
+      }
+
+      // maxBytesAccumulated is the high water mark of data that has been
+      // received but not yet consumed.
+      const accumulated = Number(stream.stats.maxBytesAccumulated);
+      if (accumulated > peakAccumulated) peakAccumulated = accumulated;
+
+      if (++reads % kYieldEvery === 0) await yieldToLoop();
+    }
+
+    stream.writer.endSync();
+    await stream.closed;
+    serverSession.close();
+    serverDone.resolve();
+  });
+}), {
+  transportParams: {
+    initialMaxStreamDataBidiRemote: kStreamWindow,
+    initialMaxData: kConnWindow,
+  },
+  maxStreamWindow: kStreamWindow,
+  maxWindow: kConnWindow,
+});
+
+const clientSession = await connect(serverEndpoint.address);
+await clientSession.opened;
+
+const stream = await clientSession.createBidirectionalStream();
+// The sender must actually hit the window, otherwise the consumer was not
+// slow relative to the sender and the ceiling below proves nothing.
+stream.onblocked = mustCallAtLeast(1);
+stream.setBody(payload);
+
+for await (const _ of stream) { /* drain */ } // eslint-disable-line no-unused-vars
+await Promise.all([stream.closed, serverDone.promise]);
+
+// Integrity first: bounded buffering is only interesting if no data was lost.
+assert.strictEqual(received, kTotal);
+const assembled = new Uint8Array(received);
+let offset = 0;
+for (const part of parts) {
+  assembled.set(part, offset);
+  offset += part.byteLength;
+}
+assert.strictEqual(hashBytes(assembled), expectedHash);
+
+// Upper bound: buffered-but-unread data never exceeded the window, even
+// though the payload was 256x the window. This is the property that keeps
+// receiver memory bounded regardless of consumer speed.
+assert.ok(peakAccumulated <= kStreamWindow,
+          `buffered data (${peakAccumulated}) must stay within the flow ` +
+          `control window (${kStreamWindow})`);
+
+// Lower bound: the buffer genuinely filled up. Without this the ceiling
+// above could be satisfied trivially by a consumer that kept pace with the
+// sender, which would not test the bound at all.
+assert.ok(peakAccumulated > kStreamWindow / 2,
+          `consumer was not slow enough to exercise the bound, peak ` +
+          `buffered was only ${peakAccumulated}`);
+
+await clientSession.close();
+await serverEndpoint.close();
diff --git a/test/parallel/test-quic-h3-flow-control-volume.mjs b/test/parallel/test-quic-h3-flow-control-volume.mjs
new file mode 100644
index 000000000000..e422d1a411ad
--- /dev/null
+++ b/test/parallel/test-quic-h3-flow-control-volume.mjs
@@ -0,0 +1,120 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: HTTP/3 high volume transfer through constrained flow control
+// windows, in both directions.
+//
+// HTTP/3 credits inbound flow control differently from raw QUIC. The bytes
+// consumed by nghttp3 frame parsing are credited as soon as they are read,
+// but DATA frame *payload* is deliberately excluded from that and is instead
+// credited later, when the application actually consumes it. That makes the
+// HTTP/3 receive path a genuinely separate code path from raw QUIC rather
+// than a thin wrapper over it, so it needs its own volume coverage: a
+// mis-credit here (either double counting the payload or never crediting it)
+// would not be caught by the raw QUIC tests.
+//
+// A large request body and a large response body are both pushed through
+// windows far smaller than either, so the transfer only completes if the
+// payload is credited exactly once as it is consumed.
+
+import { hasQuic, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect } = await import('node:quic');
+const { createPrivateKey } = await import('node:crypto');
+const { makePayload, hashBytes } = await import('../common/quic.mjs');
+const { bytes } = await import('stream/iter');
+
+const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+const cert = fixtures.readKey('agent1-cert.pem');
+
+const kTotal = 2 * 1024 * 1024;         // per direction
+const kStreamWindow = 16 * 1024;
+const kConnWindow = 32 * 1024;
+
+assert.ok(kTotal / kStreamWindow >= 100,
+          'payload must be far larger than the window to be meaningful');
+
+// Distinct payloads per direction so a direction mixup is detectable.
+const requestBody = makePayload(kTotal, 31);
+const responseBody = makePayload(kTotal, 41);
+const requestHash = hashBytes(requestBody);
+const responseHash = hashBytes(responseBody);
+assert.notStrictEqual(requestHash, responseHash);
+
+const serverDone = Promise.withResolvers();
+
+const serverEndpoint = await listen(mustCall(async (serverSession) => {
+  serverSession.onstream = mustCall(async (stream) => {
+    // Read the large request body. This is the path where DATA payload
+    // credit is deferred until consumption.
+    const body = await bytes(stream);
+    assert.strictEqual(body.byteLength, kTotal);
+    // Must be the request body, intact and in order.
+    assert.strictEqual(hashBytes(body), requestHash);
+
+    await stream.closed;
+    serverSession.close();
+    serverDone.resolve();
+  });
+}), {
+  sni: { '*': { keys: [key], certs: [cert] } },
+  transportParams: {
+    initialMaxStreamDataBidiRemote: kStreamWindow,
+    initialMaxData: kConnWindow,
+  },
+  maxStreamWindow: kStreamWindow,
+  maxWindow: kConnWindow,
+  onheaders: mustCall(function(headers) {
+    assert.strictEqual(headers[':method'], 'POST');
+    this.sendHeaders({ ':status': '200', 'content-type': 'application/octet-stream' });
+    // Send a large response body concurrently with reading the request
+    // body, so both directions are flow-control bound at the same time.
+    this.setBody(responseBody);
+  }),
+});
+
+const clientSession = await connect(serverEndpoint.address, {
+  servername: 'localhost',
+  verifyPeer: 'manual',
+  transportParams: {
+    initialMaxStreamDataBidiLocal: kStreamWindow,
+    initialMaxData: kConnWindow,
+  },
+  maxStreamWindow: kStreamWindow,
+  maxWindow: kConnWindow,
+});
+
+const info = await clientSession.opened;
+assert.strictEqual(info.protocol, 'h3');
+
+const headersReceived = Promise.withResolvers();
+
+const stream = await clientSession.createBidirectionalStream({
+  headers: {
+    ':method': 'POST',
+    ':path': '/upload',
+    ':scheme': 'https',
+    ':authority': 'localhost',
+  },
+  body: requestBody,
+  onheaders: mustCall(function(headers) {
+    assert.strictEqual(headers[':status'], 200);
+    headersReceived.resolve();
+  }),
+});
+
+await headersReceived.promise;
+
+const received = await bytes(stream);
+assert.strictEqual(received.byteLength, kTotal);
+// Must be the response body, intact and in order.
+assert.strictEqual(hashBytes(received), responseHash);
+
+await Promise.all([stream.closed, serverDone.promise]);
+await clientSession.close();
+await serverEndpoint.close();
diff --git a/test/parallel/test-quic-h3-stream-destroy-no-resurrect.mjs b/test/parallel/test-quic-h3-stream-destroy-no-resurrect.mjs
new file mode 100644
index 000000000000..c9e05eb245b1
--- /dev/null
+++ b/test/parallel/test-quic-h3-stream-destroy-no-resurrect.mjs
@@ -0,0 +1,97 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: HTTP/3 request streams are not resurrected after being destroyed
+// with response DATA still in flight.
+//
+// This is the HTTP/3 counterpart to test-quic-stream-destroy-no-resurrect.
+// The HTTP/3 receive path finds or creates a Stream for each nghttp3
+// callback, so it has to make the same distinction: a locally-initiated
+// request stream that is no longer tracked was destroyed by the application
+// and must not be recreated when the remaining DATA frames arrive.
+//
+// It also has to keep crediting flow control for the payload it discards.
+// nghttp3 hands DATA payload to the application uncredited (it is excluded
+// from the framing bytes credited when the stream data is read), so silently
+// dropping it would permanently shrink the session's shared receive window --
+// which is why this test runs enough requests to outlast a small window.
+
+import { hasQuic, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect } = await import('node:quic');
+const { createPrivateKey } = await import('node:crypto');
+const { makePayload } = await import('../common/quic.mjs');
+
+const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+const cert = fixtures.readKey('agent1-cert.pem');
+
+const kResponseSize = 256 * 1024;
+const kRequests = 12;
+// Deliberately smaller than the aggregate discarded payload, so the run only
+// completes if discarded DATA is still credited back.
+const kConnWindow = 256 * 1024;
+
+const responseBody = makePayload(kResponseSize, 17);
+
+assert.ok(kResponseSize * kRequests > kConnWindow * 4,
+          'aggregate response data must far exceed the connection window');
+
+const serverEndpoint = await listen(mustCall((serverSession) => {
+  serverSession.onstream = mustCall((stream) => {
+    // The client destroys these early; the truncated write is expected.
+    stream.onerror = () => {};
+  }, kRequests);
+}), {
+  sni: { '*': { keys: [key], certs: [cert] } },
+  onheaders: mustCall(function() {
+    this.sendHeaders({ ':status': '200' });
+    this.setBody(responseBody);
+  }, kRequests),
+});
+
+const clientSession = await connect(serverEndpoint.address, {
+  servername: 'localhost',
+  verifyPeer: 'manual',
+  transportParams: {
+    initialMaxData: kConnWindow,
+    initialMaxStreamDataBidiLocal: kResponseSize * 2,
+  },
+});
+
+// The client opens every stream itself; the server opens none. Any onstream
+// here is a destroyed request stream being resurrected and misreported as
+// peer-initiated.
+clientSession.onstream = mustNotCall(
+  'client must not receive onstream for its own destroyed request streams');
+
+const info = await clientSession.opened;
+assert.strictEqual(info.protocol, 'h3');
+
+for (let i = 0; i < kRequests; i++) {
+  const stream = await clientSession.createBidirectionalStream({
+    headers: {
+      ':method': 'GET',
+      ':path': `/${i}`,
+      ':scheme': 'https',
+      ':authority': 'localhost',
+    },
+  });
+
+  // Take one batch of the response, then abandon the rest and destroy, so
+  // DATA frames keep arriving for a stream we no longer track.
+  // eslint-disable-next-line no-unused-vars
+  for await (const _ of stream) break;
+
+  stream.destroy();
+}
+
+// Exactly one locally-opened stream per request.
+assert.strictEqual(Number(clientSession.stats.bidiOutStreamCount), kRequests);
+
+await clientSession.close();
+await serverEndpoint.close();
diff --git a/test/parallel/test-quic-h3-uni-stream-teardown.mjs b/test/parallel/test-quic-h3-uni-stream-teardown.mjs
new file mode 100644
index 000000000000..6f93ef73eb2d
--- /dev/null
+++ b/test/parallel/test-quic-h3-uni-stream-teardown.mjs
@@ -0,0 +1,34 @@
+// Flags: --experimental-quic --no-warnings
+
+// Regression test for https://github.com/nodejs/node/issues/65408.
+// A client-created unidirectional stream is not a valid HTTP/3 request stream,
+// but nghttp3 handles it internally. Destroying the endpoint after receiving
+// data on that stream must not crash during process teardown.
+
+import { hasQuic, skip, mustNotCall } from '../common/index.mjs';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { createPrivateKey } = await import('node:crypto');
+const { listen, connect } = await import('node:quic');
+
+const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+const cert = fixtures.readKey('agent1-cert.pem');
+
+const endpoint = await listen(mustNotCall(), {
+  sni: { '*': { keys: [key], certs: [cert] } },
+});
+
+const session = await connect(endpoint.address, {
+  servername: 'localhost',
+  verifyPeer: 'manual',
+});
+
+const stream = await session.createUnidirectionalStream();
+stream.writer.writeSync('x');
+
+endpoint.destroy();
+await endpoint.closed;
diff --git a/test/parallel/test-quic-stream-destroy-no-resurrect.mjs b/test/parallel/test-quic-stream-destroy-no-resurrect.mjs
new file mode 100644
index 000000000000..50687472a64c
--- /dev/null
+++ b/test/parallel/test-quic-stream-destroy-no-resurrect.mjs
@@ -0,0 +1,80 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: destroying a locally-initiated stream with data still in flight does
+// not resurrect it.
+//
+// When a stream is destroyed, its ngtcp2 stream user data is cleared. Inbound
+// STREAM frames the peer had already put in flight then arrive for a stream
+// the receiver no longer tracks. Treating "no user data" as "a stream I have
+// not seen before" is wrong for a stream we initiated ourselves: we are the
+// only party that can create it, so the absence of a record means we
+// destroyed it, not that it is new.
+//
+// Getting this wrong is visible from JavaScript in two ways, both asserted
+// here:
+//
+//   * the session reports far more locally-opened streams than were actually
+//     opened, because a fresh Stream is created for every frame still in
+//     flight
+//   * the application receives onstream events for streams it initiated and
+//     already destroyed, which is a contract violation -- onstream is for
+//     peer-initiated streams
+//
+// It also eventually breaks the session outright: the churn exhausts the
+// local stream budget and createBidirectionalStream() starts throwing
+// ERR_QUIC_OPEN_STREAM_FAILED.
+
+import { hasQuic, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect, makePayload } = await import('../common/quic.mjs');
+
+// The payload has to be big enough that the server still has plenty in flight
+// when the client walks away, which is what creates the stale frames.
+const kPayloadSize = 256 * 1024;
+const kStreams = 12;
+
+const payload = makePayload(kPayloadSize, 13);
+
+const serverEndpoint = await listen(mustCall((serverSession) => {
+  serverSession.onstream = mustCall((stream) => {
+    // The client destroys these early, so the write is cut short by
+    // STOP_SENDING. That is the scenario under test, not a failure.
+    stream.onerror = () => {};
+    stream.setBody(payload);
+  }, kStreams);
+}));
+
+const clientSession = await connect(serverEndpoint.address);
+
+// The client never expects an incoming stream: it opens every stream itself
+// and the server opens none. Any onstream event here is a resurrected local
+// stream being mistaken for a peer-initiated one.
+clientSession.onstream = mustNotCall(
+  'client must not receive onstream for its own destroyed streams');
+
+await clientSession.opened;
+
+for (let i = 0; i < kStreams; i++) {
+  const stream = await clientSession.createBidirectionalStream({
+    body: new Uint8Array(8),
+  });
+
+  // Read a little, then abandon the rest and destroy. Breaking out of the
+  // loop leaves the server mid-send, so frames keep arriving after destroy.
+  // eslint-disable-next-line no-unused-vars
+  for await (const _ of stream) break;
+
+  stream.destroy();
+}
+
+// Exactly one locally-opened stream per iteration. Before the fix this
+// counted in the hundreds, because every stale frame created a new stream.
+assert.strictEqual(Number(clientSession.stats.bidiOutStreamCount), kStreams);
+
+await clientSession.close();
+await serverEndpoint.close();
diff --git a/test/parallel/test-quic-stream-writer-api.mjs b/test/parallel/test-quic-stream-writer-api.mjs
index 009cb4ff8a4a..4f19502d8579 100644
--- a/test/parallel/test-quic-stream-writer-api.mjs
+++ b/test/parallel/test-quic-stream-writer-api.mjs
@@ -16,7 +16,7 @@ const { bytes } = await import('stream/iter');
 
 const encoder = new TextEncoder();
 
-const totalStreams = 5;
+const totalStreams = 6;
 const serverResults = [];
 const allDone = Promise.withResolvers();
 
@@ -88,6 +88,25 @@ await clientSession.opened;
   await stream.closed;
 }
 
+// Web IDL Writer argument conversion
+{
+  const stream = await clientSession.createBidirectionalStream();
+  const w = stream.writer;
+  await w.write(42, null);
+  await w.writev(new Set([true, { toString: () => 'object' }]));
+  assert.throws(
+    () => w.write(Symbol('invalid')),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.throws(
+    () => w.write('invalid options', 1),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.strictEqual(w.endSync(), 12);
+  for await (const _ of stream) { /* drain */ } // eslint-disable-line no-unused-vars
+  await stream.closed;
+}
+
 {
   const stream = await clientSession.createBidirectionalStream();
   const w = stream.writer;
@@ -139,4 +158,5 @@ assert.strictEqual(decoder.decode(serverResults[0]), 'async write');
 assert.strictEqual(decoder.decode(serverResults[1]), 'hello writev');
 assert.strictEqual(decoder.decode(serverResults[2]), 'async writev');
 assert.strictEqual(decoder.decode(serverResults[3]), 'end async');
-assert.strictEqual(decoder.decode(serverResults[4]), 'capacity');
+assert.strictEqual(decoder.decode(serverResults[4]), '42trueobject');
+assert.strictEqual(decoder.decode(serverResults[5]), 'capacity');
diff --git a/test/parallel/test-readable-from-iterator-closing.js b/test/parallel/test-readable-from-iterator-closing.js
index ef7e54821ace..0ddd222756a1 100644
--- a/test/parallel/test-readable-from-iterator-closing.js
+++ b/test/parallel/test-readable-from-iterator-closing.js
@@ -101,6 +101,40 @@ async function syncRejectedSupport() {
   }
 }
 
+async function syncRejectedAfterResolvedSupport() {
+  const expectedError = new Error('later rejection');
+  const finallyMustCall = mustCall();
+  const bodyMustCall = mustCall((chunk) => {
+    assert.strictEqual(chunk, 'a');
+  });
+  const catchMustCall = mustCall((error) => {
+    assert.strictEqual(error, expectedError);
+  });
+  const thirdNextMustNotCall = mustNotCall();
+
+  function* generate() {
+    try {
+      yield Promise.resolve('a');
+      yield Promise.reject(expectedError);
+      thirdNextMustNotCall();
+    } finally {
+      finallyMustCall();
+    }
+  }
+
+  const stream = Readable.from(generate());
+
+  try {
+    for await (const chunk of stream) {
+      bodyMustCall(chunk);
+    }
+  } catch (error) {
+    catchMustCall(error);
+  }
+
+  assert.strictEqual(stream.destroyed, true);
+}
+
 async function noReturnAfterThrow() {
   const returnMustNotCall = mustNotCall();
   const bodyMustNotCall = mustNotCall();
@@ -187,6 +221,7 @@ Promise.all([
   syncSupport(),
   syncPromiseSupport(),
   syncRejectedSupport(),
+  syncRejectedAfterResolvedSupport(),
   noReturnAfterThrow(),
   closeStreamWhileNextIsPending(),
   closeAfterNullYielded(),
diff --git a/test/parallel/test-require-resolve.js b/test/parallel/test-require-resolve.js
index 44422706e186..039e6cd7adf4 100644
--- a/test/parallel/test-require-resolve.js
+++ b/test/parallel/test-require-resolve.js
@@ -62,8 +62,6 @@ require(fixtures.path('resolve-paths', 'default', 'verify-paths.js'));
   builtinModules.forEach((mod) => {
     // TODO(@jasnell): Remove once node:quic is no longer flagged
     if (mod === 'node:quic') return;
-    // TODO: Remove once node:ffi is no longer flagged
-    if (mod === 'node:ffi') return;
     // Remove once node:vfs is no longer flagged
     if (mod === 'node:vfs') return;
     if (mod === 'node:sqlite' && !common.hasSQLite) return;
diff --git a/test/parallel/test-runner-cli.js b/test/parallel/test-runner-cli.js
index 0702c5c1500c..5a5e6b9bdf11 100644
--- a/test/parallel/test-runner-cli.js
+++ b/test/parallel/test-runner-cli.js
@@ -3,6 +3,7 @@
 require('../common');
 const assert = require('assert');
 const { spawnSync } = require('child_process');
+const { spawnSyncAndAssert } = require('../common/child_process');
 const { join } = require('path');
 const fixtures = require('../common/fixtures');
 const testFixtures = fixtures.path('test-runner');
@@ -70,16 +71,14 @@ for (const isolation of ['none', 'process']) {
       const args = ['--test', '--test-reporter=tap',
                     '--no-experimental-strip-types',
                     `--test-isolation=${isolation}`, dir];
-      const child = spawnSync(process.execPath, args, { cwd: testFixtures });
-
-      assert.strictEqual(child.status, 0);
-      assert.strictEqual(child.signal, null);
-      assert.strictEqual(child.stderr.toString(), '');
-      const stdout = child.stdout.toString();
-
-      assert.match(stdout, /ok 1 - this should pass/);
-      assert.match(stdout, /ok 2 - this should pass/);
-      assert.match(stdout, /ok 3 - this should pass/);
+      spawnSyncAndAssert(process.execPath, args, { cwd: testFixtures }, {
+        stderr: '',
+        stdout(output) {
+          assert.match(output, /ok 1 - this should pass/);
+          assert.match(output, /ok 2 - this should pass/);
+          assert.match(output, /ok 3 - this should pass/);
+        },
+      });
     }
   }
 
diff --git a/test/parallel/test-runner-coverage-default-exclusion.mjs b/test/parallel/test-runner-coverage-default-exclusion.mjs
index f6080612a37c..acc8c3bbfe96 100644
--- a/test/parallel/test-runner-coverage-default-exclusion.mjs
+++ b/test/parallel/test-runner-coverage-default-exclusion.mjs
@@ -1,10 +1,10 @@
 import '../common/index.mjs';
 import { before, describe, it } from 'node:test';
 import assert from 'node:assert';
-import { spawnSync } from 'node:child_process';
 import { cp } from 'node:fs/promises';
 import tmpdir from '../common/tmpdir.js';
 import fixtures from '../common/fixtures.js';
+import { spawnSyncAndAssert } from '../common/child_process.js';
 const skipIfNoInspector = {
   skip: !process.features.inspector ? 'inspector disabled' : false
 };
@@ -57,14 +57,13 @@ describe('test runner coverage default exclusion', skipIfNoInspector, () => {
       '--test-reporter=tap',
       '--no-experimental-strip-types',
     ];
-    const result = spawnSync(process.execPath, args, {
+    spawnSyncAndAssert(process.execPath, args, {
       env: { ...process.env, NODE_TEST_TMPDIR: tmpdir.path },
       cwd: tmpdir.path
+    }, {
+      stderr: '',
+      stdout: new RegExp(RegExp.escape(report)),
     });
-
-    assert.strictEqual(result.stderr.toString(), '');
-    assert(result.stdout.toString().includes(report));
-    assert.strictEqual(result.status, 0);
   });
 
   it('should exclude test files from coverage by default', async () => {
@@ -74,14 +73,13 @@ describe('test runner coverage default exclusion', skipIfNoInspector, () => {
       '--experimental-test-coverage',
       '--test-reporter=tap',
     ];
-    const result = spawnSync(process.execPath, args, {
+    spawnSyncAndAssert(process.execPath, args, {
       env: { ...process.env, NODE_TEST_TMPDIR: tmpdir.path },
       cwd: tmpdir.path
+    }, {
+      stderr: '',
+      stdout: assertDefaultExclusions,
     });
-
-    assert.strictEqual(result.stderr.toString(), '');
-    assertDefaultExclusions(result.stdout.toString());
-    assert.strictEqual(result.status, 0);
   });
 
   it('should exclude ts test files', async () => {
@@ -91,14 +89,13 @@ describe('test runner coverage default exclusion', skipIfNoInspector, () => {
       '--disable-warning=ExperimentalWarning',
       '--test-reporter=tap',
     ];
-    const result = spawnSync(process.execPath, args, {
+    spawnSyncAndAssert(process.execPath, args, {
       env: { ...process.env, NODE_TEST_TMPDIR: tmpdir.path },
       cwd: tmpdir.path
+    }, {
+      stderr: '',
+      stdout: assertDefaultExclusions,
     });
-
-    assert.strictEqual(result.stderr.toString(), '');
-    assertDefaultExclusions(result.stdout.toString());
-    assert.strictEqual(result.status, 0);
   });
 
   it('should exclude dotfile test files from coverage by default', async () => {
@@ -109,14 +106,15 @@ describe('test runner coverage default exclusion', skipIfNoInspector, () => {
       '--test-reporter=tap',
       'test/.dotfile.cjs',
     ];
-    const result = spawnSync(process.execPath, args, {
+    spawnSyncAndAssert(process.execPath, args, {
       env: { ...process.env, NODE_TEST_TMPDIR: tmpdir.path },
       cwd: tmpdir.path
+    }, {
+      stderr: '',
+      stdout(output) {
+        assertDefaultExclusions(output);
+        assert.doesNotMatch(output, /#\s+\.dotfile\.cjs\s+\|/);
+      },
     });
-
-    assert.strictEqual(result.stderr.toString(), '');
-    assertDefaultExclusions(result.stdout.toString());
-    assert.doesNotMatch(result.stdout.toString(), /#\s+\.dotfile\.cjs\s+\|/);
-    assert.strictEqual(result.status, 0);
   });
 });
diff --git a/test/parallel/test-runner-coverage-thresholds.js b/test/parallel/test-runner-coverage-thresholds.js
index 2742464adf64..20738c54386d 100644
--- a/test/parallel/test-runner-coverage-thresholds.js
+++ b/test/parallel/test-runner-coverage-thresholds.js
@@ -2,6 +2,7 @@
 const common = require('../common');
 const assert = require('node:assert');
 const { spawnSync } = require('node:child_process');
+const { spawnSyncAndExit } = require('../common/child_process');
 const { readdirSync } = require('node:fs');
 const { test } = require('node:test');
 const fixtures = require('../common/fixtures');
@@ -172,23 +173,24 @@ for (const coverage of coverages) {
   });
 
   test(`test failing ${coverage.flag} with dot reporter`, () => {
-    const result = spawnSync(process.execPath, [
+    const { child } = spawnSyncAndExit(process.execPath, [
       '--test',
       '--experimental-test-coverage',
       '--test-coverage-exclude=!test/**',
       `${coverage.flag}=99`,
       '--test-reporter', 'dot',
       fixture,
-    ]);
-
-    const stdout = result.stdout.toString();
-    assert.match(
-      stdout,
-      RegExp(`Error: ${coverage.actual.toFixed(2)}% ${coverage.name} coverage does not meet threshold of 99%`)
-    );
-    assert.match(stdout, /start of coverage report/);
-    assert.match(stdout, /end of coverage report/);
-    assert.strictEqual(result.status, 1);
-    assert(!findCoverageFileForPid(result.pid));
+    ], {
+      status: 1,
+      stdout(output) {
+        assert.match(
+          output,
+          RegExp(`Error: ${coverage.actual.toFixed(2)}% ${coverage.name} coverage does not meet threshold of 99%`)
+        );
+        assert.match(output, /start of coverage report/);
+        assert.match(output, /end of coverage report/);
+      },
+    });
+    assert(!findCoverageFileForPid(child.pid));
   });
 }
diff --git a/test/parallel/test-sqlite-backup.mjs b/test/parallel/test-sqlite-backup.mjs
index d1e09569e1ca..f995ae3ca72a 100644
--- a/test/parallel/test-sqlite-backup.mjs
+++ b/test/parallel/test-sqlite-backup.mjs
@@ -1,5 +1,10 @@
 // Flags: --expose-gc
-import { isWindows, skipIfSQLiteMissing } from '../common/index.mjs';
+import {
+  isWindows,
+  skipIfSQLiteMissing,
+  spawnPromisified,
+} from '../common/index.mjs';
+import fixtures from '../common/fixtures.js';
 import tmpdir from '../common/tmpdir.js';
 import { join } from 'node:path';
 import { describe, test } from 'node:test';
@@ -364,3 +369,13 @@ test('source database is kept alive while a backup is in flight', async (t) => {
   const rows = backupDb.prepare('SELECT COUNT(*) AS n FROM data').get();
   t.assert.strictEqual(rows.n, 500);
 });
+
+test('backup promise settles when the backup is the last active request', async (t) => {
+  const { code, signal, stderr } = await spawnPromisified(process.execPath, [
+    fixtures.path('sqlite', 'backup-last-request.mjs'),
+    nextDb(),
+  ]);
+
+  t.assert.strictEqual(signal, null);
+  t.assert.strictEqual(code, 0, stderr);
+});
diff --git a/test/parallel/test-sqlite-options-getter-reentry.js b/test/parallel/test-sqlite-options-getter-reentry.js
new file mode 100644
index 000000000000..495b85db92fb
--- /dev/null
+++ b/test/parallel/test-sqlite-options-getter-reentry.js
@@ -0,0 +1,303 @@
+'use strict';
+const { skipIfSQLiteMissing } = require('../common');
+skipIfSQLiteMissing();
+const tmpdir = require('../common/tmpdir');
+const { join } = require('node:path');
+const { backup, DatabaseSync } = require('node:sqlite');
+const { suite, test } = require('node:test');
+
+tmpdir.refresh();
+
+const invalidState = {
+  code: 'ERR_INVALID_STATE',
+  message: /database is not open/,
+};
+
+// A property getter on the options bag runs arbitrary JavaScript in the middle
+// of the call, so state validated before the options were read can be stale by
+// the time it is used.
+suite('closing the database from an options getter', () => {
+  test('prepare() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.prepare('SELECT 1', {
+        get returnArrays() {
+          db.close();
+          return false;
+        },
+      });
+    }, invalidState);
+  });
+
+  test('function() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.function('fn', {
+        get useBigIntArguments() {
+          db.close();
+          return false;
+        },
+      }, () => 1);
+    }, invalidState);
+  });
+
+  test('function() throws when the length getter closes the database', (t) => {
+    const db = new DatabaseSync(':memory:');
+    const fn = () => 1;
+    Object.defineProperty(fn, 'length', {
+      configurable: true,
+      get() {
+        db.close();
+        return 0;
+      },
+    });
+    t.assert.throws(() => {
+      db.function('fn', fn);
+    }, invalidState);
+  });
+
+  test('aggregate() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.aggregate('agg', {
+        get start() {
+          db.close();
+          return 0;
+        },
+        step: (acc, value) => acc,
+      });
+    }, invalidState);
+  });
+
+  test('aggregate() throws when the length getter closes the database', (t) => {
+    const db = new DatabaseSync(':memory:');
+    const step = (acc, value) => acc;
+    Object.defineProperty(step, 'length', {
+      configurable: true,
+      get() {
+        db.close();
+        return 2;
+      },
+    });
+    t.assert.throws(() => {
+      db.aggregate('agg', { start: 0, step });
+    }, invalidState);
+  });
+
+  test('deserialize() throws instead of using a closed connection', (t) => {
+    const source = new DatabaseSync(':memory:');
+    source.exec('CREATE TABLE data(value TEXT)');
+    const image = source.serialize();
+
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.deserialize(image, {
+        get dbName() {
+          db.close();
+          return 'main';
+        },
+      });
+    }, invalidState);
+  });
+
+  test('createSession() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.createSession({
+        get db() {
+          db.close();
+          return 'main';
+        },
+      });
+    }, invalidState);
+  });
+
+  test('applyChangeset() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+    const session = db.createSession();
+    db.exec('INSERT INTO data (key) VALUES (1)');
+    const changeset = session.changeset();
+
+    t.assert.throws(() => {
+      db.applyChangeset(changeset, {
+        get onConflict() {
+          db.close();
+          return undefined;
+        },
+      });
+    }, invalidState);
+  });
+
+  test('backup() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      backup(db, join(tmpdir.path, 'getter-backup.db'), {
+        get rate() {
+          db.close();
+          return 1;
+        },
+      });
+    }, invalidState);
+  });
+});
+
+// The state check runs before the options bag is read, so a call that is
+// already doomed must not execute any of the caller's getters.
+test('options getters do not run on an already-closed database', (t) => {
+  const source = new DatabaseSync(':memory:');
+  source.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+  const image = source.serialize();
+  const session = source.createSession();
+  source.exec('INSERT INTO data (key) VALUES (1)');
+  const changeset = session.changeset();
+
+  const cases = {
+    prepare: (db, options) => db.prepare('SELECT 1', options),
+    function: (db, options) => db.function('fn', options, () => 1),
+    aggregate: (db, options) => db.aggregate('agg', options),
+    deserialize: (db, options) => db.deserialize(image, options),
+    createSession: (db, options) => db.createSession(options),
+    applyChangeset: (db, options) => db.applyChangeset(changeset, options),
+    backup: (db, options) =>
+      backup(db, join(tmpdir.path, 'closed-backup.db'), options),
+  };
+
+  // The property each method reads first, and a valid value for it, so that a
+  // getter which does run leaves the "did not run" assertion as the failure
+  // rather than a type error from the returned value.
+  const probes = {
+    prepare: ['returnArrays', false],
+    function: ['useBigIntArguments', false],
+    aggregate: ['start', 0],
+    deserialize: ['dbName', 'main'],
+    createSession: ['db', 'main'],
+    applyChangeset: ['onConflict', undefined],
+    backup: ['rate', 1],
+  };
+
+  for (const [name, invoke] of Object.entries(cases)) {
+    const db = new DatabaseSync(':memory:');
+    db.close();
+
+    const [key, value] = probes[name];
+    let ran = false;
+    const options = {
+      get [key]() {
+        ran = true;
+        return value;
+      },
+    };
+
+    t.assert.throws(() => invoke(db, options), invalidState, name);
+    t.assert.strictEqual(ran, false, `${name} ran an options getter`);
+  }
+});
+
+suite('resizing a deserialize() buffer from an options getter', () => {
+  test('throws rather than handing uninitialized memory to SQLite', (t) => {
+    const source = new DatabaseSync(':memory:');
+    source.exec('CREATE TABLE data(value TEXT)');
+    source.prepare('INSERT INTO data (value) VALUES (?)').run('hello');
+    const image = source.serialize();
+
+    const buffer = new ArrayBuffer(image.byteLength, {
+      maxByteLength: image.byteLength,
+    });
+    new Uint8Array(buffer).set(image);
+
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.deserialize(new Uint8Array(buffer), {
+        get dbName() {
+          buffer.resize(1024);
+          return 'main';
+        },
+      });
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /"buffer" argument was resized/,
+    });
+  });
+
+  test('throws when the buffer is detached', (t) => {
+    const source = new DatabaseSync(':memory:');
+    source.exec('CREATE TABLE data(value TEXT)');
+    const image = source.serialize();
+
+    const buffer = new ArrayBuffer(image.byteLength);
+    new Uint8Array(buffer).set(image);
+
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.deserialize(new Uint8Array(buffer), {
+        get dbName() {
+          structuredClone(buffer, { transfer: [buffer] });
+          return 'main';
+        },
+      });
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /"buffer" argument was resized/,
+    });
+  });
+});
+
+// fn.length is configurable, so it must be validated rather than cast blindly.
+suite('non-integer callback length', () => {
+  const badLengths = ['abc', {}, [], null, undefined, NaN, 1.5, Symbol.iterator,
+                      10n, true, 2 ** 40];
+
+  test('function() rejects a non-integer length', (t) => {
+    const db = new DatabaseSync(':memory:');
+    for (const value of badLengths) {
+      const fn = () => 1;
+      Object.defineProperty(fn, 'length', { configurable: true, value });
+      t.assert.throws(() => {
+        db.function('fn', fn);
+      }, {
+        code: 'ERR_INVALID_ARG_TYPE',
+        message: /The "function\.length" property must be an integer/,
+      }, `length=${String(value)}`);
+    }
+  });
+
+  test('aggregate() rejects a non-integer step length', (t) => {
+    const db = new DatabaseSync(':memory:');
+    for (const value of badLengths) {
+      const step = (acc, next) => acc;
+      Object.defineProperty(step, 'length', { configurable: true, value });
+      t.assert.throws(() => {
+        db.aggregate('agg', { start: 0, step, result: (acc) => acc });
+      }, {
+        code: 'ERR_INVALID_ARG_TYPE',
+        message: /The "options\.step\.length" property must be an integer/,
+      }, `length=${String(value)}`);
+    }
+  });
+
+  test('aggregate() rejects a non-integer inverse length', (t) => {
+    const db = new DatabaseSync(':memory:');
+    for (const value of badLengths) {
+      const inverse = (acc, next) => acc;
+      Object.defineProperty(inverse, 'length', { configurable: true, value });
+      t.assert.throws(() => {
+        db.aggregate('agg', {
+          start: 0,
+          step: (acc, next) => acc,
+          inverse,
+          result: (acc) => acc,
+        });
+      }, {
+        code: 'ERR_INVALID_ARG_TYPE',
+        message: /The "options\.inverse\.length" property must be an integer/,
+      }, `length=${String(value)}`);
+    }
+  });
+
+  test('a normal function length is still accepted', (t) => {
+    const db = new DatabaseSync(':memory:');
+    db.function('plus', (a, b) => a + b);
+    t.assert.strictEqual(db.prepare('SELECT plus(1, 2) AS v').get().v, 3);
+  });
+});
diff --git a/test/parallel/test-sqlite-session.js b/test/parallel/test-sqlite-session.js
index a8bbaa77d064..c36ed84a0858 100644
--- a/test/parallel/test-sqlite-session.js
+++ b/test/parallel/test-sqlite-session.js
@@ -6,7 +6,8 @@ const {
   DatabaseSync,
   constants,
 } = require('node:sqlite');
-const { test, suite } = require('node:test');
+const { it, test, suite } = require('node:test');
+const dc = require('node:diagnostics_channel');
 const { nextDb } = require('../sqlite/next-db.js');
 const { Worker } = require('worker_threads');
 const { once } = require('events');
@@ -282,6 +283,25 @@ suite('conflict resolution', () => {
       [{ value: 'world' }]);  // unchanged
   });
 
+  test('database.applyChangeset() - changeset detached by onConflict', (t) => {
+    const { database2, changeset } = prepareConflict();
+    const result = database2.applyChangeset(changeset, {
+      onConflict: () => {
+        const transferred = structuredClone(changeset.buffer, {
+          transfer: [changeset.buffer],
+        });
+        new Uint8Array(transferred).fill(0);
+        return constants.SQLITE_CHANGESET_REPLACE;
+      }
+    });
+
+    t.assert.strictEqual(result, true);
+    t.assert.strictEqual(changeset.byteLength, 0);
+    deepStrictEqual(t)(
+      database2.prepare('SELECT * FROM data ORDER BY key').all(),
+      [{ key: 1, value: 'hello' }, { key: 2, value: 'foo' }]);
+  });
+
   test('database.applyChangeset() - SQLITE_CHANGESET_DATA conflict handled with SQLITE_CHANGESET_REPLACE', (t) => {
     const { database2, changeset } = prepareDataConflict();
     let conflictType = null;
@@ -413,6 +433,35 @@ test('filter handler throws', (t) => {
   });
 });
 
+test('database.applyChangeset() - changeset detached by filter', (t) => {
+  const database1 = new DatabaseSync(':memory:');
+  const database2 = new DatabaseSync(':memory:');
+  database1.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+  database2.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+
+  const session = database1.createSession();
+  database1.exec('INSERT INTO data VALUES (1), (2), (3)');
+  const changeset = session.changeset();
+
+  const result = database2.applyChangeset(changeset, {
+    filter: () => {
+      const transferred = structuredClone(changeset.buffer, {
+        transfer: [changeset.buffer],
+      });
+      new Uint8Array(transferred).fill(0);
+      return true;
+    }
+  });
+
+  t.assert.strictEqual(result, true);
+  t.assert.strictEqual(changeset.byteLength, 0);
+  deepStrictEqual(t)(database2.prepare('SELECT * FROM data').all(), [
+    { key: 1 },
+    { key: 2 },
+    { key: 3 },
+  ]);
+});
+
 test('database.createSession() - filter changes', (t) => {
   const database1 = new DatabaseSync(':memory:');
   const database2 = new DatabaseSync(':memory:');
@@ -612,26 +661,195 @@ test('session.close() - closing twice', (t) => {
   });
 });
 
-test('session.close() - while generating changes throws exception', (t) => {
-  for (const method of ['changeset', 'patchset']) {
-    const database = new DatabaseSync(':memory:');
-    database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, value TEXT)');
+test('session close and dispose - while generating changes throws exception', (t) => {
+  for (const close of ['close', Symbol.dispose]) {
+    for (const method of ['changeset', 'patchset']) {
+      const database = new DatabaseSync(':memory:');
+      database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, value TEXT)');
+
+      const session = database.createSession({ table: 'data' });
+      database.exec("INSERT INTO data VALUES (1, 'a'), (2, 'b'), (3, 'c')");
+      database.setAuthorizer(() => {
+        session[close]();
+        return constants.SQLITE_OK;
+      });
 
-    const session = database.createSession({ table: 'data' });
-    database.exec("INSERT INTO data VALUES (1, 'a'), (2, 'b'), (3, 'c')");
-    database.setAuthorizer(() => {
+      t.assert.throws(() => session[method](), {
+        code: 'ERR_INVALID_STATE',
+        message: 'session is currently in use',
+      });
+
+      database.setAuthorizer(null);
+      t.assert.notStrictEqual(session[method]().length, 0);
+    }
+  }
+});
+
+test('session[Symbol.dispose]() - closed session is a no-op', () => {
+  const database = new DatabaseSync(':memory:');
+  const session = database.createSession();
+  session.close();
+
+  session[Symbol.dispose]();
+});
+
+test('session[Symbol.dispose]() - after closing database is a no-op', () => {
+  const database = new DatabaseSync(':memory:');
+  const session = database.createSession();
+  database.close();
+
+  session[Symbol.dispose]();
+});
+
+// SQLite runs "PRAGMA table_xinfo" from inside its pre-update hook, while it is
+// still walking the connection's session list. Deleting a session from a
+// callback that PRAGMA triggers frees memory the walk is still using, so the
+// close has to be rejected instead.
+suite('session.close() - from a callback', () => {
+  const expectedError =
+    'ERR_INVALID_STATE: session cannot be closed while in a callback';
+
+  for (const method of ['close', 'dispose']) {
+    const closeSession = (session) => {
+      if (method === 'close') {
+        session.close();
+      } else {
+        session[Symbol.dispose]();
+      }
+    };
+
+    it(`rejects ${method} from an authorizer callback`, (t) => {
+      const database = new DatabaseSync(':memory:');
+      database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+      const session = database.createSession();
+      let outcome = 'callback did not run';
+
+      database.setAuthorizer((actionCode, param1) => {
+        if (actionCode === constants.SQLITE_PRAGMA && param1 === 'table_xinfo') {
+          try {
+            closeSession(session);
+            outcome = 'did not throw';
+          } catch (err) {
+            outcome = `${err.code}: ${err.message}`;
+          }
+        }
+        return constants.SQLITE_OK;
+      });
+
+      database.exec('INSERT INTO data VALUES (1)');
+      t.assert.strictEqual(outcome, expectedError);
+
+      // The session survived and kept recording the insert.
+      database.setAuthorizer(null);
+      t.assert.notStrictEqual(session.changeset().length, 0);
       session.close();
-      return constants.SQLITE_OK;
     });
 
-    t.assert.throws(() => session[method](), {
-      code: 'ERR_INVALID_STATE',
-      message: 'session is currently in use',
+    it(`rejects ${method} from a 'sqlite.db.query' subscriber`, (t) => {
+      const database = new DatabaseSync(':memory:');
+      database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+      const session = database.createSession();
+      let outcome = 'callback did not run';
+
+      const handler = ({ sql }) => {
+        if (sql.includes('table_xinfo')) {
+          try {
+            closeSession(session);
+            outcome = 'did not throw';
+          } catch (err) {
+            outcome = `${err.code}: ${err.message}`;
+          }
+        }
+      };
+      dc.subscribe('sqlite.db.query', handler);
+      t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+      database.exec('INSERT INTO data VALUES (1)');
+      t.assert.strictEqual(outcome, expectedError);
+
+      dc.unsubscribe('sqlite.db.query', handler);
+      t.assert.notStrictEqual(session.changeset().length, 0);
+      session.close();
     });
 
-    database.setAuthorizer(null);
-    t.assert.notStrictEqual(session[method]().length, 0);
+    // Deliberately broader than the crash: the pre-update hook is not on the
+    // stack here, so this close is safe today. Node cannot tell whether SQLite
+    // is inside that hook, so every callback is rejected. This pins the
+    // trade-off rather than leaving it to be discovered as a regression.
+    it(`rejects ${method} from a user-defined function`, (t) => {
+      const database = new DatabaseSync(':memory:');
+      database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+      const session = database.createSession();
+      let outcome = 'callback did not run';
+
+      database.function('f', (x) => {
+        try {
+          closeSession(session);
+          outcome = 'did not throw';
+        } catch (err) {
+          outcome = `${err.code}: ${err.message}`;
+        }
+        return x;
+      });
+
+      database.exec('SELECT f(1)');
+      t.assert.strictEqual(outcome, expectedError);
+
+      // Still closable once the callback is off the stack.
+      session.close();
+      t.assert.throws(() => session.close(), { message: 'session is not open' });
+    });
   }
+
+  // Rejecting disposal has a cost: a `using` declaration inside a callback
+  // demotes the block's own error to SuppressedError. Accepted for symmetry
+  // with StatementSync's disposal, which throws for a busy statement the same
+  // way. Pinned here so the trade-off is visible rather than surprising.
+  it('demotes a callback error when disposal is rejected', (t) => {
+    const database = new DatabaseSync(':memory:');
+    database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+    let caught;
+
+    database.function('f', (x) => {
+      try {
+        using session = database.createSession();
+        t.assert.ok(session);
+        throw new Error('callback error');
+      } catch (err) {
+        caught = err;
+      }
+      return x;
+    });
+
+    database.exec('SELECT f(1)');
+    t.assert.ok(caught instanceof SuppressedError);
+    t.assert.strictEqual(caught.suppressed.message, 'callback error');
+    t.assert.strictEqual(
+      caught.error.message,
+      'session cannot be closed while in a callback',
+    );
+  });
+
+  it('leaves an already closed session disposable from a callback', (t) => {
+    const database = new DatabaseSync(':memory:');
+    database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+    const session = database.createSession();
+    session.close();
+    let outcome = 'callback did not run';
+
+    database.setAuthorizer(() => {
+      try {
+        session[Symbol.dispose]();
+        outcome = 'no-op';
+      } catch (err) {
+        outcome = `${err.code}: ${err.message}`;
+      }
+      return constants.SQLITE_OK;
+    });
+
+    database.exec('INSERT INTO data VALUES (1)');
+    t.assert.strictEqual(outcome, 'no-op');
+  });
 });
 
 test('session - keeps its database alive after the db handle is dropped', async (t) => {
@@ -664,6 +882,50 @@ test('session - keeps its database alive after the db handle is dropped', async
   session.close();
 });
 
+// SQLite runs "PRAGMA table_xinfo" from inside its pre-update hook, while it is
+// still walking the connection's session list. Session objects are weak, so a
+// GC during a callback that the PRAGMA triggers could collect a session that
+// JavaScript no longer references and free memory the walk is still using.
+test('session - survives GC during an authorizer callback', (t) => {
+  const database = new DatabaseSync(':memory:');
+  database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+  database.createSession(); // Never referenced again, so it is collectable.
+
+  let ran = false;
+  database.setAuthorizer((actionCode, param1) => {
+    if (actionCode === constants.SQLITE_PRAGMA && param1 === 'table_xinfo') {
+      ran = true;
+      globalThis.gc();
+      globalThis.gc();
+    }
+    return constants.SQLITE_OK;
+  });
+
+  database.exec('INSERT INTO data VALUES (1)');
+  t.assert.ok(ran, 'the authorizer callback never ran');
+});
+
+test("session - survives GC during a 'sqlite.db.query' subscriber", (t) => {
+  const dc = require('node:diagnostics_channel');
+  const database = new DatabaseSync(':memory:');
+  database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+  database.createSession(); // Never referenced again, so it is collectable.
+
+  let ran = false;
+  const handler = ({ sql }) => {
+    if (sql.includes('table_xinfo')) {
+      ran = true;
+      globalThis.gc();
+      globalThis.gc();
+    }
+  };
+  dc.subscribe('sqlite.db.query', handler);
+  t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+  database.exec('INSERT INTO data VALUES (1)');
+  t.assert.ok(ran, 'the subscriber never ran');
+});
+
 test('session supports ERM', (t) => {
   const database = new DatabaseSync(':memory:');
   let afterDisposeSession;
diff --git a/test/parallel/test-startup-large-pages.js b/test/parallel/test-startup-large-pages.js
index 9ebe9fa7b668..f84aca074fb0 100644
--- a/test/parallel/test-startup-large-pages.js
+++ b/test/parallel/test-startup-large-pages.js
@@ -1,30 +1,31 @@
 'use strict';
 
-// Make sure that Node.js runs correctly with the --use-largepages option.
+// Tests that the obsolete --use-largepages option is a no-op. It only prints
+// a warning when the value is `on`.
 
 require('../common');
-const assert = require('assert');
-const { spawnSync } = require('child_process');
+const { spawnSyncAndAssert } = require('../common/child_process');
 
-{
-  const child = spawnSync(process.execPath,
-                          [ '--use-largepages=on', '-p', '42' ],
-                          { stdio: ['inherit', 'pipe', 'inherit'] });
-  const stdout = child.stdout.toString().match(/\S+/g);
-  assert.strictEqual(child.status, 0);
-  assert.strictEqual(child.signal, null);
-  assert.strictEqual(stdout.length, 1);
-  assert.strictEqual(stdout[0], '42');
-}
+spawnSyncAndAssert(process.execPath, ['--use-largepages=on', '-p', '42'], {
+  trim: true,
+  stdout: '42',
+  stderr: /--use-largepages is no longer supported/,
+});
 
-{
-  const child = spawnSync(process.execPath,
-                          [ '--use-largepages=xyzzy', '-p', '42' ]);
-  assert.strictEqual(child.status, 9);
-  assert.strictEqual(child.signal, null);
-  assert.match(child.stderr.toString().trim(),
-               /invalid value for --use-largepages$/);
+for (const mode of ['off', 'silent']) {
+  spawnSyncAndAssert(
+    process.execPath,
+    [`--use-largepages=${mode}`, '-p', '42'],
+    {
+      trim: true,
+      stdout: '42',
+      stderr: '',
+    });
 }
 
-// TODO(gabrielschulhof): Make assertions about the stderr, which may or may not
-// contain a message indicating that mapping to large pages has failed.
+spawnSyncAndAssert(process.execPath, ['--use-largepages=xyzzy', '-p', '42'], {
+  trim: true,
+  status: 9,
+  stdout: '',
+  stderr: /invalid value for --use-largepages/,
+});
diff --git a/test/parallel/test-stream-iter-broadcast-backpressure.js b/test/parallel/test-stream-iter-broadcast-backpressure.js
index 698f1821aeea..6efa7eb54c73 100644
--- a/test/parallel/test-stream-iter-broadcast-backpressure.js
+++ b/test/parallel/test-stream-iter-broadcast-backpressure.js
@@ -3,7 +3,7 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { broadcast, text } = require('stream/iter');
+const { broadcast, ondrain, text } = require('stream/iter');
 
 // =============================================================================
 // Backpressure policies
@@ -47,6 +47,36 @@ async function testDropNewest() {
   assert.strictEqual(data, 'K'.repeat(16384));
 }
 
+async function testDropPoliciesReportPhysicalCapacity() {
+  const chunk = new Uint8Array(16384);
+
+  for (const backpressure of ['drop-oldest', 'drop-newest']) {
+    const { writer, broadcast: bc } = broadcast({
+      budget: chunk.byteLength,
+      backpressure,
+    });
+    const iterator = bc.push()[Symbol.asyncIterator]();
+
+    assert.strictEqual(writer.writeSync(chunk), true);
+    assert.strictEqual(writer.canWrite, false);
+
+    let drained = false;
+    const drain = ondrain(writer);
+    drain.then(common.mustCall(() => { drained = true; }));
+
+    // Drop policies still accept writes despite having no physical capacity.
+    assert.strictEqual(writer.writeSync(chunk), true);
+    assert.strictEqual(writer.canWrite, false);
+    await new Promise(setImmediate);
+    assert.strictEqual(drained, false);
+
+    assert.strictEqual((await iterator.next()).done, false);
+    assert.strictEqual(await drain, true);
+    assert.strictEqual(writer.canWrite, true);
+    bc.cancel();
+  }
+}
+
 // =============================================================================
 // Block backpressure
 // =============================================================================
@@ -269,6 +299,7 @@ async function testEndSyncReturnValue() {
 Promise.all([
   testDropOldest(),
   testDropNewest(),
+  testDropPoliciesReportPhysicalCapacity(),
   testBlockBackpressure(),
   testBlockBackpressureContent(),
   testStrictBackpressureOverflow(),
diff --git a/test/parallel/test-stream-iter-consumers-bytes.js b/test/parallel/test-stream-iter-consumers-bytes.js
index 53d0a3858f87..531917eb9734 100644
--- a/test/parallel/test-stream-iter-consumers-bytes.js
+++ b/test/parallel/test-stream-iter-consumers-bytes.js
@@ -101,6 +101,31 @@ async function testAsyncConsumersAbortPendingNormalization() {
   }
 }
 
+async function testAsyncConsumerSignalPreservesProtocolPrecedence() {
+  let protocolCalls = 0;
+  let iteratorCalls = 0;
+  const source = {
+    __proto__: null,
+    [toAsyncStreamable]() {
+      protocolCalls++;
+      return from('protocol');
+    },
+    async *[Symbol.asyncIterator]() {
+      iteratorCalls++;
+      yield 'iterator';
+    },
+  };
+
+  const result = await text(source, {
+    __proto__: null,
+    signal: new AbortController().signal,
+  });
+
+  assert.strictEqual(result, 'protocol');
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 0);
+}
+
 async function testBytesEmpty() {
   const data = await bytes(from([]));
   assert.ok(data instanceof Uint8Array);
@@ -255,6 +280,7 @@ Promise.all([
   testBytesAsyncAbort(),
   testAsyncConsumersAbortPendingNext(),
   testAsyncConsumersAbortPendingNormalization(),
+  testAsyncConsumerSignalPreservesProtocolPrecedence(),
   testBytesEmpty(),
   testArrayBufferSyncBasic(),
   testArrayBufferAsync(),
diff --git a/test/parallel/test-stream-iter-consumers-merge.js b/test/parallel/test-stream-iter-consumers-merge.js
index 84aeb24b6159..becf68ee63a1 100644
--- a/test/parallel/test-stream-iter-consumers-merge.js
+++ b/test/parallel/test-stream-iter-consumers-merge.js
@@ -108,6 +108,109 @@ async function testMergeSourceError() {
   );
 }
 
+async function testMergeFalsySourceErrors() {
+  const reasons = [undefined, null, false, 0, '', NaN];
+
+  for (const reason of reasons) {
+    const noError = { __proto__: null };
+    let actual = noError;
+    try {
+      await text(merge(rejectedSource(reason), from('other')));
+    } catch (error) {
+      actual = error;
+    }
+    assert.strictEqual(Object.is(actual, reason), true);
+  }
+}
+
+function rejectedSource(reason) {
+  return {
+    __proto__: null,
+    [Symbol.asyncIterator]() {
+      return this;
+    },
+    next() {
+      return Promise.reject(reason);
+    },
+  };
+}
+
+function pendingSource() {
+  return {
+    __proto__: null,
+    [Symbol.asyncIterator]() {
+      return this;
+    },
+    next() {
+      return new Promise(() => {});
+    },
+    return() {
+      return new Promise(() => {});
+    },
+  };
+}
+
+async function testMergeSourceErrorDoesNotAwaitCleanup() {
+  const reason = new Error('source failed');
+
+  const timedOut = { __proto__: null };
+  const outcome = await Promise.race([
+    text(merge(rejectedSource(reason), pendingSource())).then(
+      () => ({ __proto__: null, status: 'fulfilled' }),
+      (error) => ({ __proto__: null, status: 'rejected', error }),
+    ),
+    new Promise((resolve) => setImmediate(resolve, timedOut)),
+  ]);
+
+  assert.notStrictEqual(outcome, timedOut);
+  assert.strictEqual(outcome.status, 'rejected');
+  assert.strictEqual(outcome.error, reason);
+}
+
+async function testMergeBreakDoesNotAwaitCleanup() {
+  async function* readySource() {
+    yield [Uint8Array.of(1)];
+  }
+
+  const timedOut = { __proto__: null };
+  const outcome = await Promise.race([
+    (async () => {
+      for await (const batch of merge(readySource(), pendingSource())) {
+        assert.deepStrictEqual(batch, [Uint8Array.of(1)]);
+        break;
+      }
+      return true;
+    })(),
+    new Promise((resolve) => setImmediate(resolve, timedOut)),
+  ]);
+
+  assert.strictEqual(outcome, true);
+}
+
+async function testMergeNaNAbortDoesNotAwaitCleanup() {
+  const ac = new AbortController();
+  const iterator = merge(pendingSource(), pendingSource(), {
+    __proto__: null,
+    signal: ac.signal,
+  })[Symbol.asyncIterator]();
+  const next = iterator.next();
+  await new Promise(setImmediate);
+  ac.abort(NaN);
+
+  const timedOut = { __proto__: null };
+  const outcome = await Promise.race([
+    next.then(
+      () => ({ __proto__: null, status: 'fulfilled' }),
+      (error) => ({ __proto__: null, status: 'rejected', error }),
+    ),
+    new Promise((resolve) => setImmediate(resolve, timedOut)),
+  ]);
+
+  assert.notStrictEqual(outcome, timedOut);
+  assert.strictEqual(outcome.status, 'rejected');
+  assert.strictEqual(Object.is(outcome.error, NaN), true);
+}
+
 async function testMergeConsumerBreak() {
   let source1Return = false;
   let source2Return = false;
@@ -296,9 +399,8 @@ async function testMergeCleanupErrorOnly() {
   );
 }
 
-// Primary error + cleanup error: a source throws during iteration AND
-// iterator.return() also throws. Should get a SuppressedError.
-async function testMergePrimaryAndCleanupError() {
+// A primary source error must not wait for asynchronous cleanup failures.
+async function testMergePrimaryErrorPrecedesCleanupError() {
   async function* badSource() {
     yield [new TextEncoder().encode('x')];
     throw new Error('primary boom');
@@ -319,15 +421,7 @@ async function testMergePrimaryAndCleanupError() {
         // Consume until error
       }
     },
-    (err) => {
-      assert.ok(
-        err instanceof SuppressedError,
-        `Expected SuppressedError, got ${err.constructor.name}`,
-      );
-      assert.strictEqual(err.error.message, 'primary boom');
-      assert.strictEqual(err.suppressed.message, 'cleanup boom');
-      return true;
-    },
+    { message: 'primary boom' },
   );
 }
 
@@ -353,6 +447,27 @@ async function testMergeBreakWithCleanupError() {
   );
 }
 
+async function testMergeMultiSourceBreakWithCleanupError() {
+  async function* failingReturnSource() {
+    try {
+      yield [new TextEncoder().encode('data')];
+    } finally {
+      await Promise.resolve();
+      throwInFinally('async cleanup on break');
+    }
+  }
+
+  await assert.rejects(
+    async () => {
+      // eslint-disable-next-line no-unused-vars
+      for await (const _ of merge(failingReturnSource(), from('other'))) {
+        break;
+      }
+    },
+    { message: 'async cleanup on break' },
+  );
+}
+
 Promise.all([
   testMergeTwoSources(),
   testMergeSingleSource(),
@@ -360,6 +475,10 @@ Promise.all([
   testMergeWithAbortSignal(),
   testMergeSyncSources(),
   testMergeSourceError(),
+  testMergeFalsySourceErrors(),
+  testMergeSourceErrorDoesNotAwaitCleanup(),
+  testMergeBreakDoesNotAwaitCleanup(),
+  testMergeNaNAbortDoesNotAwaitCleanup(),
   testMergeConsumerBreak(),
   testMergeSignalMidIteration(),
   testMergeSignalDuringPendingMultiSourceRead(),
@@ -368,6 +487,7 @@ Promise.all([
   testMergeStringSources(),
   testMergeObjectLikeSources(),
   testMergeCleanupErrorOnly(),
-  testMergePrimaryAndCleanupError(),
+  testMergePrimaryErrorPrecedesCleanupError(),
   testMergeBreakWithCleanupError(),
+  testMergeMultiSourceBreakWithCleanupError(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-consumers-text.js b/test/parallel/test-stream-iter-consumers-text.js
index a8fb7a74367f..68be098ff8f6 100644
--- a/test/parallel/test-stream-iter-consumers-text.js
+++ b/test/parallel/test-stream-iter-consumers-text.js
@@ -143,17 +143,17 @@ function testTextSyncUnsupportedEncodingThrowsRangeError() {
   );
 }
 
-async function testTextNonStringEncodingThrowsTypeError() {
+async function testTextConvertedEncodingThrowsRangeError() {
   await assert.rejects(
     () => text(from('hello'), { encoding: 1 }),
-    { code: 'ERR_INVALID_ARG_TYPE' },
+    { code: 'ERR_INVALID_ARG_VALUE' },
   );
 }
 
-function testTextSyncNonStringEncodingThrowsTypeError() {
+function testTextSyncConvertedEncodingThrowsRangeError() {
   assert.throws(
     () => textSync(fromSync('hello'), { encoding: 1 }),
-    { code: 'ERR_INVALID_ARG_TYPE' },
+    { code: 'ERR_INVALID_ARG_VALUE' },
   );
 }
 
@@ -173,6 +173,6 @@ Promise.all([
   testTextSyncBOMStripped(),
   testTextUnsupportedEncodingThrowsRangeError(),
   testTextSyncUnsupportedEncodingThrowsRangeError(),
-  testTextNonStringEncodingThrowsTypeError(),
-  testTextSyncNonStringEncodingThrowsTypeError(),
+  testTextConvertedEncodingThrowsRangeError(),
+  testTextSyncConvertedEncodingThrowsRangeError(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-duplex.js b/test/parallel/test-stream-iter-duplex.js
index 0969b91e7d21..354fa28b67a6 100644
--- a/test/parallel/test-stream-iter-duplex.js
+++ b/test/parallel/test-stream-iter-duplex.js
@@ -14,32 +14,26 @@ async function testBasicDuplex() {
 
   // A writes, B reads
   await channelA.writer.write('hello from A');
-  await channelA.close();
-
+  const closing = channelA.close();
   const dataAtB = await text(channelB.readable);
+  await closing;
   assert.strictEqual(dataAtB, 'hello from A');
 }
 
 async function testBidirectional() {
   const [channelA, channelB] = duplex();
 
-  // A writes to B, B writes to A concurrently
-  const writeA = (async () => {
-    await channelA.writer.write('A to B');
-    await channelA.close();
-  })();
-
-  const writeB = (async () => {
-    await channelB.writer.write('B to A');
-    await channelB.close();
-  })();
-
-  const readAtB = text(channelB.readable);
-  const readAtA = text(channelA.readable);
-
-  await Promise.all([writeA, writeB]);
+  await channelA.writer.write('A to B');
+  await channelB.writer.write('B to A');
 
-  const [dataAtA, dataAtB] = await Promise.all([readAtA, readAtB]);
+  const endA = channelA.writer.end();
+  const endB = channelB.writer.end();
+  const [dataAtA, dataAtB] = await Promise.all([
+    text(channelA.readable),
+    text(channelB.readable),
+  ]);
+  await Promise.all([endA, endB]);
+  await Promise.all([channelA.close(), channelB.close()]);
 
   assert.strictEqual(dataAtB, 'A to B');
   assert.strictEqual(dataAtA, 'B to A');
@@ -51,19 +45,29 @@ async function testMultipleWrites() {
   await channelA.writer.write('one');
   await channelA.writer.write('two');
   await channelA.writer.write('three');
-  await channelA.close();
-
+  const closing = channelA.close();
   const data = await text(channelB.readable);
+  await closing;
   assert.strictEqual(data, 'onetwothree');
 }
 
 async function testChannelClose() {
   const [channelA, channelB] = duplex();
-
-  await channelA.close();
-
-  // Should be able to close twice without error
-  await channelA.close();
+  const iteratorA = channelA.readable[Symbol.asyncIterator]();
+  const otherIteratorA = channelA.readable[Symbol.asyncIterator]();
+  const pendingRead = iteratorA.next();
+
+  const closing = channelA.close();
+  assert.strictEqual(channelA.close(), closing);
+  await closing;
+
+  assert.strictEqual((await pendingRead).done, true);
+  assert.strictEqual((await otherIteratorA.next()).done, true);
+  assert.strictEqual(
+    (await channelA.readable[Symbol.asyncIterator]().next()).done, true);
+  await assert.rejects(channelB.writer.write('late'), {
+    code: 'ERR_INVALID_STATE',
+  });
 
   // B's readable should end (A -> B direction is closed)
   const batches = [];
@@ -73,6 +77,20 @@ async function testChannelClose() {
   assert.strictEqual(batches.length, 0);
 }
 
+async function testConcurrentChannelClose() {
+  const [channelA, channelB] = duplex();
+
+  const results = await Promise.allSettled([
+    channelA.close(),
+    channelB.close(),
+  ]);
+
+  assert.deepStrictEqual(results, [
+    { status: 'fulfilled', value: undefined },
+    { status: 'fulfilled', value: undefined },
+  ]);
+}
+
 async function testWithOptions() {
   const [channelA, channelB] = duplex({
     budget: 16384,
@@ -80,9 +98,9 @@ async function testWithOptions() {
   });
 
   await channelA.writer.write('msg');
-  await channelA.close();
-
+  const closing = channelA.close();
   const data = await text(channelB.readable);
+  await closing;
   assert.strictEqual(data, 'msg');
 }
 
@@ -95,15 +113,17 @@ async function testPerChannelOptions() {
   // Channel A -> B direction uses A's options
   // Channel B -> A direction uses B's options
   await channelA.writer.write('from-a');
-  await channelA.close();
-
   await channelB.writer.write('from-b');
-  await channelB.close();
+
+  const endA = channelA.writer.end();
+  const endB = channelB.writer.end();
 
   const [dataAtA, dataAtB] = await Promise.all([
     text(channelA.readable),
     text(channelB.readable),
   ]);
+  await Promise.all([endA, endB]);
+  await Promise.all([channelA.close(), channelB.close()]);
 
   assert.strictEqual(dataAtB, 'from-a');
   assert.strictEqual(dataAtA, 'from-b');
@@ -146,17 +166,39 @@ async function testWriterEndWithPreAbortedSignal() {
 async function testEmptyDuplex() {
   const [channelA, channelB] = duplex();
 
-  // Close without writing
-  await channelA.close();
-  await channelB.close();
+  await channelA.writer.end();
+  await channelB.writer.end();
 
   const dataAtA = await bytes(channelA.readable);
   const dataAtB = await bytes(channelB.readable);
+  await Promise.all([channelA.close(), channelB.close()]);
 
   assert.strictEqual(dataAtA.byteLength, 0);
   assert.strictEqual(dataAtB.byteLength, 0);
 }
 
+async function testCloseWaitsForDrain() {
+  const [channelA, channelB] = duplex();
+  await channelA.writer.write('buffered');
+
+  let closed = false;
+  const closing = channelA.close().then(common.mustCall(() => {
+    closed = true;
+  }));
+  await new Promise(setImmediate);
+  assert.strictEqual(closed, false);
+
+  assert.strictEqual(await text(channelB.readable), 'buffered');
+  await closing;
+}
+
+async function testClosePropagatesWriterFailure() {
+  const [channelA] = duplex();
+  const reason = new Error('writer failed');
+  channelA.writer.fail(reason);
+  await assert.rejects(channelA.close(), (error) => error === reason);
+}
+
 // Channel fail propagation
 async function testChannelFail() {
   const [a, b] = duplex();
@@ -195,11 +237,14 @@ Promise.all([
   testBidirectional(),
   testMultipleWrites(),
   testChannelClose(),
+  testConcurrentChannelClose(),
   testWithOptions(),
   testPerChannelOptions(),
   testAbortSignal(),
   testWriterEndWithPreAbortedSignal(),
   testEmptyDuplex(),
+  testCloseWaitsForDrain(),
+  testClosePropagatesWriterFailure(),
   testChannelFail(),
   testAbortSignalBothChannels(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-from-async.js b/test/parallel/test-stream-iter-from-async.js
index 5ef78088bfbd..a4726d633ef0 100644
--- a/test/parallel/test-stream-iter-from-async.js
+++ b/test/parallel/test-stream-iter-from-async.js
@@ -31,6 +31,30 @@ async function testFromAsyncGenerator() {
   assert.deepStrictEqual(batches[1][0], new Uint8Array([30, 40]));
 }
 
+async function testFromBoundsNestedAsyncIterable() {
+  let nestedClosed = false;
+  async function* nested() {
+    try {
+      let value = 0;
+      while (true) yield new Uint8Array([value++]);
+    } finally {
+      nestedClosed = true;
+    }
+  }
+
+  async function* source() {
+    yield nested();
+  }
+
+  const iterator = from(source())[Symbol.asyncIterator]();
+  const first = await iterator.next();
+  assert.strictEqual(first.done, false);
+  assert.strictEqual(first.value.length, 128);
+
+  await iterator.return();
+  assert.strictEqual(nestedClosed, true);
+}
+
 async function testFromSyncIterableAsAsync() {
   // Sync iterable passed to from() should work
   function* gen() {
@@ -235,6 +259,20 @@ async function testFromTopLevelProtocolOverIterator() {
   assert.strictEqual(result, 'from-protocol');
 }
 
+async function testFromHandlesProtocolRejectionUntilIteration() {
+  const reason = new Error('protocol failed');
+  const iterable = from({
+    [Symbol.for('Stream.toAsyncStreamable')]: common.mustCall(
+      () => Promise.reject(reason)),
+  });
+
+  await new Promise(setImmediate);
+  await assert.rejects(
+    iterable[Symbol.asyncIterator]().next(),
+    (error) => error === reason,
+  );
+}
+
 // DataView input should be converted to Uint8Array (zero-copy)
 async function testFromDataView() {
   const buf = new ArrayBuffer(5);
@@ -260,6 +298,7 @@ function testFromUndefinedThrows() {
 Promise.all([
   testFromString(),
   testFromAsyncGenerator(),
+  testFromBoundsNestedAsyncIterable(),
   testFromSyncIterableAsAsync(),
   testFromSyncIterableAwaitsPromiseValues(),
   testFromSyncIterableRejectsNestedAsyncIterable(),
@@ -279,5 +318,6 @@ Promise.all([
   testFromTopLevelToStreamable(),
   testFromTopLevelAsyncPrecedence(),
   testFromTopLevelProtocolOverIterator(),
+  testFromHandlesProtocolRejectionUntilIteration(),
   testFromDataView(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-pipeto-edge.js b/test/parallel/test-stream-iter-pipeto-edge.js
index 3f09c4dfd42d..13223a226a1f 100644
--- a/test/parallel/test-stream-iter-pipeto-edge.js
+++ b/test/parallel/test-stream-iter-pipeto-edge.js
@@ -1,33 +1,41 @@
 // Flags: --experimental-stream-iter
 'use strict';
 
-// Edge case tests for pipeToSync: endSync fallback, preventFail.
+// Edge case tests for pipeToSync close and failure behavior.
 
 const common = require('../common');
 const assert = require('assert');
 const { pipeToSync, fromSync } = require('stream/iter');
 
-// pipeToSync endSync returns negative → falls back to end()
-async function testPipeToSyncEndSyncFallback() {
+// pipeToSync cannot complete when endSync() requires async fallback.
+async function testPipeToSyncEndSyncFailure() {
   let endCalled = false;
   const writer = {
     writeSync() { return true; },
-    endSync() { return -1; }, // Negative → triggers end() fallback
+    endSync() { return -1; },
     end() { endCalled = true; },
   };
-  pipeToSync(fromSync('data'), writer);
-  assert.strictEqual(endCalled, true);
+  assert.throws(
+    () => pipeToSync(fromSync('data'), writer, { preventFail: true }),
+    { code: 'ERR_INVALID_STATE' },
+  );
+  assert.strictEqual(endCalled, false);
 }
 
-// pipeToSync endSync missing → falls back to end()
+// pipeToSync requires endSync() when closing is enabled.
 async function testPipeToSyncNoEndSync() {
+  let writeCalled = false;
   let endCalled = false;
   const writer = {
-    writeSync() { return true; },
+    writeSync() { writeCalled = true; return true; },
     end() { endCalled = true; },
   };
-  pipeToSync(fromSync('data'), writer);
-  assert.strictEqual(endCalled, true);
+  assert.throws(
+    () => pipeToSync(fromSync('data'), writer),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.strictEqual(writeCalled, false);
+  assert.strictEqual(endCalled, false);
 }
 
 // pipeToSync with preventFail: true — source error does NOT call fail()
@@ -61,7 +69,7 @@ async function testPipeToSyncPreventClose() {
 }
 
 Promise.all([
-  testPipeToSyncEndSyncFallback(),
+  testPipeToSyncEndSyncFailure(),
   testPipeToSyncNoEndSync(),
   testPipeToSyncPreventFail(),
   testPipeToSyncPreventClose(),
diff --git a/test/parallel/test-stream-iter-pipeto-signal.js b/test/parallel/test-stream-iter-pipeto-signal.js
index ec1324a4e04b..be04c8c635df 100644
--- a/test/parallel/test-stream-iter-pipeto-signal.js
+++ b/test/parallel/test-stream-iter-pipeto-signal.js
@@ -9,6 +9,51 @@ const assert = require('assert');
 const { setTimeout } = require('timers/promises');
 const { pipeTo, from } = require('stream/iter');
 
+async function testPipeToPreAbortedSignalFailsWriter() {
+  const reason = new Error('already aborted');
+  let sourceTouched = false;
+  const source = {
+    [Symbol.asyncIterator]() {
+      sourceTouched = true;
+      return {};
+    },
+  };
+  const writer = {
+    write: common.mustNotCall(),
+    fail: common.mustCall((error) => assert.strictEqual(error, reason)),
+  };
+
+  await assert.rejects(
+    pipeTo(source, writer, { signal: AbortSignal.abort(reason) }),
+    (error) => error === reason,
+  );
+  assert.strictEqual(sourceTouched, false);
+}
+
+async function testPipeToPreAbortedSignalPreventFail() {
+  const reason = new Error('already aborted');
+  let sourceTouched = false;
+  const source = {
+    [Symbol.asyncIterator]() {
+      sourceTouched = true;
+      return {};
+    },
+  };
+  const writer = {
+    write: common.mustNotCall(),
+    fail: common.mustNotCall(),
+  };
+
+  await assert.rejects(
+    pipeTo(source, writer, {
+      signal: AbortSignal.abort(reason),
+      preventFail: true,
+    }),
+    (error) => error === reason,
+  );
+  assert.strictEqual(sourceTouched, false);
+}
+
 // pipeTo with live signal, no transforms — abort mid-stream
 async function testPipeToLiveSignalNoTransforms() {
   const ac = new AbortController();
@@ -116,6 +161,8 @@ async function testPipeToLiveSignalWithTransformsCompletes() {
 }
 
 Promise.all([
+  testPipeToPreAbortedSignalFailsWriter(),
+  testPipeToPreAbortedSignalPreventFail(),
   testPipeToLiveSignalNoTransforms(),
   testPipeToLiveSignalNoTransformsPendingNext(),
   testPipeToLiveSignalWithTransforms(),
diff --git a/test/parallel/test-stream-iter-pipeto.js b/test/parallel/test-stream-iter-pipeto.js
index 5d8b5088f540..4711b291a7af 100644
--- a/test/parallel/test-stream-iter-pipeto.js
+++ b/test/parallel/test-stream-iter-pipeto.js
@@ -71,6 +71,7 @@ async function testPipeToSyncSourceError() {
   let failCalled = false;
   const writer = {
     writeSync() { return true; },
+    endSync: common.mustNotCall(),
     fail(reason) { failCalled = true; },
   };
   function* failingSource() {
@@ -127,6 +128,7 @@ async function testPipeToSyncWithTransforms() {
   const chunks = [];
   const writer = {
     writeSync(chunk) { chunks.push(new TextDecoder().decode(chunk)); return true; },
+    endSync() { return 0; },
   };
   const upper = (batch) => {
     if (batch === null) return null;
@@ -160,6 +162,7 @@ async function testPipeToSyncWriterTransformMethodIgnored() {
       chunks.push(new TextDecoder().decode(chunk));
       return true;
     },
+    endSync() { return 0; },
   };
 
   pipeToSync(fromSync('hello'), writer);
@@ -240,11 +243,11 @@ async function testPipeToSyncMinimalWriter() {
     },
   };
 
-  pipeToSync(fromSync('minimal-sync'), minimalWriter);
+  pipeToSync(fromSync('minimal-sync'), minimalWriter, { preventClose: true });
   assert.strictEqual(chunks.length > 0, true);
 }
 
-async function testPipeToSyncIterableFastPathWritesIncrementally() {
+async function testPipeToSyncIterableUsesFromBatching() {
   let pulled = 0;
   let firstWritePulled = 0;
   const chunks = [];
@@ -267,7 +270,7 @@ async function testPipeToSyncIterableFastPathWritesIncrementally() {
 
   const totalBytes = await pipeTo(source(), writer);
   assert.strictEqual(totalBytes, 3);
-  assert.strictEqual(firstWritePulled, 1);
+  assert.strictEqual(firstWritePulled, 3);
   assert.deepStrictEqual(chunks, [
     new Uint8Array([0x61]),
     new Uint8Array([0x62]),
@@ -275,7 +278,31 @@ async function testPipeToSyncIterableFastPathWritesIncrementally() {
   ]);
 }
 
-async function testPipeToSyncIterableFastPathWriteFallback() {
+async function testPipeToSourceNormalizationIndependentOfWriter() {
+  function source() {
+    return {
+      *[Symbol.iterator]() {
+        yield {
+          async *[Symbol.asyncIterator]() {
+            yield 'nested';
+          },
+        };
+      },
+    };
+  }
+
+  for (const hasWriteSync of [false, true]) {
+    const writer = { write: common.mustNotCall() };
+    if (hasWriteSync) writer.writeSync = common.mustNotCall();
+
+    await assert.rejects(
+      pipeTo(source(), writer, { preventClose: true, preventFail: true }),
+      { code: 'ERR_INVALID_ARG_TYPE' },
+    );
+  }
+}
+
+async function testPipeToSyncIterableWriteFallback() {
   const asyncWrites = [];
   const writer = {
     writeSync(chunk) {
@@ -296,7 +323,7 @@ async function testPipeToSyncIterableFastPathWriteFallback() {
   assert.deepStrictEqual(asyncWrites, [new Uint8Array([0x62])]);
 }
 
-async function testPipeToSyncIterableFastPathAsyncValue() {
+async function testPipeToSyncIterableAsyncValue() {
   const chunks = [];
   const writer = {
     write: common.mustNotCall(),
@@ -334,7 +361,8 @@ Promise.all([
   testPipeToSyncPreventClose(),
   testPipeToMinimalWriter(),
   testPipeToSyncMinimalWriter(),
-  testPipeToSyncIterableFastPathWritesIncrementally(),
-  testPipeToSyncIterableFastPathWriteFallback(),
-  testPipeToSyncIterableFastPathAsyncValue(),
+  testPipeToSyncIterableUsesFromBatching(),
+  testPipeToSyncIterableWriteFallback(),
+  testPipeToSyncIterableAsyncValue(),
+  testPipeToSourceNormalizationIndependentOfWriter(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-pull-async.js b/test/parallel/test-stream-iter-pull-async.js
index 3159b718f27e..c341cf296ddd 100644
--- a/test/parallel/test-stream-iter-pull-async.js
+++ b/test/parallel/test-stream-iter-pull-async.js
@@ -3,7 +3,16 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { pull, from, text, tap } = require('stream/iter');
+const {
+  broadcast,
+  from,
+  pull,
+  push,
+  share,
+  tap,
+  text,
+  toAsyncStreamable,
+} = require('stream/iter');
 
 async function testPullIdentity() {
   const data = await text(pull(from('hello-async')));
@@ -40,23 +49,72 @@ async function testPullStatefulTransform() {
   assert.strictEqual(data, 'data-ASYNC-END');
 }
 
+async function testPullStatefulTransformReceiver() {
+  const descriptor = {};
+  descriptor.transform = common.mustCall(
+    async function*(source) {
+      assert.strictEqual(this, descriptor);
+      for await (const chunks of source) {
+        yield chunks;
+      }
+    });
+
+  assert.strictEqual(await text(pull(from('receiver'), descriptor)), 'receiver');
+}
+
 async function testPullWithAbortSignal() {
   async function* gen() {
     yield [new Uint8Array([1])];
   }
 
-  const result = pull(gen(), { signal: AbortSignal.abort() });
-  await assert.rejects(
-    async () => {
-      // eslint-disable-next-line no-unused-vars
-      for await (const _ of result) {
-        assert.fail('Should not reach here');
-      }
-    },
+  assert.throws(
+    () => pull(gen(), { signal: AbortSignal.abort() }),
     { name: 'AbortError' },
   );
 }
 
+async function testPullNormalizesSourceAtCallTime() {
+  let protocolCalls = 0;
+  let iteratorCalls = 0;
+  const source = {
+    [toAsyncStreamable]() {
+      protocolCalls++;
+      return {
+        async *[Symbol.asyncIterator]() {
+          iteratorCalls++;
+          yield 'data';
+        },
+      };
+    },
+  };
+
+  const result = pull(source);
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 0);
+  assert.strictEqual(await text(result), 'data');
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 1);
+}
+
+function testPullPreAbortOrdering() {
+  const reason = new Error('already aborted');
+  let protocolCalls = 0;
+  const source = {
+    [toAsyncStreamable]() {
+      protocolCalls++;
+      return from('data');
+    },
+  };
+  const signal = AbortSignal.abort(reason);
+
+  assert.throws(() => pull(source, { signal }), (error) => error === reason);
+  assert.strictEqual(protocolCalls, 1);
+  assert.throws(
+    () => pull(null, { signal }),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+}
+
 async function testPullChainedTransforms() {
   const enc = new TextEncoder();
   const transforms = [
@@ -170,6 +228,61 @@ async function testPullSignalAbortWhileSourceNextPending() {
   await assert.rejects(next, { name: 'AbortError' });
 }
 
+async function testPullReturnWhileSourceNextPending() {
+  let startNext;
+  const nextStarted = new Promise((resolve) => { startNext = resolve; });
+  const source = {
+    [Symbol.asyncIterator]() {
+      return {
+        next() {
+          startNext();
+          return new Promise(() => {});
+        },
+      };
+    },
+  };
+
+  const iter = pull(source)[Symbol.asyncIterator]();
+  const next = assert.rejects(iter.next(), { name: 'AbortError' });
+  await nextStarted;
+
+  const timeout = {};
+  const result = await Promise.race([
+    iter.return(),
+    new Promise((resolve) => setImmediate(resolve, timeout)),
+  ]);
+
+  assert.notStrictEqual(result, timeout);
+  assert.deepStrictEqual(result, { value: undefined, done: true });
+  await next;
+}
+
+async function testTransformedConsumerReturnBeforeNext() {
+  const identity = (chunks) => chunks;
+  const pushed = push(identity);
+  const { broadcast: bc } = broadcast();
+  const broadcastConsumer = bc.push(identity);
+  const shared = share(from('shared'));
+  const sharedConsumer = shared.pull(identity);
+
+  assert.strictEqual(bc.consumerCount, 1);
+  assert.strictEqual(shared.consumerCount, 1);
+
+  const cases = [
+    [pushed.readable, common.mustCall(
+      () => assert.strictEqual(pushed.writer.canWrite, null))],
+    [broadcastConsumer, common.mustCall(
+      () => assert.strictEqual(bc.consumerCount, 0))],
+    [sharedConsumer, common.mustCall(
+      () => assert.strictEqual(shared.consumerCount, 0))],
+  ];
+
+  for (const [readable, verify] of cases) {
+    await readable[Symbol.asyncIterator]().return();
+    verify();
+  }
+}
+
 async function testPullSignalAbortWithTransformWhileSourceNextPending() {
   const source = {
     [Symbol.asyncIterator]() {
@@ -411,12 +524,17 @@ async function testTransformOptionsNotShared() {
     testPullIdentity(),
     testPullStatelessTransform(),
     testPullStatefulTransform(),
+    testPullStatefulTransformReceiver(),
     testPullWithAbortSignal(),
+    testPullNormalizesSourceAtCallTime(),
+    testPullPreAbortOrdering(),
     testPullChainedTransforms(),
     testPullSourceError(),
     testTapCallbackError(),
     testPullSignalAbortMidIteration(),
     testPullSignalAbortWhileSourceNextPending(),
+    testPullReturnWhileSourceNextPending(),
+    testTransformedConsumerReturnBeforeNext(),
     testPullSignalAbortWithTransformWhileSourceNextPending(),
     testPullConsumerBreakCleanup(),
     testPullTransformReturnsPromise(),
diff --git a/test/parallel/test-stream-iter-pull-sync.js b/test/parallel/test-stream-iter-pull-sync.js
index c47a6b3f9233..af481dbfa137 100644
--- a/test/parallel/test-stream-iter-pull-sync.js
+++ b/test/parallel/test-stream-iter-pull-sync.js
@@ -3,7 +3,13 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { pullSync, fromSync, bytesSync, tapSync } = require('stream/iter');
+const {
+  pullSync,
+  fromSync,
+  bytesSync,
+  tapSync,
+  toStreamable,
+} = require('stream/iter');
 
 function testPullSyncIdentity() {
   // No transforms - just pass through
@@ -11,6 +17,30 @@ function testPullSyncIdentity() {
   assert.deepStrictEqual(data, new TextEncoder().encode('hello'));
 }
 
+function testPullSyncNormalizesSourceAtCallTime() {
+  let protocolCalls = 0;
+  let iteratorCalls = 0;
+  const source = {
+    [toStreamable]() {
+      protocolCalls++;
+      return {
+        *[Symbol.iterator]() {
+          iteratorCalls++;
+          yield 'data';
+        },
+      };
+    },
+  };
+
+  const result = pullSync(source);
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 0);
+  assert.strictEqual(new TextDecoder().decode(bytesSync(result)), 'data');
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 1);
+  assert.throws(() => pullSync(null), { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
 function testPullSyncStatelessTransform() {
   const upper = (chunks) => {
     if (chunks === null) return null;
@@ -44,6 +74,20 @@ function testPullSyncStatefulTransform() {
   assert.strictEqual(data, 'data-END');
 }
 
+function testPullSyncStatefulTransformReceiver() {
+  const descriptor = {};
+  descriptor.transform = common.mustCall(
+    function*(source) {
+      assert.strictEqual(this, descriptor);
+      yield* source;
+    });
+
+  assert.strictEqual(
+    new TextDecoder().decode(bytesSync(pullSync(fromSync('receiver'), descriptor))),
+    'receiver',
+  );
+}
+
 function testPullSyncChainedTransforms() {
   const addExcl = (chunks) => {
     if (chunks === null) return null;
@@ -177,8 +221,10 @@ function testPullSyncInvalidTransform() {
 
 Promise.all([
   testPullSyncIdentity(),
+  testPullSyncNormalizesSourceAtCallTime(),
   testPullSyncStatelessTransform(),
   testPullSyncStatefulTransform(),
+  testPullSyncStatefulTransformReceiver(),
   testPullSyncChainedTransforms(),
   testPullSyncSourceError(),
   testPullSyncEmptySource(),
diff --git a/test/parallel/test-stream-iter-push-writer.js b/test/parallel/test-stream-iter-push-writer.js
index 8ce555ca9251..854bd69f0ac6 100644
--- a/test/parallel/test-stream-iter-push-writer.js
+++ b/test/parallel/test-stream-iter-push-writer.js
@@ -19,6 +19,36 @@ async function testOndrain() {
   assert.strictEqual(ondrain(writer), null);
 }
 
+async function testDropPoliciesReportPhysicalCapacity() {
+  const chunk = new Uint8Array(16384);
+
+  for (const backpressure of ['drop-oldest', 'drop-newest']) {
+    const { writer, readable } = push({
+      budget: chunk.byteLength,
+      backpressure,
+    });
+    const iterator = readable[Symbol.asyncIterator]();
+
+    assert.strictEqual(writer.writeSync(chunk), true);
+    assert.strictEqual(writer.canWrite, false);
+
+    let drained = false;
+    const drain = ondrain(writer);
+    drain.then(common.mustCall(() => { drained = true; }));
+
+    // Drop policies still accept writes despite having no physical capacity.
+    assert.strictEqual(writer.writeSync(chunk), true);
+    assert.strictEqual(writer.canWrite, false);
+    await new Promise(setImmediate);
+    assert.strictEqual(drained, false);
+
+    assert.strictEqual((await iterator.next()).done, false);
+    assert.strictEqual(await drain, true);
+    assert.strictEqual(writer.canWrite, true);
+    await iterator.return();
+  }
+}
+
 async function testOndrainNonDrainable() {
   // Non-drainable objects return null
   assert.strictEqual(ondrain(null), null);
@@ -54,9 +84,9 @@ async function testWriteWithSignalRejects() {
   await assert.rejects(writePromise, { name: 'AbortError' });
 
   // Clean up
-  writer.end();
-  // eslint-disable-next-line no-unused-vars
-  for await (const _ of readable) { break; }
+  const end = writer.end();
+  await text(readable);
+  await end;
 }
 
 async function testWriteWithPreAbortedSignal() {
@@ -70,9 +100,10 @@ async function testWriteWithPreAbortedSignal() {
 
   // Writer should still be usable for other writes
   writer.write('ok');
-  writer.end();
+  const end = writer.end();
   const data = await text(readable);
   assert.strictEqual(data, 'ok');
+  await end;
 }
 
 async function testCancelledWriteRemovedFromQueue() {
@@ -97,7 +128,7 @@ async function testCancelledWriteRemovedFromQueue() {
   // The cancelled write should NOT occupy a pending slot.
   // A new write should succeed now that the buffer has room.
   await writer.write(kChunk);
-  writer.end();
+  const end = writer.end();
 
   const result = await iter.next();
   assert.ok(!result.done);
@@ -106,7 +137,8 @@ async function testCancelledWriteRemovedFromQueue() {
     totalBytes += chunk.byteLength;
   }
   assert.strictEqual(totalBytes, 16384);
-  await iter.return();
+  assert.strictEqual((await iter.next()).done, true);
+  await end;
 }
 
 async function testOndrainResolvesFalseOnConsumerBreak() {
@@ -184,7 +216,7 @@ async function testWritevSyncInvalidChunkDoesNotQueue() {
   const { writer, readable } = push({ budget: 16384 });
 
   assert.throws(
-    () => writer.writevSync([1]),
+    () => writer.writevSync([Symbol('invalid')]),
     { code: 'ERR_INVALID_ARG_TYPE' },
   );
 
@@ -294,6 +326,21 @@ async function testEndSignalAbortWhileDraining() {
   assert.strictEqual(await completedEnd, 5);
 }
 
+async function testFactorySignalAbortWhileDraining() {
+  const controller = new AbortController();
+  const reason = new Error('stream aborted while draining');
+  const { writer, readable } = push({ signal: controller.signal });
+
+  writer.writeSync('hello');
+  const end = writer.end();
+  const endRejected = assert.rejects(end, (error) => error === reason);
+  controller.abort(reason);
+
+  await endRejected;
+  await assert.rejects(text(readable), (error) => error === reason);
+  await assert.rejects(writer.end(), (error) => error === reason);
+}
+
 async function testEndAfterEndSyncWaitsForDrain() {
   const { writer, readable } = push();
   writer.writeSync('hello');
@@ -424,6 +471,20 @@ async function testConsumerReturnResolvesPendingRead() {
   assert.strictEqual(readResult.done, true);
 }
 
+async function testEndRejectsAfterConsumerReturn() {
+  const { writer, readable } = push();
+  writer.writeSync('data');
+  const iter = readable[Symbol.asyncIterator]();
+
+  await iter.return();
+
+  await assert.rejects(
+    writer.end({ signal: AbortSignal.timeout(common.platformTimeout(100)) }),
+    { code: 'ERR_INVALID_STATE' },
+  );
+  assert.strictEqual((await iter.next()).done, true);
+}
+
 // iterator.throw() rejects a pending read with the thrown error
 async function testConsumerThrowRejectsPendingRead() {
   const { readable } = push();
@@ -446,28 +507,48 @@ async function testConsumerThrowRejectsPendingRead() {
   await readRejects;
 }
 
-// end() while writes are pending rejects those writes
-async function testEndRejectsPendingWrites() {
+// end() drains writes that were already pending, then waits for EOF to be read.
+async function testEndDrainsPendingWrites() {
   const kChunk = new Uint8Array(16384);
   const { writer, readable } = push({ budget: 16384, backpressure: 'unbounded' });
   writer.writeSync(kChunk); // fill budget
 
   // This write blocks on backpressure
   const writePromise = writer.write(kChunk);
+  const endPromise = writer.end();
+  await assert.rejects(writer.write(kChunk), { code: 'ERR_INVALID_STATE' });
 
-  await new Promise(setImmediate);
+  let ended = false;
+  endPromise.then(common.mustCall(() => { ended = true; }));
+  const iterator = readable[Symbol.asyncIterator]();
 
-  // Ending should reject the pending write
-  writer.endSync();
+  assert.strictEqual((await iterator.next()).done, false);
+  await writePromise;
+  assert.strictEqual((await iterator.next()).done, false);
+  await Promise.resolve();
+  assert.strictEqual(ended, false);
 
-  await assert.rejects(
-    () => writePromise,
-    { code: 'ERR_INVALID_STATE' },
-  );
+  assert.strictEqual((await iterator.next()).done, true);
+  assert.strictEqual(await endPromise, kChunk.byteLength * 2);
+  assert.strictEqual(ended, true);
+}
 
-  // Clean up: drain the readable
-  // eslint-disable-next-line no-unused-vars
-  for await (const _ of readable) { break; }
+async function testEndWaitsForEofPull() {
+  const { writer, readable } = push();
+  writer.writeSync('hello');
+  const endPromise = writer.end();
+  let ended = false;
+  endPromise.then(common.mustCall(() => { ended = true; }));
+  const iterator = readable[Symbol.asyncIterator]();
+
+  const data = await iterator.next();
+  assert.strictEqual(data.done, false);
+  await Promise.resolve();
+  assert.strictEqual(ended, false);
+
+  assert.strictEqual((await iterator.next()).done, true);
+  await endPromise;
+  assert.strictEqual(ended, true);
 }
 
 async function testEndIdempotentWhenClosed() {
@@ -502,6 +583,23 @@ async function testAsyncDispose() {
   }
 }
 
+async function testAsyncDisposeWaitsAfterEndSync() {
+  const { writer, readable } = push({ budget: 16384 });
+  writer.writeSync('hello');
+  assert.strictEqual(writer.endSync(), -1);
+
+  let disposed = false;
+  const disposal = writer[Symbol.asyncDispose]().then(() => {
+    disposed = true;
+  });
+  await Promise.resolve();
+  assert.strictEqual(disposed, false);
+
+  assert.strictEqual(await text(readable), 'hello');
+  await disposal;
+  assert.strictEqual(disposed, true);
+}
+
 async function testSyncDispose() {
   const { writer, readable } = push({ budget: 16384 });
   writer.writeSync('hello');
@@ -572,6 +670,7 @@ async function testFailRejectsPendingReadWithFalsyReason() {
 
 Promise.all([
   testOndrain(),
+  testDropPoliciesReportPhysicalCapacity(),
   testOndrainNonDrainable(),
   testWriteWithSignalRejects(),
   testWriteWithPreAbortedSignal(),
@@ -589,6 +688,7 @@ Promise.all([
   testEndAsyncReturnValue(),
   testEndWithPreAbortedSignal(),
   testEndSignalAbortWhileDraining(),
+  testFactorySignalAbortWhileDraining(),
   testEndAfterEndSyncWaitsForDrain(),
   testWriteUint8Array(),
   testOndrainWaitsForDrain(),
@@ -599,10 +699,13 @@ Promise.all([
   testFailRejectsFutureReadWithFalsyReason(),
   testFailRejectsPendingReadWithFalsyReason(),
   testConsumerReturnResolvesPendingRead(),
+  testEndRejectsAfterConsumerReturn(),
   testConsumerThrowRejectsPendingRead(),
-  testEndRejectsPendingWrites(),
+  testEndDrainsPendingWrites(),
+  testEndWaitsForEofPull(),
   testEndIdempotentWhenClosed(),
   testEndRejectsWhenErrored(),
   testAsyncDispose(),
+  testAsyncDisposeWaitsAfterEndSync(),
   testSyncDispose(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-resizable-buffers.js b/test/parallel/test-stream-iter-resizable-buffers.js
new file mode 100644
index 000000000000..b66973393cac
--- /dev/null
+++ b/test/parallel/test-stream-iter-resizable-buffers.js
@@ -0,0 +1,178 @@
+// Flags: --experimental-stream-iter
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const {
+  array,
+  arraySync,
+  broadcast,
+  pipeTo,
+  pipeToSync,
+  push,
+  share,
+  shareSync,
+} = require('stream/iter');
+
+const kResizeError = {
+  code: 'ERR_INVALID_STATE',
+  message: /resized or detached/,
+};
+
+async function testBufferedViewMutationRejected() {
+  const resizable = new ArrayBuffer(1, { maxByteLength: 2 });
+  const growable = new SharedArrayBuffer(1, { maxByteLength: 2 });
+  const detachable = new ArrayBuffer(1);
+  const cases = [
+    [new Uint8Array(resizable), () => resizable.resize(2)],
+    [new Uint8Array(growable), () => growable.grow(2)],
+    [new Uint8Array(detachable), () => {
+      structuredClone(detachable, { transfer: [detachable] });
+    }],
+  ];
+
+  for (const [view, mutate] of cases) {
+    const { writer, readable } = push();
+    assert.strictEqual(writer.writeSync(view), true);
+    mutate();
+    await assert.rejects(
+      readable[Symbol.asyncIterator]().next(),
+      kResizeError,
+    );
+  }
+}
+
+async function testDropOldestUsesAcceptedByteLength() {
+  const buffer = new ArrayBuffer(16384, { maxByteLength: 16384 });
+  const { writer, broadcast: bc } = broadcast({
+    budget: 16384,
+    backpressure: 'drop-oldest',
+  });
+  const iterator = bc.push()[Symbol.asyncIterator]();
+
+  assert.strictEqual(writer.writeSync(new Uint8Array(buffer)), true);
+  buffer.resize(0);
+  assert.strictEqual(writer.writeSync(Uint8Array.of(2)), true);
+  assert.strictEqual(writer.writeSync(Uint8Array.of(3)), true);
+  writer.endSync();
+
+  assert.strictEqual((await iterator.next()).value[0][0], 2);
+  assert.strictEqual((await iterator.next()).value[0][0], 3);
+  assert.strictEqual((await iterator.next()).done, true);
+}
+
+async function testPendingWritesRejectResizedViews() {
+  const pushResult = push({ budget: 16384, backpressure: 'unbounded' });
+  assert.strictEqual(
+    pushResult.writer.writeSync(new Uint8Array(16384)), true);
+  const pushBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const pushPending = pushResult.writer.write(new Uint8Array(pushBuffer));
+  const pushRejected = assert.rejects(pushPending, kResizeError);
+  pushBuffer.resize(2);
+  const pushIterator = pushResult.readable[Symbol.asyncIterator]();
+  assert.strictEqual((await pushIterator.next()).done, false);
+  await pushRejected;
+  pushResult.writer.endSync();
+  assert.strictEqual((await pushIterator.next()).done, true);
+
+  const { writer, broadcast: bc } = broadcast({
+    budget: 16384,
+    backpressure: 'unbounded',
+  });
+  const broadcastIterator = bc.push()[Symbol.asyncIterator]();
+  assert.strictEqual(writer.writeSync(new Uint8Array(16384)), true);
+  const broadcastBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const broadcastPending = writer.write(new Uint8Array(broadcastBuffer));
+  const broadcastRejected = assert.rejects(broadcastPending, kResizeError);
+  broadcastBuffer.resize(2);
+  assert.strictEqual((await broadcastIterator.next()).done, false);
+  await broadcastRejected;
+  writer.endSync();
+  assert.strictEqual((await broadcastIterator.next()).done, true);
+}
+
+async function testBroadcastRejectsResizedBufferedView() {
+  const buffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const { writer, broadcast: bc } = broadcast();
+  const iterator = bc.push()[Symbol.asyncIterator]();
+
+  assert.strictEqual(writer.writeSync(new Uint8Array(buffer)), true);
+  buffer.resize(2);
+
+  await assert.rejects(iterator.next(), kResizeError);
+  await assert.rejects(writer.end(), kResizeError);
+}
+
+async function testShareRejectsResizedBufferedView() {
+  const asyncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const shared = share([[new Uint8Array(asyncBuffer)]]);
+  const first = shared.pull()[Symbol.asyncIterator]();
+  const second = shared.pull()[Symbol.asyncIterator]();
+
+  assert.strictEqual((await first.next()).done, false);
+  asyncBuffer.resize(2);
+  await assert.rejects(second.next(), kResizeError);
+
+  const syncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const sharedSync = shareSync([[new Uint8Array(syncBuffer)]]);
+  const firstSync = sharedSync.pull()[Symbol.iterator]();
+  const secondSync = sharedSync.pull()[Symbol.iterator]();
+
+  assert.strictEqual(firstSync.next().done, false);
+  syncBuffer.resize(2);
+  assert.throws(() => secondSync.next(), kResizeError);
+}
+
+async function testConsumersRejectResizedViews() {
+  const asyncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  async function* asyncSource() {
+    yield [new Uint8Array(asyncBuffer)];
+    asyncBuffer.resize(2);
+  }
+  await assert.rejects(array(asyncSource(), { limit: 1 }), kResizeError);
+
+  const syncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  function* syncSource() {
+    yield [new Uint8Array(syncBuffer)];
+    syncBuffer.resize(2);
+  }
+  assert.throws(() => arraySync(syncSource(), { limit: 1 }), kResizeError);
+}
+
+async function testPipeRejectsWriterResize() {
+  const asyncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const asyncWriter = {
+    write() {
+      asyncBuffer.resize(2);
+    },
+    fail: common.mustCall(),
+  };
+  await assert.rejects(
+    pipeTo([new Uint8Array(asyncBuffer)], asyncWriter),
+    kResizeError,
+  );
+
+  const syncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const syncWriter = {
+    writeSync() {
+      syncBuffer.resize(2);
+      return true;
+    },
+    fail: common.mustCall(),
+  };
+  assert.throws(
+    () => pipeToSync(
+      [new Uint8Array(syncBuffer)], syncWriter, { preventClose: true }),
+    kResizeError,
+  );
+}
+
+Promise.all([
+  testBufferedViewMutationRejected(),
+  testDropOldestUsesAcceptedByteLength(),
+  testPendingWritesRejectResizedViews(),
+  testBroadcastRejectsResizedBufferedView(),
+  testShareRejectsResizedBufferedView(),
+  testConsumersRejectResizedViews(),
+  testPipeRejectsWriterResize(),
+]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-share-async.js b/test/parallel/test-stream-iter-share-async.js
index c96a0cb0f3c3..dafb157a7512 100644
--- a/test/parallel/test-stream-iter-share-async.js
+++ b/test/parallel/test-stream-iter-share-async.js
@@ -143,6 +143,70 @@ async function testShareCancelWithFalsyReason() {
   }
 }
 
+async function testShareCancelWhileSourcePullPending() {
+  const noReason = { __proto__: null };
+
+  for (const reason of [noReason, 0]) {
+    const sourceStarted = Promise.withResolvers();
+    const sourceNext = Promise.withResolvers();
+    let nextCalls = 0;
+    let returnCalls = 0;
+    const source = {
+      __proto__: null,
+      [Symbol.asyncIterator]() {
+        return {
+          __proto__: null,
+          next() {
+            nextCalls++;
+            sourceStarted.resolve();
+            return sourceNext.promise;
+          },
+          async return() {
+            returnCalls++;
+            return { __proto__: null, done: true, value: undefined };
+          },
+        };
+      },
+    };
+    const shared = share(source);
+    const iterator = shared.pull()[Symbol.asyncIterator]();
+    const read = iterator.next().then(
+      (value) => ({ __proto__: null, rejected: false, value }),
+      (error) => ({ __proto__: null, rejected: true, error }),
+    );
+
+    await sourceStarted.promise;
+    if (reason === noReason) {
+      shared.cancel();
+    } else {
+      shared.cancel(reason);
+    }
+
+    const timedOut = { __proto__: null };
+    const outcome = await Promise.race([
+      read,
+      new Promise((resolve) => setImmediate(resolve, timedOut)),
+    ]);
+    assert.notStrictEqual(outcome, timedOut);
+    if (reason === noReason) {
+      assert.strictEqual(outcome.rejected, false);
+      assert.strictEqual(outcome.value.done, true);
+    } else {
+      assert.strictEqual(outcome.rejected, true);
+      assert.strictEqual(outcome.error, reason);
+    }
+    assert.strictEqual(nextCalls, 1);
+
+    sourceNext.resolve({
+      __proto__: null,
+      done: false,
+      value: [Uint8Array.of(1)],
+    });
+    await new Promise(setImmediate);
+    assert.strictEqual(returnCalls, 1);
+  }
+}
+
 async function testShareAbortSignal() {
   const ac = new AbortController();
   const reason = new Error('share aborted');
@@ -272,6 +336,27 @@ async function testShareSourceError() {
   }, { message: 'share source boom' });
 }
 
+async function testShareSourceErrorFollowsBufferedData() {
+  const reason = new Error('share source boom');
+  async function* failingSource() {
+    yield [Uint8Array.of(1)];
+    throw reason;
+  }
+
+  const shared = share(failingSource());
+  const fast = shared.pull()[Symbol.asyncIterator]();
+  const slow = shared.pull()[Symbol.asyncIterator]();
+  const returned = shared.pull()[Symbol.asyncIterator]();
+  await returned.return();
+
+  assert.deepStrictEqual((await fast.next()).value, [Uint8Array.of(1)]);
+  await assert.rejects(fast.next(), (error) => error === reason);
+
+  assert.deepStrictEqual((await slow.next()).value, [Uint8Array.of(1)]);
+  await assert.rejects(slow.next(), (error) => error === reason);
+  assert.strictEqual((await returned.next()).done, true);
+}
+
 async function testShareLateJoiningConsumer() {
   // A consumer that joins after some data has been consumed should only
   // see data remaining in the buffer (not items already trimmed).
@@ -380,12 +465,14 @@ Promise.all([
   testShareCancelMidIteration(),
   testShareCancelWithReason(),
   testShareCancelWithFalsyReason(),
+  testShareCancelWhileSourcePullPending(),
   testShareAbortSignal(),
   testShareAbortSignalWhileSourcePullPending(),
   testSharePullAbortSignalRejectsPendingNext(),
   testSharePullPreAbortedSignalDoesNotAddConsumer(),
   testShareAlreadyAborted(),
   testShareSourceError(),
+  testShareSourceErrorFollowsBufferedData(),
   testShareLateJoiningConsumer(),
   testShareConsumerBreak(),
   testShareMultipleConsumersConcurrentPull(),
diff --git a/test/parallel/test-stream-iter-transform-roundtrip.js b/test/parallel/test-stream-iter-transform-roundtrip.js
index df63483d6c85..d9a745593c27 100644
--- a/test/parallel/test-stream-iter-transform-roundtrip.js
+++ b/test/parallel/test-stream-iter-transform-roundtrip.js
@@ -42,6 +42,18 @@ async function testGzipRoundTrip() {
   assert.strictEqual(result, input);
 }
 
+async function testValidatedTransformReceiver() {
+  const descriptor = compressGzip();
+  const transform = descriptor.transform;
+  descriptor.transform = common.mustCall(function(source, options) {
+    assert.strictEqual(this, descriptor);
+    return Reflect.apply(transform, this, [source, options]);
+  });
+
+  const result = await bytes(pull(from('receiver'), descriptor));
+  assert.ok(result.byteLength > 0);
+}
+
 async function testGzipLargeData() {
   // 100KB of repeated text - exercises multi-chunk path
   const input = 'gzip large data test. '.repeat(5000);
@@ -250,6 +262,7 @@ async function testGzipWithLevel() {
 (async () => {
   // Gzip
   await testGzipRoundTrip();
+  await testValidatedTransformReceiver();
   await testGzipLargeData();
   await testGzipActuallyCompresses();
 
diff --git a/test/parallel/test-stream-iter-validation.js b/test/parallel/test-stream-iter-validation.js
index 8dcfb46f173f..871c891a6539 100644
--- a/test/parallel/test-stream-iter-validation.js
+++ b/test/parallel/test-stream-iter-validation.js
@@ -22,7 +22,7 @@ const {
 // =============================================================================
 
 // Budget must be integer >= 16384
-assert.throws(() => push({ budget: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => push({ budget: 'bad' }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => push({ budget: 1.5 }), { code: 'ERR_OUT_OF_RANGE' });
 // Values < 16384 are rejected
 assert.throws(() => push({ budget: 0 }), { code: 'ERR_OUT_OF_RANGE' });
@@ -68,12 +68,11 @@ assert.throws(() => push('bad', {}), { code: 'ERR_INVALID_ARG_TYPE' });
   writer.endSync();
 }
 
-// Writer.write rejects non-string/non-Uint8Array
+// Writer chunks use the Web IDL (Uint8Array or USVString) conversion.
 {
   const { writer } = push();
-  assert.throws(() => writer.writeSync(42), { code: 'ERR_INVALID_ARG_TYPE' });
-  assert.throws(() => writer.writeSync({}), { code: 'ERR_INVALID_ARG_TYPE' });
-  assert.throws(() => writer.writeSync(true), { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => writer.writeSync(Symbol()),
+                { code: 'ERR_INVALID_ARG_TYPE' });
   writer.endSync();
 }
 
@@ -87,7 +86,7 @@ assert.throws(() => duplex({ a: 42 }), { code: 'ERR_INVALID_ARG_TYPE' });
 assert.throws(() => duplex({ b: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
 
 // Budget validation (cascades through to push())
-assert.throws(() => duplex({ budget: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => duplex({ budget: 'bad' }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => duplex({ budget: 1.5 }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => duplex({ budget: Number.MAX_SAFE_INTEGER + 1 }),
               { code: 'ERR_OUT_OF_RANGE' });
@@ -99,16 +98,16 @@ assert.throws(() => duplex({ budget: 0 }), { code: 'ERR_OUT_OF_RANGE' });
   const [a, b] = duplex({ budget: Number.MAX_SAFE_INTEGER });
   assert.strictEqual(a.writer.canWrite, true);
   assert.strictEqual(b.writer.canWrite, true);
-  a.close();
-  b.close();
+  a.writer.endSync();
+  b.writer.endSync();
 }
 // Per-direction overrides
 {
   const [a, b] = duplex({ a: { budget: 16384 }, b: { budget: 32768 } });
   assert.strictEqual(a.writer.canWrite, true);
   assert.strictEqual(b.writer.canWrite, true);
-  a.close();
-  b.close();
+  a.writer.endSync();
+  b.writer.endSync();
 }
 
 assert.throws(() => duplex({ signal: {} }), { code: 'ERR_INVALID_ARG_TYPE' });
@@ -129,7 +128,7 @@ assert.throws(() => pullSync(fromSync('a'), 42), { code: 'ERR_INVALID_ARG_TYPE'
 // broadcast() validation
 // =============================================================================
 
-assert.throws(() => broadcast({ budget: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => broadcast({ budget: 'bad' }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => broadcast({ budget: 1.5 }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => broadcast({ budget: Number.MAX_SAFE_INTEGER + 1 }),
               { code: 'ERR_OUT_OF_RANGE' });
@@ -214,7 +213,7 @@ assert.throws(() => Broadcast.from(42), { code: 'ERR_INVALID_ARG_TYPE' });
 // =============================================================================
 
 assert.throws(() => share(42), { code: 'ERR_INVALID_ARG_TYPE' });
-assert.throws(() => share(from('a'), { budget: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => share(from('a'), { budget: 'bad' }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => share(from('a'), { budget: 1.5 }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => share(from('a'), { budget: Number.MAX_SAFE_INTEGER + 1 }),
               { code: 'ERR_OUT_OF_RANGE' });
@@ -239,7 +238,7 @@ share(from('a'), { budget: Number.MAX_SAFE_INTEGER }).cancel();
 
 assert.throws(() => shareSync(42), { code: 'ERR_INVALID_ARG_TYPE' });
 assert.throws(() => shareSync(fromSync('a'), { budget: 'bad' }),
-              { code: 'ERR_INVALID_ARG_TYPE' });
+              { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => shareSync(fromSync('a'), { budget: 1.5 }),
               { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => shareSync(fromSync('a'), { budget: Number.MAX_SAFE_INTEGER + 1 }),
@@ -274,7 +273,7 @@ assert.throws(() => bytesSync(fromSync('a'), { limit: 'bad' }),
 assert.throws(() => bytesSync(fromSync('a'), { limit: -1 }),
               { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => textSync(fromSync('a'), { encoding: 42 }),
-              { code: 'ERR_INVALID_ARG_TYPE' });
+              { code: 'ERR_INVALID_ARG_VALUE' });
 assert.throws(() => textSync(fromSync('a'), { encoding: 'bogus' }),
               { code: 'ERR_INVALID_ARG_VALUE' });
 assert.throws(() => arrayBufferSync(fromSync('a'), { limit: 'bad' }),
@@ -318,7 +317,7 @@ async function testAsyncValidation() {
   await assert.rejects(
     () => bytes(from('a'), { limit: -1 }), { code: 'ERR_OUT_OF_RANGE' });
   await assert.rejects(
-    () => text(from('a'), { encoding: 42 }), { code: 'ERR_INVALID_ARG_TYPE' });
+    () => text(from('a'), { encoding: 42 }), { code: 'ERR_INVALID_ARG_VALUE' });
   await assert.rejects(
     () => text(from('a'), { encoding: 'not-a-real-encoding' }),
     { code: 'ERR_INVALID_ARG_VALUE' });
@@ -397,8 +396,8 @@ async function testAsyncValidation() {
 // Duplex with valid options
 {
   const [a, b] = duplex({ budget: 16384 });
-  a.close();
-  b.close();
+  a.writer.endSync();
+  b.writer.endSync();
 }
 
 // Broadcast with valid options
diff --git a/test/parallel/test-stream-iter-webidl.js b/test/parallel/test-stream-iter-webidl.js
new file mode 100644
index 000000000000..904bf77a647f
--- /dev/null
+++ b/test/parallel/test-stream-iter-webidl.js
@@ -0,0 +1,159 @@
+// Flags: --experimental-stream-iter
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { Writable } = require('stream');
+const {
+  Broadcast,
+  broadcast,
+  bytesSync,
+  from,
+  fromWritable,
+  fromSync,
+  pipeTo,
+  pull,
+  push,
+  share,
+  shareSync,
+  text,
+  textSync,
+} = require('stream/iter');
+
+function testDictionaryAndIntegerConversion() {
+  const pushed = push(null);
+  assert.strictEqual(pushed.writer.endSync(), 0);
+  const transformedWithNull = push((chunks) => chunks, null);
+  transformedWithNull.writer.endSync();
+
+  const broadcasted = broadcast(null);
+  assert.strictEqual(broadcasted.writer.endSync(), 0);
+
+  share(from(''), null).cancel();
+  shareSync(fromSync(''), null).cancel();
+
+  assert.deepStrictEqual(bytesSync(fromSync('data'), null),
+                         new TextEncoder().encode('data'));
+  assert.deepStrictEqual(
+    bytesSync(fromSync('data'), { limit: '4.9' }),
+    new TextEncoder().encode('data'),
+  );
+  assert.throws(
+    () => bytesSync(fromSync('data'), { limit: -1 }),
+    { name: 'TypeError', code: 'ERR_OUT_OF_RANGE' },
+  );
+
+  const converted = push({
+    budget: '16384.9',
+    backpressure: { toString: () => 'strict' },
+  });
+  assert.strictEqual(converted.writer.canWrite, true);
+  converted.writer.endSync();
+
+  let signalReads = 0;
+  const transformed = push((chunks) => chunks, {
+    get signal() {
+      signalReads++;
+      return undefined;
+    },
+  });
+  assert.strictEqual(signalReads, 1);
+  transformed.writer.endSync();
+}
+
+async function testUnknownDictionaryMembers() {
+  const source = pull(from('pull'), {
+    transform: 1,
+    write: 1,
+    unknown: true,
+  });
+  assert.strictEqual(await text(source), 'pull');
+
+  let ended = false;
+  const writer = {
+    write() {},
+    end() { ended = true; },
+  };
+  await pipeTo(from('pipe'), writer, {
+    transform: 1,
+    write: 1,
+  });
+  assert.strictEqual(ended, true);
+
+  const options = {
+    get encoding() {
+      throw new Error('unknown member was read');
+    },
+  };
+  assert.deepStrictEqual(bytesSync(fromSync('bytes'), options),
+                         new TextEncoder().encode('bytes'));
+  assert.strictEqual(textSync(fromSync('text'), {
+    encoding: { toString: () => 'utf-8' },
+  }), 'text');
+}
+
+async function testWriterConversion() {
+  const { writer, readable } = push();
+
+  await writer.write(42, null);
+  assert.strictEqual(writer.writevSync(new Set([
+    null,
+    true,
+    { toString: () => 'object' },
+  ])), true);
+
+  assert.throws(
+    () => writer.write(Symbol('invalid')),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.throws(
+    () => writer.writev('not a sequence object'),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.throws(
+    () => writer.write('invalid options', 1),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+
+  writer.endSync();
+  assert.strictEqual(await text(readable), '42nulltrueobject');
+}
+
+async function testOtherWriterConversions() {
+  const output = [];
+  const writable = new Writable({
+    write(chunk, encoding, callback) {
+      output.push(chunk.toString());
+      callback();
+    },
+  });
+  const classicWriter = fromWritable(writable);
+  await classicWriter.write(42, null);
+  await classicWriter.writev(new Set([false, '!']));
+  await classicWriter.end(null);
+  assert.strictEqual(output.join(''), '42false!');
+
+  const result = broadcast();
+  const source = result.broadcast.push();
+  await result.writer.write(42, null);
+  await result.writer.writev(new Set([true]));
+  result.writer.endSync();
+  assert.strictEqual(await text(source), '42true');
+
+  let signalReads = 0;
+  const fromResult = Broadcast.from(from(''), {
+    get signal() {
+      signalReads++;
+      return undefined;
+    },
+  });
+  assert.strictEqual(signalReads, 1);
+  fromResult.broadcast.cancel();
+}
+
+Promise.all([
+  testDictionaryAndIntegerConversion(),
+  testUnknownDictionaryMembers(),
+  testWriterConversion(),
+  testOtherWriterConversions(),
+]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-writable-interop.js b/test/parallel/test-stream-iter-writable-interop.js
index 110e8e0a7d2e..a8ae0a99cad7 100644
--- a/test/parallel/test-stream-iter-writable-interop.js
+++ b/test/parallel/test-stream-iter-writable-interop.js
@@ -511,25 +511,18 @@ async function testAsyncDispose() {
 }
 
 // =============================================================================
-// write() validates chunk type
+// write() rejects values that cannot be converted to USVString
 // =============================================================================
 
-async function testWriteInvalidChunkType() {
+function testWriteInvalidChunkType() {
   const writable = new Writable({ write(chunk, enc, cb) { cb(); } });
   const writer = fromWritable(writable);
 
-  await assert.rejects(
-    writer.write(42),
-    { code: 'ERR_INVALID_ARG_TYPE' },
-  );
-  await assert.rejects(
-    writer.write(null),
-    { code: 'ERR_INVALID_ARG_TYPE' },
-  );
-  await assert.rejects(
-    writer.write({}),
+  assert.throws(
+    () => writer.write(Symbol('invalid')),
     { code: 'ERR_INVALID_ARG_TYPE' },
   );
+  writable.destroy();
 }
 
 // =============================================================================
@@ -559,7 +552,7 @@ function testWritevInvalidChunkUncorks() {
   const writer = fromWritable(writable);
 
   assert.throws(
-    () => writer.writev([new Uint8Array([1]), 42]),
+    () => writer.writev([new Uint8Array([1]), Symbol('invalid')]),
     { code: 'ERR_INVALID_ARG_TYPE' },
   );
   assert.strictEqual(writable.writableCorked, 0);
diff --git a/test/parallel/test-stream-iter-writer-reentrancy.js b/test/parallel/test-stream-iter-writer-reentrancy.js
new file mode 100644
index 000000000000..119bda269239
--- /dev/null
+++ b/test/parallel/test-stream-iter-writer-reentrancy.js
@@ -0,0 +1,65 @@
+// Flags: --experimental-stream-iter
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { broadcast, push } = require('stream/iter');
+
+const factories = [
+  () => push({ budget: 16384 }),
+  () => {
+    const { writer, broadcast: bc } = broadcast({ budget: 16384 });
+    return { __proto__: null, writer, readable: bc.push() };
+  },
+];
+
+async function testWritevReentrancy() {
+  for (const factory of factories) {
+    const { writer, readable } = factory();
+    const chunks = [];
+    Object.defineProperty(chunks, 0, {
+      __proto__: null,
+      enumerable: true,
+      get: common.mustCall(() => {
+        assert.strictEqual(
+          writer.writeSync(new Uint8Array(16384)), true);
+        return Uint8Array.of(42);
+      }),
+    });
+
+    let resolved = false;
+    const write = writer.writev(chunks).then(common.mustCall(() => {
+      resolved = true;
+    }));
+    await new Promise(setImmediate);
+    assert.strictEqual(resolved, false);
+
+    const iterator = readable[Symbol.asyncIterator]();
+    assert.strictEqual((await iterator.next()).value[0].byteLength, 16384);
+    await write;
+    assert.strictEqual((await iterator.next()).value[0][0], 42);
+    writer.endSync();
+    assert.strictEqual((await iterator.next()).done, true);
+  }
+
+  for (const factory of factories) {
+    const { writer, readable } = factory();
+    const chunks = [];
+    Object.defineProperty(chunks, 0, {
+      __proto__: null,
+      enumerable: true,
+      get: common.mustCall(() => {
+        writer.endSync();
+        return Uint8Array.of(42);
+      }),
+    });
+
+    await assert.rejects(writer.writev(chunks), {
+      code: 'ERR_INVALID_STATE',
+    });
+    assert.strictEqual(
+      (await readable[Symbol.asyncIterator]().next()).done, true);
+  }
+}
+
+testWritevReentrancy().then(common.mustCall());
diff --git a/test/parallel/test-stream-pipeline-http2.js b/test/parallel/test-stream-pipeline-http2.js
index 8ffee7786838..0b26c95b3a4e 100644
--- a/test/parallel/test-stream-pipeline-http2.js
+++ b/test/parallel/test-stream-pipeline-http2.js
@@ -30,8 +30,7 @@ const http2 = require('http2');
     let received = 0;
     req.on('data', (data) => {
       received += data.length;
-      // Bound the data that flows before teardown - bytes per data event vary
-      // by platform, and letting this run longer hangs on macOS.
+      // Use a byte threshold because data event chunking varies by platform.
       if (received >= 32 * 1024) rs.destroy();
     });
   }));
diff --git a/test/parallel/test-stream-pipeline.js b/test/parallel/test-stream-pipeline.js
index 7b4052f2b47d..4e7ff2f8c79d 100644
--- a/test/parallel/test-stream-pipeline.js
+++ b/test/parallel/test-stream-pipeline.js
@@ -243,12 +243,12 @@ tmpdir.refresh();
     pipeline(rs, res, () => {});
   }));
 
-  let cnt = 10;
+  let received = 0;
 
   const badSink = new Writable({
     write(data, enc, cb) {
-      cnt--;
-      if (cnt === 0) cb(new Error('kaboom'));
+      received += data.length;
+      if (received >= 50) cb(new Error('kaboom'));
       else cb();
     }
   });
diff --git a/test/parallel/test-stream-readable-next-no-null.js b/test/parallel/test-stream-readable-next-no-null.js
index 7599e386ca70..b3348c2b9794 100644
--- a/test/parallel/test-stream-readable-next-no-null.js
+++ b/test/parallel/test-stream-readable-next-no-null.js
@@ -1,19 +1,87 @@
 'use strict';
-const { mustNotCall, expectsError } = require('../common');
+const common = require('../common');
+const assert = require('assert');
 const { Readable } = require('stream');
+const { finished } = require('stream/promises');
 
-async function* generate() {
-  yield null;
-}
-
-const stream = Readable.from(generate());
-
-stream.on('error', expectsError({
+const expectedError = {
   code: 'ERR_STREAM_NULL_VALUES',
   name: 'TypeError',
   message: 'May not write null values to stream'
-}));
+};
+
+async function rejectsNull(iterable, expectedChunks = []) {
+  const stream = Readable.from(iterable);
+  const chunks = [];
+  const completion = finished(stream);
+
+  stream.on('data', (chunk) => chunks.push(chunk));
+
+  await assert.rejects(completion, expectedError);
+  assert.deepStrictEqual(chunks, expectedChunks);
+  assert.strictEqual(stream.destroyed, true);
+}
+
+async function asyncIteratorYieldsNull() {
+  const cleanup = common.mustCall();
+
+  async function* generate() {
+    try {
+      yield null;
+    } finally {
+      cleanup();
+    }
+  }
+
+  await rejectsNull(generate());
+}
 
-stream.on('data', mustNotCall());
+async function syncIteratorYieldsNull() {
+  const cleanup = common.mustCall();
+
+  function* generate() {
+    try {
+      yield null;
+    } finally {
+      cleanup();
+    }
+  }
+
+  await rejectsNull(generate());
+}
+
+async function firstSyncValueResolvesToNull() {
+  const cleanup = common.mustCall();
+
+  function* generate() {
+    try {
+      yield Promise.resolve(null);
+    } finally {
+      cleanup();
+    }
+  }
+
+  await rejectsNull(generate());
+}
+
+async function laterSyncValueResolvesToNull() {
+  const cleanup = common.mustCall();
+
+  function* generate() {
+    try {
+      yield Promise.resolve('first');
+      yield Promise.resolve(null);
+    } finally {
+      cleanup();
+    }
+  }
+
+  await rejectsNull(generate(), ['first']);
+}
 
-stream.on('end', mustNotCall());
+Promise.all([
+  asyncIteratorYieldsNull(),
+  syncIteratorYieldsNull(),
+  firstSyncValueResolvesToNull(),
+  laterSyncValueResolvesToNull(),
+]).then(common.mustCall());
diff --git a/test/parallel/test-stream-readable-unobserved-eof-readable.js b/test/parallel/test-stream-readable-unobserved-eof-readable.js
new file mode 100644
index 000000000000..5eb6d1b2b631
--- /dev/null
+++ b/test/parallel/test-stream-readable-unobserved-eof-readable.js
@@ -0,0 +1,76 @@
+'use strict';
+const common = require('../common');
+const { Readable } = require('stream');
+const assert = require('assert');
+
+// When a stream reaches its end while nobody is observing it, the
+// end-of-stream 'readable' emission is not scheduled. It is emitted
+// later if a 'readable' listener is attached, and read()/resume()
+// still reach 'end' on their own.
+
+{
+  // Listener attached synchronously after push(null) gets 'readable'
+  // and then 'end'.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  let readableEmitted = false;
+  r.on('readable', common.mustCall(() => {
+    readableEmitted = true;
+    assert.strictEqual(r.read(), null);
+  }));
+  r.on('end', common.mustCall(() => {
+    assert.strictEqual(readableEmitted, true);
+  }));
+}
+
+{
+  // Listener attached one macrotask after the unobserved end still gets
+  // the owed 'readable' before 'end'.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    let readableEmitted = false;
+    r.on('readable', common.mustCall(() => {
+      readableEmitted = true;
+      assert.strictEqual(r.read(), null);
+    }));
+    r.on('end', common.mustCall(() => {
+      assert.strictEqual(readableEmitted, true);
+    }));
+  }));
+}
+
+{
+  // A stream that ends unobserved still emits 'end' when resumed later.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    r.resume();
+    r.on('end', common.mustCall());
+  }));
+}
+
+{
+  // read() after an unobserved end consumes the owed notification: a
+  // 'readable' listener attached afterwards does not receive it, but
+  // 'end' is still emitted.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    assert.strictEqual(r.read(), null);
+    r.on('end', common.mustCall());
+  }));
+}
+
+{
+  // A 'data' listener attached after an unobserved end still gets 'end'.
+  const r = new Readable({ read() {} });
+  r.push('x');
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    r.on('data', common.mustCall((chunk) => {
+      assert.strictEqual(chunk.toString(), 'x');
+    }));
+    r.on('end', common.mustCall());
+  }));
+}
diff --git a/test/parallel/test-tls-peer-certificate-repeated-reads.js b/test/parallel/test-tls-peer-certificate-repeated-reads.js
new file mode 100644
index 000000000000..a50d69687b9c
--- /dev/null
+++ b/test/parallel/test-tls-peer-certificate-repeated-reads.js
@@ -0,0 +1,87 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+// Reading the peer certificate must not consume the chain held by the SSL
+// session. getPeerX509Certificate() and getPeerCertificate() have to keep
+// returning the full chain however often, and in whichever order, they are
+// called on either end of the connection (see the #65579 regression, where an
+// internal getPeerX509Certificate() call left getPeerCertificate(true) with
+// only the leaf). On the server this also covers the peer certificate check
+// that runs before 'secureConnection' is emitted.
+
+const assert = require('assert');
+const { X509Certificate } = require('crypto');
+const tls = require('tls');
+const fixtures = require('../common/fixtures');
+
+// Each peer presents a distinct leaf -> intermediate -> root chain, so the
+// certificate read back has two issuers above the leaf.
+const serverChain = [
+  'leaf-from-intermediate-cert.pem',
+  'intermediate-ca.pem',
+  'fake-startcom-root-cert.pem',
+].map((name) => fixtures.readKey(name));
+const clientChain = [
+  'agent10-cert.pem',
+  'ca4-cert.pem',
+  'ca2-cert.pem',
+].map((name) => fixtures.readKey(name));
+
+function fingerprints(chain) {
+  return chain.map((pem) => new X509Certificate(pem).fingerprint256);
+}
+
+function checkPeerCertificate(socket, chain, side) {
+  assert.strictEqual(socket.authorized, true, side);
+  const [leaf, intermediate, root] = fingerprints(chain);
+
+  // Two rounds, alternating the read methods, so a chain consumed by one read
+  // would be observed by the next.
+  for (let round = 0; round < 2; round++) {
+    const x509 = socket.getPeerX509Certificate();
+    assert.strictEqual(x509.fingerprint256, leaf, side);
+    assert.strictEqual(x509.issuerCertificate.fingerprint256,
+                       intermediate, side);
+
+    const detailed = socket.getPeerCertificate(true);
+    assert.strictEqual(detailed.fingerprint256, leaf, side);
+    assert.strictEqual(detailed.issuerCertificate.fingerprint256,
+                       intermediate, side);
+    assert.strictEqual(
+      detailed.issuerCertificate.issuerCertificate.fingerprint256, root, side);
+
+    assert.strictEqual(socket.getPeerCertificate().fingerprint256, leaf, side);
+  }
+}
+
+const server = tls.createServer({
+  key: fixtures.readKey('leaf-from-intermediate-key.pem'),
+  cert: Buffer.concat(serverChain),
+  ca: clientChain[2],
+  requestCert: true,
+}, common.mustCall((socket) => {
+  checkPeerCertificate(socket, clientChain, 'server');
+  socket.end();
+}));
+
+server.listen(0, common.mustCall(() => {
+  const socket = tls.connect({
+    port: server.address().port,
+    key: fixtures.readKey('agent10-key.pem'),
+    cert: Buffer.concat(clientChain),
+    ca: serverChain[2],
+  }, common.mustCall(() => {
+    checkPeerCertificate(socket, serverChain, 'client');
+
+    // The client receives the server chain verbatim, so its X509 certificate
+    // links all the way to the root, exercising the recursive issuer build
+    // more than one level deep.
+    const [, , root] = fingerprints(serverChain);
+    const x509 = socket.getPeerX509Certificate();
+    assert.strictEqual(x509.issuerCertificate.issuerCertificate.fingerprint256,
+                       root);
+  }));
+  socket.on('close', common.mustCall(() => server.close()));
+}));
diff --git a/test/parallel/test-trace-events-fs-async.js b/test/parallel/test-trace-events-fs-async.js
index 9b8e21b3d560..2a658838b39e 100644
--- a/test/parallel/test-trace-events-fs-async.js
+++ b/test/parallel/test-trace-events-fs-async.js
@@ -47,8 +47,10 @@ function chown({ uid, gid }) {
 
 function close() {
   const fs = require('fs');
-  fs.writeFile('fs3.txt', '123', 'utf8', () => {
-    fs.unlinkSync('fs3.txt');
+  fs.open('fs3.txt', 'w', (err, fd) => {
+    fs.close(fd, () => {
+      fs.unlinkSync('fs3.txt');
+    });
   });
 }
 
@@ -173,7 +175,8 @@ function mktmp() {
 
 function open() {
   const fs = require('fs');
-  fs.writeFile('fs16.txt', '123', 'utf8', () => {
+  fs.open('fs16.txt', 'w', (err, fd) => {
+    fs.closeSync(fd);
     fs.unlinkSync('fs16.txt');
   });
 }
diff --git a/test/parallel/test-urlpattern.js b/test/parallel/test-urlpattern.js
index 42bdd114f43d..0ba84cae3f81 100644
--- a/test/parallel/test-urlpattern.js
+++ b/test/parallel/test-urlpattern.js
@@ -50,3 +50,43 @@ assert.throws(() => {
   assert.strictEqual(result.pathname.input, '/test');
   assert.strictEqual(result.pathname.groups.value, 'test');
 }
+
+{
+  const accessed = [];
+  const expected = [
+    'baseURL',
+    'hash',
+    'hostname',
+    'password',
+    'pathname',
+    'port',
+    'protocol',
+    'search',
+    'username',
+  ];
+  const init = new Proxy({}, {
+    get(target, name, receiver) {
+      accessed.push(name);
+      return Reflect.get(target, name, receiver);
+    },
+  });
+
+  new URLPattern(init);
+  assert.deepStrictEqual(accessed, expected);
+}
+
+{
+  const input = new URLPattern({ pathname: '/x' })
+    .exec({
+      protocol: 'https',
+      pathname: '/x',
+      username: undefined,
+    }).inputs[0];
+
+  assert.deepStrictEqual(Object.keys(input), ['pathname', 'protocol']);
+  assert.strictEqual('username' in input, false);
+  assert.deepStrictEqual({ ...input }, {
+    pathname: '/x',
+    protocol: 'https',
+  });
+}
diff --git a/test/parallel/test-util-inspect.js b/test/parallel/test-util-inspect.js
index 989f6907da69..ae5289cc721c 100644
--- a/test/parallel/test-util-inspect.js
+++ b/test/parallel/test-util-inspect.js
@@ -1475,11 +1475,11 @@ if (typeof Symbol !== 'undefined') {
   assert.strictEqual(util.inspect(new ArraySubclass(1, 2, 3)),
                      'ArraySubclass(3) [ 1, 2, 3 ]');
   assert.strictEqual(util.inspect(new SetSubclass([1, 2, 3])),
-                     'SetSubclass(3) { 1, 2, 3 }');
+                     'SetSubclass(3) [Set] { 1, 2, 3 }');
   assert.strictEqual(util.inspect(new MapSubclass([['foo', 42]])),
-                     "MapSubclass(1) { 'foo' => 42 }");
+                     "MapSubclass(1) [Map] { 'foo' => 42 }");
   assert.strictEqual(util.inspect(new PromiseSubclass(() => {})),
-                     'PromiseSubclass { <pending> }');
+                     'PromiseSubclass [Promise] { <pending> }');
   assert.strictEqual(util.inspect(new SymbolNameClass()),
                      'Symbol(name) {}');
   assert.strictEqual(
@@ -1490,29 +1490,6 @@ if (typeof Symbol !== 'undefined') {
     util.inspect(Object.setPrototypeOf(x, null)),
     '[ObjectSubclass: null prototype] { foo: 42 }'
   );
-
-  class MiddleErrorPart extends Error {}
-  assert(util.inspect(new MiddleErrorPart('foo')).includes('MiddleErrorPart: foo'));
-
-  class MapClass extends Map {}
-  assert.strictEqual(util.inspect(new MapClass([['key', 'value']])),
-                     "MapClass(1) { 'key' => 'value' }");
-
-  class AbcMap extends Map {}
-  assert.strictEqual(util.inspect(new AbcMap([['key', 'value']])),
-                     "AbcMap(1) { 'key' => 'value' }");
-
-  class SetAbc extends Set {}
-  assert.strictEqual(util.inspect(new SetAbc([1, 2, 3])),
-                     'SetAbc(3) { 1, 2, 3 }');
-
-  class FooSet extends Set {}
-  assert.strictEqual(util.inspect(new FooSet([1, 2, 3])),
-                     'FooSet(3) { 1, 2, 3 }');
-
-  class Settings extends Set {}
-  assert.strictEqual(util.inspect(new Settings([1, 2, 3])),
-                     'Settings(3) [Set] { 1, 2, 3 }');
 }
 
 // Empty and circular before depth.
@@ -4070,3 +4047,16 @@ ${error.stack.split('\n').slice(1).join('\n')}`,
   const expected = "{ a: 'short string', b: [ 1, 2 ], c: { d: true } }";
   assert.strictEqual(util.inspect(obj, { breakLength: Infinity }), expected);
 }
+
+{
+  class Class {
+    get [Symbol.toStringTag]() {
+      return 'Namespaced.Class';
+    }
+  }
+
+  class DerivedClass extends Class {}
+
+  assert.strictEqual(inspect(new Class()), 'Namespaced.Class {}');
+  assert.strictEqual(inspect(new DerivedClass()), 'DerivedClass [Namespaced.Class] {}');
+}
diff --git a/test/parallel/test-v8-heap-profile.js b/test/parallel/test-v8-heap-profile.js
index d1c611212509..a8068b1a59ce 100644
--- a/test/parallel/test-v8-heap-profile.js
+++ b/test/parallel/test-v8-heap-profile.js
@@ -44,6 +44,12 @@ assert.throws(
     code: 'ERR_INVALID_ARG_TYPE',
   });
 
+const invalidLimits = [-1, 0, '', {}, NaN, undefined];
+for (const value of invalidLimits) {
+  assert.throws(() => v8.setHeapProfileNearHeapLimit(value),
+                /ERR_INVALID_ARG_TYPE|ERR_OUT_OF_RANGE/);
+}
+
 // Default params.
 {
   const handle = v8.startHeapProfile();
@@ -73,3 +79,11 @@ assert.throws(
   JSON.parse(handle.stop());
   assert.strictEqual(handle.stop(), undefined);
 }
+
+// Profile and snapshot near-heap-limit callbacks coexist.
+{
+  v8.setHeapProfileNearHeapLimit(1);
+  v8.setHeapProfileNearHeapLimit(1);   // no-op
+  v8.setHeapSnapshotNearHeapLimit(1);
+  v8.setHeapSnapshotNearHeapLimit(1);  // no-op
+}
diff --git a/test/parallel/test-vfs-addon.js b/test/parallel/test-vfs-addon.js
new file mode 100644
index 000000000000..1c138a187d0a
--- /dev/null
+++ b/test/parallel/test-vfs-addon.js
@@ -0,0 +1,37 @@
+// Flags: --experimental-vfs
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const vfs = require('node:vfs');
+
+const addonPath = path.join(
+  __dirname, '..', 'addons', 'hello-world', 'build', 'Release', 'binding.node');
+if (!fs.existsSync(addonPath)) {
+  common.skip('the hello-world addon is not built');
+}
+
+// A native addon inside a mounted VFS can be require()d: dlopen() cannot open
+// the reserved mount path, so the loader hands the addon's bytes to
+// process.dlopen's `binary` option, which loads them from a private temporary
+// image (an in-memory memfd on Linux).
+const myVfs = vfs.create();
+myVfs.writeFileSync('/binding.node', fs.readFileSync(addonPath));
+const mountPoint = myVfs.mount();
+
+const before = new Set(fs.readdirSync(os.tmpdir()));
+const addon = require(path.join(mountPoint, 'binding.node'));
+assert.strictEqual(addon.hello(), 'world');
+
+// On Linux the memfd path never touches the filesystem; on other POSIX the
+// temp image is unlinked right after loading, so no addon temp file lingers.
+// (Windows keeps a delete-on-close file until exit, so skip the check there.)
+if (process.platform !== 'win32') {
+  const leaked = fs.readdirSync(os.tmpdir())
+    .filter((f) => f.startsWith('node-addon') && !before.has(f));
+  assert.deepStrictEqual(leaked, [], `addon temp not cleaned up: ${leaked}`);
+}
+
+myVfs.unmount();
diff --git a/test/parallel/test-vfs-destructuring.js b/test/parallel/test-vfs-destructuring.js
index 11422cf4eda8..e38d15bbb734 100644
--- a/test/parallel/test-vfs-destructuring.js
+++ b/test/parallel/test-vfs-destructuring.js
@@ -18,17 +18,13 @@ const {
   realpathSync,
 } = require('fs');
 
-// path.resolve here so the mount point and the assertion targets are in the
-// platform's native form (e.g. 'D:\vfs_destr' on Windows). VirtualFileSystem
-// stores the mount point via path.resolve internally, so we mirror that.
-const MOUNT = path.resolve('/vfs_destr');
-const FILE = path.join(MOUNT, 'file.txt');
-
 const myVfs = vfs.create();
 myVfs.mkdirSync('/sub', { recursive: true });
 myVfs.writeFileSync('/file.txt', 'hello from vfs');
 myVfs.writeFileSync('/sub/nested.txt', 'nested content');
-myVfs.mount(MOUNT);
+
+const MOUNT = myVfs.mount();
+const FILE = path.join(MOUNT, 'file.txt');
 
 {
   const content = readFileSync(FILE, 'utf8');
diff --git a/test/parallel/test-vfs-fs-accessSync.js b/test/parallel/test-vfs-fs-accessSync.js
index a05bfd132823..9d3469608ecc 100644
--- a/test/parallel/test-vfs-fs-accessSync.js
+++ b/test/parallel/test-vfs-fs-accessSync.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-accessSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 // Existing path succeeds
 fs.accessSync(path.join(mountPoint, 'src/hello.txt'));
diff --git a/test/parallel/test-vfs-fs-callback-error-paths.js b/test/parallel/test-vfs-fs-callback-error-paths.js
index 8a9bf95980e5..5cff379eda66 100644
--- a/test/parallel/test-vfs-fs-callback-error-paths.js
+++ b/test/parallel/test-vfs-fs-callback-error-paths.js
@@ -9,14 +9,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-cb-err-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-chmod-callback.js b/test/parallel/test-vfs-fs-chmod-callback.js
index 72523a3bd7e8..44f86833c397 100644
--- a/test/parallel/test-vfs-fs-chmod-callback.js
+++ b/test/parallel/test-vfs-fs-chmod-callback.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-chmod-cb-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 const target = path.join(mountPoint, 'src/hello.txt');
 const uid = process.getuid?.() ?? 0;
diff --git a/test/parallel/test-vfs-fs-chmodSync.js b/test/parallel/test-vfs-fs-chmodSync.js
index f4403d370872..91a63c36129e 100644
--- a/test/parallel/test-vfs-fs-chmodSync.js
+++ b/test/parallel/test-vfs-fs-chmodSync.js
@@ -10,11 +10,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-chmodSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 const target = path.join(mountPoint, 'src/hello.txt');
 const uid = process.getuid?.() ?? 0;
diff --git a/test/parallel/test-vfs-fs-copyFileSync.js b/test/parallel/test-vfs-fs-copyFileSync.js
index 9f97421329c5..3383b460862c 100644
--- a/test/parallel/test-vfs-fs-copyFileSync.js
+++ b/test/parallel/test-vfs-fs-copyFileSync.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-copyFileSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 fs.copyFileSync(
   path.join(mountPoint, 'src/hello.txt'),
diff --git a/test/parallel/test-vfs-fs-createReadStream.js b/test/parallel/test-vfs-fs-createReadStream.js
index 08303a361e1f..357d7db2b923 100644
--- a/test/parallel/test-vfs-fs-createReadStream.js
+++ b/test/parallel/test-vfs-fs-createReadStream.js
@@ -10,14 +10,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-createReadStream-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello world');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-createWriteStream.js b/test/parallel/test-vfs-fs-createWriteStream.js
index 42660acb7f63..495d4108db37 100644
--- a/test/parallel/test-vfs-fs-createWriteStream.js
+++ b/test/parallel/test-vfs-fs-createWriteStream.js
@@ -10,15 +10,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve(
-  '/tmp/vfs-createWriteStream-' + process.pid,
-);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-existsSync.js b/test/parallel/test-vfs-fs-existsSync.js
index 190304a154ca..5bb6df4c1c20 100644
--- a/test/parallel/test-vfs-fs-existsSync.js
+++ b/test/parallel/test-vfs-fs-existsSync.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-existsSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 assert.strictEqual(fs.existsSync(path.join(mountPoint, 'src/hello.txt')), true);
 assert.strictEqual(fs.existsSync(path.join(mountPoint, 'src')), true);
diff --git a/test/parallel/test-vfs-fs-fchmod-callback.js b/test/parallel/test-vfs-fs-fchmod-callback.js
index fa55c934f36f..e46fd27af424 100644
--- a/test/parallel/test-vfs-fs-fchmod-callback.js
+++ b/test/parallel/test-vfs-fs-fchmod-callback.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-fchmod-cb-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 const fd = fs.openSync(path.join(mountPoint, 'src/hello.txt'), 'r+');
 const uid = process.getuid?.() ?? 0;
diff --git a/test/parallel/test-vfs-fs-linkSync.js b/test/parallel/test-vfs-fs-linkSync.js
index f8090b24720d..e73bcc76df00 100644
--- a/test/parallel/test-vfs-fs-linkSync.js
+++ b/test/parallel/test-vfs-fs-linkSync.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-linkSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 fs.linkSync(
   path.join(mountPoint, 'src/hello.txt'),
diff --git a/test/parallel/test-vfs-fs-mkdir-callback.js b/test/parallel/test-vfs-fs-mkdir-callback.js
index e354cc94d01b..4caccda70f6d 100644
--- a/test/parallel/test-vfs-fs-mkdir-callback.js
+++ b/test/parallel/test-vfs-fs-mkdir-callback.js
@@ -9,14 +9,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-mkdir-cb-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-mkdirSync.js b/test/parallel/test-vfs-fs-mkdirSync.js
index de3959a06e3b..83942b8856be 100644
--- a/test/parallel/test-vfs-fs-mkdirSync.js
+++ b/test/parallel/test-vfs-fs-mkdirSync.js
@@ -9,10 +9,9 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-mkdirSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 // Plain mkdir
 fs.mkdirSync(path.join(mountPoint, 'src/d1'));
diff --git a/test/parallel/test-vfs-fs-mkdtempSync.js b/test/parallel/test-vfs-fs-mkdtempSync.js
index ba837b716cb6..2fd1e81d7093 100644
--- a/test/parallel/test-vfs-fs-mkdtempSync.js
+++ b/test/parallel/test-vfs-fs-mkdtempSync.js
@@ -10,10 +10,9 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-mkdtempSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 const prefix = path.join(mountPoint, 'src/tmp-');
 
diff --git a/test/parallel/test-vfs-fs-open-callback.js b/test/parallel/test-vfs-fs-open-callback.js
index b1cacb11d921..23a4f8ccadb9 100644
--- a/test/parallel/test-vfs-fs-open-callback.js
+++ b/test/parallel/test-vfs-fs-open-callback.js
@@ -10,14 +10,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-open-cb-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello world');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-openAsBlob.js b/test/parallel/test-vfs-fs-openAsBlob.js
index 1c8d175c8f99..663472269156 100644
--- a/test/parallel/test-vfs-fs-openAsBlob.js
+++ b/test/parallel/test-vfs-fs-openAsBlob.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-openAsBlob-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 fs.openAsBlob(path.join(mountPoint, 'src/hello.txt'))
   .then(async (blob) => {
diff --git a/test/parallel/test-vfs-fs-openSync.js b/test/parallel/test-vfs-fs-openSync.js
index 28fa17d28b3c..d1155e36cb14 100644
--- a/test/parallel/test-vfs-fs-openSync.js
+++ b/test/parallel/test-vfs-fs-openSync.js
@@ -12,11 +12,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-openSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 // openSync + fstatSync + readSync + closeSync
 {
diff --git a/test/parallel/test-vfs-fs-opendir-callback.js b/test/parallel/test-vfs-fs-opendir-callback.js
index 36b8ef81d74e..6b1f6fe5f884 100644
--- a/test/parallel/test-vfs-fs-opendir-callback.js
+++ b/test/parallel/test-vfs-fs-opendir-callback.js
@@ -10,15 +10,12 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-opendir-cb-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello');
   myVfs.writeFileSync('/src/data.json', '{}');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-opendirSync.js b/test/parallel/test-vfs-fs-opendirSync.js
index 18ba4c49dd21..260b3114d104 100644
--- a/test/parallel/test-vfs-fs-opendirSync.js
+++ b/test/parallel/test-vfs-fs-opendirSync.js
@@ -9,12 +9,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-opendirSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src/subdir', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
 myVfs.writeFileSync('/src/data.json', '{}');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 const dir = fs.opendirSync(path.join(mountPoint, 'src'));
 const names = [];
diff --git a/test/parallel/test-vfs-fs-promises-buffer-encoding.js b/test/parallel/test-vfs-fs-promises-buffer-encoding.js
index cfb38787ab46..0c371c9c4587 100644
--- a/test/parallel/test-vfs-fs-promises-buffer-encoding.js
+++ b/test/parallel/test-vfs-fs-promises-buffer-encoding.js
@@ -10,14 +10,11 @@ const fsp = require('fs/promises');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-buf-enc-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-promises-stat-no-throw.js b/test/parallel/test-vfs-fs-promises-stat-no-throw.js
index 6bd0c546a02d..0b9b28ea1012 100644
--- a/test/parallel/test-vfs-fs-promises-stat-no-throw.js
+++ b/test/parallel/test-vfs-fs-promises-stat-no-throw.js
@@ -11,11 +11,10 @@ const path = require('path');
 const vfs = require('node:vfs');
 
 (async () => {
-  const mountPoint = path.resolve('/tmp/vfs-stat-no-throw-' + process.pid);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
 
   // Missing file -> undefined
   const missing = await fsp.stat(path.join(mountPoint, 'src/nope'),
diff --git a/test/parallel/test-vfs-fs-promises.js b/test/parallel/test-vfs-fs-promises.js
index 0f09c96f83ae..a5761d4ca5dd 100644
--- a/test/parallel/test-vfs-fs-promises.js
+++ b/test/parallel/test-vfs-fs-promises.js
@@ -12,11 +12,10 @@ const path = require('path');
 const vfs = require('node:vfs');
 
 (async () => {
-  const mountPoint = path.resolve('/tmp/vfs-promises-' + process.pid);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello world');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   const p = (s) => path.join(mountPoint, s);
 
   // Path-based reads
diff --git a/test/parallel/test-vfs-fs-readFile-callback.js b/test/parallel/test-vfs-fs-readFile-callback.js
index 5902f399b30a..653e79e395a2 100644
--- a/test/parallel/test-vfs-fs-readFile-callback.js
+++ b/test/parallel/test-vfs-fs-readFile-callback.js
@@ -10,14 +10,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-readFile-cb-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello world');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-readFileSync.js b/test/parallel/test-vfs-fs-readFileSync.js
index 1ca906b2a057..297a88551014 100644
--- a/test/parallel/test-vfs-fs-readFileSync.js
+++ b/test/parallel/test-vfs-fs-readFileSync.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-readFileSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 // Default (buffer) result
 {
@@ -48,15 +47,12 @@ myVfs.unmount();
 // is renamed.
 {
   const root = path.join('/tmp', 'vfs-real-readFileSync-' + process.pid);
-  const realMountPoint = path.join('/tmp', 'vfs-real-readFileSync-mount-' + process.pid);
   fs.rmSync(root, { recursive: true, force: true });
-  fs.rmSync(realMountPoint, { recursive: true, force: true });
   fs.mkdirSync(root, { recursive: true });
-  fs.mkdirSync(realMountPoint, { recursive: true });
 
-  const realVfs = vfs
-    .create(new vfs.RealFSProvider(root), { emitExperimentalWarning: false })
-    .mount(realMountPoint);
+  const realVfs = vfs.create(new vfs.RealFSProvider(root),
+                             { emitExperimentalWarning: false });
+  const realMountPoint = realVfs.mount();
   try {
     fs.writeFileSync(path.join(root, 'a.txt'), 'still readable');
     const fd = fs.openSync(path.join(realMountPoint, 'a.txt'), 'r');
@@ -69,6 +65,5 @@ myVfs.unmount();
   } finally {
     realVfs.unmount();
     fs.rmSync(root, { recursive: true, force: true });
-    fs.rmSync(realMountPoint, { recursive: true, force: true });
   }
 }
diff --git a/test/parallel/test-vfs-fs-readdirSync.js b/test/parallel/test-vfs-fs-readdirSync.js
index 9a7955481339..ee1a1a258b3c 100644
--- a/test/parallel/test-vfs-fs-readdirSync.js
+++ b/test/parallel/test-vfs-fs-readdirSync.js
@@ -10,12 +10,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-readdirSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src/subdir', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
 myVfs.writeFileSync('/src/data.json', '{}');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 // Default (utf8 string array)
 {
diff --git a/test/parallel/test-vfs-fs-realpathSync.js b/test/parallel/test-vfs-fs-realpathSync.js
index 77d028877616..2d87b1e87d3b 100644
--- a/test/parallel/test-vfs-fs-realpathSync.js
+++ b/test/parallel/test-vfs-fs-realpathSync.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-realpathSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 const p = path.join(mountPoint, 'src/hello.txt');
 
diff --git a/test/parallel/test-vfs-fs-rename-callback.js b/test/parallel/test-vfs-fs-rename-callback.js
index ccf6cccdd56e..dd426c181e4a 100644
--- a/test/parallel/test-vfs-fs-rename-callback.js
+++ b/test/parallel/test-vfs-fs-rename-callback.js
@@ -9,14 +9,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-rename-cb-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello world');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-renameSync.js b/test/parallel/test-vfs-fs-renameSync.js
index 88c3f17eef5c..1f1cbf6b394d 100644
--- a/test/parallel/test-vfs-fs-renameSync.js
+++ b/test/parallel/test-vfs-fs-renameSync.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-renameSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 fs.renameSync(
   path.join(mountPoint, 'src/hello.txt'),
diff --git a/test/parallel/test-vfs-fs-rmSync.js b/test/parallel/test-vfs-fs-rmSync.js
index a6b77a66bc41..4f3af281d61a 100644
--- a/test/parallel/test-vfs-fs-rmSync.js
+++ b/test/parallel/test-vfs-fs-rmSync.js
@@ -9,13 +9,12 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-rmSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src/subdir', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
 myVfs.writeFileSync('/src/subdir/inside.txt', 'inside');
 myVfs.mkdirSync('/empty');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 // rmdirSync on an empty directory
 fs.rmdirSync(path.join(mountPoint, 'empty'));
diff --git a/test/parallel/test-vfs-fs-stat-callback.js b/test/parallel/test-vfs-fs-stat-callback.js
index 873d27e14445..bd3494b73fec 100644
--- a/test/parallel/test-vfs-fs-stat-callback.js
+++ b/test/parallel/test-vfs-fs-stat-callback.js
@@ -9,14 +9,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-stat-cb-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello world');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-statSync.js b/test/parallel/test-vfs-fs-statSync.js
index e952dfab9ad5..5a48c4e426fa 100644
--- a/test/parallel/test-vfs-fs-statSync.js
+++ b/test/parallel/test-vfs-fs-statSync.js
@@ -10,11 +10,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-statSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 // statSync on a regular file
 {
diff --git a/test/parallel/test-vfs-fs-symlink-callback.js b/test/parallel/test-vfs-fs-symlink-callback.js
index 004745e0fb97..e35eeb38b980 100644
--- a/test/parallel/test-vfs-fs-symlink-callback.js
+++ b/test/parallel/test-vfs-fs-symlink-callback.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-symlink-cb-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 fs.symlink('hello.txt', path.join(mountPoint, 'src/lnk.txt'),
            common.mustSucceed(() => {
diff --git a/test/parallel/test-vfs-fs-symlinkSync.js b/test/parallel/test-vfs-fs-symlinkSync.js
index 6d043c59a98a..5a39cc281e05 100644
--- a/test/parallel/test-vfs-fs-symlinkSync.js
+++ b/test/parallel/test-vfs-fs-symlinkSync.js
@@ -10,11 +10,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-symlinkSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 fs.symlinkSync('hello.txt', path.join(mountPoint, 'src/link.txt'));
 assert.strictEqual(
diff --git a/test/parallel/test-vfs-fs-truncate-callback.js b/test/parallel/test-vfs-fs-truncate-callback.js
index e33ed7e4d614..1399bf6ed149 100644
--- a/test/parallel/test-vfs-fs-truncate-callback.js
+++ b/test/parallel/test-vfs-fs-truncate-callback.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-truncate-cb-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 fs.truncate(path.join(mountPoint, 'src/hello.txt'), 5,
             common.mustSucceed(() => {
diff --git a/test/parallel/test-vfs-fs-truncateSync.js b/test/parallel/test-vfs-fs-truncateSync.js
index 1c15f5647a47..d4ed16f8fb87 100644
--- a/test/parallel/test-vfs-fs-truncateSync.js
+++ b/test/parallel/test-vfs-fs-truncateSync.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-truncateSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 fs.truncateSync(path.join(mountPoint, 'src/hello.txt'), 5);
 assert.strictEqual(
diff --git a/test/parallel/test-vfs-fs-watch-dispatch.js b/test/parallel/test-vfs-fs-watch-dispatch.js
index 6d528d6fef7c..e9952919193b 100644
--- a/test/parallel/test-vfs-fs-watch-dispatch.js
+++ b/test/parallel/test-vfs-fs-watch-dispatch.js
@@ -10,11 +10,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-watch-dispatch-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 const watcher = fs.watch(path.join(mountPoint, 'src/hello.txt'));
 assert.ok(watcher);
diff --git a/test/parallel/test-vfs-fs-writeFile-callback.js b/test/parallel/test-vfs-fs-writeFile-callback.js
index a02dc686b0e0..ce22b6b8811a 100644
--- a/test/parallel/test-vfs-fs-writeFile-callback.js
+++ b/test/parallel/test-vfs-fs-writeFile-callback.js
@@ -9,13 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-writeFile-cb-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-writeFileSync.js b/test/parallel/test-vfs-fs-writeFileSync.js
index eeed2a685f08..7bde5f6c7b85 100644
--- a/test/parallel/test-vfs-fs-writeFileSync.js
+++ b/test/parallel/test-vfs-fs-writeFileSync.js
@@ -9,10 +9,9 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-writeFileSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 const target = path.join(mountPoint, 'src/new.txt');
 
@@ -58,15 +57,12 @@ myVfs.unmount();
 // after the backing path is renamed.
 {
   const root = path.join('/tmp', 'vfs-real-writeFileSync-' + process.pid);
-  const realMountPoint = path.join('/tmp', 'vfs-real-writeFileSync-mount-' + process.pid);
   fs.rmSync(root, { recursive: true, force: true });
-  fs.rmSync(realMountPoint, { recursive: true, force: true });
   fs.mkdirSync(root, { recursive: true });
-  fs.mkdirSync(realMountPoint, { recursive: true });
 
-  const realVfs = vfs
-    .create(new vfs.RealFSProvider(root), { emitExperimentalWarning: false })
-    .mount(realMountPoint);
+  const realVfs = vfs.create(
+    new vfs.RealFSProvider(root), { emitExperimentalWarning: false });
+  const realMountPoint = realVfs.mount();
   try {
     const mountedFile = path.join(realMountPoint, 'a.txt');
     fs.writeFileSync(path.join(root, 'a.txt'), 'old');
@@ -83,6 +79,5 @@ myVfs.unmount();
   } finally {
     realVfs.unmount();
     fs.rmSync(root, { recursive: true, force: true });
-    fs.rmSync(realMountPoint, { recursive: true, force: true });
   }
 }
diff --git a/test/parallel/test-vfs-import.mjs b/test/parallel/test-vfs-import.mjs
new file mode 100644
index 000000000000..03e1047c7b79
--- /dev/null
+++ b/test/parallel/test-vfs-import.mjs
@@ -0,0 +1,139 @@
+// Flags: --experimental-vfs
+import '../common/index.mjs';
+import assert from 'assert';
+import { pathToFileURL } from 'node:url';
+import vfs from 'node:vfs';
+
+const vfsImport = (path) => pathToFileURL(path).href;
+
+// ESM imports are cached by URL and unmounting does not clear the V8 module
+// cache; each vfs.create() gets its own layer id so mount points are unique.
+
+// Test importing a simple virtual ES module
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/hello.mjs', 'export const message = "hello from vfs";');
+  const mountPoint = myVfs.mount();
+
+  const { message } = await import(vfsImport(`${mountPoint}/hello.mjs`));
+  assert.strictEqual(message, 'hello from vfs');
+
+  myVfs.unmount();
+}
+
+// Test importing a virtual module with default export
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/default.mjs', 'export default { name: "test", value: 42 };');
+  const mountPoint = myVfs.mount();
+
+  const mod = await import(vfsImport(`${mountPoint}/default.mjs`));
+  assert.strictEqual(mod.default.name, 'test');
+  assert.strictEqual(mod.default.value, 42);
+
+  myVfs.unmount();
+}
+
+// Test importing a virtual module that imports another virtual module.
+// Mount first so the embedded absolute specifier can use the mount point.
+{
+  const myVfs = vfs.create();
+  const mountPoint = myVfs.mount();
+  myVfs.writeFileSync(`${mountPoint}/utils.mjs`,
+                      'export function add(a, b) { return a + b; }');
+  myVfs.writeFileSync(`${mountPoint}/main.mjs`, `
+    import { add } from ${JSON.stringify(vfsImport(`${mountPoint}/utils.mjs`))};
+    export const result = add(10, 20);
+  `);
+
+  const { result } = await import(vfsImport(`${mountPoint}/main.mjs`));
+  assert.strictEqual(result, 30);
+
+  myVfs.unmount();
+}
+
+// Test importing with relative paths
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/lib', { recursive: true });
+  myVfs.writeFileSync('/lib/helper.mjs', 'export const helper = () => "helped";');
+  myVfs.writeFileSync('/lib/index.mjs', `
+    import { helper } from './helper.mjs';
+    export const output = helper();
+  `);
+  const mountPoint = myVfs.mount();
+
+  const { output } = await import(vfsImport(`${mountPoint}/lib/index.mjs`));
+  assert.strictEqual(output, 'helped');
+
+  myVfs.unmount();
+}
+
+// Test importing JSON from VFS (with import assertion)
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/data.json', JSON.stringify({ items: [1, 2, 3], enabled: true }));
+  const mountPoint = myVfs.mount();
+
+  const data = await import(vfsImport(`${mountPoint}/data.json`), { with: { type: 'json' } });
+  assert.deepStrictEqual(data.default.items, [1, 2, 3]);
+  assert.strictEqual(data.default.enabled, true);
+
+  myVfs.unmount();
+}
+
+// Test that real modules still work when VFS is mounted
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/test.mjs', 'export const x = 1;');
+  myVfs.mount();
+
+  const assertMod = await import('node:assert');
+  assert.strictEqual(typeof assertMod.strictEqual, 'function');
+
+  myVfs.unmount();
+}
+
+// Test mixed CJS and ESM - ESM importing from VFS while CJS also works
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/esm-module.mjs', 'export const esmValue = "esm";');
+  myVfs.writeFileSync('/cjs-module.js', 'module.exports = { cjsValue: "cjs" };');
+  const mountPoint = myVfs.mount();
+
+  const { esmValue } = await import(vfsImport(`${mountPoint}/esm-module.mjs`));
+  assert.strictEqual(esmValue, 'esm');
+
+  const { createRequire } = await import('module');
+  const require = createRequire(import.meta.url);
+  const { cjsValue } = require(`${mountPoint}/cjs-module.js`);
+  assert.strictEqual(cjsValue, 'cjs');
+
+  myVfs.unmount();
+}
+
+// Test ESM bare specifier resolution from VFS node_modules.
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/my-vfs-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/my-vfs-pkg/package.json', JSON.stringify({
+    name: 'my-vfs-pkg',
+    type: 'module',
+    exports: { '.': './index.mjs' },
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/my-vfs-pkg/index.mjs',
+    'export const fromVfs = true;',
+  );
+  // Importing module must live in the VFS mount so node_modules walk stays inside VFS.
+  myVfs.writeFileSync(
+    '/app/entry.mjs',
+    "export { fromVfs } from 'my-vfs-pkg';",
+  );
+  const mountPoint = myVfs.mount();
+
+  const { fromVfs } = await import(vfsImport(`${mountPoint}/app/entry.mjs`));
+  assert.strictEqual(fromVfs, true);
+
+  myVfs.unmount();
+}
diff --git a/test/parallel/test-vfs-invalid-package-json.js b/test/parallel/test-vfs-invalid-package-json.js
new file mode 100644
index 000000000000..99589d16afbb
--- /dev/null
+++ b/test/parallel/test-vfs-invalid-package-json.js
@@ -0,0 +1,76 @@
+// Flags: --experimental-vfs --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const vfs = require('node:vfs');
+
+// Malformed package.json in VFS throws ERR_INVALID_PACKAGE_CONFIG
+// (matches native CJS behavior after nodejs/node#48606).
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/pkg', { recursive: true });
+  myVfs.writeFileSync('/pkg/package.json', '{ invalid json');
+  myVfs.writeFileSync('/pkg/index.js', 'module.exports = 42;');
+  const mountPoint = myVfs.mount();
+
+  assert.throws(() => require(`${mountPoint}/pkg`),
+                { code: 'ERR_INVALID_PACKAGE_CONFIG' });
+
+  myVfs.unmount();
+}
+
+// Valid package.json still works
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/pkg2', { recursive: true });
+  myVfs.writeFileSync('/pkg2/package.json', '{"main": "lib.js"}');
+  myVfs.writeFileSync('/pkg2/lib.js', 'module.exports = 99;');
+  const mountPoint = myVfs.mount();
+
+  assert.strictEqual(require(`${mountPoint}/pkg2`), 99);
+
+  myVfs.unmount();
+}
+
+// Missing package.json (ENOENT) still falls through to index.js
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/pkg3', { recursive: true });
+  myVfs.writeFileSync('/pkg3/index.js', 'module.exports = 77;');
+  const mountPoint = myVfs.mount();
+
+  assert.strictEqual(require(`${mountPoint}/pkg3`), 77);
+
+  myVfs.unmount();
+}
+
+// A malformed ancestor package.json aborts the scope walk with
+// ERR_INVALID_PACKAGE_CONFIG for both CJS and ESM.
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/outer/inner', { recursive: true });
+  myVfs.writeFileSync('/outer/package.json', '{ bad }');
+  myVfs.writeFileSync('/outer/inner/mod.js', 'module.exports = 1;');
+  const mountPoint = myVfs.mount();
+
+  assert.throws(() => require(`${mountPoint}/outer/inner/mod.js`),
+                { code: 'ERR_INVALID_PACKAGE_CONFIG' });
+
+  myVfs.unmount();
+}
+
+(async () => {
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/outer2/inner', { recursive: true });
+  myVfs.writeFileSync('/outer2/package.json', '{ bad }');
+  myVfs.writeFileSync('/outer2/inner/mod.js', 'export const x = 1;');
+  myVfs.mount();
+
+  await assert.rejects(
+    () => import(`${myVfs.mountPointURL}/outer2/inner/mod.js`),
+    { code: 'ERR_INVALID_PACKAGE_CONFIG' },
+  );
+
+  myVfs.unmount();
+})().then(common.mustCall());
diff --git a/test/parallel/test-vfs-layer-tag-prefix.mjs b/test/parallel/test-vfs-layer-tag-prefix.mjs
new file mode 100644
index 000000000000..8c751cee73f9
--- /dev/null
+++ b/test/parallel/test-vfs-layer-tag-prefix.mjs
@@ -0,0 +1,45 @@
+// Flags: --experimental-vfs
+
+// Regression: unmounting a layer whose id is a decimal prefix of another
+// (e.g. layer 1 vs layer 10) must not purge the other's ESM cache entries.
+// Mount points look like `${os.devNull}/vfs/<id>`, so we create instances
+// until the returned mount points exhibit the prefix collision, then
+// verify the survivor's cache lives on.
+
+import '../common/index.mjs';
+import assert from 'node:assert';
+import { pathToFileURL } from 'node:url';
+import vfs from 'node:vfs';
+
+const vfsImport = (path) => pathToFileURL(path).href;
+
+// Layer ids are per-process and increment on every `vfs.create()`, so the
+// second construction lands at id 1 and the eleventh at id 10.
+const instances = [];
+for (let i = 0; i < 11; i++) instances.push(vfs.create());
+const layerOne = instances[1];
+const layerTen = instances[10];
+
+layerOne.writeFileSync('/m.mjs', 'export const tag = "one";');
+const mountOne = layerOne.mount();
+
+layerTen.writeFileSync('/m.mjs', 'export const tag = "ten";');
+const mountTen = layerTen.mount();
+
+assert.notStrictEqual(mountOne, mountTen);
+assert.ok(mountTen.startsWith(mountOne),
+          'test scaffolding: expected layerTen mount to start with layerOne mount');
+
+const oneA = await import(vfsImport(`${mountOne}/m.mjs`));
+const tenA = await import(vfsImport(`${mountTen}/m.mjs`));
+assert.strictEqual(oneA.tag, 'one');
+assert.strictEqual(tenA.tag, 'ten');
+
+layerOne.unmount();
+
+// Layer 10 still mounted: re-import must hit the cache and return the same
+// namespace object. A prefix-based purge would evict it and cause re-eval.
+const tenB = await import(vfsImport(`${mountTen}/m.mjs`));
+assert.strictEqual(tenA, tenB);
+
+layerTen.unmount();
diff --git a/test/parallel/test-vfs-lchown-symlink.js b/test/parallel/test-vfs-lchown-symlink.js
index 5eda47432eeb..6154e9fb2de9 100644
--- a/test/parallel/test-vfs-lchown-symlink.js
+++ b/test/parallel/test-vfs-lchown-symlink.js
@@ -8,7 +8,6 @@ const fsp = require('fs/promises');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-lchown-' + process.pid);
 const myVfs = vfs.create();
 myVfs.writeFileSync('/sync-target.txt', 'target');
 myVfs.symlinkSync('/sync-target.txt', '/sync-link.txt');
@@ -16,7 +15,7 @@ myVfs.writeFileSync('/async-target.txt', 'target');
 myVfs.symlinkSync('/async-target.txt', '/async-link.txt');
 myVfs.writeFileSync('/promise-target.txt', 'target');
 myVfs.symlinkSync('/promise-target.txt', '/promise-link.txt');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 function assertOwnership(filePath, uid, gid) {
   const stats = fs.lstatSync(path.join(mountPoint, filePath));
diff --git a/test/parallel/test-vfs-memory-provider-dynamic.js b/test/parallel/test-vfs-memory-provider-dynamic.js
index 9ddd105a5a55..13ed609820e7 100644
--- a/test/parallel/test-vfs-memory-provider-dynamic.js
+++ b/test/parallel/test-vfs-memory-provider-dynamic.js
@@ -46,35 +46,43 @@ function makeFileEntry(prototypeFrom, contentProvider) {
   return fileEntry;
 }
 
-// ===== Lazy-populated directory =====
-{
-  const provider = new MemoryProvider();
-  const root = getRoot(provider);
-
-  const dir = {
-    __proto__: Object.getPrototypeOf(root),
+function makeDirEntry(prototypeFrom, populate) {
+  const t = Date.now();
+  const dirEntry = { __proto__: Object.getPrototypeOf(prototypeFrom) };
+  Object.assign(dirEntry, {
     type: 1,           // TYPE_DIR
     mode: 0o755,
     children: new Map(),
-    populate: (scoped) => {
-      scoped.addFile('hello.txt', 'lazy hello');
-      scoped.addFile('dyn.txt', () => 'dynamic-string');
-      scoped.addDirectory('subdir', null);
-      scoped.addSymlink('link.txt', '/lazy/hello.txt');
-    },
+    populate,
     populated: false,
     nlink: 1,
     uid: 0,
     gid: 0,
-  };
-  const t = Date.now();
-  dir.atime = t; dir.mtime = t; dir.ctime = t; dir.birthtime = t;
-  dir.isFile = root.isFile.bind(dir);
-  dir.isDirectory = root.isDirectory.bind(dir);
-  dir.isSymbolicLink = root.isSymbolicLink.bind(dir);
-  dir.isDynamic = root.isDynamic.bind(dir);
-  dir.getContentSync = root.getContentSync.bind(dir);
-  dir.getContentAsync = root.getContentAsync.bind(dir);
+    atime: t,
+    mtime: t,
+    ctime: t,
+    birthtime: t,
+  });
+  dirEntry.isFile = prototypeFrom.isFile.bind(dirEntry);
+  dirEntry.isDirectory = prototypeFrom.isDirectory.bind(dirEntry);
+  dirEntry.isSymbolicLink = prototypeFrom.isSymbolicLink.bind(dirEntry);
+  dirEntry.isDynamic = prototypeFrom.isDynamic.bind(dirEntry);
+  dirEntry.getContentSync = prototypeFrom.getContentSync.bind(dirEntry);
+  dirEntry.getContentAsync = prototypeFrom.getContentAsync.bind(dirEntry);
+  return dirEntry;
+}
+
+// ===== Lazy-populated directory =====
+{
+  const provider = new MemoryProvider();
+  const root = getRoot(provider);
+
+  const dir = makeDirEntry(root, (scoped) => {
+    scoped.addFile('hello.txt', 'lazy hello');
+    scoped.addFile('dyn.txt', () => 'dynamic-string');
+    scoped.addDirectory('subdir', null);
+    scoped.addSymlink('link.txt', '/lazy/hello.txt');
+  });
   root.children.set('lazy', dir);
 
   const myVfs = vfs.create(provider);
@@ -125,3 +133,19 @@ function makeFileEntry(prototypeFrom, contentProvider) {
     assert.strictEqual(s, 'async-only');
   }));
 }
+
+// ===== Renaming over a lazy directory does not discard its entries =====
+{
+  const provider = new MemoryProvider();
+  const root = getRoot(provider);
+  root.children.set('lazy', makeDirEntry(root, (scoped) => {
+    scoped.addFile('keep.txt', 'keep');
+  }));
+
+  const myVfs = vfs.create(provider);
+  myVfs.mkdirSync('/src');
+
+  assert.throws(() => myVfs.renameSync('/src', '/lazy'), { code: 'ENOTEMPTY' });
+  assert.strictEqual(myVfs.existsSync('/src'), true);
+  assert.strictEqual(myVfs.readFileSync('/lazy/keep.txt', 'utf8'), 'keep');
+}
diff --git a/test/parallel/test-vfs-module-hooks-cleanup.js b/test/parallel/test-vfs-module-hooks-cleanup.js
new file mode 100644
index 000000000000..825957497d1e
--- /dev/null
+++ b/test/parallel/test-vfs-module-hooks-cleanup.js
@@ -0,0 +1,123 @@
+// Flags: --experimental-vfs
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { pathToFileURL } = require('node:url');
+const vfs = require('node:vfs');
+
+const vfsImport = (path) => pathToFileURL(path).href;
+
+// After a full deregister, a fresh register re-installs hooks cleanly.
+{
+  const a = vfs.create();
+  a.writeFileSync('/m1.js', 'module.exports = "first"');
+  const mountA = a.mount();
+  assert.strictEqual(require(`${mountA}/m1.js`), 'first');
+  a.unmount();
+
+  const b = vfs.create();
+  b.writeFileSync('/m2.js', 'module.exports = "second"');
+  const mountB = b.mount();
+  assert.strictEqual(require(`${mountB}/m2.js`), 'second');
+  b.unmount();
+}
+
+// After the last VFS is removed, real-fs require still works.
+{
+  const v = vfs.create();
+  v.writeFileSync('/x.js', 'module.exports = 1');
+  const mountPoint = v.mount();
+  require(`${mountPoint}/x.js`);
+  v.unmount();
+  const fs = require('fs');
+  assert.strictEqual(typeof fs.readFileSync, 'function');
+}
+
+// Top-level non-object package.json is rejected with ERR_INVALID_PACKAGE_CONFIG
+// (matches the native binding's throw_invalid_package_config path).
+{
+  const v = vfs.create();
+  v.mkdirSync('/pkg');
+  v.writeFileSync('/pkg/package.json', 'null');
+  v.writeFileSync('/pkg/index.js', 'module.exports = 1');
+  const mountPoint = v.mount();
+  assert.throws(
+    () => require(`${mountPoint}/pkg`),
+    { code: 'ERR_INVALID_PACKAGE_CONFIG' },
+  );
+  v.unmount();
+}
+
+// Non-string `main` is silently omitted, matching the native binding
+// (`USE(value.get_string(...))` in src/node_modules.cc).
+{
+  const v = vfs.create();
+  v.mkdirSync('/pkg');
+  v.writeFileSync('/pkg/package.json', '{"main": 42}');
+  v.writeFileSync('/pkg/index.js', 'module.exports = "via-index"');
+  const mountPoint = v.mount();
+  assert.strictEqual(require(`${mountPoint}/pkg`), 'via-index');
+  v.unmount();
+}
+
+// Partial deregister of a multi-mount setup leaves the still-mounted
+// VFS fully functional.
+{
+  const a = vfs.create();
+  a.writeFileSync('/a.js', 'module.exports = "a"');
+  const mountA = a.mount();
+  const b = vfs.create();
+  b.writeFileSync('/b.js', 'module.exports = "b"');
+  const mountB = b.mount();
+
+  assert.strictEqual(require(`${mountA}/a.js`), 'a');
+  assert.strictEqual(require(`${mountB}/b.js`), 'b');
+
+  a.unmount();
+  assert.strictEqual(require(`${mountB}/b.js`), 'b');
+
+  b.unmount();
+}
+
+// ESM legacyMainResolve override produces ERR_MODULE_NOT_FOUND with the
+// resolved candidate path when `main` points at a missing file, and err.url
+// is undefined (regression: previously 'package' leaked into err.url).
+(async () => {
+  const v = vfs.create();
+  v.mkdirSync('/app/node_modules/badpkg', { recursive: true });
+  v.writeFileSync(
+    '/app/node_modules/badpkg/package.json', '{"main": "./nope.js"}');
+  v.writeFileSync('/app/entry.mjs', "import 'badpkg';");
+  const mountPoint = v.mount();
+  await assert.rejects(
+    () => import(vfsImport(`${mountPoint}/app/entry.mjs`)),
+    (err) => {
+      assert.strictEqual(err.code, 'ERR_MODULE_NOT_FOUND');
+      assert.match(err.message, /nope\.js/);
+      assert.match(err.message, /^Cannot find package /);
+      assert.strictEqual(err.url, undefined);
+      return true;
+    },
+  );
+  v.unmount();
+})().then(common.mustCall());
+
+// Symlink inside a VFS: unmount purges cache entries recorded under the
+// resolved realpath too. Remounting the same instance at the same prefix
+// reuses the same mount point, so a stale entry would be revived.
+{
+  const v = vfs.create();
+  v.mkdirSync('/real', { recursive: true });
+  v.writeFileSync('/real/mod.js', 'module.exports = "one"');
+  v.symlinkSync('/real/mod.js', '/link.js');
+  const mountPoint = v.mount();
+  assert.strictEqual(require(`${mountPoint}/link.js`), 'one');
+  v.unmount();
+
+  v.writeFileSync('/real/mod.js', 'module.exports = "two"');
+  const mountPoint2 = v.mount();
+  assert.strictEqual(mountPoint2, mountPoint);
+  assert.strictEqual(require(`${mountPoint2}/link.js`), 'two');
+  v.unmount();
+}
diff --git a/test/parallel/test-vfs-module-hooks.mjs b/test/parallel/test-vfs-module-hooks.mjs
new file mode 100644
index 000000000000..9629b3bdbaf6
--- /dev/null
+++ b/test/parallel/test-vfs-module-hooks.mjs
@@ -0,0 +1,657 @@
+// Flags: --experimental-vfs
+import '../common/index.mjs';
+import assert from 'assert';
+import { createRequire } from 'module';
+import { pathToFileURL } from 'node:url';
+import vfs from 'node:vfs';
+
+const require = createRequire(import.meta.url);
+const vfsImport = (path) => pathToFileURL(path).href;
+
+// mount() returns the actual mount point (reserved under os.devNull);
+// each test captures it and uses it for requires/imports.
+
+// Test: CJS bare specifier resolution with exports string shorthand
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/str-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/str-pkg/package.json', JSON.stringify({
+    name: 'str-pkg',
+    exports: './main.js',
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/str-pkg/main.js',
+    'module.exports = { strExport: true };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry.js',
+    "module.exports = require('str-pkg');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/app/entry.js`);
+  assert.strictEqual(result.strExport, true);
+
+  myVfs.unmount();
+}
+
+// Test: Conditional exports with import/require/default conditions
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/cond-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/cond-pkg/package.json', JSON.stringify({
+    name: 'cond-pkg',
+    exports: {
+      import: './esm.mjs',
+      require: './cjs.js',
+      default: './default.js',
+    },
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/cond-pkg/esm.mjs',
+    'export const source = "esm";',
+  );
+  myVfs.writeFileSync(
+    '/app/node_modules/cond-pkg/cjs.js',
+    'module.exports = { source: "cjs" };',
+  );
+  myVfs.writeFileSync(
+    '/app/node_modules/cond-pkg/default.js',
+    'module.exports = { source: "default" };',
+  );
+  myVfs.writeFileSync(
+    '/app/esm-entry.mjs',
+    "export { source } from 'cond-pkg';",
+  );
+  myVfs.writeFileSync(
+    '/app/cjs-entry.js',
+    "module.exports = require('cond-pkg');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const esmResult = await import(vfsImport(`${mountPoint}/app/esm-entry.mjs`));
+  assert.strictEqual(esmResult.source, 'esm');
+
+  const cjsResult = require(`${mountPoint}/app/cjs-entry.js`);
+  assert.strictEqual(cjsResult.source, 'cjs');
+
+  myVfs.unmount();
+}
+
+// Test: Subpath exports map
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/sub-pkg/lib', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/sub-pkg/package.json', JSON.stringify({
+    name: 'sub-pkg',
+    exports: {
+      '.': './lib/index.mjs',
+      './feature': './lib/feature.mjs',
+    },
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/sub-pkg/lib/index.mjs',
+    'export const main = true;',
+  );
+  myVfs.writeFileSync(
+    '/app/node_modules/sub-pkg/lib/feature.mjs',
+    'export const feature = true;',
+  );
+  myVfs.writeFileSync(
+    '/app/entry.mjs',
+    `
+    import { main } from 'sub-pkg';
+    import { feature } from 'sub-pkg/feature';
+    export { main, feature };
+    `,
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/app/entry.mjs`));
+  assert.strictEqual(result.main, true);
+  assert.strictEqual(result.feature, true);
+
+  myVfs.unmount();
+}
+
+// Test: Subpath exports with conditional object target
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/sub-cond-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/sub-cond-pkg/package.json', JSON.stringify({
+    name: 'sub-cond-pkg',
+    exports: {
+      '.': {
+        import: './esm.mjs',
+        require: './cjs.js',
+      },
+    },
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/sub-cond-pkg/esm.mjs',
+    'export const fromSubCond = "esm";',
+  );
+  myVfs.writeFileSync(
+    '/app/node_modules/sub-cond-pkg/cjs.js',
+    'module.exports = { fromSubCond: "cjs" };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry2.mjs',
+    "export { fromSubCond } from 'sub-cond-pkg';",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/app/entry2.mjs`));
+  assert.strictEqual(result.fromSubCond, 'esm');
+
+  myVfs.unmount();
+}
+
+// Test: Nested conditional exports (e.g. node -> import/require)
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/nested-cond-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/nested-cond-pkg/package.json', JSON.stringify({
+    name: 'nested-cond-pkg',
+    exports: {
+      node: {
+        import: './node-esm.mjs',
+        require: './node-cjs.js',
+      },
+      default: './fallback.js',
+    },
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/nested-cond-pkg/node-esm.mjs',
+    'export const nested = "node-esm";',
+  );
+  myVfs.writeFileSync(
+    '/app/node_modules/nested-cond-pkg/node-cjs.js',
+    'module.exports = { nested: "node-cjs" };',
+  );
+  myVfs.writeFileSync(
+    '/app/node_modules/nested-cond-pkg/fallback.js',
+    'module.exports = { nested: "fallback" };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry3.mjs',
+    "export { nested } from 'nested-cond-pkg';",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/app/entry3.mjs`));
+  assert.strictEqual(result.nested, 'node-esm');
+
+  myVfs.unmount();
+}
+
+// Test: Package without exports, using main field
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/main-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/main-pkg/package.json', JSON.stringify({
+    name: 'main-pkg',
+    main: './lib/entry.js',
+  }));
+  myVfs.mkdirSync('/app/node_modules/main-pkg/lib', { recursive: true });
+  myVfs.writeFileSync(
+    '/app/node_modules/main-pkg/lib/entry.js',
+    'module.exports = { fromMain: true };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry4.js',
+    "module.exports = require('main-pkg');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/app/entry4.js`);
+  assert.strictEqual(result.fromMain, true);
+
+  myVfs.unmount();
+}
+
+// Test: Package without exports/main, fallback to index.js
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/index-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/index-pkg/package.json', JSON.stringify({
+    name: 'index-pkg',
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/index-pkg/index.js',
+    'module.exports = { fromIndex: true };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry5.js',
+    "module.exports = require('index-pkg');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/app/entry5.js`);
+  assert.strictEqual(result.fromIndex, true);
+
+  myVfs.unmount();
+}
+
+// Test: Extension resolution (require without file extension)
+{
+  const myVfs = vfs.create();
+  // The embedded specifier must be an absolute mounted path, so mount first.
+  const mountPoint = myVfs.mount();
+  myVfs.mkdirSync(`${mountPoint}/lib`, { recursive: true });
+  myVfs.writeFileSync(`${mountPoint}/lib/utils.js`, 'module.exports = { ext: "js" };');
+  myVfs.writeFileSync(
+    `${mountPoint}/lib/main.js`,
+    `module.exports = require(${JSON.stringify(`${mountPoint}/lib/utils`)});`,
+  );
+
+  const result = require(`${mountPoint}/lib/main.js`);
+  assert.strictEqual(result.ext, 'js');
+
+  myVfs.unmount();
+}
+
+// Test: Extension resolution with .json
+{
+  const myVfs = vfs.create();
+  const mountPoint = myVfs.mount();
+  myVfs.writeFileSync(`${mountPoint}/data.json`, JSON.stringify({ ext: 'json' }));
+  myVfs.writeFileSync(
+    `${mountPoint}/reader.js`,
+    `module.exports = require(${JSON.stringify(`${mountPoint}/data`)});`,
+  );
+
+  const result = require(`${mountPoint}/reader.js`);
+  assert.strictEqual(result.ext, 'json');
+
+  myVfs.unmount();
+}
+
+// Test: Scoped package resolution (@scope/pkg)
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/@myorg/mylib', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/@myorg/mylib/package.json', JSON.stringify({
+    name: '@myorg/mylib',
+    type: 'module',
+    exports: './index.mjs',
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/@myorg/mylib/index.mjs',
+    'export const scoped = true;',
+  );
+  myVfs.writeFileSync(
+    '/app/scoped-entry.mjs',
+    "export { scoped } from '@myorg/mylib';",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/app/scoped-entry.mjs`));
+  assert.strictEqual(result.scoped, true);
+
+  myVfs.unmount();
+}
+
+// Test: Scoped package with subpath
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/@myorg/utils/lib', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/@myorg/utils/package.json', JSON.stringify({
+    name: '@myorg/utils',
+    exports: {
+      '.': './lib/index.mjs',
+      './helpers': './lib/helpers.mjs',
+    },
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/@myorg/utils/lib/index.mjs',
+    'export const main = true;',
+  );
+  myVfs.writeFileSync(
+    '/app/node_modules/@myorg/utils/lib/helpers.mjs',
+    'export const helpers = true;',
+  );
+  myVfs.writeFileSync(
+    '/app/scoped-sub-entry.mjs',
+    `
+    import { helpers } from '@myorg/utils/helpers';
+    export { helpers };
+    `,
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/app/scoped-sub-entry.mjs`));
+  assert.strictEqual(result.helpers, true);
+
+  myVfs.unmount();
+}
+
+// Test: .js file with type: module in package.json -> ESM format
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/package.json', JSON.stringify({ type: 'module' }));
+  myVfs.writeFileSync('/mod.js', 'export const fromModule = true;');
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/mod.js`));
+  assert.strictEqual(result.fromModule, true);
+
+  myVfs.unmount();
+}
+
+// Test: .cjs always treated as CommonJS regardless of package type
+{
+  const myVfs = vfs.create();
+  const mountPoint = myVfs.mount();
+  myVfs.writeFileSync(`${mountPoint}/package.json`, JSON.stringify({ type: 'module' }));
+  myVfs.writeFileSync(`${mountPoint}/helper.cjs`, 'module.exports = { cjsAlways: true };');
+  myVfs.writeFileSync(
+    `${mountPoint}/use-cjs.js`,
+    `
+    import { createRequire } from 'module';
+    const require = createRequire(import.meta.url);
+    const result = require(${JSON.stringify(`${mountPoint}/helper.cjs`)});
+    export const cjsAlways = result.cjsAlways;
+    `,
+  );
+
+  const result = await import(vfsImport(`${mountPoint}/use-cjs.js`));
+  assert.strictEqual(result.cjsAlways, true);
+
+  myVfs.unmount();
+}
+
+// Test: file: URL specifier
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/fileurl.mjs', 'export const fromFileUrl = true;');
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/fileurl.mjs`));
+  assert.strictEqual(result.fromFileUrl, true);
+
+  myVfs.unmount();
+}
+
+// Test: Package with main field requiring extension resolution
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/dir-pkg', { recursive: true });
+  myVfs.writeFileSync('/dir-pkg/package.json', JSON.stringify({
+    name: 'dir-pkg',
+    main: './entry',
+  }));
+  myVfs.writeFileSync(
+    '/dir-pkg/entry.js',
+    'module.exports = { dirPkg: true };',
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/dir-pkg`);
+  assert.strictEqual(result.dirPkg, true);
+
+  myVfs.unmount();
+}
+
+// Test: Bare specifier with package subpath (no exports, direct file)
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/direct-pkg/lib', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/direct-pkg/package.json', JSON.stringify({
+    name: 'direct-pkg',
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/direct-pkg/lib/util.js',
+    'module.exports = { directSub: true };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry-sub.js',
+    "module.exports = require('direct-pkg/lib/util.js');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/app/entry-sub.js`);
+  assert.strictEqual(result.directSub, true);
+
+  myVfs.unmount();
+}
+
+// Test: Bare specifier subpath with extension resolution
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/ext-pkg/lib', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/ext-pkg/package.json', JSON.stringify({
+    name: 'ext-pkg',
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/ext-pkg/lib/util.js',
+    'module.exports = { extSub: true };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry-ext.js',
+    "module.exports = require('ext-pkg/lib/util');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/app/entry-ext.js`);
+  assert.strictEqual(result.extSub, true);
+
+  myVfs.unmount();
+}
+
+// Test: Bare specifier main field with extension resolution
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/main-ext-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/main-ext-pkg/package.json', JSON.stringify({
+    name: 'main-ext-pkg',
+    main: './entry',
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/main-ext-pkg/entry.js',
+    'module.exports = { mainExt: true };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry-main-ext.js',
+    "module.exports = require('main-ext-pkg');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/app/entry-main-ext.js`);
+  assert.strictEqual(result.mainExt, true);
+
+  myVfs.unmount();
+}
+
+// Test: exports with array value (fallback array)
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/arr-exp-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/arr-exp-pkg/package.json', JSON.stringify({
+    name: 'arr-exp-pkg',
+    exports: {
+      '.': ['./index.js', './fallback.js'],
+    },
+    main: './index.js',
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/arr-exp-pkg/index.js',
+    'module.exports = { arrExport: true };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry-arr.js',
+    "module.exports = require('arr-exp-pkg');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/app/entry-arr.js`);
+  assert.strictEqual(result.arrExport, true);
+
+  myVfs.unmount();
+}
+
+// Test: Exports with "default" condition
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/default-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/default-pkg/package.json', JSON.stringify({
+    name: 'default-pkg',
+    exports: {
+      '.': {
+        browser: './browser.js',
+        default: './default.mjs',
+      },
+    },
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/default-pkg/default.mjs',
+    'export const fromDefault = true;',
+  );
+  myVfs.writeFileSync(
+    '/app/entry-default.mjs',
+    "export { fromDefault } from 'default-pkg';",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/app/entry-default.mjs`));
+  assert.strictEqual(result.fromDefault, true);
+
+  myVfs.unmount();
+}
+
+// Test: Package.json type "commonjs" explicitly set for .js
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/package.json', JSON.stringify({ type: 'commonjs' }));
+  myVfs.writeFileSync('/explicit-cjs.js', 'module.exports = { explicitCjs: true };');
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/explicit-cjs.js`);
+  assert.strictEqual(result.explicitCjs, true);
+
+  myVfs.unmount();
+}
+
+// Test: .js file with no package.json -> defaults to commonjs
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/no-pkg.js', 'module.exports = { noPkg: true };');
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/no-pkg.js`);
+  assert.strictEqual(result.noPkg, true);
+
+  myVfs.unmount();
+}
+
+// Test: Package.json type walk stops at node_modules boundary
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/package.json', JSON.stringify({ type: 'module' }));
+  myVfs.mkdirSync('/node_modules/inner', { recursive: true });
+  myVfs.writeFileSync(
+    '/node_modules/inner/index.js',
+    'module.exports = { inner: true };',
+  );
+  const mountPoint = myVfs.mount();
+
+  // Walk stops at node_modules; type:module from root is not inherited.
+  const result = require(`${mountPoint}/node_modules/inner/index.js`);
+  assert.strictEqual(result.inner, true);
+
+  myVfs.unmount();
+}
+
+// Test: Invalid package.json in directory resolution
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/bad-json-dir', { recursive: true });
+  myVfs.writeFileSync('/bad-json-dir/package.json', '{ invalid json }');
+  myVfs.writeFileSync(
+    '/bad-json-dir/index.js',
+    'module.exports = { fallbackIndex: true };',
+  );
+  const mountPoint = myVfs.mount();
+
+  // Malformed package.json raises ERR_INVALID_PACKAGE_CONFIG after nodejs/node#48606.
+  assert.throws(() => require(`${mountPoint}/bad-json-dir`),
+                { code: 'ERR_INVALID_PACKAGE_CONFIG' });
+
+  myVfs.unmount();
+}
+
+// Test: Invalid package.json in type walk-up
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/package.json', '{ broken json }');
+  myVfs.writeFileSync('/no-type.js', 'module.exports = { noType: true };');
+  const mountPoint = myVfs.mount();
+
+  assert.throws(() => require(`${mountPoint}/no-type.js`),
+                { code: 'ERR_INVALID_PACKAGE_CONFIG' });
+
+  myVfs.unmount();
+}
+
+// Test: Scoped package without slash (just @scope/name)
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/@solo/pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/@solo/pkg/package.json', JSON.stringify({
+    name: '@solo/pkg',
+    main: './index.js',
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/@solo/pkg/index.js',
+    'module.exports = { solo: true };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry-solo.js',
+    "module.exports = require('@solo/pkg');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/app/entry-solo.js`);
+  assert.strictEqual(result.solo, true);
+
+  myVfs.unmount();
+}
+
+// Test: node: builtin passthrough
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/use-builtin.mjs', `
+    import path from 'node:path';
+    export const sep = path.sep;
+  `);
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/use-builtin.mjs`));
+  assert.strictEqual(typeof result.sep, 'string');
+
+  myVfs.unmount();
+}
+
+// Test: JSON import with type assertion
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/data.json', JSON.stringify({ preformat: true }));
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/data.json`), { with: { type: 'json' } });
+  assert.strictEqual(result.default.preformat, true);
+
+  myVfs.unmount();
+}
+
+// Test: File with unknown extension -> defaults to commonjs
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/data.txt', 'module.exports = { txt: true };');
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/data.txt`);
+  assert.strictEqual(result.txt, true);
+
+  myVfs.unmount();
+}
diff --git a/test/parallel/test-vfs-module-paths.js b/test/parallel/test-vfs-module-paths.js
new file mode 100644
index 000000000000..25c0ce0ba26a
--- /dev/null
+++ b/test/parallel/test-vfs-module-paths.js
@@ -0,0 +1,106 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// The `node_modules` lookup for modules inside a mounted VFS stops at the
+// mount point: no candidate directories above the mount root are generated,
+// while the legacy CommonJS global folders (NODE_PATH etc.) still apply.
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { pathToFileURL } = require('url');
+const { execFileSync } = require('child_process');
+const Module = require('module');
+const vfs = require('node:vfs');
+const tmpdir = require('../common/tmpdir');
+
+// Test: module.paths for a CJS module inside a mounted VFS ends at the
+// mount root.
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/foo/bar', { recursive: true });
+  myVfs.writeFileSync('/foo/bar/main.cjs', 'module.exports = module.paths;');
+  const mountPoint = myVfs.mount();
+
+  const paths = require(path.join(mountPoint, 'foo/bar/main.cjs'));
+  assert.deepStrictEqual(paths, [
+    path.join(mountPoint, 'foo/bar/node_modules'),
+    path.join(mountPoint, 'foo/node_modules'),
+    path.join(mountPoint, 'node_modules'),
+  ]);
+
+  myVfs.unmount();
+}
+
+// Test: Module._nodeModulePaths for real paths still walks to the file
+// system root.
+{
+  const paths = Module._nodeModulePaths(__dirname);
+  const root = path.parse(__dirname).root;
+  assert.strictEqual(paths[paths.length - 1],
+                     path.join(root, 'node_modules'));
+}
+
+// Test: bare specifiers resolve through node_modules directories inside
+// the VFS, for both require() and import.
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/dep', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/dep/package.json',
+                      '{"name":"dep","main":"index.js"}');
+  myVfs.writeFileSync('/app/node_modules/dep/index.js',
+                      'module.exports = "dep-from-vfs";');
+  myVfs.writeFileSync('/app/main.cjs', 'module.exports = require("dep");');
+  myVfs.writeFileSync('/app/main.mjs',
+                      'import dep from "dep"; export default dep;');
+  const mountPoint = myVfs.mount();
+
+  assert.strictEqual(require(path.join(mountPoint, 'app/main.cjs')),
+                     'dep-from-vfs');
+
+  import(pathToFileURL(path.join(mountPoint, 'app/main.mjs')).href)
+    .then(common.mustCall((ns) => {
+      assert.strictEqual(ns.default, 'dep-from-vfs');
+      myVfs.unmount();
+    }));
+}
+
+// Test: a bare specifier that exists nowhere fails for both loaders.
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/missing.cjs', 'require("missing-pkg-xyz");');
+  myVfs.writeFileSync('/missing.mjs', 'import "missing-pkg-xyz";');
+  const mountPoint = myVfs.mount();
+
+  assert.throws(() => require(path.join(mountPoint, 'missing.cjs')),
+                { code: 'MODULE_NOT_FOUND' });
+
+  assert.rejects(
+    import(pathToFileURL(path.join(mountPoint, 'missing.mjs')).href),
+    { code: 'ERR_MODULE_NOT_FOUND' },
+  ).then(() => myVfs.unmount()).then(common.mustCall());
+}
+
+// Test: the legacy CommonJS global folders still apply to require() from
+// inside a VFS: a NODE_PATH directory provides the fallback.
+{
+  tmpdir.refresh();
+  const globalDir = tmpdir.resolve('gpath');
+  fs.mkdirSync(path.join(globalDir, 'gdep'), { recursive: true });
+  fs.writeFileSync(path.join(globalDir, 'gdep', 'index.js'),
+                   'module.exports = "from-node-path";');
+
+  const out = execFileSync(process.execPath, ['--experimental-vfs', '-e', `
+    const vfs = require('node:vfs');
+    const path = require('path');
+    const myVfs = vfs.create();
+    myVfs.writeFileSync('/main.cjs', 'console.log(require("gdep"));');
+    const mountPoint = myVfs.mount();
+    require(path.join(mountPoint, 'main.cjs'));
+  `], {
+    encoding: 'utf8',
+    env: { ...process.env, NODE_PATH: globalDir, NODE_NO_WARNINGS: '1' },
+  });
+  assert.strictEqual(out.trim(), 'from-node-path');
+}
diff --git a/test/parallel/test-vfs-mount-errors.js b/test/parallel/test-vfs-mount-errors.js
index 905f1c6d0683..dd0fef606421 100644
--- a/test/parallel/test-vfs-mount-errors.js
+++ b/test/parallel/test-vfs-mount-errors.js
@@ -3,30 +3,25 @@
 
 // Error paths in the VFS mount layer:
 // - EXDEV when renaming/linking across different VFS instances or VFS<->real
-// - lastunmount handler cleanup (vfsState.handlers becomes null again)
-// - rename of root mount point is rejected as overlapping
+// - last-unmount handler cleanup (vfsState.handlers becomes null again)
+// - namespace isolation between layers
 
 require('../common');
 const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
 const vfs = require('node:vfs');
 const { vfsState } = require('internal/fs/utils');
 
-const baseMountPoint = path.resolve('/tmp/vfs-mount-errors-' + process.pid);
-let mountCounter = 0;
-const nextMount = () => baseMountPoint + '-' + (mountCounter++);
-
 // EXDEV: rename across two different VFS instances
 {
-  const mountA = nextMount();
-  const mountB = nextMount();
   const a = vfs.create();
   const b = vfs.create();
   a.writeFileSync('/file.txt', 'a');
   b.mkdirSync('/x', { recursive: true });
-  a.mount(mountA);
-  b.mount(mountB);
+  const mountA = a.mount();
+  const mountB = b.mount();
 
   assert.throws(
     () => fs.renameSync(path.join(mountA, 'file.txt'),
@@ -39,14 +34,12 @@ const nextMount = () => baseMountPoint + '-' + (mountCounter++);
 
 // EXDEV: copyFileSync across two different VFS instances
 {
-  const mountA = nextMount();
-  const mountB = nextMount();
   const a = vfs.create();
   const b = vfs.create();
   a.writeFileSync('/file.txt', 'a');
   b.mkdirSync('/x', { recursive: true });
-  a.mount(mountA);
-  b.mount(mountB);
+  const mountA = a.mount();
+  const mountB = b.mount();
 
   assert.throws(
     () => fs.copyFileSync(path.join(mountA, 'file.txt'),
@@ -59,14 +52,12 @@ const nextMount = () => baseMountPoint + '-' + (mountCounter++);
 
 // EXDEV: linkSync across two different VFS instances
 {
-  const mountA = nextMount();
-  const mountB = nextMount();
   const a = vfs.create();
   const b = vfs.create();
   a.writeFileSync('/file.txt', 'a');
   b.mkdirSync('/x', { recursive: true });
-  a.mount(mountA);
-  b.mount(mountB);
+  const mountA = a.mount();
+  const mountB = b.mount();
 
   assert.throws(
     () => fs.linkSync(path.join(mountA, 'file.txt'),
@@ -79,10 +70,9 @@ const nextMount = () => baseMountPoint + '-' + (mountCounter++);
 
 // EXDEV: rename from VFS to a real-fs path
 {
-  const mountA = nextMount();
   const a = vfs.create();
   a.writeFileSync('/file.txt', 'a');
-  a.mount(mountA);
+  const mountA = a.mount();
 
   const tmpReal = '/tmp/vfs-mount-real-' + process.pid + '.txt';
   assert.throws(
@@ -96,25 +86,25 @@ const nextMount = () => baseMountPoint + '-' + (mountCounter++);
 {
   assert.strictEqual(vfsState.handlers, null);
   const x = vfs.create();
-  x.mount(nextMount());
+  x.mount();
   assert.notStrictEqual(vfsState.handlers, null);
   x.unmount();
   assert.strictEqual(vfsState.handlers, null);
 
   // And it re-installs on a subsequent mount
   const y = vfs.create();
-  y.mount(nextMount());
+  y.mount();
   assert.notStrictEqual(vfsState.handlers, null);
   y.unmount();
   assert.strictEqual(vfsState.handlers, null);
 }
 
-// Two parallel non-overlapping mounts both register, last-out clears handlers
+// Two parallel mounts both register, last-out clears handlers
 {
   const a = vfs.create();
   const b = vfs.create();
-  a.mount(nextMount());
-  b.mount(nextMount());
+  a.mount();
+  b.mount();
   assert.notStrictEqual(vfsState.handlers, null);
   a.unmount();
   assert.notStrictEqual(vfsState.handlers, null);
@@ -122,38 +112,30 @@ const nextMount = () => baseMountPoint + '-' + (mountCounter++);
   assert.strictEqual(vfsState.handlers, null);
 }
 
-// Overlap detection: nested-under and parent-of both rejected
+// Namespace isolation: a path in an unmounted (or never-mounted) layer
+// namespace is not served by other active layers.
 {
-  const parent = nextMount();
-  const child = path.join(parent, 'child');
   const a = vfs.create();
   const b = vfs.create();
-  a.mount(parent);
-  assert.throws(() => b.mount(child), { code: 'ERR_INVALID_STATE' });
-  a.unmount();
-
-  // Reverse direction: child first, then parent rejected
-  const c = vfs.create();
-  const d = vfs.create();
-  c.mount(child);
-  assert.throws(() => d.mount(parent), { code: 'ERR_INVALID_STATE' });
-  c.unmount();
-}
-
-// Equal mount points: second one rejected
-{
-  const m = nextMount();
-  const a = vfs.create();
-  const b = vfs.create();
-  a.mount(m);
-  assert.throws(() => b.mount(m), { code: 'ERR_INVALID_STATE' });
+  a.writeFileSync('/f.txt', 'a');
+  b.writeFileSync('/f.txt', 'b');
+  const mountA = a.mount();
+  const mountB = b.mount();
+  assert.notStrictEqual(mountA, mountB);
+  b.unmount();
+  // B's namespace is dead even though A is still mounted.
+  assert.strictEqual(fs.existsSync(path.join(mountB, 'f.txt')), false);
+  assert.strictEqual(fs.readFileSync(path.join(mountA, 'f.txt'), 'utf8'), 'a');
+  // A malformed layer segment under the VFS root is not served either.
+  const bogus = path.join(os.devNull, 'vfs', 'not-a-number', 'f.txt');
+  assert.strictEqual(fs.existsSync(bogus), false);
   a.unmount();
 }
 
 // Double-mount of same instance rejected
 {
   const a = vfs.create();
-  a.mount(nextMount());
-  assert.throws(() => a.mount(nextMount()), { code: 'ERR_INVALID_STATE' });
+  a.mount();
+  assert.throws(() => a.mount(), { code: 'ERR_INVALID_STATE' });
   a.unmount();
 }
diff --git a/test/parallel/test-vfs-mount-point-url.js b/test/parallel/test-vfs-mount-point-url.js
new file mode 100644
index 000000000000..717919a26909
--- /dev/null
+++ b/test/parallel/test-vfs-mount-point-url.js
@@ -0,0 +1,41 @@
+// Flags: --experimental-vfs
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const { pathToFileURL } = require('url');
+const vfs = require('node:vfs');
+
+// Test: null while not mounted.
+{
+  const myVfs = vfs.create();
+  assert.strictEqual(myVfs.mountPointURL, null);
+}
+
+// Test: file: URL string of the mount point while mounted, null again
+// after unmounting.
+{
+  const myVfs = vfs.create();
+  const mountPoint = myVfs.mount();
+
+  const url = myVfs.mountPointURL;
+  assert.strictEqual(typeof url, 'string');
+  assert.ok(url.startsWith('file:'));
+  assert.strictEqual(url, pathToFileURL(mountPoint).href);
+
+  myVfs.unmount();
+  assert.strictEqual(myVfs.mountPointURL, null);
+}
+
+// Test: the URL is usable to address files in the mounted VFS.
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/data.txt', 'hello url');
+  myVfs.mount();
+
+  const fileURL = new URL(`${myVfs.mountPointURL}/data.txt`);
+  assert.strictEqual(fs.readFileSync(fileURL, 'utf8'), 'hello url');
+
+  myVfs.unmount();
+}
diff --git a/test/parallel/test-vfs-mount.js b/test/parallel/test-vfs-mount.js
index e59e39eef971..2334e7d1e7ec 100644
--- a/test/parallel/test-vfs-mount.js
+++ b/test/parallel/test-vfs-mount.js
@@ -5,32 +5,37 @@ const common = require('../common');
 const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
 const vfs = require('node:vfs');
 
-// Basic mount/unmount API and dispatch through node:vfs from the public fs.
+// Mount points look like `${os.devNull}/vfs/<id>` where `<id>` is a decimal
+// integer segment. This regex captures that structural invariant without
+// tying the tests to a specific id.
+const mountPointShape = new RegExp(
+  `^${os.devNull.replace(/[\\^$.*+?()[\]{}|/\\\\]/g, '\\$&')}` +
+  `\\${path.sep}vfs\\${path.sep}\\d+$`,
+);
 
-const baseMountPoint = path.resolve('/tmp/vfs-mount-' + process.pid);
-let mountCounter = 0;
+// Basic mount/unmount API and dispatch through node:vfs from the public fs.
 
 function createMountedVfs() {
-  const mountPoint = baseMountPoint + '-' + (mountCounter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello world');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
-// Test: mounted/mountPoint getters
+// Test: mounted/mountPoint getters; mount() returns a path under os.devNull.
 {
   const myVfs = vfs.create();
   assert.strictEqual(myVfs.mounted, false);
   assert.strictEqual(myVfs.mountPoint, null);
 
-  const mountPoint = baseMountPoint + '-' + (mountCounter++);
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   assert.strictEqual(myVfs.mounted, true);
   assert.strictEqual(myVfs.mountPoint, mountPoint);
+  assert.match(mountPoint, mountPointShape);
 
   myVfs.unmount();
   assert.strictEqual(myVfs.mounted, false);
@@ -40,22 +45,26 @@ function createMountedVfs() {
 // Test: double-mount throws
 {
   const myVfs = vfs.create();
-  const mountPoint = baseMountPoint + '-' + (mountCounter++);
-  myVfs.mount(mountPoint);
-  assert.throws(() => myVfs.mount(mountPoint), { code: 'ERR_INVALID_STATE' });
+  myVfs.mount();
+  assert.throws(() => myVfs.mount(), { code: 'ERR_INVALID_STATE' });
   myVfs.unmount();
 }
 
-// Test: overlapping mounts throw
+// Test: two instances get distinct mount points in their own layer namespace.
 {
   const a = vfs.create();
   const b = vfs.create();
-  const mountPoint = baseMountPoint + '-' + (mountCounter++);
-  a.mount(mountPoint);
-  assert.throws(() => b.mount(mountPoint), { code: 'ERR_INVALID_STATE' });
-  assert.throws(() => b.mount(path.join(mountPoint, 'inner')),
-                { code: 'ERR_INVALID_STATE' });
+  a.writeFileSync('/f.txt', 'A');
+  b.writeFileSync('/f.txt', 'B');
+  const mountA = a.mount();
+  const mountB = b.mount();
+  assert.notStrictEqual(mountA, mountB);
+  assert.match(mountA, mountPointShape);
+  assert.match(mountB, mountPointShape);
+  assert.strictEqual(fs.readFileSync(path.join(mountA, 'f.txt'), 'utf8'), 'A');
+  assert.strictEqual(fs.readFileSync(path.join(mountB, 'f.txt'), 'utf8'), 'B');
   a.unmount();
+  b.unmount();
 }
 
 // Test: fs.readFileSync intercepted
@@ -165,8 +174,7 @@ function createMountedVfs() {
 // Test: Symbol.dispose unmounts
 {
   const myVfs = vfs.create();
-  const mountPoint = baseMountPoint + '-' + (mountCounter++);
-  myVfs.mount(mountPoint);
+  myVfs.mount();
   assert.strictEqual(myVfs.mounted, true);
   myVfs[Symbol.dispose]();
   assert.strictEqual(myVfs.mounted, false);
diff --git a/test/parallel/test-vfs-multi-mount.js b/test/parallel/test-vfs-multi-mount.js
index 879f7cfcbf2b..7539c0a6f028 100644
--- a/test/parallel/test-vfs-multi-mount.js
+++ b/test/parallel/test-vfs-multi-mount.js
@@ -1,8 +1,8 @@
 // Flags: --experimental-vfs
 'use strict';
 
-// Two concurrent non-overlapping mounts must each route to its own VFS without
-// interference. Also exercises that the handler registry iterates and routes
+// Two concurrent mounts must each route to its own VFS without
+// interference. Also exercises that the layer registry routes
 // correctly when more than one VFS is active.
 
 require('../common');
@@ -11,9 +11,6 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseA = path.resolve('/tmp/vfs-multi-a-' + process.pid);
-const baseB = path.resolve('/tmp/vfs-multi-b-' + process.pid);
-
 const a = vfs.create();
 a.writeFileSync('/file.txt', 'from-a');
 a.mkdirSync('/dir', { recursive: true });
@@ -24,8 +21,8 @@ b.writeFileSync('/file.txt', 'from-b');
 b.mkdirSync('/dir', { recursive: true });
 b.writeFileSync('/dir/inside.txt', 'b-inside');
 
-a.mount(baseA);
-b.mount(baseB);
+const baseA = a.mount();
+const baseB = b.mount();
 
 // Each mount sees its own content
 assert.strictEqual(fs.readFileSync(path.join(baseA, 'file.txt'), 'utf8'),
diff --git a/test/parallel/test-vfs-package-json-cache.js b/test/parallel/test-vfs-package-json-cache.js
new file mode 100644
index 000000000000..7a787d613fc2
--- /dev/null
+++ b/test/parallel/test-vfs-package-json-cache.js
@@ -0,0 +1,40 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// Package.json caches must be cleared on VFS unmount.
+
+require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const vfs = require('node:vfs');
+
+const myVfs = vfs.create();
+myVfs.mkdirSync('/pkg');
+myVfs.writeFileSync('/pkg/package.json', '{"name":"test","type":"module"}');
+myVfs.writeFileSync('/pkg/index.js', 'module.exports = 42');
+const mountPoint = myVfs.mount();
+
+assert.ok(fs.existsSync(`${mountPoint}/pkg/package.json`));
+
+myVfs.unmount();
+
+assert.strictEqual(fs.existsSync(`${mountPoint}/pkg/package.json`), false);
+
+// Remounting the same instance reuses the same mount point; a package.json
+// whose `type` changed between mounts must be re-read, not served from the
+// nearest-parent caches populated during the first mount.
+{
+  const remountVfs = vfs.create();
+  remountVfs.mkdirSync('/scope');
+  remountVfs.writeFileSync('/scope/package.json', '{"type":"commonjs"}');
+  remountVfs.writeFileSync('/scope/index.js', 'module.exports = 42;');
+  const mp = remountVfs.mount();
+  assert.strictEqual(require(`${mp}/scope/index.js`), 42);
+  remountVfs.unmount();
+
+  remountVfs.writeFileSync('/scope/package.json', '{"type":"module"}');
+  remountVfs.writeFileSync('/scope/index.js', 'export default 43;');
+  assert.strictEqual(remountVfs.mount(), mp);
+  assert.strictEqual(require(`${mp}/scope/index.js`).default, 43);
+  remountVfs.unmount();
+}
diff --git a/test/parallel/test-vfs-package-json.js b/test/parallel/test-vfs-package-json.js
new file mode 100644
index 000000000000..9b8dbe868123
--- /dev/null
+++ b/test/parallel/test-vfs-package-json.js
@@ -0,0 +1,183 @@
+// Flags: --experimental-vfs --expose-internals
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const path = require('path');
+const vfs = require('node:vfs');
+
+// read() reads package.json from VFS
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/pkg', { recursive: true });
+  myVfs.writeFileSync('/pkg/package.json', JSON.stringify({
+    name: 'test-pkg',
+    type: 'module',
+    main: './index.js',
+    exports: { '.': './index.js' },
+  }));
+  const mountPoint = myVfs.mount();
+
+  const packageJsonReader = require('internal/modules/package_json_reader');
+  const result = packageJsonReader.read(
+    path.join(mountPoint, 'pkg', 'package.json'), {},
+  );
+
+  assert.strictEqual(result.exists, true);
+  assert.strictEqual(result.name, 'test-pkg');
+  assert.strictEqual(result.type, 'module');
+  assert.strictEqual(result.main, './index.js');
+  assert.deepStrictEqual(result.exports, { '.': './index.js' });
+  assert.strictEqual(
+    result.pjsonPath,
+    path.join(mountPoint, 'pkg', 'package.json'),
+  );
+
+  // Non-existent package.json returns exists: false
+  const missing = packageJsonReader.read(
+    path.join(mountPoint, 'nope', 'package.json'), {},
+  );
+  assert.strictEqual(missing.exists, false);
+
+  myVfs.unmount();
+}
+
+// getNearestParentPackageJSON() walks up VFS directories
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/src/lib/deep', { recursive: true });
+  myVfs.writeFileSync('/app/package.json', JSON.stringify({
+    name: 'my-app',
+    type: 'module',
+  }));
+  myVfs.writeFileSync('/app/src/lib/deep/module.js', '');
+  const mountPoint = myVfs.mount();
+
+  const packageJsonReader = require('internal/modules/package_json_reader');
+  const result = packageJsonReader.getNearestParentPackageJSON(
+    path.join(mountPoint, 'app', 'src', 'lib', 'deep', 'module.js'),
+  );
+
+  assert.ok(result);
+  assert.strictEqual(result.exists, true);
+  assert.strictEqual(result.data.name, 'my-app');
+  assert.strictEqual(result.data.type, 'module');
+  assert.strictEqual(
+    result.path,
+    path.join(mountPoint, 'app', 'package.json'),
+  );
+
+  myVfs.unmount();
+}
+
+// getPackageScopeConfig() returns correct scope from VFS
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/project/src', { recursive: true });
+  myVfs.writeFileSync('/project/package.json', JSON.stringify({
+    name: 'my-project',
+    type: 'commonjs',
+    exports: { '.': './main.js' },
+  }));
+  myVfs.writeFileSync('/project/src/index.js', '');
+  const mountPoint = myVfs.mount();
+
+  const packageJsonReader = require('internal/modules/package_json_reader');
+  const { pathToFileURL } = require('url');
+  const scopeUrl = pathToFileURL(
+    path.join(mountPoint, 'project', 'src', 'index.js'),
+  ).href;
+  const result = packageJsonReader.getPackageScopeConfig(scopeUrl);
+
+  assert.strictEqual(result.exists, true);
+  assert.strictEqual(result.type, 'commonjs');
+  assert.strictEqual(result.name, 'my-project');
+  assert.strictEqual(
+    result.pjsonPath,
+    path.join(mountPoint, 'project', 'package.json'),
+  );
+
+  // Path with no package.json returns exists: false
+  const myVfs2 = vfs.create();
+  myVfs2.mkdirSync('/empty/src', { recursive: true });
+  myVfs2.writeFileSync('/empty/src/file.js', '');
+  const mountPoint2 = myVfs2.mount();
+
+  const emptyUrl = pathToFileURL(
+    path.join(mountPoint2, 'empty', 'src', 'file.js'),
+  ).href;
+  const emptyResult = packageJsonReader.getPackageScopeConfig(emptyUrl);
+  assert.strictEqual(emptyResult.exists, false);
+
+  myVfs2.unmount();
+  myVfs.unmount();
+}
+
+// getPackageType() returns correct type from VFS
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/esm-app', { recursive: true });
+  myVfs.writeFileSync('/esm-app/package.json', JSON.stringify({
+    type: 'module',
+  }));
+  myVfs.writeFileSync('/esm-app/index.js', '');
+  const mountPoint = myVfs.mount();
+
+  const packageJsonReader = require('internal/modules/package_json_reader');
+  const { pathToFileURL } = require('url');
+  const typeUrl = pathToFileURL(
+    path.join(mountPoint, 'esm-app', 'index.js'),
+  ).href;
+  const type = packageJsonReader.getPackageType(typeUrl);
+  assert.strictEqual(type, 'module');
+
+  // No package.json => 'none'
+  const myVfs2 = vfs.create();
+  myVfs2.mkdirSync('/bare', { recursive: true });
+  myVfs2.writeFileSync('/bare/file.js', '');
+  const mountPoint2 = myVfs2.mount();
+
+  const noneUrl = pathToFileURL(
+    path.join(mountPoint2, 'bare', 'file.js'),
+  ).href;
+  const noneType = packageJsonReader.getPackageType(noneUrl);
+  assert.strictEqual(noneType, 'none');
+
+  myVfs2.unmount();
+  myVfs.unmount();
+}
+
+// End-to-end CJS require with package.json type detection
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/cjs-app', { recursive: true });
+  myVfs.writeFileSync('/cjs-app/package.json', JSON.stringify({
+    name: 'cjs-app',
+    type: 'commonjs',
+  }));
+  myVfs.writeFileSync('/cjs-app/main.js',
+                      'module.exports = { format: "cjs", ok: true };');
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/cjs-app/main.js`);
+  assert.strictEqual(result.format, 'cjs');
+  assert.strictEqual(result.ok, true);
+
+  myVfs.unmount();
+}
+
+// End-to-end ESM import with VFS package type
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/esm', { recursive: true });
+  myVfs.writeFileSync('/esm/package.json', JSON.stringify({
+    type: 'module',
+  }));
+  myVfs.writeFileSync('/esm/mod.mjs', 'export const x = 42;');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/esm/mod.mjs`);
+  assert.strictEqual(mod.x, 42);
+
+  myVfs.unmount();
+}
diff --git a/test/parallel/test-vfs-rename.js b/test/parallel/test-vfs-rename.js
index 69daba43c11d..b1ca98dc684e 100644
--- a/test/parallel/test-vfs-rename.js
+++ b/test/parallel/test-vfs-rename.js
@@ -58,3 +58,67 @@ const vfs = require('node:vfs');
   assert.strictEqual(myVfs.existsSync('/a/b/c'), false);
   assert.strictEqual(myVfs.readFileSync('/a/file.txt', 'utf8'), 'data');
 }
+
+// Renaming a directory onto a non-empty directory throws ENOTEMPTY
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/src');
+  myVfs.mkdirSync('/dst');
+  myVfs.writeFileSync('/dst/keep.txt', 'keep');
+
+  assert.throws(() => myVfs.renameSync('/src', '/dst'), { code: 'ENOTEMPTY' });
+  assert.strictEqual(myVfs.readFileSync('/dst/keep.txt', 'utf8'), 'keep');
+  assert.strictEqual(myVfs.existsSync('/src'), true);
+}
+
+// Renaming a directory onto an empty directory succeeds
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/src');
+  myVfs.writeFileSync('/src/a.txt', 'a');
+  myVfs.mkdirSync('/dst');
+
+  myVfs.renameSync('/src', '/dst');
+  assert.strictEqual(myVfs.existsSync('/src'), false);
+  assert.strictEqual(myVfs.readFileSync('/dst/a.txt', 'utf8'), 'a');
+}
+
+// Overwriting a file drops one of its links
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/a.txt', 'a');
+  myVfs.writeFileSync('/b.txt', 'b');
+  myVfs.linkSync('/b.txt', '/b-link.txt');
+  assert.strictEqual(myVfs.statSync('/b-link.txt').nlink, 2);
+
+  myVfs.renameSync('/a.txt', '/b.txt');
+  assert.strictEqual(myVfs.statSync('/b-link.txt').nlink, 1);
+  assert.strictEqual(myVfs.readFileSync('/b-link.txt', 'utf8'), 'b');
+}
+
+// Renaming a path onto itself is a no-op
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/a.txt', 'a');
+  myVfs.mkdirSync('/d');
+  myVfs.writeFileSync('/d/keep.txt', 'keep');
+
+  myVfs.renameSync('/a.txt', '/a.txt');
+  assert.strictEqual(myVfs.readFileSync('/a.txt', 'utf8'), 'a');
+  assert.strictEqual(myVfs.statSync('/a.txt').nlink, 1);
+
+  myVfs.renameSync('/d', '/d');
+  assert.strictEqual(myVfs.readFileSync('/d/keep.txt', 'utf8'), 'keep');
+}
+
+// Renaming a hard link onto another link to the same file is a no-op
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/a.txt', 'a');
+  myVfs.linkSync('/a.txt', '/b.txt');
+
+  myVfs.renameSync('/a.txt', '/b.txt');
+  assert.strictEqual(myVfs.existsSync('/a.txt'), true);
+  assert.strictEqual(myVfs.existsSync('/b.txt'), true);
+  assert.strictEqual(myVfs.statSync('/a.txt').nlink, 2);
+}
diff --git a/test/parallel/test-vfs-require.js b/test/parallel/test-vfs-require.js
new file mode 100644
index 000000000000..3e6869672272
--- /dev/null
+++ b/test/parallel/test-vfs-require.js
@@ -0,0 +1,411 @@
+// Flags: --experimental-vfs
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { pathToFileURL } = require('node:url');
+const vfs = require('node:vfs');
+
+const vfsImport = (path) => pathToFileURL(path).href;
+
+// Test requiring a simple virtual module
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/hello.js', 'module.exports = "hello from vfs";');
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/hello.js`);
+  assert.strictEqual(result, 'hello from vfs');
+
+  myVfs.unmount();
+}
+
+// Test requiring a virtual module that exports an object
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/config.js', `
+    module.exports = {
+      name: 'test-config',
+      version: '1.0.0',
+      getValue: function() { return 42; }
+    };
+  `);
+  const mountPoint = myVfs.mount();
+
+  const config = require(`${mountPoint}/config.js`);
+  assert.strictEqual(config.name, 'test-config');
+  assert.strictEqual(config.version, '1.0.0');
+  assert.strictEqual(config.getValue(), 42);
+
+  myVfs.unmount();
+}
+
+// Test requiring a virtual module that requires another virtual module.
+// Mount first so the embedded absolute specifier can use the mount point.
+{
+  const myVfs = vfs.create();
+  const mountPoint = myVfs.mount();
+  myVfs.writeFileSync(`${mountPoint}/utils.js`, `
+    module.exports = {
+      add: function(a, b) { return a + b; }
+    };
+  `);
+  myVfs.writeFileSync(`${mountPoint}/main.js`, `
+    const utils = require(${JSON.stringify(`${mountPoint}/utils.js`)});
+    module.exports = {
+      sum: utils.add(10, 20)
+    };
+  `);
+
+  const main = require(`${mountPoint}/main.js`);
+  assert.strictEqual(main.sum, 30);
+
+  myVfs.unmount();
+}
+
+// Test requiring a JSON file from VFS
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/data.json', JSON.stringify({
+    items: [1, 2, 3],
+    enabled: true,
+  }));
+  const mountPoint = myVfs.mount();
+
+  const data = require(`${mountPoint}/data.json`);
+  assert.deepStrictEqual(data.items, [1, 2, 3]);
+  assert.strictEqual(data.enabled, true);
+
+  myVfs.unmount();
+}
+
+// Test virtual package.json resolution
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/my-package', { recursive: true });
+  myVfs.writeFileSync('/my-package/package.json', JSON.stringify({
+    name: 'my-package',
+    main: 'index.js',
+  }));
+  myVfs.writeFileSync('/my-package/index.js', `
+    module.exports = { loaded: true };
+  `);
+  const mountPoint = myVfs.mount();
+
+  const pkg = require(`${mountPoint}/my-package`);
+  assert.strictEqual(pkg.loaded, true);
+
+  myVfs.unmount();
+}
+
+// Test that real modules still work when VFS is mounted
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/test.js', 'module.exports = 1;');
+  myVfs.mount();
+
+  assert.strictEqual(typeof assert.strictEqual, 'function');
+
+  const commonMod = require('../common');
+  assert.ok(commonMod);
+
+  myVfs.unmount();
+}
+
+// Test require with relative paths inside VFS module
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/lib', { recursive: true });
+  myVfs.writeFileSync('/lib/helper.js', `
+    module.exports = { help: function() { return 'helped'; } };
+  `);
+  myVfs.writeFileSync('/lib/index.js', `
+    const helper = require('./helper.js');
+    module.exports = helper.help();
+  `);
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/lib/index.js`);
+  assert.strictEqual(result, 'helped');
+
+  myVfs.unmount();
+}
+
+// Test fs.readFileSync interception when VFS is active
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/file.txt', 'virtual content');
+  const mountPoint = myVfs.mount();
+
+  const content = fs.readFileSync(`${mountPoint}/file.txt`, 'utf8');
+  assert.strictEqual(content, 'virtual content');
+
+  myVfs.unmount();
+}
+
+// Test requiring an ESM .mjs module from VFS
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/esm.mjs', 'export const msg = "hello from esm";');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/esm.mjs`);
+  assert.strictEqual(mod.msg, 'hello from esm');
+
+  myVfs.unmount();
+}
+
+// Test requiring an ESM .mjs module with default export from VFS
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/esm-default.mjs', 'export default function() { return 42; }');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/esm-default.mjs`);
+  assert.strictEqual(mod.default(), 42);
+
+  myVfs.unmount();
+}
+
+// Test require(esm): .js file detected as ESM via VFS package.json type:module
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app', { recursive: true });
+  myVfs.writeFileSync('/app/package.json', JSON.stringify({
+    name: 'esm-app',
+    type: 'module',
+  }));
+  myVfs.writeFileSync('/app/lib.js',
+                      'export const value = 42;' +
+                      ' export function hello() { return "hi"; }');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/app/lib.js`);
+  assert.strictEqual(mod.value, 42);
+  assert.strictEqual(mod.hello(), 'hi');
+
+  myVfs.unmount();
+}
+
+// Test require(esm): nested .js walks up to parent package.json in VFS
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/project/src/utils', { recursive: true });
+  myVfs.writeFileSync('/project/package.json', JSON.stringify({
+    name: 'nested-esm',
+    type: 'module',
+  }));
+  myVfs.writeFileSync('/project/src/utils/math.js',
+                      'export const add = (a, b) => a + b;' +
+                      ' export default 99;');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/project/src/utils/math.js`);
+  assert.strictEqual(mod.add(3, 4), 7);
+  assert.strictEqual(mod.default, 99);
+
+  myVfs.unmount();
+}
+
+// Test require(esm): .js without type field stays CJS
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/cjs-app', { recursive: true });
+  myVfs.writeFileSync('/cjs-app/package.json', JSON.stringify({
+    name: 'cjs-app',
+  }));
+  myVfs.writeFileSync('/cjs-app/index.js',
+                      'module.exports = { cjs: true };');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/cjs-app/index.js`);
+  assert.strictEqual(mod.cjs, true);
+
+  myVfs.unmount();
+}
+
+// Test require(esm): ESM .js that imports another ESM .js in VFS
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/multi/src', { recursive: true });
+  myVfs.writeFileSync('/multi/package.json', JSON.stringify({
+    type: 'module',
+  }));
+  myVfs.writeFileSync('/multi/src/dep.js', 'export const X = 100;');
+  myVfs.writeFileSync('/multi/src/main.js',
+                      'import { X } from "./dep.js";' +
+                      ' export const result = X + 1;');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/multi/src/main.js`);
+  assert.strictEqual(mod.result, 101);
+
+  myVfs.unmount();
+}
+
+// Test require(esm): .mjs without any package.json loads as ESM
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/no-pkg.mjs',
+                      'export const x = 1; export default "hello";');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/no-pkg.mjs`);
+  assert.strictEqual(mod.x, 1);
+  assert.strictEqual(mod.default, 'hello');
+
+  myVfs.unmount();
+}
+
+// Test require(esm): .mjs with package.json that has no type field
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app', { recursive: true });
+  myVfs.writeFileSync('/app/package.json',
+                      JSON.stringify({ name: 'no-type' }));
+  myVfs.writeFileSync('/app/lib.mjs', 'export const val = 42;');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/app/lib.mjs`);
+  assert.strictEqual(mod.val, 42);
+
+  myVfs.unmount();
+}
+
+// Test require(esm): .mjs in type:commonjs package still loads as ESM
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/cjs-pkg', { recursive: true });
+  myVfs.writeFileSync('/cjs-pkg/package.json', JSON.stringify({
+    name: 'cjs-pkg',
+    type: 'commonjs',
+  }));
+  myVfs.writeFileSync('/cjs-pkg/esm.mjs', 'export const z = 99;');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/cjs-pkg/esm.mjs`);
+  assert.strictEqual(mod.z, 99);
+
+  myVfs.unmount();
+}
+
+// Test CJS: package with "main" field resolves through VFS
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/pkg/lib', { recursive: true });
+  myVfs.writeFileSync('/pkg/package.json', JSON.stringify({
+    name: 'legacy-main-pkg',
+    main: './lib/entry',
+  }));
+  myVfs.writeFileSync('/pkg/lib/entry.js', 'module.exports = "legacy-main";');
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/pkg`);
+  assert.strictEqual(result, 'legacy-main');
+
+  myVfs.unmount();
+}
+
+// Test CJS: package with no "main" field resolves index.js
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/pkg2', { recursive: true });
+  myVfs.writeFileSync('/pkg2/package.json', JSON.stringify({
+    name: 'no-main-pkg',
+  }));
+  myVfs.writeFileSync('/pkg2/index.js', 'module.exports = "index-fallback";');
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/pkg2`);
+  assert.strictEqual(result, 'index-fallback');
+
+  myVfs.unmount();
+}
+
+// Test ESM legacyMainResolve: import() a VFS package with "main" (no "exports")
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/esm-legacy-main/lib', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/esm-legacy-main/package.json', JSON.stringify({
+    name: 'esm-legacy-main',
+    type: 'module',
+    main: './lib/entry.js',
+  }));
+  myVfs.writeFileSync('/app/node_modules/esm-legacy-main/lib/entry.js',
+                      'export const value = "esm-legacy-main";');
+  myVfs.writeFileSync('/app/main.mjs',
+                      'export { value } from "esm-legacy-main";');
+  const mountPoint = myVfs.mount();
+
+  import(vfsImport(`${mountPoint}/app/main.mjs`)).then(common.mustCall((mod) => {
+    assert.strictEqual(mod.value, 'esm-legacy-main');
+    myVfs.unmount();
+  }));
+}
+
+// Test ESM legacyMainResolve: import() a VFS package with no "main" (index.js fallback)
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app2/node_modules/esm-nomain', { recursive: true });
+  myVfs.writeFileSync('/app2/node_modules/esm-nomain/package.json', JSON.stringify({
+    name: 'esm-nomain',
+    type: 'module',
+  }));
+  myVfs.writeFileSync('/app2/node_modules/esm-nomain/index.js',
+                      'export const value = "esm-index-fallback";');
+  myVfs.writeFileSync('/app2/main.mjs',
+                      'export { value } from "esm-nomain";');
+  const mountPoint = myVfs.mount();
+
+  import(vfsImport(`${mountPoint}/app2/main.mjs`)).then(common.mustCall((mod) => {
+    assert.strictEqual(mod.value, 'esm-index-fallback');
+    myVfs.unmount();
+  }));
+}
+
+// Test getFormatOfExtensionlessFile: extensionless JS file in type:module package
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/esm-pkg', { recursive: true });
+  myVfs.writeFileSync('/esm-pkg/package.json', JSON.stringify({
+    name: 'esm-pkg',
+    type: 'module',
+  }));
+  myVfs.writeFileSync('/esm-pkg/entry', 'export const x = 123;');
+  const mountPoint = myVfs.mount();
+
+  import(vfsImport(`${mountPoint}/esm-pkg/entry`)).then(common.mustCall((mod) => {
+    assert.strictEqual(mod.x, 123);
+    myVfs.unmount();
+  }));
+}
+
+// Test that unmounting stops interception
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/unmount-test.js', 'module.exports = "before unmount";');
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/unmount-test.js`);
+  assert.strictEqual(result, 'before unmount');
+
+  myVfs.unmount();
+
+  // On Windows, the native loader may surface the NUL-backed former mount
+  // path as ERR_INVALID_PACKAGE_CONFIG while probing for package.json.
+  assert.throws(() => {
+    delete require.cache[path.join(mountPoint, 'unmount-test.js')];
+    require(`${mountPoint}/unmount-test.js`);
+  }, (err) => {
+    if (common.isWindows) {
+      assert.ok(
+        ['ERR_INVALID_PACKAGE_CONFIG', 'MODULE_NOT_FOUND'].includes(err.code),
+      );
+    } else {
+      assert.strictEqual(err.code, 'MODULE_NOT_FOUND');
+    }
+    return true;
+  });
+}
diff --git a/test/parallel/test-vfs-router.js b/test/parallel/test-vfs-router.js
index 864a684f5c2d..292e33e7379a 100644
--- a/test/parallel/test-vfs-router.js
+++ b/test/parallel/test-vfs-router.js
@@ -9,38 +9,11 @@
 require('../common');
 const assert = require('assert');
 const path = require('path');
-const { isUnderMountPoint, getRelativePath, isAbsolutePath } =
-  require('internal/vfs/router');
+const { getRelativePath } = require('internal/vfs/router');
 
 const mount = path.resolve('/app');
 const nested = path.join(mount, 'src', 'index.js');
 
-// isUnderMountPoint: equal paths are always considered "under"
-assert.strictEqual(isUnderMountPoint(mount, mount), true);
-
-// isUnderMountPoint: nested paths
-assert.strictEqual(isUnderMountPoint(nested, mount), true);
-
-// isUnderMountPoint: rejects sibling paths that share the prefix string
-assert.strictEqual(
-  isUnderMountPoint(path.resolve('/app2/index.js'), mount), false,
-);
-assert.strictEqual(isUnderMountPoint(path.resolve('/applebrick'), mount),
-                   false);
-
-// isUnderMountPoint: rejects an unrelated absolute path
-assert.strictEqual(isUnderMountPoint(path.resolve('/other'), mount), false);
-
-// isUnderMountPoint: root mount matches any absolute path on POSIX.
-// On Windows the root mount '/' resolves to a drive-letter root, so the
-// special-case in router.js only applies when mountPoint === '/'. Skip the
-// root-mount checks where they would not be representative on Windows.
-if (process.platform !== 'win32') {
-  assert.strictEqual(isUnderMountPoint('/anywhere', '/'), true);
-  assert.strictEqual(isUnderMountPoint('/', '/'), true);
-  assert.strictEqual(isUnderMountPoint('/a/b/c', '/'), true);
-}
-
 // getRelativePath: equal => '/'
 assert.strictEqual(getRelativePath(mount, mount), '/');
 
@@ -48,16 +21,7 @@ assert.strictEqual(getRelativePath(mount, mount), '/');
 // the platform-native input separators.
 assert.strictEqual(getRelativePath(nested, mount), '/src/index.js');
 
-// getRelativePath: root mount returns the original (already absolute) path
-if (process.platform !== 'win32') {
-  assert.strictEqual(getRelativePath('/foo/bar', '/'), '/foo/bar');
-}
-
 // getRelativePath: deeper nesting
 const mountA = path.resolve('/m/a');
 const deep = path.join(mountA, 'b', 'c', 'd');
 assert.strictEqual(getRelativePath(deep, mountA), '/b/c/d');
-
-// isAbsolutePath is re-exported from node:path
-assert.strictEqual(isAbsolutePath(path.resolve('/foo')), true);
-assert.strictEqual(isAbsolutePath('foo'), false);
diff --git a/test/parallel/test-vfs-scoped-cache-purge.js b/test/parallel/test-vfs-scoped-cache-purge.js
new file mode 100644
index 000000000000..104089cd4a23
--- /dev/null
+++ b/test/parallel/test-vfs-scoped-cache-purge.js
@@ -0,0 +1,57 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// Deregistering one VFS must scope-purge loader caches: entries under the
+// unmounted mount point are dropped, entries from other VFSes are kept.
+
+const common = require('../common');
+const assert = require('assert');
+const { pathToFileURL } = require('node:url');
+const vfs = require('node:vfs');
+
+const vfsImport = (path) => pathToFileURL(path).href;
+
+// Multi-mount: deregistering one VFS keeps the other's CJS require.cache warm.
+{
+  const a = vfs.create();
+  a.writeFileSync('/value.js', 'module.exports = "a-cached"');
+  const mountA = a.mount();
+
+  const b = vfs.create();
+  b.writeFileSync('/value.js', 'module.exports = "b-cached"');
+  const mountB = b.mount();
+
+  assert.strictEqual(require(`${mountA}/value.js`), 'a-cached');
+  assert.strictEqual(require(`${mountB}/value.js`), 'b-cached');
+
+  const bKey = require.resolve(`${mountB}/value.js`);
+  assert.ok(bKey in require.cache, 'b should be cached before unmount');
+
+  a.unmount();
+  assert.ok(
+    bKey in require.cache,
+    'unmounting a different VFS must not evict b\'s cache entry',
+  );
+
+  assert.strictEqual(require(`${mountB}/value.js`), 'b-cached');
+
+  b.unmount();
+}
+
+// import.meta.url is the plain file URL under the mount point, and repeated
+// dynamic imports (including via import.meta.resolve) return the same namespace.
+(async () => {
+  const v = vfs.create();
+  v.writeFileSync('/m.mjs',
+                  'export const url = import.meta.url;\n' +
+                  'export const resolved = import.meta.resolve("./m.mjs");');
+  const mountPoint = v.mount();
+
+  const ns = await import(vfsImport(`${mountPoint}/m.mjs`));
+  assert.strictEqual(ns.url, pathToFileURL(`${mountPoint}/m.mjs`).href);
+
+  const nsAgain = await import(ns.resolved);
+  assert.strictEqual(ns, nsAgain);
+
+  v.unmount();
+})().then(common.mustCall());
diff --git a/test/parallel/test-vfs-zip-provider-dispose.js b/test/parallel/test-vfs-zip-provider-dispose.js
new file mode 100644
index 000000000000..b93ed914a701
--- /dev/null
+++ b/test/parallel/test-vfs-zip-provider-dispose.js
@@ -0,0 +1,93 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// Exercises ZipProvider's Symbol.dispose / Symbol.asyncDispose aliases:
+// disposing a provider closes its backing archive (a ZipFile releases its
+// file descriptor; a ZipBuffer has nothing to close, so disposal is a no-op),
+// and the aliases work with the `using` / `await using` declarations.
+
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const path = require('path');
+const fsPromises = require('fs/promises');
+const zlib = require('zlib');
+const vfs = require('node:vfs');
+
+tmpdir.refresh();
+
+async function buildArchive(entries) {
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive(entries)) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+async function writeArchive(name) {
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+  const filePath = path.join(tmpdir.path, name);
+  await fsPromises.writeFile(filePath, archive);
+  return filePath;
+}
+
+(async () => {
+  // Symbol.asyncDispose closes a ZipFile-backed provider's archive.
+  {
+    const zip = await zlib.ZipFile.open(await writeArchive('dispose-async.zip'));
+    let closed = 0;
+    const original = zip.close.bind(zip);
+    zip.close = async (...args) => { closed++; return original(...args); };
+
+    const provider = new vfs.ZipProvider(zip);
+    await provider[Symbol.asyncDispose]();
+    assert.strictEqual(closed, 1);
+  }
+
+  // Symbol.dispose closes a ZipFile-backed provider's archive synchronously.
+  {
+    const zip = zlib.ZipFile.openSync(await writeArchive('dispose-sync.zip'));
+    let closed = 0;
+    const original = zip.closeSync.bind(zip);
+    zip.closeSync = (...args) => { closed++; return original(...args); };
+
+    const provider = new vfs.ZipProvider(zip);
+    provider[Symbol.dispose]();
+    assert.strictEqual(closed, 1);
+  }
+
+  // `await using` disposes the provider (and closes the archive) at block exit.
+  {
+    const zip = await zlib.ZipFile.open(await writeArchive('dispose-await-using.zip'));
+    let closed = 0;
+    const original = zip.close.bind(zip);
+    zip.close = async (...args) => { closed++; return original(...args); };
+
+    {
+      await using provider = new vfs.ZipProvider(zip);
+      assert.strictEqual(provider.readonly, true);
+      assert.strictEqual(closed, 0); // Not yet disposed.
+    }
+    assert.strictEqual(closed, 1); // Disposed at block exit.
+  }
+
+  // `using` disposes the provider synchronously at block exit.
+  {
+    const zip = zlib.ZipFile.openSync(await writeArchive('dispose-using.zip'));
+    let closed = 0;
+    const original = zip.closeSync.bind(zip);
+    zip.closeSync = (...args) => { closed++; return original(...args); };
+
+    {
+      using provider = new vfs.ZipProvider(zip);
+      assert.strictEqual(provider.readonly, true);
+    }
+    assert.strictEqual(closed, 1);
+  }
+
+  // A ZipBuffer has nothing to close: both aliases are safe no-ops.
+  {
+    const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+    const provider = new vfs.ZipProvider(new zlib.ZipBuffer(archive));
+    provider[Symbol.dispose](); // Does not throw.
+    await provider[Symbol.asyncDispose](); // Does not throw.
+  }
+})().then(common.mustCall());
diff --git a/test/parallel/test-vfs-zip-provider-handle.js b/test/parallel/test-vfs-zip-provider-handle.js
new file mode 100644
index 000000000000..3c88eacbb8c9
--- /dev/null
+++ b/test/parallel/test-vfs-zip-provider-handle.js
@@ -0,0 +1,514 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// Additional ZipProvider coverage beyond test-vfs-zip-provider.js:
+// direct ZipFileHandle read/write/stat/truncate (both explicit and
+// current position, append-mode positioning, buffer growth), readFile/
+// writeFile encoding and data-type variants, compression-method-preserving
+// rename() (methodOption()), ZipFile-backed synchronous delete, an explicit
+// empty-directory open() EISDIR, the readdir child-directory dedup path, and
+// a few error branches (EROFS on open(), ENOTDIR on rmdir(), ENOENT on
+// rename()) not exercised by the base test.
+
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const path = require('path');
+const fs = require('fs');
+const fsPromises = require('fs/promises');
+const zlib = require('zlib');
+const vfs = require('node:vfs');
+
+tmpdir.refresh();
+
+async function buildArchive(entries, comment) {
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive(entries, comment)) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+function buildArchiveSync(entries, comment) {
+  return Buffer.concat([...zlib.createZipArchiveSync(entries, comment)]);
+}
+
+// --- direct ZipFileHandle read/write/stat/truncate (async) -------------
+(async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('a.txt', Buffer.from('hello world')),
+  ]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  const handle = await provider.open('/a.txt', 'r+');
+
+  // Explicit position leaves the handle's own position untouched.
+  const buf = Buffer.alloc(5);
+  const { bytesRead } = await handle.read(buf, 0, 5, 0);
+  assert.strictEqual(bytesRead, 5);
+  assert.strictEqual(buf.toString(), 'hello');
+  assert.strictEqual(handle.position, 0);
+
+  // Current position (undefined/null/-1) advances the handle's position.
+  const buf2 = Buffer.alloc(5);
+  await handle.read(buf2, 0, 5, null);
+  assert.strictEqual(buf2.toString(), 'hello');
+  assert.strictEqual(handle.position, 5);
+  const buf3 = Buffer.alloc(1);
+  await handle.read(buf3, 0, 1, -1);
+  assert.strictEqual(buf3.toString(), ' ');
+  assert.strictEqual(handle.position, 6);
+
+  // Reading past EOF yields 0 bytes without advancing further than available.
+  const tail = Buffer.alloc(100);
+  const { bytesRead: tailRead } = await handle.read(tail, 0, 100, 6);
+  assert.strictEqual(tailRead, 5); // 'world'.length
+
+  // write() at an explicit position (overwrite), then at the current
+  // position (append past the buffer's current size, forcing growth).
+  await handle.write(Buffer.from('HELLO'), 0, 5, 0);
+  const stat1 = await handle.stat();
+  assert.strictEqual(stat1.size, 11);
+
+  handle.position = 11;
+  await handle.write(Buffer.from('!!!'), 0, 3, null);
+  const stat2 = await handle.stat();
+  assert.strictEqual(stat2.size, 14);
+
+  await handle.truncate(5);
+  const stat3 = await handle.stat();
+  assert.strictEqual(stat3.size, 5);
+
+  await handle.truncate(8);
+  const stat4 = await handle.stat();
+  assert.strictEqual(stat4.size, 8);
+
+  await handle.close();
+
+  const archiveVfs = vfs.create(provider);
+  const final = await archiveVfs.promises.readFile('/a.txt');
+  assert.strictEqual(final.length, 8);
+  assert.strictEqual(final.subarray(0, 5).toString(), 'HELLO');
+})().then(common.mustCall());
+
+// --- direct ZipFileHandle read/write/stat/truncate (sync) --------------
+(() => {
+  const archive = buildArchiveSync([zlib.ZipEntry.createSync('b.txt', Buffer.from('0123456789'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+  const handle = provider.openSync('/b.txt', 'r+');
+
+  const buf = Buffer.alloc(4);
+  const { bytesRead } = handle.readSync(buf, 0, 4, 2);
+  assert.strictEqual(bytesRead, 4);
+  assert.strictEqual(buf.toString(), '2345');
+
+  handle.writeSync(Buffer.from('AB'), 0, 2, 0);
+  assert.strictEqual(handle.statSync().size, 10);
+
+  // A write growing well beyond current capacity exercises #ensureCapacity's
+  // doubling path.
+  handle.writeSync(Buffer.alloc(1000, 0x58 /* 'X' */), 0, 1000, 10);
+  assert.strictEqual(handle.statSync().size, 1010);
+
+  handle.truncateSync(3);
+  assert.strictEqual(handle.statSync().size, 3);
+  assert.strictEqual(handle.readFileSync('utf8'), 'AB2');
+
+  handle.closeSync();
+})();
+
+// --- append-mode positioning: writes always land at the current end -------
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('c.txt', Buffer.from('xy'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  const handle = await provider.open('/c.txt', 'a');
+  assert.strictEqual(handle.position, 2); // Positioned at EOF on open
+
+  // Even with an explicit (wrong) position, append mode writes at the end.
+  await handle.write(Buffer.from('z'), 0, 1, 0);
+  assert.strictEqual((await handle.stat()).size, 3);
+  await handle.close();
+
+  const archiveVfs = vfs.create(provider);
+  assert.strictEqual(await archiveVfs.promises.readFile('/c.txt', 'utf8'), 'xyz');
+})().then(common.mustCall());
+
+// --- readFile/readFileSync encoding variants + writeFile data types --------
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('d.txt', Buffer.from('café'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  const handle = await provider.open('/d.txt', 'r');
+  const asBuffer = await handle.readFile();
+  assert.ok(Buffer.isBuffer(asBuffer));
+  const asStringShorthand = await handle.readFile('utf8');
+  assert.strictEqual(asStringShorthand, 'café');
+  const asStringOption = await handle.readFile({ encoding: 'utf8' });
+  assert.strictEqual(asStringOption, 'café');
+  const asExplicitBuffer = await handle.readFile({ encoding: 'buffer' });
+  assert.ok(Buffer.isBuffer(asExplicitBuffer));
+  await handle.close();
+
+  const writeHandle = await provider.open('/e.txt', 'w');
+  await writeHandle.writeFile(Buffer.from('buffer-data'));
+  await writeHandle.close();
+  assert.strictEqual(await (await provider.open('/e.txt', 'r')).readFile('utf8'), 'buffer-data');
+
+  const writeHandle2 = await provider.open('/f.txt', 'w');
+  await writeHandle2.writeFile('string-data', { encoding: 'utf8' });
+  await writeHandle2.close();
+  assert.strictEqual(await (await provider.open('/f.txt', 'r')).readFile('utf8'), 'string-data');
+})().then(common.mustCall());
+
+(() => {
+  const archive = buildArchiveSync([zlib.ZipEntry.createSync('g.txt', Buffer.from('sync-café'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  const handle = provider.openSync('/g.txt', 'r');
+  assert.ok(Buffer.isBuffer(handle.readFileSync()));
+  assert.strictEqual(handle.readFileSync('utf8'), 'sync-café');
+  assert.strictEqual(handle.readFileSync({ encoding: 'utf8' }), 'sync-café');
+  assert.ok(Buffer.isBuffer(handle.readFileSync({ encoding: 'buffer' })));
+  handle.closeSync();
+
+  const writeHandle = provider.openSync('/h.txt', 'w');
+  writeHandle.writeFileSync(Buffer.from('sync-buffer-data'));
+  writeHandle.closeSync();
+  assert.strictEqual(provider.openSync('/h.txt', 'r').readFileSync('utf8'), 'sync-buffer-data');
+})();
+
+// --- rename() preserves the original compression method (methodOption) ----
+(async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('store.bin', Buffer.from('a'.repeat(100)), { method: 'store' }),
+    await zlib.ZipEntry.create('deflate.bin', Buffer.from('b'.repeat(100)), { method: 'deflate' }),
+    await zlib.ZipEntry.create('zstd.bin', Buffer.from('c'.repeat(100)), { method: 'zstd' }),
+  ]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+  const archiveVfs = vfs.create(provider);
+
+  const methodsBefore = new Map([
+    ['store.bin', zip.get('store.bin').method],
+    ['deflate.bin', zip.get('deflate.bin').method],
+    ['zstd.bin', zip.get('zstd.bin').method],
+  ]);
+
+  await archiveVfs.promises.rename('/store.bin', '/store-renamed.bin');
+  await archiveVfs.promises.rename('/deflate.bin', '/deflate-renamed.bin');
+  await archiveVfs.promises.rename('/zstd.bin', '/zstd-renamed.bin');
+
+  assert.strictEqual(zip.get('store-renamed.bin').method, methodsBefore.get('store.bin'));
+  assert.strictEqual(zip.get('deflate-renamed.bin').method, methodsBefore.get('deflate.bin'));
+  assert.strictEqual(zip.get('zstd-renamed.bin').method, methodsBefore.get('zstd.bin'));
+
+  // Content must still round-trip correctly under the reproduced method.
+  assert.strictEqual((await zip.get('store-renamed.bin').content()).toString(), 'a'.repeat(100));
+  assert.strictEqual((await zip.get('deflate-renamed.bin').content()).toString(), 'b'.repeat(100));
+  assert.strictEqual((await zip.get('zstd-renamed.bin').content()).toString(), 'c'.repeat(100));
+})().then(common.mustCall());
+
+(() => {
+  const archive = buildArchiveSync([
+    zlib.ZipEntry.createSync('store.bin', Buffer.from('a'.repeat(100)), { method: 'store' }),
+    zlib.ZipEntry.createSync('zstd.bin', Buffer.from('c'.repeat(100)), { method: 'zstd' }),
+  ]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+  const archiveVfs = vfs.create(provider);
+
+  const storeMethod = zip.get('store.bin').method;
+  const zstdMethod = zip.get('zstd.bin').method;
+  archiveVfs.renameSync('/store.bin', '/store-renamed.bin');
+  archiveVfs.renameSync('/zstd.bin', '/zstd-renamed.bin');
+  assert.strictEqual(zip.get('store-renamed.bin').method, storeMethod);
+  assert.strictEqual(zip.get('zstd-renamed.bin').method, zstdMethod);
+})();
+
+// --- rename() with a missing source is rejected with ENOENT ---------------
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('only.txt', Buffer.from('x'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+  const archiveVfs = vfs.create(provider);
+
+  await assert.rejects(
+    archiveVfs.promises.rename('/missing.txt', '/renamed.txt'),
+    { code: 'ENOENT' },
+  );
+  assert.throws(
+    () => archiveVfs.renameSync('/missing.txt', '/renamed.txt'),
+    { code: 'ENOENT' },
+  );
+})().then(common.mustCall());
+
+// --- rmdir() on a plain file is rejected with ENOTDIR ----------------------
+// (called on the provider directly: the vfs router validates directory-ness
+// itself before delegating for some operations, which would otherwise never
+// exercise ZipProvider's own check).
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('file.txt', Buffer.from('x'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  await assert.rejects(provider.rmdir('/file.txt'), { code: 'ENOTDIR' });
+  assert.throws(() => provider.rmdirSync('/file.txt'), { code: 'ENOTDIR' });
+})().then(common.mustCall());
+
+// --- open(): EEXIST/ENOENT/EISDIR-on-wrong-direction, called directly on
+// the provider so the router can't short-circuit before delegating ---------
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  await assert.rejects(provider.open('/a.txt', 'wx'), { code: 'EEXIST' });
+  assert.throws(() => provider.openSync('/a.txt', 'wx'), { code: 'EEXIST' });
+  await assert.rejects(provider.open('/missing.txt', 'r'), { code: 'ENOENT' });
+  assert.throws(() => provider.openSync('/missing.txt', 'r'), { code: 'ENOENT' });
+
+  // A handle opened write-only can't be read from, and vice versa.
+  const writeOnly = await provider.open('/w.txt', 'w');
+  await assert.rejects(writeOnly.read(Buffer.alloc(1), 0, 1, 0), { code: 'EISDIR' });
+  await writeOnly.close();
+  const readOnly = await provider.open('/a.txt', 'r');
+  await assert.rejects(readOnly.write(Buffer.alloc(1), 0, 1, 0), { code: 'EISDIR' });
+  await readOnly.close();
+})().then(common.mustCall());
+
+// --- normalize(): a path without a leading slash is used as-is ------------
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  const stats = await provider.stat('a.txt');
+  assert.strictEqual(stats.isFile(), true);
+})().then(common.mustCall());
+
+// --- mkdir(): both the with-options and no-options shapes, called
+// directly on the provider ---------------------------------------------
+(async () => {
+  const archive = await buildArchive([]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  await provider.mkdir('/no-opts');
+  assert.strictEqual((await provider.stat('/no-opts')).isDirectory(), true);
+  await provider.mkdir('/with-opts', { mode: 0o700 });
+  assert.strictEqual((await provider.stat('/with-opts')).isDirectory(), true);
+
+  provider.mkdirSync('/no-opts-sync');
+  assert.strictEqual(provider.statSync('/no-opts-sync').isDirectory(), true);
+  provider.mkdirSync('/with-opts-sync', { mode: 0o700 });
+  assert.strictEqual(provider.statSync('/with-opts-sync').isDirectory(), true);
+})().then(common.mustCall());
+
+// --- readdir() skips a directory's own explicit entry when listing it -----
+(async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('dir/', Buffer.alloc(0)),
+    await zlib.ZipEntry.create('dir/child.txt', Buffer.from('x')),
+  ]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+  const archiveVfs = vfs.create(provider);
+
+  const entries = await archiveVfs.promises.readdir('/dir');
+  assert.deepStrictEqual(entries, ['child.txt']);
+})().then(common.mustCall());
+
+// --- an entry not made by a Unix zip tool reports mode 0, so stat() and
+// rename() fall back to their documented defaults --------------------------
+(async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('foreign.txt', Buffer.from('x')),
+    await zlib.ZipEntry.create('foreign-dir/', Buffer.alloc(0)),
+  ]);
+  const tampered = Buffer.from(archive);
+  // The central header's "version made by" high byte selects the platform;
+  // anything other than 3 (Unix) makes `mode` report 0 (see zip.js's
+  // `CentralFileHeader.prototype.mode`).
+  // The central directory follows *all* entries' local sections, and each
+  // entry's central header follows the previous entries' central headers.
+  const localSectionsLength = (30 + 'foreign.txt'.length + 'x'.length) +
+    (30 + 'foreign-dir/'.length + 0);
+  const fileHeaderStart = localSectionsLength;
+  const dirHeaderStart = fileHeaderStart + (46 + 'foreign.txt'.length);
+  const fileMadeByOffset = fileHeaderStart + 5;
+  const dirMadeByOffset = dirHeaderStart + 5;
+  assert.strictEqual(tampered[fileMadeByOffset], 3); // sanity: was Unix-made
+  assert.strictEqual(tampered[dirMadeByOffset], 3);
+  tampered[fileMadeByOffset] = 0; // MS-DOS/FAT
+  tampered[dirMadeByOffset] = 0;
+
+  const zip = new zlib.ZipBuffer(tampered);
+  assert.strictEqual(zip.get('foreign.txt').mode, 0);
+  assert.strictEqual(zip.get('foreign-dir/').mode, 0);
+  const provider = new vfs.ZipProvider(zip);
+  const archiveVfs = vfs.create(provider);
+
+  // stat()'s `entry.mode || <default>` fallback, for both a file and an
+  // (explicit) directory entry.
+  const fileStats = await archiveVfs.promises.stat('/foreign.txt');
+  assert.strictEqual(fileStats.mode & 0o777, 0o644);
+  const dirStats = await archiveVfs.promises.stat('/foreign-dir');
+  assert.strictEqual(dirStats.mode & 0o777, 0o755);
+  assert.strictEqual(archiveVfs.statSync('/foreign.txt').mode & 0o777, 0o644);
+  assert.strictEqual(archiveVfs.statSync('/foreign-dir').mode & 0o777, 0o755);
+
+  // rename()'s `mode: entry.mode || undefined` fallback (undefined lets
+  // ZipEntry.create() pick its own default mode instead of reproducing 0).
+  await archiveVfs.promises.rename('/foreign.txt', '/renamed.txt');
+  assert.strictEqual((await archiveVfs.promises.stat('/renamed.txt')).mode & 0o777, 0o644);
+})().then(common.mustCall());
+
+(() => {
+  const archive = buildArchiveSync([zlib.ZipEntry.createSync('foreign.txt', Buffer.from('x'))]);
+  const tampered = Buffer.from(archive);
+  const centralHeaderStart = 30 + 'foreign.txt'.length + 'x'.length;
+  const madeByOffset = centralHeaderStart + 5;
+  tampered[madeByOffset] = 0;
+
+  const zip = new zlib.ZipBuffer(tampered);
+  const provider = new vfs.ZipProvider(zip);
+  const archiveVfs = vfs.create(provider);
+
+  archiveVfs.renameSync('/foreign.txt', '/renamed.txt');
+  assert.strictEqual(archiveVfs.statSync('/renamed.txt').mode & 0o777, 0o644);
+})();
+
+// --- opening an explicit (empty) directory entry is rejected with EISDIR --
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('empty-dir/', Buffer.alloc(0))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  await assert.rejects(provider.open('/empty-dir', 'r'), { code: 'EISDIR' });
+  assert.throws(() => provider.openSync('/empty-dir', 'r'), { code: 'EISDIR' });
+})().then(common.mustCall());
+
+// --- readdir dedups a child directory reached through multiple entries ----
+(async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('dir/one.txt', Buffer.from('1')),
+    await zlib.ZipEntry.create('dir/two.txt', Buffer.from('2')),
+  ]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+  const archiveVfs = vfs.create(provider);
+
+  // Both entries imply the same 'dir' child at the root; it must appear once.
+  const rootEntries = await archiveVfs.promises.readdir('/');
+  assert.deepStrictEqual(rootEntries, ['dir']);
+  const dirEntries = await archiveVfs.promises.readdir('/dir');
+  assert.deepStrictEqual(dirEntries.sort(), ['one.txt', 'two.txt']);
+})().then(common.mustCall());
+
+// --- open() with a write flag against a readonly (ZipFile) archive: EROFS --
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+  const filePath = path.join(tmpdir.path, 'vfs-archive-handle-readonly.zip');
+  await fsPromises.writeFile(filePath, archive);
+  const zip = await zlib.ZipFile.open(filePath);
+  const provider = new vfs.ZipProvider(zip);
+
+  await assert.rejects(provider.open('/new.txt', 'w'), { code: 'EROFS' });
+  assert.throws(() => provider.openSync('/new.txt', 'w'), { code: 'EROFS' });
+
+  await zip.close();
+})().then(common.mustCall());
+
+// --- ZipFile-backed writable archive: sync unlink/rmdir (deleteSync) ------
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+  const filePath = path.join(tmpdir.path, 'vfs-archive-handle-writable-sync.zip');
+  await fsPromises.writeFile(filePath, archive);
+  const zip = await zlib.ZipFile.open(filePath, { writable: true });
+  const provider = new vfs.ZipProvider(zip);
+  const archiveVfs = vfs.create(provider);
+
+  archiveVfs.mkdirSync('/somedir');
+  assert.strictEqual(archiveVfs.statSync('/somedir').isDirectory(), true);
+  archiveVfs.rmdirSync('/somedir');
+  assert.throws(() => archiveVfs.statSync('/somedir'), { code: 'ENOENT' });
+
+  archiveVfs.unlinkSync('/a.txt');
+  assert.throws(() => archiveVfs.statSync('/a.txt'), { code: 'ENOENT' });
+
+  await zip.close();
+})().then(common.mustCall());
+
+// --- numeric open flags are normalized like node:fs (O_* constants) --------
+(async () => {
+  const { O_RDONLY, O_WRONLY, O_CREAT, O_TRUNC } = fs.constants;
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('hello'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  // A numeric read-only flag reads the existing entry.
+  const rh = await provider.open('/a.txt', O_RDONLY);
+  assert.strictEqual(await rh.readFile('utf8'), 'hello');
+  await rh.close();
+
+  // A numeric write+create+truncate flag creates and commits a new entry.
+  const wh = await provider.open('/num.txt', O_WRONLY | O_CREAT | O_TRUNC);
+  await wh.writeFile('written via numeric flags');
+  await wh.close();
+  assert.strictEqual(await provider.readFile('/num.txt', 'utf8'), 'written via numeric flags');
+
+  // The synchronous surface normalizes numeric flags identically.
+  const sh = provider.openSync('/a.txt', O_RDONLY);
+  assert.strictEqual(sh.readFileSync('utf8'), 'hello');
+  sh.closeSync();
+  const swh = provider.openSync('/num-sync.txt', O_WRONLY | O_CREAT | O_TRUNC);
+  swh.writeFileSync('sync numeric');
+  swh.closeSync();
+  assert.strictEqual(provider.readFileSync('/num-sync.txt', 'utf8'), 'sync numeric');
+})().then(common.mustCall());
+
+// --- readonly archive: any writable open flag (including 'r+' and numeric
+// O_RDWR) is rejected with EROFS, matching MemoryProvider/real fs -----------
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+  const filePath = path.join(tmpdir.path, 'vfs-archive-handle-rplus-readonly.zip');
+  await fsPromises.writeFile(filePath, archive);
+  const zip = await zlib.ZipFile.open(filePath); // read-only
+  const provider = new vfs.ZipProvider(zip);
+
+  // 'r+' opens for writing, so it is refused even though it also reads.
+  await assert.rejects(provider.open('/a.txt', 'r+'), { code: 'EROFS' });
+  assert.throws(() => provider.openSync('/a.txt', 'r+'), { code: 'EROFS' });
+
+  // Numeric O_RDWR is likewise a writable flag.
+  await assert.rejects(provider.open('/a.txt', fs.constants.O_RDWR), { code: 'EROFS' });
+  assert.throws(() => provider.openSync('/a.txt', fs.constants.O_RDWR), { code: 'EROFS' });
+
+  // Plain read access is still allowed.
+  const h = await provider.open('/a.txt', 'r');
+  assert.strictEqual(await h.readFile('utf8'), 'x');
+  await h.close();
+
+  await zip.close();
+})().then(common.mustCall());
+
+// --- mkdir({ recursive: true }) over an existing FILE still throws EEXIST;
+// over an existing DIRECTORY it stays a no-op -------------------------------
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  await assert.rejects(provider.mkdir('/a.txt', { recursive: true }), { code: 'EEXIST' });
+  assert.throws(() => provider.mkdirSync('/a.txt', { recursive: true }), { code: 'EEXIST' });
+
+  // Recursive mkdir over an existing directory remains a no-op (no throw).
+  await provider.mkdir('/d');
+  await provider.mkdir('/d', { recursive: true });
+  provider.mkdirSync('/d', { recursive: true });
+  assert.strictEqual((await provider.stat('/d')).isDirectory(), true);
+})().then(common.mustCall());
diff --git a/test/parallel/test-vfs-zip-provider.js b/test/parallel/test-vfs-zip-provider.js
new file mode 100644
index 000000000000..ad137457f7a3
--- /dev/null
+++ b/test/parallel/test-vfs-zip-provider.js
@@ -0,0 +1,243 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// Exercises ZipProvider (node:vfs backed by node:zlib's ZipBuffer/
+// ZipFile): construction validation, readonly reflecting the archive's own
+// writability, stat/readdir over explicit and implicit directories, and the
+// full async and synchronous CRUD surface, against both a ZipBuffer and a
+// ZipFile (opened both via open() and openSync()) source.
+
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const path = require('path');
+const fsPromises = require('fs/promises');
+const zlib = require('zlib');
+const vfs = require('node:vfs');
+
+tmpdir.refresh();
+
+async function buildArchive(entries, comment) {
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive(entries, comment)) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+(async () => {
+  // Construction validation.
+  assert.throws(() => new vfs.ZipProvider({}), { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => new vfs.ZipProvider(null), { code: 'ERR_INVALID_ARG_TYPE' });
+
+  // --- ZipBuffer-backed: always writable ------------------------------------
+  {
+    const archive = await buildArchive([
+      await zlib.ZipEntry.create('a.txt', Buffer.from('hello')),
+      await zlib.ZipEntry.create('dir/b.txt', Buffer.from('nested')),
+      await zlib.ZipEntry.create('empty-dir/', Buffer.alloc(0)),
+    ]);
+    const zip = new zlib.ZipBuffer(archive);
+    const provider = new vfs.ZipProvider(zip);
+    assert.strictEqual(provider.readonly, false);
+    assert.strictEqual(provider.supportsSymlinks, false);
+    assert.strictEqual(provider.supportsWatch, false);
+
+    const archiveVfs = vfs.create(provider);
+
+    // stat: file, implicit directory, explicit directory, root.
+    const fileStat = await archiveVfs.promises.stat('/a.txt');
+    assert.strictEqual(fileStat.isFile(), true);
+    assert.strictEqual(fileStat.size, 5);
+
+    const implicitDirStat = await archiveVfs.promises.stat('/dir');
+    assert.strictEqual(implicitDirStat.isDirectory(), true);
+
+    const explicitDirStat = await archiveVfs.promises.stat('/empty-dir');
+    assert.strictEqual(explicitDirStat.isDirectory(), true);
+
+    const rootStat = await archiveVfs.promises.stat('/');
+    assert.strictEqual(rootStat.isDirectory(), true);
+
+    await assert.rejects(archiveVfs.promises.stat('/missing.txt'), { code: 'ENOENT' });
+
+    // readdir: root lists both files and directories, deduped.
+    const rootEntries = await archiveVfs.promises.readdir('/');
+    assert.deepStrictEqual(rootEntries.sort(), ['a.txt', 'dir', 'empty-dir']);
+
+    const dirEntries = await archiveVfs.promises.readdir('/dir');
+    assert.deepStrictEqual(dirEntries, ['b.txt']);
+
+    const withTypes = await archiveVfs.promises.readdir('/', { withFileTypes: true });
+    const byName = new Map(withTypes.map((d) => [d.name, d]));
+    assert.strictEqual(byName.get('a.txt').isFile(), true);
+    assert.strictEqual(byName.get('dir').isDirectory(), true);
+
+    await assert.rejects(archiveVfs.promises.readdir('/a.txt'), { code: 'ENOTDIR' });
+    await assert.rejects(
+      archiveVfs.promises.readdir('/', { recursive: true }),
+      { code: 'ERR_METHOD_NOT_IMPLEMENTED' },
+    );
+
+    // readFile / writeFile round trip (new file).
+    assert.strictEqual(await archiveVfs.promises.readFile('/a.txt', 'utf8'), 'hello');
+    await archiveVfs.promises.writeFile('/new.txt', 'brand new');
+    assert.strictEqual(await archiveVfs.promises.readFile('/new.txt', 'utf8'), 'brand new');
+    assert.strictEqual(zip.has('new.txt'), true);
+
+    // Overwriting an existing file.
+    await archiveVfs.promises.writeFile('/a.txt', 'overwritten');
+    assert.strictEqual(await archiveVfs.promises.readFile('/a.txt', 'utf8'), 'overwritten');
+
+    // appendFile.
+    await archiveVfs.promises.writeFile('/append.txt', 'ab');
+    await archiveVfs.promises.appendFile('/append.txt', 'cd');
+    assert.strictEqual(await archiveVfs.promises.readFile('/append.txt', 'utf8'), 'abcd');
+
+    // mkdir + rmdir.
+    await archiveVfs.promises.mkdir('/newdir');
+    assert.strictEqual((await archiveVfs.promises.stat('/newdir')).isDirectory(), true);
+    await assert.rejects(archiveVfs.promises.mkdir('/newdir'), { code: 'EEXIST' });
+    await archiveVfs.promises.mkdir('/newdir', { recursive: true }); // No throw, already exists
+    await archiveVfs.promises.rmdir('/newdir');
+    await assert.rejects(archiveVfs.promises.stat('/newdir'), { code: 'ENOENT' });
+
+    // Rmdir refuses a non-empty directory.
+    await assert.rejects(archiveVfs.promises.rmdir('/dir'), { code: 'ENOTEMPTY' });
+
+    // unlink.
+    await archiveVfs.promises.unlink('/append.txt');
+    await assert.rejects(archiveVfs.promises.stat('/append.txt'), { code: 'ENOENT' });
+    await assert.rejects(archiveVfs.promises.unlink('/missing.txt'), { code: 'ENOENT' });
+    await assert.rejects(archiveVfs.promises.unlink('/dir'), { code: 'EISDIR' });
+
+    // rename.
+    await archiveVfs.promises.writeFile('/rename-me.txt', 'content');
+    await archiveVfs.promises.rename('/rename-me.txt', '/renamed.txt');
+    assert.strictEqual(zip.has('rename-me.txt'), false);
+    assert.strictEqual(await archiveVfs.promises.readFile('/renamed.txt', 'utf8'), 'content');
+
+    // open() flag semantics.
+    await assert.rejects(archiveVfs.promises.open('/does-not-exist.txt', 'r'), { code: 'ENOENT' });
+    await assert.rejects(archiveVfs.promises.open('/a.txt', 'wx'), { code: 'EEXIST' });
+    await assert.rejects(archiveVfs.promises.open('/dir', 'r'), { code: 'EISDIR' });
+  }
+
+  // --- ZipFile-backed, read-only: writes rejected with EROFS ----------------
+  {
+    const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+    const filePath = path.join(tmpdir.path, 'vfs-archive-readonly.zip');
+    await fsPromises.writeFile(filePath, archive);
+    const zip = await zlib.ZipFile.open(filePath);
+    const provider = new vfs.ZipProvider(zip);
+    assert.strictEqual(provider.readonly, true);
+    const archiveVfs = vfs.create(provider);
+
+    assert.strictEqual(await archiveVfs.promises.readFile('/a.txt', 'utf8'), 'x');
+    await assert.rejects(archiveVfs.promises.writeFile('/new.txt', 'y'), { code: 'EROFS' });
+    await assert.rejects(archiveVfs.promises.unlink('/a.txt'), { code: 'EROFS' });
+    await assert.rejects(archiveVfs.promises.mkdir('/newdir'), { code: 'EROFS' });
+    await assert.rejects(archiveVfs.promises.rmdir('/newdir'), { code: 'EROFS' });
+    await assert.rejects(archiveVfs.promises.rename('/a.txt', '/b.txt'), { code: 'EROFS' });
+
+    // The synchronous surface rejects the same way.
+    assert.strictEqual(archiveVfs.readFileSync('/a.txt', 'utf8'), 'x');
+    assert.throws(() => archiveVfs.writeFileSync('/new.txt', 'y'), { code: 'EROFS' });
+    assert.throws(() => archiveVfs.unlinkSync('/a.txt'), { code: 'EROFS' });
+    assert.throws(() => archiveVfs.mkdirSync('/newdir'), { code: 'EROFS' });
+    assert.throws(() => archiveVfs.rmdirSync('/newdir'), { code: 'EROFS' });
+    assert.throws(() => archiveVfs.renameSync('/a.txt', '/b.txt'), { code: 'EROFS' });
+
+    await zip.close();
+  }
+
+  // --- ZipFile-backed, opened writable: mutations persist to disk ----------
+  {
+    const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+    const filePath = path.join(tmpdir.path, 'vfs-archive-writable.zip');
+    await fsPromises.writeFile(filePath, archive);
+    const zip = await zlib.ZipFile.open(filePath, { writable: true });
+    const provider = new vfs.ZipProvider(zip);
+    assert.strictEqual(provider.readonly, false);
+    const archiveVfs = vfs.create(provider);
+
+    await archiveVfs.promises.writeFile('/b.txt', 'new content');
+    await zip.close();
+
+    const reopened = await zlib.ZipFile.open(filePath);
+    assert.strictEqual((await (await reopened.get('b.txt')).content()).toString(), 'new content');
+    await reopened.close();
+  }
+
+  // --- ZipBuffer-backed, fully synchronous CRUD ------------------------------
+  {
+    const archive = await buildArchive([
+      await zlib.ZipEntry.create('a.txt', Buffer.from('hello')),
+      await zlib.ZipEntry.create('dir/b.txt', Buffer.from('nested')),
+    ]);
+    const zip = new zlib.ZipBuffer(archive);
+    const provider = new vfs.ZipProvider(zip);
+    const archiveVfs = vfs.create(provider);
+
+    // stat/readdir.
+    assert.strictEqual(archiveVfs.statSync('/a.txt').isFile(), true);
+    assert.strictEqual(archiveVfs.statSync('/dir').isDirectory(), true);
+    assert.throws(() => archiveVfs.statSync('/missing.txt'), { code: 'ENOENT' });
+    assert.deepStrictEqual(archiveVfs.readdirSync('/').sort(), ['a.txt', 'dir']);
+    assert.throws(() => archiveVfs.readdirSync('/a.txt'), { code: 'ENOTDIR' });
+    assert.throws(
+      () => archiveVfs.readdirSync('/', { recursive: true }),
+      { code: 'ERR_METHOD_NOT_IMPLEMENTED' },
+    );
+
+    // readFile/writeFile/appendFile round trip.
+    assert.strictEqual(archiveVfs.readFileSync('/a.txt', 'utf8'), 'hello');
+    archiveVfs.writeFileSync('/new.txt', 'brand new');
+    assert.strictEqual(archiveVfs.readFileSync('/new.txt', 'utf8'), 'brand new');
+    archiveVfs.appendFileSync('/new.txt', '!');
+    assert.strictEqual(archiveVfs.readFileSync('/new.txt', 'utf8'), 'brand new!');
+
+    // mkdir/rmdir.
+    archiveVfs.mkdirSync('/newdir');
+    assert.strictEqual(archiveVfs.statSync('/newdir').isDirectory(), true);
+    assert.throws(() => archiveVfs.mkdirSync('/newdir'), { code: 'EEXIST' });
+    archiveVfs.mkdirSync('/newdir', { recursive: true }); // No throw, already exists.
+    archiveVfs.rmdirSync('/newdir');
+    assert.throws(() => archiveVfs.statSync('/newdir'), { code: 'ENOENT' });
+    assert.throws(() => archiveVfs.rmdirSync('/dir'), { code: 'ENOTEMPTY' });
+
+    // unlink.
+    archiveVfs.unlinkSync('/new.txt');
+    assert.throws(() => archiveVfs.statSync('/new.txt'), { code: 'ENOENT' });
+    assert.throws(() => archiveVfs.unlinkSync('/missing.txt'), { code: 'ENOENT' });
+    assert.throws(() => archiveVfs.unlinkSync('/dir'), { code: 'EISDIR' });
+
+    // rename.
+    archiveVfs.writeFileSync('/rename-me.txt', 'content');
+    archiveVfs.renameSync('/rename-me.txt', '/renamed.txt');
+    assert.strictEqual(zip.has('rename-me.txt'), false);
+    assert.strictEqual(archiveVfs.readFileSync('/renamed.txt', 'utf8'), 'content');
+
+    // open() flag semantics.
+    assert.throws(() => archiveVfs.openSync('/does-not-exist.txt', 'r'), { code: 'ENOENT' });
+    assert.throws(() => archiveVfs.openSync('/a.txt', 'wx'), { code: 'EEXIST' });
+    assert.throws(() => archiveVfs.openSync('/dir', 'r'), { code: 'EISDIR' });
+  }
+
+  // --- ZipFile-backed via openSync: sync-only round trip on disk -----------
+  {
+    const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+    const filePath = path.join(tmpdir.path, 'vfs-archive-opensync.zip');
+    await fsPromises.writeFile(filePath, archive);
+    const zip = zlib.ZipFile.openSync(filePath, { writable: true });
+    const provider = new vfs.ZipProvider(zip);
+    assert.strictEqual(provider.readonly, false);
+    const archiveVfs = vfs.create(provider);
+
+    assert.strictEqual(archiveVfs.readFileSync('/a.txt', 'utf8'), 'x');
+    archiveVfs.writeFileSync('/b.txt', 'new content');
+    zip.closeSync();
+
+    const reopened = zlib.ZipFile.openSync(filePath);
+    assert.strictEqual(reopened.getSync('b.txt').contentSync().toString(), 'new content');
+    reopened.closeSync();
+  }
+})().then(common.mustCall());
diff --git a/test/parallel/test-web-locks-no-livelock.js b/test/parallel/test-web-locks-no-livelock.js
new file mode 100644
index 000000000000..d654acb2b353
--- /dev/null
+++ b/test/parallel/test-web-locks-no-livelock.js
@@ -0,0 +1,51 @@
+// Flags: --expose-internals
+// Regression test for https://github.com/nodejs/node/issues/62644.
+'use strict';
+
+const common = require('../common');
+if (!common.isDebug) {
+  common.skip('Only works in debug mode');
+}
+
+const assert = require('node:assert');
+const { once } = require('node:events');
+const {
+  isMainThread,
+  parentPort,
+  workerData,
+  Worker,
+} = require('node:worker_threads');
+
+const resource = `web-locks-no-livelock`;
+
+if (!isMainThread) {
+  // A pending lock request alone does not keep the worker alive, so keep a
+  // message listener until the parent terminates this Environment.
+  parentPort.on('message', () => {});
+  navigator.locks.request(workerData, () => {});
+  parentPort.postMessage('ready');
+} else {
+  const { internalBinding } = require('internal/test/binding');
+  const { getGenericUsageCount } = internalBinding('debug');
+  const wakeCounter = 'LockManager.WakeEnvironment';
+
+  (async () => {
+    let worker;
+    let pendingInMain;
+    await navigator.locks.request(resource, common.mustCall(async () => {
+      // The worker queues an exclusive request for the resource held above.
+      worker = new Worker(__filename, { workerData: resource });
+      await once(worker, 'message');
+
+      // Queueing a second blocked request must not wake the worker: its
+      // request cannot make progress, so the two Environments would wake
+      // each other forever (livelock).
+      const wakeCount = getGenericUsageCount(wakeCounter);
+      pendingInMain = navigator.locks.request(resource, common.mustCall());
+      assert.strictEqual(getGenericUsageCount(wakeCounter), wakeCount);
+    }));
+
+    await pendingInMain;
+    await worker.terminate();
+  })().then(common.mustCall());
+}
diff --git a/test/parallel/test-webcrypto-export-import-cfrg.js b/test/parallel/test-webcrypto-export-import-cfrg.js
index 0ff7c61bdc68..fb8014840f34 100644
--- a/test/parallel/test-webcrypto-export-import-cfrg.js
+++ b/test/parallel/test-webcrypto-export-import-cfrg.js
@@ -432,6 +432,41 @@ async function testImportRaw({ name, publicUsages }) {
   await Promise.all(tests);
 })().then(common.mustCall());
 
+// JWK key usage validation precedes `key_ops` validation.
+(async function() {
+  for (const { name, publicUsages, privateUsages } of testVectors) {
+    const jwk = keyData[name].jwk;
+    const publicJwk = {
+      kty: jwk.kty,
+      crv: jwk.crv,
+      x: jwk.x,
+    };
+    const isKeyAgreement = name.startsWith('X');
+    const invalidUsage = isKeyAgreement ?
+      privateUsages[0] : publicUsages[0];
+    const invalidJwk = isKeyAgreement ? publicJwk : jwk;
+
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...invalidJwk, key_ops: [invalidUsage, invalidUsage] },
+        { name },
+        true,
+        [invalidUsage]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+
+    const validUsage = privateUsages[0];
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...jwk, key_ops: [validUsage, validUsage] },
+        { name },
+        true,
+        [validUsage]),
+      { name: 'DataError', message: 'Duplicate key operation' });
+  }
+})().then(common.mustCall());
+
 {
   const rsaPublic = crypto.createPublicKey(
     fixtures.readKey('rsa_public_2048.pem'));
diff --git a/test/parallel/test-webcrypto-export-import-ec.js b/test/parallel/test-webcrypto-export-import-ec.js
index f6157bff2b69..f4f36ceeff5a 100644
--- a/test/parallel/test-webcrypto-export-import-ec.js
+++ b/test/parallel/test-webcrypto-export-import-ec.js
@@ -120,6 +120,12 @@ async function testImportSpki({ name, publicUsages }, namedCurve, extractable) {
     assert.strictEqual(
       Buffer.from(spki).toString('hex'),
       keyData[namedCurve].spki.toString('hex'));
+
+    await assert.rejects(
+      subtle.exportKey('pkcs8', key), {
+        message: 'Key must be a private key',
+        name: 'InvalidAccessError',
+      });
   } else {
     await assert.rejects(
       subtle.exportKey('spki', key), {
@@ -163,6 +169,12 @@ async function testImportPkcs8(
     assert.strictEqual(
       Buffer.from(pkcs8).toString('hex'),
       keyData[namedCurve].pkcs8.toString('hex'));
+
+    await assert.rejects(
+      subtle.exportKey('spki', key), {
+        message: 'Key must be a public key',
+        name: 'InvalidAccessError',
+      });
   } else {
     await assert.rejects(
       subtle.exportKey('pkcs8', key), {
@@ -406,6 +418,42 @@ async function testImportRaw({ name, publicUsages }, namedCurve) {
   await Promise.all(tests);
 })().then(common.mustCall());
 
+// JWK key usage validation precedes `key_ops` validation.
+(async function() {
+  const jwk = keyData['P-256'].jwk;
+  const publicJwk = {
+    kty: jwk.kty,
+    crv: jwk.crv,
+    x: jwk.x,
+    y: jwk.y,
+  };
+
+  for (const { name, publicUsages, privateUsages } of testVectors) {
+    const invalidUsage = name === 'ECDH' ?
+      privateUsages[0] : publicUsages[0];
+    const invalidJwk = name === 'ECDH' ? publicJwk : jwk;
+
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...invalidJwk, key_ops: [invalidUsage, invalidUsage] },
+        { name, namedCurve: 'P-256' },
+        true,
+        [invalidUsage]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+
+    const validUsage = privateUsages[0];
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...jwk, key_ops: [validUsage, validUsage] },
+        { name, namedCurve: 'P-256' },
+        true,
+        [validUsage]),
+      { name: 'DataError', message: 'Duplicate key operation' });
+  }
+})().then(common.mustCall());
+
 
 // https://github.com/nodejs/node/issues/45859
 (async function() {
diff --git a/test/parallel/test-webcrypto-export-import-ml-dsa.js b/test/parallel/test-webcrypto-export-import-ml-dsa.js
index 20d46870e430..9c6e04da053c 100644
--- a/test/parallel/test-webcrypto-export-import-ml-dsa.js
+++ b/test/parallel/test-webcrypto-export-import-ml-dsa.js
@@ -491,6 +491,40 @@ async function testImportRawSeed({ name, privateUsages }, extractable) {
   });
 })().then(common.mustCall());
 
+// JWK key usage validation precedes `key_ops` validation.
+(async function() {
+  const privateJwk = keyData['ML-DSA-65'].jwk;
+  const publicJwk = { ...privateJwk, priv: undefined };
+
+  for (const [jwk, usage] of [
+    [privateJwk, 'verify'],
+    [publicJwk, 'sign'],
+  ]) {
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...jwk, key_ops: [usage, usage] },
+        'ML-DSA-65',
+        true,
+        [usage]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+  }
+
+  for (const [jwk, usage] of [
+    [privateJwk, 'sign'],
+    [publicJwk, 'verify'],
+  ]) {
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...jwk, key_ops: [usage, usage] },
+        'ML-DSA-65',
+        true,
+        [usage]),
+      { name: 'DataError', message: /Duplicate key operation/ });
+  }
+})().then(common.mustCall());
+
 if (!process.features.openssl_is_boringssl) {
   (async function() {
     for (const { name, privateUsages } of testVectors) {
diff --git a/test/parallel/test-webcrypto-export-import-ml-kem.js b/test/parallel/test-webcrypto-export-import-ml-kem.js
index cd05224969c8..862eea96726d 100644
--- a/test/parallel/test-webcrypto-export-import-ml-kem.js
+++ b/test/parallel/test-webcrypto-export-import-ml-kem.js
@@ -496,13 +496,29 @@ async function testImportJwk({ name, publicUsages, privateUsages }, extractable)
   });
 })().then(common.mustCall());
 
-// Regression test: JWK `key_ops` validation must recognize ML-KEM operations
-// (encapsulateKey, encapsulateBits, decapsulateKey, decapsulateBits) so that
-// duplicate entries are rejected
+// JWK key usage validation precedes `key_ops` validation.
 (async function() {
-  for (const op of ['encapsulateKey', 'encapsulateBits',
-                    'decapsulateKey', 'decapsulateBits']) {
-    const jwk = { ...keyData['ML-KEM-768'].jwk, key_ops: [op, op] };
+  const privateJwk = keyData['ML-KEM-768'].jwk;
+  const encapsulationOps = ['encapsulateKey', 'encapsulateBits'];
+  const decapsulationOps = ['decapsulateKey', 'decapsulateBits'];
+
+  for (const op of encapsulationOps) {
+    const jwk = { ...privateJwk, key_ops: [op, op] };
+    await assert.rejects(
+      subtle.importKey('jwk', jwk, { name: 'ML-KEM-768' }, true, [op]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+  }
+
+  // Duplicate entries are still rejected when the requested usages are valid.
+  for (const op of encapsulationOps) {
+    const jwk = { ...privateJwk, priv: undefined, key_ops: [op, op] };
+    await assert.rejects(
+      subtle.importKey('jwk', jwk, { name: 'ML-KEM-768' }, true, [op]),
+      { name: 'DataError', message: /Duplicate key operation/ });
+  }
+
+  for (const op of decapsulationOps) {
+    const jwk = { ...privateJwk, key_ops: [op, op] };
     await assert.rejects(
       subtle.importKey('jwk', jwk, { name: 'ML-KEM-768' }, true, [op]),
       { name: 'DataError', message: /Duplicate key operation/ });
diff --git a/test/parallel/test-webcrypto-export-import-rsa.js b/test/parallel/test-webcrypto-export-import-rsa.js
index 8808fcbe6b1f..294baff544a6 100644
--- a/test/parallel/test-webcrypto-export-import-rsa.js
+++ b/test/parallel/test-webcrypto-export-import-rsa.js
@@ -651,6 +651,35 @@ const testVectors = [
   await Promise.all(variations);
 })().then(common.mustCall());
 
+// Type-specific JWK usage validation precedes `key_ops` validation.
+(async function() {
+  const privateJwk = keyData[1024].jwk;
+
+  for (const { name, publicUsages, privateUsages } of testVectors) {
+    const algorithm = { name, hash: 'SHA-256' };
+    const invalidUsage = publicUsages[0];
+    const validUsage = privateUsages[0];
+
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...privateJwk, key_ops: [invalidUsage, invalidUsage] },
+        algorithm,
+        true,
+        [invalidUsage]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...privateJwk, key_ops: [validUsage, validUsage] },
+        algorithm,
+        true,
+        [validUsage]),
+      { name: 'DataError', message: 'Duplicate key operation' });
+  }
+})().then(common.mustCall());
+
 {
   const ecPublic = crypto.createPublicKey(
     fixtures.readKey('ec_p256_public.pem'));
diff --git a/test/parallel/test-webcrypto-sign-verify-rsa.js b/test/parallel/test-webcrypto-sign-verify-rsa.js
index 62e9cbe7826a..12633cd50de2 100644
--- a/test/parallel/test-webcrypto-sign-verify-rsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-rsa.js
@@ -227,22 +227,26 @@ async function testSaltLength(keyLength, hash, hLen) {
 
   const signature = await subtle.sign(
     { name: 'RSA-PSS', saltLength: max }, privateKey, data);
-  await assert.rejects(
-    subtle.sign({ name: 'RSA-PSS', saltLength: max + 1 }, privateKey, data), (err) => {
-      assert.strictEqual(err.name, 'OperationError');
-      assert.strictEqual(err.cause?.code, 'ERR_OUT_OF_RANGE');
-      assert.strictEqual(err.cause?.message, `The value of "algorithm.saltLength" is out of range. It must be >= 0 && <= ${max}. Received ${max + 1}`);
-      return true;
-    });
-  await subtle.verify(
-    { name: 'RSA-PSS', saltLength: max }, publicKey, signature, data);
-  await assert.rejects(
-    subtle.verify({ name: 'RSA-PSS', saltLength: max + 1 }, publicKey, signature, data), (err) => {
-      assert.strictEqual(err.name, 'OperationError');
-      assert.strictEqual(err.cause?.code, 'ERR_OUT_OF_RANGE');
-      assert.strictEqual(err.cause?.message, `The value of "algorithm.saltLength" is out of range. It must be >= 0 && <= ${max}. Received ${max + 1}`);
-      return true;
-    });
+  assert.strictEqual(await subtle.verify(
+    { name: 'RSA-PSS', saltLength: max }, publicKey, signature, data), true);
+
+  for (const saltLength of [max + 1, 0x7fffffff]) {
+    await assert.rejects(
+      subtle.sign({ name: 'RSA-PSS', saltLength }, privateKey, data), {
+        name: 'OperationError',
+      });
+    assert.strictEqual(await subtle.verify(
+      { name: 'RSA-PSS', saltLength }, publicKey, signature, data), false);
+  }
+
+  for (const saltLength of [0x80000000, 0xffffffff]) {
+    await assert.rejects(
+      subtle.sign({ name: 'RSA-PSS', saltLength }, privateKey, data), {
+        name: 'OperationError',
+      });
+    assert.strictEqual(await subtle.verify(
+      { name: 'RSA-PSS', saltLength }, publicKey, signature, data), false);
+  }
 }
 
 (async function() {
diff --git a/test/parallel/test-webcrypto-wrap-unwrap.js b/test/parallel/test-webcrypto-wrap-unwrap.js
index c2c089ed0ffa..5ffffe230ac6 100644
--- a/test/parallel/test-webcrypto-wrap-unwrap.js
+++ b/test/parallel/test-webcrypto-wrap-unwrap.js
@@ -506,7 +506,7 @@ async function testNonByteLengthWrapUnwrap({
 // Test that wrapKey/unwrapKey validate the wrapping/unwrapping key's
 // algorithm and usage before proceeding.
 // Spec: https://w3c.github.io/webcrypto/#SubtleCrypto-method-wrapKey
-// Steps 9-10 (wrapping key checks) must precede step 12 (exportKey).
+// Steps 9-10 (wrapping key checks) must precede step 13 (export operation).
 (async function() {
   const hmacKey = await subtle.generateKey(
     { name: 'HMAC', hash: 'SHA-256' },
@@ -551,7 +551,7 @@ async function testNonByteLengthWrapUnwrap({
     });
 
   // Correct wrapping key algorithm and usage results in the expected
-  // exportKey error (not the wrapping key validation error).
+  // export operation error (not the wrapping key validation error).
   const wrapKey = await subtle.generateKey(
     { name: 'AES-GCM', length: 128 },
     true,
@@ -563,8 +563,19 @@ async function testNonByteLengthWrapUnwrap({
       name: 'AES-GCM',
       iv: new Uint8Array(12),
     }), {
-      // exportKey('spki', privateKey) throws NotSupportedError
-      name: 'NotSupportedError',
+      message: 'Key must be a public key',
+      name: 'InvalidAccessError',
+    });
+
+  // Symmetric case: exporting a public key as 'pkcs8' must also fail with
+  // InvalidAccessError, not the generic NotSupportedError.
+  await assert.rejects(
+    subtle.wrapKey('pkcs8', ecKey.publicKey, wrapKey, {
+      name: 'AES-GCM',
+      iv: new Uint8Array(12),
+    }), {
+      message: 'Key must be a private key',
+      name: 'InvalidAccessError',
     });
 
   // --- unwrapKey validation tests ---
diff --git a/test/parallel/test-webstreams-pipeline.js b/test/parallel/test-webstreams-pipeline.js
index a4bf579f5f11..5643524449ad 100644
--- a/test/parallel/test-webstreams-pipeline.js
+++ b/test/parallel/test-webstreams-pipeline.js
@@ -212,7 +212,7 @@ const http = require('http');
         values.push(chunk?.toString());
       });
       res.on('end', common.mustCall(() => {
-        assert.deepStrictEqual(values, ['hello', 'world']);
+        assert.strictEqual(values.join(''), 'helloworld');
         server.close();
       }));
     }));
diff --git a/test/parallel/test-webworker-ref-unref.js b/test/parallel/test-webworker-ref-unref.js
new file mode 100644
index 000000000000..cff2bb5d097f
--- /dev/null
+++ b/test/parallel/test-webworker-ref-unref.js
@@ -0,0 +1,29 @@
+// Flags: --experimental-web-worker
+'use strict';
+
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+const assert = require('assert');
+
+{
+  // Both are no-ops on a worker whose script could not be loaded.
+  const worker = new Worker(fixtures.fileURL('web-worker', 'nonexistent.js').href);
+  worker.addEventListener('error', common.mustCall());
+  process.unref(worker);
+  process.ref(worker);
+}
+
+const worker = new Worker(fixtures.fileURL('web-worker', 'echo.js').href);
+
+worker.addEventListener('error', common.mustNotCall('worker failed'));
+worker.addEventListener('message', common.mustCall(({ data }) => {
+  assert.strictEqual(data, 'hello');
+  worker.terminate();
+}));
+
+process.once('beforeExit', common.mustCall(() => {
+  process.ref(worker);
+  worker.postMessage('hello');
+}));
+
+process.unref(worker);
diff --git a/test/parallel/test-worker-heap-profile.js b/test/parallel/test-worker-heap-profile.js
index 2a466dc2f186..b3332831621a 100644
--- a/test/parallel/test-worker-heap-profile.js
+++ b/test/parallel/test-worker-heap-profile.js
@@ -63,11 +63,10 @@ worker.on('online', common.mustCall(async () => {
 
   {
     const handle = await worker.startHeapProfile();
-    try {
-      await worker.startHeapProfile();
-    } catch (err) {
-      assert.strictEqual(err.code, 'ERR_HEAP_PROFILE_HAVE_BEEN_STARTED');
-    }
+
+    await assert.rejects(worker.startHeapProfile(), {
+      code: 'ERR_HEAP_PROFILE_HAVE_BEEN_STARTED',
+    });
     JSON.parse(await handle.stop());
   }
 
diff --git a/test/parallel/test-worker-spec-differences.js b/test/parallel/test-worker-spec-differences.js
new file mode 100644
index 000000000000..871745b99e04
--- /dev/null
+++ b/test/parallel/test-worker-spec-differences.js
@@ -0,0 +1,134 @@
+// Flags: --experimental-web-worker
+'use strict';
+
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+const assert = require('assert');
+const path = require('path');
+
+function workerURL(name) {
+  return fixtures.fileURL('web-worker', name).href;
+}
+
+// Asserts that `worker` posts exactly one message and terminates it. A worker
+// is kept alive by its message port, so it never exits on its own.
+function expectMessage(worker, check) {
+  worker.addEventListener('error', common.mustNotCall('worker failed'));
+  worker.addEventListener('message', common.mustCall(({ data }) => {
+    check(data);
+    worker.terminate();
+  }));
+}
+
+// Asserts that `worker` fails to run and fires an error event.
+function expectError(worker, check) {
+  worker.addEventListener('message', common.mustNotCall('worker succeeded'));
+  worker.addEventListener('error', check);
+}
+
+process.on('uncaughtException', common.mustNotCall(
+  'worker errors must not be reported on the main thread'));
+
+// The only supported schemes are 'file:', 'blob:', and 'data:'
+for (const unsupported of [
+  'https://nodejs.org/worker.js',
+  'http://localhost/worker.js',
+  'about:blank',
+  'node:worker_threads',
+]) {
+  assert.throws(() => new Worker(unsupported), { name: 'NotSupportedError' });
+}
+
+// Same as above, for `importScripts`
+expectMessage(new Worker(workerURL('import-scheme.js')),
+              common.mustCall((data) => assert.strictEqual(data, 'NetworkError')));
+
+// Rejection events are emitted on the process
+expectMessage(new Worker(workerURL('no-events.js')), common.mustCall((data) => {
+  assert.deepStrictEqual(data.dispatched, []);
+  assert.strictEqual(data.processEvents, 1);
+}));
+
+{
+  // Calling close() immediately terminates the worker
+  const worker = new Worker(workerURL('close.js'));
+  worker.addEventListener('error', common.mustNotCall('worker failed'));
+  worker.addEventListener('message', common.mustCall(({ data }) => {
+    assert.strictEqual(data, 'before-close');
+  }, 1));
+}
+
+{
+  // Relative imports
+  const target = fixtures.path('web-worker', 'relative.js');
+  const relative =
+    path.relative(process.cwd(), target).replaceAll(path.sep, '/');
+  expectMessage(new Worker(relative.startsWith('.') ? relative : `./${relative}`),
+                common.mustCall((data) => assert.strictEqual(data, 'relative')));
+}
+
+{
+  // The classic type takes precedence over the file extension.
+  expectMessage(new Worker(workerURL('classic.mjs'), { type: 'classic' }),
+                common.mustCall((data) => assert.deepStrictEqual(data, {
+                  binding: 'classic',
+                  requireType: 'function',
+                  thisIsGlobal: true,
+                })));
+}
+
+{
+  // The module type takes precedence over the file extension and preserves
+  // the file URL as the base for relative imports.
+  expectMessage(new Worker(workerURL('module.cjs'), { type: 'module' }),
+                common.mustCall((data) => assert.deepStrictEqual(data, {
+                  requireType: 'undefined',
+                  thisIsUndefined: true,
+                  value: 'module',
+                })));
+}
+
+if (common.hasCrypto) {
+  {
+    // MIME validation must use the Blob's internal type, not its public getter.
+    const blob = new Blob(['postMessage("unexpected")'], { type: 'text/plain' });
+    const url = URL.createObjectURL(blob);
+    const typeDescriptor = Object.getOwnPropertyDescriptor(Blob.prototype, 'type');
+    Object.defineProperty(Blob.prototype, 'type', {
+      configurable: true,
+      get() { return 'text/javascript'; },
+    });
+    let worker;
+    try {
+      worker = new Worker(url);
+    } finally {
+      Object.defineProperty(Blob.prototype, 'type', typeDescriptor);
+    }
+    expectError(worker, common.mustCall(({ message }) => {
+      assert.match(message, /^Failed to fetch the worker script:/);
+      URL.revokeObjectURL(url);
+    }));
+  }
+
+  {
+    // Module source encoding must not call mutable Buffer prototype methods.
+    const blob = new Blob(['postMessage("original")'], {
+      type: 'text/javascript',
+    });
+    const url = URL.createObjectURL(blob);
+    const bufferToString = Buffer.prototype.toString;
+    Buffer.prototype.toString = common.mustNotCall();
+    let worker;
+    try {
+      worker = new Worker(url, { type: 'module' });
+    } finally {
+      Buffer.prototype.toString = bufferToString;
+    }
+    expectMessage(worker, common.mustCall((data) => {
+      assert.strictEqual(data, 'original');
+      URL.revokeObjectURL(url);
+    }));
+  }
+} else {
+  common.printSkipMessage('skipping Blob tests due to lack of randomUUID()');
+}
diff --git a/test/parallel/test-zlib-zip-file-lifecycle.js b/test/parallel/test-zlib-zip-file-lifecycle.js
index 85a06f86b75e..ad5d4b6237da 100644
--- a/test/parallel/test-zlib-zip-file-lifecycle.js
+++ b/test/parallel/test-zlib-zip-file-lifecycle.js
@@ -44,6 +44,21 @@ test('close() waits for an in-flight read instead of closing under it', async ()
   assert.ok(data.equals(payload));
 });
 
+test('close() resolves with a paused contentIterator()', async () => {
+  tmpdir.refresh();
+  const file = tmpdir.resolve('paused-iterator.zip');
+  const payload = Buffer.alloc(8 * 1024 * 1024, 0x61);
+  writeArchive(file, [zlib.ZipEntry.createSync('big', payload, { method: 'store' })]);
+
+  const zf = zlib.ZipFile.openSync(file);
+  const iterator = zf.getSync('big').contentIterator();
+  const first = await iterator.next();
+  assert.strictEqual(first.done, false);
+
+  await zf.close();
+  await assert.rejects(iterator.next(), { code: 'ERR_INVALID_STATE' });
+});
+
 // 2. A failed central-directory rewrite during add() is rolled back.
 test('a failed directory rewrite during addEntrySync is rolled back', () => {
   tmpdir.refresh();
diff --git a/test/parallel/test-zlib-zip-vfs.js b/test/parallel/test-zlib-zip-vfs.js
new file mode 100644
index 000000000000..213dcad0f286
--- /dev/null
+++ b/test/parallel/test-zlib-zip-vfs.js
@@ -0,0 +1,180 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// Exercises the node:zlib ZipFile read/write surface over a node:vfs virtual
+// file descriptor. An in-memory archive is placed in a mounted MemoryProvider
+// VFS and opened with ZipFile through its mounted path, so every fd operation
+// ZipFile performs - positional read/write, fstat, ftruncate, open/close, in
+// both the asynchronous and the synchronous flavour - is served by the VFS
+// rather than a real OS fd. This validates that ZipFile's fd abstraction is
+// complete enough to run unchanged on a purely virtual descriptor.
+
+require('../common');
+
+const assert = require('node:assert');
+const zlib = require('node:zlib');
+const fs = require('node:fs');
+const { test } = require('node:test');
+const vfs = require('node:vfs');
+
+async function buildArchive(entries, comment) {
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive(entries, comment)) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+// Places `archive` in a freshly mounted in-memory VFS and returns the mounted
+// path of the archive file plus a cleanup that unmounts the VFS. mount() picks
+// the mount point itself, inside a reserved namespace.
+function mountArchive(archive) {
+  const memfs = vfs.create();
+  memfs.writeFileSync('/archive.zip', archive); // provider-relative, before mount
+  const mountPoint = memfs.mount();
+  return { vpath: `${mountPoint}/archive.zip`, cleanup: () => memfs.unmount() };
+}
+
+test('ZipFile.open() reads a VFS-backed archive through an async virtual fd', async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('a.txt', Buffer.from('hello vfs')),
+    await zlib.ZipEntry.create('dir/b.bin', Buffer.from([1, 2, 3, 4]), { method: 'store' }),
+    await zlib.ZipEntry.create('z.txt', Buffer.from('Z'.repeat(4096)), { method: 'zstd' }),
+  ]);
+  const { vpath, cleanup } = mountArchive(archive);
+  try {
+    const zf = await zlib.ZipFile.open(vpath);
+    try {
+      assert.strictEqual(zf.size, 3);
+      assert.deepStrictEqual([...zf.keys()].sort(), ['a.txt', 'dir/b.bin', 'z.txt']);
+
+      // A lazy, file-backed entry: it retains no content and reads straight
+      // from the virtual fd on demand.
+      const a = await zf.get('a.txt');
+      assert.strictEqual(a.rawContent, null);
+      assert.strictEqual((await a.content()).toString(), 'hello vfs');
+      assert.strictEqual(await zf.get('a.txt'), a); // Cached handle identity
+
+      // The contentIterator() streams (decompressing on the way) from the fd.
+      const chunks = [];
+      for await (const c of (await zf.get('z.txt')).contentIterator()) chunks.push(c);
+      assert.strictEqual(Buffer.concat(chunks).toString(), 'Z'.repeat(4096));
+
+      // stream() resolves to a Readable over the virtual fd.
+      const rs = await zf.stream('dir/b.bin');
+      const out = [];
+      for await (const c of rs) out.push(c);
+      assert.deepStrictEqual(Buffer.concat(out), Buffer.from([1, 2, 3, 4]));
+    } finally {
+      await zf.close();
+    }
+  } finally {
+    cleanup();
+  }
+});
+
+test('ZipFile.openSync() reads a VFS-backed archive through a synchronous virtual fd', async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('a.txt', Buffer.from('sync hello')),
+    await zlib.ZipEntry.create('b.bin', Buffer.from([9, 8, 7]), { method: 'store' }),
+  ]);
+  const { vpath, cleanup } = mountArchive(archive);
+  try {
+    const zf = zlib.ZipFile.openSync(vpath);
+    try {
+      assert.strictEqual(zf.getSync('a.txt').contentSync().toString(), 'sync hello');
+      assert.deepStrictEqual([...zf.getSync('b.bin').contentSync()], [9, 8, 7]);
+      assert.deepStrictEqual([...zf.valuesSync()].map((e) => e.name).sort(), ['a.txt', 'b.bin']);
+    } finally {
+      zf.closeSync();
+    }
+  } finally {
+    cleanup();
+  }
+});
+
+test('ZipFile writable mutations run against an async virtual fd', async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('keep.txt', Buffer.from('keep')),
+    await zlib.ZipEntry.create('drop.txt', Buffer.from('drop')),
+  ]);
+  const { vpath, cleanup } = mountArchive(archive);
+  try {
+    const sizeBefore = fs.statSync(vpath).size;
+    const zw = await zlib.ZipFile.open(vpath, { writable: true });
+    try {
+      await zw.add('added.txt', Buffer.from('a new member over vfs'));
+      assert.strictEqual(await zw.delete('drop.txt'), true);
+    } finally {
+      await zw.close();
+    }
+    // Positional writes + ftruncate actually altered the virtual file.
+    assert.notStrictEqual(fs.statSync(vpath).size, sizeBefore);
+
+    const zr = await zlib.ZipFile.open(vpath);
+    try {
+      assert.deepStrictEqual([...zr.keys()].sort(), ['added.txt', 'keep.txt']);
+      assert.strictEqual((await (await zr.get('added.txt')).content()).toString(), 'a new member over vfs');
+      assert.strictEqual(zr.has('drop.txt'), false);
+    } finally {
+      await zr.close();
+    }
+  } finally {
+    cleanup();
+  }
+});
+
+test('ZipFile sync mutations (addEntrySync) run against a synchronous virtual fd', async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('a'))]);
+  const { vpath, cleanup } = mountArchive(archive);
+  try {
+    const zw = zlib.ZipFile.openSync(vpath, { writable: true });
+    try {
+      zw.addSync('b.txt', Buffer.from('b sync'));
+      assert.deepStrictEqual([...zw.keys()].sort(), ['a.txt', 'b.txt']);
+    } finally {
+      zw.closeSync();
+    }
+    const zr = zlib.ZipFile.openSync(vpath);
+    try {
+      assert.strictEqual(zr.getSync('b.txt').contentSync().toString(), 'b sync');
+    } finally {
+      zr.closeSync();
+    }
+  } finally {
+    cleanup();
+  }
+});
+
+test('addEntry() promotes a streaming entry to file-backed on a virtual fd', async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('seed.txt', Buffer.from('seed'))]);
+  const { vpath, cleanup } = mountArchive(archive);
+  try {
+    const payload = 'streamed over vfs'.repeat(32);
+    const zw = await zlib.ZipFile.open(vpath, { writable: true });
+    try {
+      async function* source() {
+        yield Buffer.from(payload.slice(0, 5));
+        yield Buffer.from(payload.slice(5));
+      }
+      const streamEntry = zlib.ZipEntry.createStream('s.txt', source());
+      const returned = await zw.addEntry(streamEntry);
+      assert.strictEqual(returned, streamEntry);
+
+      // Promoted in place against the virtual fd: now readable and re-streamable.
+      assert.strictEqual((await streamEntry.content()).toString(), payload);
+      const it = [];
+      for await (const c of streamEntry.contentIterator()) it.push(c);
+      assert.strictEqual(Buffer.concat(it).toString(), payload);
+    } finally {
+      await zw.close();
+    }
+
+    const zr = await zlib.ZipFile.open(vpath);
+    try {
+      assert.strictEqual((await (await zr.get('s.txt')).content()).toString(), payload);
+    } finally {
+      await zr.close();
+    }
+  } finally {
+    cleanup();
+  }
+});
diff --git a/test/pseudo-tty/test-set-raw-mode-modes.js b/test/pseudo-tty/test-set-raw-mode-modes.js
index 8280aacb0a85..fa11b25f3c1c 100644
--- a/test/pseudo-tty/test-set-raw-mode-modes.js
+++ b/test/pseudo-tty/test-set-raw-mode-modes.js
@@ -1,15 +1,14 @@
 'use strict';
 require('../common');
 const assert = require('assert');
-const { spawnSync } = require('child_process');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
 
 function isOnlcrEnabled() {
-  const { stdout, stderr, status } = spawnSync('stty', ['-a'], {
+  const { child: { stdout } } = spawnSyncAndExitWithoutError('stty', ['-a'], {
     encoding: 'utf8',
     stdio: ['inherit', 'pipe', 'pipe'],
   });
 
-  assert.strictEqual(status, 0, stderr);
   return /(?:^|[\s;])onlcr(?:[\s;]|$)/.test(stdout);
 }
 
diff --git a/test/pummel/test-heap-profile-and-snapshot-near-heap-limit.js b/test/pummel/test-heap-profile-and-snapshot-near-heap-limit.js
new file mode 100644
index 000000000000..f7dec66d9060
--- /dev/null
+++ b/test/pummel/test-heap-profile-and-snapshot-near-heap-limit.js
@@ -0,0 +1,33 @@
+'use strict';
+
+const common = require('../common');
+
+if (common.isPi()) {
+  common.skip('Too slow for Raspberry Pi devices');
+}
+
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fixtures = require('../common/fixtures');
+const fs = require('fs');
+
+tmpdir.refresh();
+const child = spawnSync(process.execPath, [
+  '--max-old-space-size=50',
+  fixtures.path('workload', 'heap-profile-and-snapshot-near-heap-limit.js'),
+], {
+  cwd: tmpdir.path,
+});
+
+const stderr = child.stderr.toString();
+assert(common.nodeProcessAborted(child.status, child.signal),
+       'process should have aborted, but did not');
+
+const files = fs.readdirSync(tmpdir.path);
+const snapshots = files.filter((f) => f.endsWith('.heapsnapshot'));
+const profiles = files.filter((f) => f.endsWith('.heapprofile'));
+
+assert(snapshots.length === 1 ||
+       stderr.includes('Not generating snapshots because it\'s too risky'));
+assert.strictEqual(profiles.length, 1);
diff --git a/test/pummel/test-heap-profile-near-heap-limit.js b/test/pummel/test-heap-profile-near-heap-limit.js
new file mode 100644
index 000000000000..522b01c54c7c
--- /dev/null
+++ b/test/pummel/test-heap-profile-near-heap-limit.js
@@ -0,0 +1,33 @@
+'use strict';
+
+const common = require('../common');
+
+if (common.isPi()) {
+  common.skip('Too slow for Raspberry Pi devices');
+}
+
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fixtures = require('../common/fixtures');
+const fs = require('fs');
+
+tmpdir.refresh();
+const child = spawnSync(process.execPath, [
+  '--max-old-space-size=50',
+  fixtures.path('workload', 'heap-profile-near-heap-limit.js'),
+], {
+  cwd: tmpdir.path,
+});
+
+assert(common.nodeProcessAborted(child.status, child.signal),
+       'process should have aborted, but did not');
+
+const profiles = fs.readdirSync(tmpdir.path)
+  .filter((file) => file.endsWith('.heapprofile'));
+assert.strictEqual(profiles.length, 1);
+
+const profile = JSON.parse(
+  fs.readFileSync(tmpdir.resolve(profiles[0]), 'utf8'));
+assert(profile.head);
+assert(profile.samples.length > 0);
diff --git a/test/sea/test-build-sea-elf-segments.js b/test/sea/test-build-sea-elf-segments.js
new file mode 100644
index 000000000000..3772352380c0
--- /dev/null
+++ b/test/sea/test-build-sea-elf-segments.js
@@ -0,0 +1,37 @@
+'use strict';
+// This tests that --build-sea emits an ELF whose PT_LOAD segments never share
+// a page, since kernels that map them with MAP_FIXED_NOREPLACE (Linux < 5.4,
+// RHEL 8) refuse to execute such a file.
+
+const common = require('../common');
+if (process.platform !== 'linux')
+  common.skip('ELF-specific');
+
+const { buildSEA, skipIfBuildSEAIsNotSupported } = require('../common/sea');
+skipIfBuildSEAIsNotSupported();
+
+const assert = require('assert');
+const { readFileSync } = require('fs');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+const elf = readFileSync(buildSEA(fixtures.path('sea', 'basic')));
+assert.strictEqual(elf[4], 2);  // ELFCLASS64
+const phoff = Number(elf.readBigUInt64LE(0x20));
+const phentsize = elf.readUInt16LE(0x36);
+const phnum = elf.readUInt16LE(0x38);
+const loads = [];
+for (let i = 0; i < phnum; i++) {
+  const at = phoff + i * phentsize;
+  if (elf.readUInt32LE(at) !== 1) continue;  // PT_LOAD
+  const vaddr = elf.readBigUInt64LE(at + 0x10);
+  const memsz = elf.readBigUInt64LE(at + 0x28);
+  if (memsz > 0n) loads.push({ first: vaddr >> 12n, last: (vaddr + memsz - 1n) >> 12n });
+}
+loads.sort((a, b) => (a.first < b.first ? -1 : 1));
+for (let i = 1; i < loads.length; i++) {
+  assert(loads[i].first > loads[i - 1].last,
+         `PT_LOAD ${i} starts on page 0x${loads[i].first.toString(16)}, ` +
+         `which PT_LOAD ${i - 1} already covers`);
+}
diff --git a/test/sea/test-build-sea-vfs-incompatible-options.js b/test/sea/test-build-sea-vfs-incompatible-options.js
new file mode 100644
index 000000000000..3f76beff087d
--- /dev/null
+++ b/test/sea/test-build-sea-vfs-incompatible-options.js
@@ -0,0 +1,77 @@
+// This tests that --build-sea rejects "useVfs" combined with options it
+// does not support.
+
+'use strict';
+
+require('../common');
+const tmpdir = require('../common/tmpdir');
+const { skipIfBuildSEAIsNotSupported } = require('../common/sea');
+const { writeFileSync } = require('fs');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+skipIfBuildSEAIsNotSupported();
+
+// Test: "useVfs" is not a Boolean
+{
+  tmpdir.refresh();
+  const config = tmpdir.resolve('invalid-useVfs.json');
+  writeFileSync(config, `
+{
+  "main": "bundle.js",
+  "output": "sea",
+  "useVfs": "true"
+}
+  `, 'utf8');
+  spawnSyncAndAssert(
+    process.execPath,
+    ['--build-sea', config], {
+      cwd: tmpdir.path,
+    }, {
+      status: 1,
+      stderr: /"useVfs" field of .*invalid-useVfs\.json is not a Boolean/,
+    });
+}
+
+// Test: "useVfs" with "useSnapshot"
+{
+  tmpdir.refresh();
+  const config = tmpdir.resolve('vfs-snapshot.json');
+  writeFileSync(config, `
+{
+  "main": "bundle.js",
+  "output": "sea",
+  "useVfs": true,
+  "useSnapshot": true
+}
+  `, 'utf8');
+  spawnSyncAndAssert(
+    process.execPath,
+    ['--build-sea', config], {
+      cwd: tmpdir.path,
+    }, {
+      status: 1,
+      stderr: /"useVfs" is not supported when "useSnapshot" is true/,
+    });
+}
+
+// Test: "useVfs" with "useCodeCache"
+{
+  tmpdir.refresh();
+  const config = tmpdir.resolve('vfs-code-cache.json');
+  writeFileSync(config, `
+{
+  "main": "bundle.js",
+  "output": "sea",
+  "useVfs": true,
+  "useCodeCache": true
+}
+  `, 'utf8');
+  spawnSyncAndAssert(
+    process.execPath,
+    ['--build-sea', config], {
+      cwd: tmpdir.path,
+    }, {
+      status: 1,
+      stderr: /"useVfs" is not supported when "useCodeCache" is true/,
+    });
+}
diff --git a/test/sea/test-single-executable-application-vfs-esm.js b/test/sea/test-single-executable-application-vfs-esm.js
new file mode 100644
index 000000000000..b591f6e9d62b
--- /dev/null
+++ b/test/sea/test-single-executable-application-vfs-esm.js
@@ -0,0 +1,39 @@
+'use strict';
+
+// This tests the SEA VFS integration with an ESM entry point - the bundled
+// assets are mounted as a virtual file system and the ESM main script runs
+// from inside the mount through the ESM loader.
+
+require('../common');
+
+const {
+  buildSEA,
+  skipIfBuildSEAIsNotSupported,
+} = require('../common/sea');
+
+skipIfBuildSEAIsNotSupported();
+
+const tmpdir = require('../common/tmpdir');
+const { spawnSyncAndAssert } = require('../common/child_process');
+const fixtures = require('../common/fixtures');
+
+tmpdir.refresh();
+const outputFile = buildSEA(fixtures.path('sea', 'vfs-esm'));
+
+spawnSyncAndAssert(
+  outputFile,
+  {
+    env: {
+      ...process.env,
+      NODE_DEBUG_NATIVE: undefined,
+    },
+  },
+  {
+    stdout: /All SEA VFS ESM tests passed!/,
+    stderr(stderr) {
+      if (/ExperimentalWarning: VirtualFileSystem/.test(stderr)) {
+        throw new Error('SEA VFS should not emit the public VirtualFileSystem warning');
+      }
+    },
+  },
+);
diff --git a/test/sea/test-single-executable-application-vfs.js b/test/sea/test-single-executable-application-vfs.js
new file mode 100644
index 000000000000..46a50cd79f86
--- /dev/null
+++ b/test/sea/test-single-executable-application-vfs.js
@@ -0,0 +1,38 @@
+'use strict';
+
+// This tests the SEA VFS integration - the bundled assets are mounted as a
+// virtual file system and the main script runs from inside the mount.
+
+require('../common');
+
+const {
+  buildSEA,
+  skipIfBuildSEAIsNotSupported,
+} = require('../common/sea');
+
+skipIfBuildSEAIsNotSupported();
+
+const tmpdir = require('../common/tmpdir');
+const { spawnSyncAndAssert } = require('../common/child_process');
+const fixtures = require('../common/fixtures');
+
+tmpdir.refresh();
+const outputFile = buildSEA(fixtures.path('sea', 'vfs'));
+
+spawnSyncAndAssert(
+  outputFile,
+  {
+    env: {
+      ...process.env,
+      NODE_DEBUG_NATIVE: undefined,
+    },
+  },
+  {
+    stdout: /All SEA VFS tests passed!/,
+    stderr(stderr) {
+      if (/ExperimentalWarning: VirtualFileSystem/.test(stderr)) {
+        throw new Error('SEA VFS should not emit the public VirtualFileSystem warning');
+      }
+    },
+  },
+);
diff --git a/test/sea/test-single-executable-application.js b/test/sea/test-single-executable-application.js
index f9f92958921f..ae49156451a3 100644
--- a/test/sea/test-single-executable-application.js
+++ b/test/sea/test-single-executable-application.js
@@ -3,11 +3,11 @@
 require('../common');
 
 const {
-  generateSEA,
-  skipIfSingleExecutableIsNotSupported,
+  buildSEA,
+  skipIfBuildSEAIsNotSupported,
 } = require('../common/sea');
 
-skipIfSingleExecutableIsNotSupported();
+skipIfBuildSEAIsNotSupported();
 
 // This tests the creation of a single executable application.
 
@@ -18,7 +18,7 @@ const fixtures = require('../common/fixtures');
 
 tmpdir.refresh();
 
-const outputFile = generateSEA(fixtures.path('sea', 'simple'));
+const outputFile = buildSEA(fixtures.path('sea', 'simple'));
 
 spawnSyncAndAssert(
   outputFile,
diff --git a/test/sequential/test-async-wrap-getasyncid.js b/test/sequential/test-async-wrap-getasyncid.js
index ef48f457a878..0842f8fdfa98 100644
--- a/test/sequential/test-async-wrap-getasyncid.js
+++ b/test/sequential/test-async-wrap-getasyncid.js
@@ -76,6 +76,8 @@ const { getSystemErrorName } = require('util');
     delete providers.QUIC_SESSION;
     delete providers.QUIC_STREAM;
     delete providers.LOCKS;
+    delete providers.DTLS_ENDPOINT;
+    delete providers.DTLS_SESSION;
 
     const objKeys = Object.keys(providers);
     if (objKeys.length > 0)
diff --git a/test/sequential/test-dtls-interop-openssl-client.mjs b/test/sequential/test-dtls-interop-openssl-client.mjs
new file mode 100644
index 000000000000..580cc0401a18
--- /dev/null
+++ b/test/sequential/test-dtls-interop-openssl-client.mjs
@@ -0,0 +1,103 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: DTLS interop -- Node.js DTLS server with OpenSSL s_client.
+// Verifies that an external DTLS client (OpenSSL CLI) can complete a
+// handshake with Node's DTLS server and exchange application data.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import { createRequire } from 'module';
+import assert from 'node:assert';
+import { spawn } from 'node:child_process';
+import { setTimeout as sleep } from 'node:timers/promises';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const require = createRequire(import.meta.url);
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
+  skip('missing openssl-cli');
+}
+
+const { listen } = await import('node:dtls');
+
+const reply = 'I AM THE WALRUS'; // Something recognizable
+const serverReceivedData = Promise.withResolvers();
+
+// Start Node.js DTLS server.
+const endpoint = listen(mustCall((session) => {
+  session.onmessage = mustCall((data) => {
+    assert.strictEqual(data.toString().trim(), 'hello from openssl');
+    session.send(reply);
+    serverReceivedData.resolve();
+  });
+  session.onhandshake = mustCall();
+}), {
+  cert: fixtures.readKey('agent1-cert.pem').toString(),
+  key: fixtures.readKey('agent1-key.pem').toString(),
+  port: 0,
+  host: '127.0.0.1',
+});
+
+const { port } = endpoint.address;
+
+// Spawn OpenSSL s_client to connect to the Node.js server.
+const args = [
+  's_client',
+  '-dtls',
+  '-connect', `127.0.0.1:${port}`,
+  '-CAfile', fixtures.path('keys/ca1-cert.pem'),
+];
+
+const client = spawn(opensslCli, args, { stdio: 'pipe' });
+
+let stdout = '';
+client.stdout.on('data', (data) => { stdout += data; });
+
+let stderr = '';
+client.stderr.on('data', (data) => { stderr += data; });
+
+const timeout = setTimeout(() => {
+  client.kill();
+  endpoint.close();
+  assert.fail('Test timed out');
+}, 10000);
+
+// Wait for the handshake to start (s_client writes TLS info to stdout),
+// then send data.
+await new Promise((resolve) => client.stdout.once('data', resolve));
+await sleep(500);
+
+client.stdin.write('hello from openssl\n');
+
+// Wait for the server to receive and reply.
+await serverReceivedData.promise;
+await sleep(500);
+
+// Close stdin so s_client exits.
+client.stdin.end();
+
+// Wait for s_client to exit.
+const code = await new Promise((resolve) => client.on('close', resolve));
+clearTimeout(timeout);
+
+// s_client should exit cleanly.
+assert.strictEqual(code, 0,
+                   `openssl s_client exited with code ${code}\n${stderr}`);
+
+// Verify the reply from Node's server appeared in s_client's stdout.
+assert(stdout.includes(reply),
+       `Expected stdout to include "${reply}"\n${stdout}`);
+
+// Verify it was a DTLS connection.
+assert(stdout.includes('DTLS'),
+       `Expected stdout to include "DTLS"\n${stdout}`);
+
+await endpoint.close();
diff --git a/test/sequential/test-dtls-interop-openssl-server.mjs b/test/sequential/test-dtls-interop-openssl-server.mjs
new file mode 100644
index 000000000000..26e66710611f
--- /dev/null
+++ b/test/sequential/test-dtls-interop-openssl-server.mjs
@@ -0,0 +1,95 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: DTLS interop -- OpenSSL s_server with Node.js DTLS client.
+// Verifies that Node's DTLS client can complete a handshake with an
+// external DTLS server (OpenSSL CLI) and exchange application data.
+
+import { hasCrypto, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import { createRequire } from 'module';
+import assert from 'node:assert';
+import { spawn } from 'node:child_process';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const require = createRequire(import.meta.url);
+const common = require('../common');
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
+  skip('missing openssl-cli');
+}
+
+const { connect } = await import('node:dtls');
+
+const reply = 'I AM THE WALRUS'; // Something recognizable
+
+// Start OpenSSL DTLS server.
+const server = spawn(opensslCli, [
+  's_server',
+  '-dtls1_2',
+  '-accept', String(common.PORT),
+  '-cert', fixtures.path('keys/agent1-cert.pem'),
+  '-key', fixtures.path('keys/agent1-key.pem'),
+  '-listen',
+], { stdio: 'pipe' });
+
+let serverOut = '';
+server.stdout.on('data', (data) => { serverOut += data; });
+let serverErr = '';
+server.stderr.on('data', (data) => { serverErr += data; });
+server.on('error', mustNotCall());
+
+const timeout = setTimeout(() => {
+  server.kill();
+  assert.fail(`Test timed out\nstdout: ${serverOut}\nstderr: ${serverErr}`);
+}, 10000);
+
+// Wait for "ACCEPT" on stdout -- this means s_server is ready.
+await new Promise((resolve) => {
+  server.stdout.on('data', function onReady() {
+    if (!serverOut.includes('ACCEPT')) return;
+    server.stdout.removeListener('data', onReady);
+    resolve();
+  });
+});
+
+// Connect Node.js DTLS client.
+const session = connect('127.0.0.1', common.PORT, {
+  ca: [fixtures.readKey('ca1-cert.pem').toString()],
+  rejectUnauthorized: false,
+});
+
+const { protocol } = await session.opened;
+assert.match(protocol, /DTLS/i);
+
+// Send data from Node to OpenSSL server.
+session.send('hello from node');
+
+// Send data from OpenSSL server to Node client via s_server stdin.
+// s_server forwards its stdin to the connected client.
+server.stdin.write(reply + '\n');
+
+// Wait for Node client to receive the message.
+const data = await new Promise((resolve) => {
+  session.onmessage = mustCall(resolve);
+});
+assert.strictEqual(data.toString().trim(), reply);
+
+// Clean up.
+await session.close();
+await session.endpoint.close();
+clearTimeout(timeout);
+server.kill();
+
+// Wait for server to exit.
+const [, signal] = await new Promise((resolve) => {
+  server.on('exit', mustCall((...args) => resolve(args)));
+});
+assert.strictEqual(signal, 'SIGTERM');
diff --git a/test/sequential/test-error-serdes.js b/test/sequential/test-error-serdes.js
index acd08903efab..75a37b376ca1 100644
--- a/test/sequential/test-error-serdes.js
+++ b/test/sequential/test-error-serdes.js
@@ -39,6 +39,10 @@ assert.strictEqual(cycle(new ReferenceError('foo')).name, 'ReferenceError');
 assert.strictEqual(cycle(new URIError('foo')).name, 'URIError');
 assert.strictEqual(cycle(new EvalError('foo')).name, 'EvalError');
 assert.strictEqual(cycle(new SyntaxError('foo')).name, 'SyntaxError');
+const aggregate = cycle(new AggregateError([new Error('inner')], 'aggregate'));
+assert(aggregate instanceof AggregateError);
+assert.strictEqual(aggregate.message, 'aggregate');
+assert.strictEqual(aggregate.errors[0].message, 'inner');
 
 class SubError extends Error {}
 
diff --git a/test/wpt/README.md b/test/wpt/README.md
index aba1b8617f90..ac96e3b247ba 100644
--- a/test/wpt/README.md
+++ b/test/wpt/README.md
@@ -12,6 +12,50 @@ declares build requirements, expected failures, and tests to skip.
 See [`test/fixtures/wpt/README.md`][] for the pinned WPT commit
 hashes for each module.
 
+## Running tests
+
+Run a WPT module through the Python test runner:
+
+```bash
+tools/test.py wpt/test-url
+```
+
+Pass a source file to its module runner to run all globals and variants
+generated from that file:
+
+```bash
+node test/wpt/test-url.js url-searchparams.any.js
+```
+
+Pass a generated path, as printed in the test output, to run only that test:
+
+```bash
+node test/wpt/test-url.js 'url/url-searchparams.any.html'
+```
+
+### Execution backends
+
+By default, each test runs in a worker thread. Set `WPT_BACKEND=process` to run
+tests in child processes instead:
+
+```bash
+WPT_BACKEND=process tools/test.py wpt
+```
+
+### Debugging a test
+
+Set `WPT_INSPECT=1` to run one generated main-thread test in a child process
+with `--inspect-brk` on an available port:
+
+```bash
+WPT_INSPECT=1 out/Release/node test/wpt/test-compression.js \
+  'compression/compression-bad-chunks.any.html'
+```
+
+Connect an inspector client to the URL printed on stderr. A source file that
+generates multiple tests is rejected with the exact paths to choose from.
+Worker tests are not supported by inspect mode.
+
 <a id="add-tests"></a>
 
 ## How to add tests for a new module
@@ -53,8 +97,8 @@ runner.runJsTests();
 ```
 
 The runner loads the tests from `test/fixtures/wpt/url`, applies the
-status rules from `test/wpt/status/url.cjs`, and runs them using
-worker threads.
+status rules from `test/wpt/status/url.cjs`, and runs them using the
+selected backend.
 
 #### `new WPTRunner(path[, options])`
 
@@ -64,15 +108,18 @@ worker threads.
   * `concurrency` {number} Number of tests to run in parallel.
     Defaults to `os.availableParallelism() - 1`. Set to `1` for tests
     that require sequential execution (e.g. web-locks, webstorage).
+  * `backend` {string} Test execution backend. Must be either `'thread'` or
+    `'process'`. Defaults to `'thread'`. `WPT_BACKEND` overrides this option.
+    `WPT_INSPECT` always uses `'process'`.
 
 #### `runner.setFlags(flags)`
 
-* `flags` {string\[]} Node.js CLI flags passed to each worker thread
+* `flags` {string\[]} Node.js CLI flags passed to each test process or worker
   (e.g. `['--expose-internals']`).
 
 #### `runner.setInitScript(script)`
 
-* `script` {string} JavaScript code executed in the worker before
+* `script` {string} JavaScript code executed before
   the tests run. Useful for setting up globals needed by the tests.
 
 #### `runner.setScriptModifier(modifier)`
@@ -94,19 +141,7 @@ Starts running the tests. Must be called last, after all configuration.
 
 ### 4. Run the tests
 
-Run the test using `tools/test.py` and see if there are any failures.
-For example, to run all the URL tests under `test/fixtures/wpt/url`:
-
-```bash
-tools/test.py wpt/test-url
-```
-
-To run a specific test in WPT, for example, `url/url-searchparams.any.js`,
-pass the file name as argument to the corresponding test runner:
-
-```bash
-node test/wpt/test-url.js url-searchparams.any.js
-```
+Run the module as described in [Running tests](#running-tests).
 
 If there are any failures, update the corresponding status file
 (in this case, `test/wpt/status/url.cjs`) to make the test pass.
@@ -201,6 +236,10 @@ that has not been ported to the Node.js runner. Use `fail` instead when
 the test can run but produces incorrect results due to an implementation
 bug or missing feature.
 
+For a multi-global `.any.js` test, a source file key applies to every generated
+test. Use a generated URL key such as `something.any.worker.html` to apply a
+rule only to the dedicated worker test.
+
 ### Skipping individual subtests
 
 To skip specific subtests within a file (rather than skipping the entire file),
diff --git a/test/wpt/status/FileAPI/blob.cjs b/test/wpt/status/FileAPI/blob.cjs
index bf40df1b8425..6f8599dc8b4e 100644
--- a/test/wpt/status/FileAPI/blob.cjs
+++ b/test/wpt/status/FileAPI/blob.cjs
@@ -33,7 +33,4 @@ module.exports = {
       ],
     },
   },
-  'Blob-in-worker.worker.js': {
-    skip: 'Depends on Web Workers API',
-  },
 };
diff --git a/test/wpt/status/dom/events.json b/test/wpt/status/dom/events.json
index 8109e2372adf..f621431c9fc2 100644
--- a/test/wpt/status/dom/events.json
+++ b/test/wpt/status/dom/events.json
@@ -21,9 +21,6 @@
   "event-global-set-before-handleEvent-lookup.window.js": {
     "skip": "window is not defined"
   },
-  "event-global.worker.js": {
-    "skip": "importScripts is not defined"
-  },
   "legacy-pre-activation-behavior.window.js": {
     "skip": "document is not defined"
   },
diff --git a/test/wpt/status/hr-time.cjs b/test/wpt/status/hr-time.cjs
index c426eeeb8e92..35b82c87a1ea 100644
--- a/test/wpt/status/hr-time.cjs
+++ b/test/wpt/status/hr-time.cjs
@@ -19,7 +19,7 @@ module.exports = {
     },
   } : {}),
 
-  'idlharness.any.js': {
+  'idlharness.any.html': {
     fail: {
       expected: [
         'Window interface: attribute performance',
diff --git a/test/wpt/status/resource-timing.json b/test/wpt/status/resource-timing.json
index 74de815387ed..0299d6652047 100644
--- a/test/wpt/status/resource-timing.json
+++ b/test/wpt/status/resource-timing.json
@@ -23,25 +23,15 @@
   "idlharness.any.js": {
     "fail": {
       "expected": [
-        "PerformanceResourceTiming interface: attribute firstInterimResponseStart",
-        "PerformanceResourceTiming interface: attribute finalResponseHeadersStart",
-        "PerformanceResourceTiming interface: resource must inherit property \"finalResponseHeadersStart\" with the proper type",
-        "PerformanceResourceTiming interface: attribute renderBlockingStatus",
-        "PerformanceResourceTiming interface: attribute contentType",
-        "PerformanceResourceTiming interface: resource must inherit property \"firstInterimResponseStart\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"renderBlockingStatus\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"contentType\" with the proper type",
         "PerformanceResourceTiming interface: default toJSON operation on resource",
         "PerformanceResourceTiming interface: attribute workerRouterEvaluationStart",
         "PerformanceResourceTiming interface: attribute workerCacheLookupStart",
         "PerformanceResourceTiming interface: attribute workerMatchedRouterSource",
         "PerformanceResourceTiming interface: attribute workerFinalRouterSource",
-        "PerformanceResourceTiming interface: attribute contentEncoding",
         "PerformanceResourceTiming interface: resource must inherit property \"workerRouterEvaluationStart\" with the proper type",
         "PerformanceResourceTiming interface: resource must inherit property \"workerCacheLookupStart\" with the proper type",
         "PerformanceResourceTiming interface: resource must inherit property \"workerMatchedRouterSource\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"workerFinalRouterSource\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"contentEncoding\" with the proper type"
+        "PerformanceResourceTiming interface: resource must inherit property \"workerFinalRouterSource\" with the proper type"
       ]
     }
   }
diff --git a/test/wpt/status/streams.json b/test/wpt/status/streams.json
index 968b33597651..5be444999b00 100644
--- a/test/wpt/status/streams.json
+++ b/test/wpt/status/streams.json
@@ -8,7 +8,14 @@
   "readable-streams/cross-realm-crash.window.js": {
     "skip": "Browser-specific test"
   },
-  "readable-streams/owning-type-message-port.any.js": {
+  "readable-streams/from.any.js": {
+    "fail": {
+      "expected": [
+        "ReadableStream.from throws on invalid iterables; specifically a string"
+      ]
+    }
+  },
+  "readable-streams/owning-type-message-port.tentative.any.js": {
     "fail": {
       "note": "Readable streams with type owning are not yet supported",
       "expected": [
@@ -17,10 +24,10 @@
       ]
     }
   },
-  "readable-streams/owning-type-video-frame.any.js": {
+  "readable-streams/owning-type-video-frame.tentative.any.js": {
     "skip": "Browser-specific test"
   },
-  "readable-streams/owning-type.any.js": {
+  "readable-streams/owning-type.tentative.any.js": {
     "fail": {
       "note": "Readable streams with type owning are not yet supported",
       "expected": [
diff --git a/test/wpt/status/url.cjs b/test/wpt/status/url.cjs
index d7cd8a8666b2..1ee0ce90071b 100644
--- a/test/wpt/status/url.cjs
+++ b/test/wpt/status/url.cjs
@@ -1,7 +1,7 @@
 'use strict';
 
 module.exports = {
-  'historical.any.js': {
+  'historical.any.html': {
     'fail': {
       'expected': [
         'searchParams on location object',
diff --git a/test/wpt/status/webidl.json b/test/wpt/status/webidl.json
index 26a6e44f4841..8dcbe1b247c8 100644
--- a/test/wpt/status/webidl.json
+++ b/test/wpt/status/webidl.json
@@ -6,6 +6,18 @@
       ]
     }
   },
+  "ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js": {
+    "fail": {
+      "note": "needs a V8 update, see https://github.com/nodejs/node/issues/63579",
+      "expected": [
+        "DOMException instance does not have an own stack property",
+        "Error.prototype.stack is an accessor property with correct attributes",
+        "Error.prototype.stack getter works on DOMException instances",
+        "Error.prototype.stack setter installs own data property on DOMException instances",
+        "Error.prototype.stack setter ignores Error.prototype itself"
+      ]
+    }
+  },
   "ecmascript-binding/global-immutable-prototype.any.js": {
     "fail": {
       "expected": [
@@ -27,11 +39,24 @@
         "Global object's setter throws when called on incompatible object",
         "Global object's operation throws when called on incompatible object",
         "Global object's getter works when called on null / undefined",
-        "Global object's setter works when called on null / undefined",
+        "Global object's setter works when called on null / undefined"
+      ]
+    }
+  },
+  "ecmascript-binding/global-object-implicit-this-value.any.html": {
+    "fail": {
+      "expected": [
         "ReferenceError: addEventListener is not defined"
       ]
     }
   },
+  "ecmascript-binding/global-object-implicit-this-value.any.worker.html": {
+    "fail": {
+      "expected": [
+        "Global object's operation works when called on null / undefined"
+      ]
+    }
+  },
   "ecmascript-binding/legacy-factor-function-subclass.window.js": {
     "fail": {
       "expected": [
@@ -46,7 +71,7 @@
       ]
     }
   },
-  "ecmascript-binding/no-regexp-special-casing.any.js": {
+  "ecmascript-binding/no-regexp-special-casing.any.html": {
     "fail": {
       "expected": [
         "Can be used as an object implementing a callback interface"
diff --git a/test/wpt/status/workers.json b/test/wpt/status/workers.json
new file mode 100644
index 000000000000..015ac98d0084
--- /dev/null
+++ b/test/wpt/status/workers.json
@@ -0,0 +1,170 @@
+{
+  "SharedWorker-MessageEvent-source.any.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "SharedWorker-replace-EventHandler.any.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "Worker-location.sub.any.js": {
+    "skip": "Server substitution (.sub) is not supported"
+  },
+  "WorkerLocation-origin.sub.window.js": {
+    "skip": "Needs a document and a WPT server"
+  },
+  "constructors/Worker/AbstractWorker.onerror.js": {
+    "skip": "Not a test file; used as a worker script by .html tests"
+  },
+  "constructors/Worker/expected-self-properties.worker.js": {
+    "fail": {
+      "note": "XMLHttpRequest and EventSource are not implemented",
+      "expected": [
+        "existence of XMLHttpRequest",
+        "existence of EventSource"
+      ]
+    }
+  },
+  "dedicated-worker-from-blob-url.window.js": {
+    "note": "crypto.randomUUID() is used to generate blob URL identifiers",
+    "requires": ["crypto"]
+  },
+  "dedicated-worker-in-data-url-context.window.js": {
+    "skip": "Needs a document to create iframes"
+  },
+  "examples/onconnect.any.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "importscripts_mime.any.js": {
+    "skip": "Needs a WPT server to serve scripts with arbitrary MIME types"
+  },
+  "importscripts_mime_local.any.js": {
+    "note": "crypto.randomUUID() is used to generate blob URL identifiers",
+    "requires": ["crypto"]
+  },
+  "interfaces/WorkerUtils/importScripts/catch.sub.any.js": {
+    "skip": "Needs a WPT server; tests cross-origin importScripts()"
+  },
+  "interfaces/WorkerUtils/importScripts/blob-url.worker.js": {
+    "note": "crypto.randomUUID() is used to generate blob URL identifiers",
+    "requires": ["crypto"]
+  },
+  "interfaces/WorkerUtils/importScripts/report-error-cross-origin.sub.any.js": {
+    "skip": "Needs a WPT server; tests cross-origin importScripts()"
+  },
+  "interfaces/WorkerUtils/importScripts/report-error-redirect-to-cross-origin.sub.any.js": {
+    "skip": "Needs a WPT server; tests cross-origin importScripts()"
+  },
+  "interfaces/WorkerUtils/importScripts/report-error-same-origin.sub.any.js": {
+    "skip": "Needs a WPT server; tests cross-origin importScripts()"
+  },
+  "interfaces/WorkerUtils/importScripts/report-error-setTimeout-cross-origin.sub.any.js": {
+    "skip": "Needs a WPT server; tests cross-origin importScripts()"
+  },
+  "interfaces/WorkerUtils/importScripts/report-error-setTimeout-redirect-to-cross-origin.sub.any.js": {
+    "skip": "Needs a WPT server; tests cross-origin importScripts()"
+  },
+  "interfaces/WorkerUtils/importScripts/report-error-setTimeout-same-origin.sub.any.js": {
+    "skip": "Needs a WPT server; tests cross-origin importScripts()"
+  },
+  "modules/dedicated-worker-import-blob-url.any.js": {
+    "skip": "Modules are imported from http(s): URLs served by a WPT server"
+  },
+  "modules/dedicated-worker-import-data-url.any.js": {
+    "skip": "Modules are imported from http(s): URLs served by a WPT server"
+  },
+  "modules/dedicated-worker-import.any.js": {
+    "fail": {
+      "note": "Needs a WPT server; tests cross-origin and redirected imports",
+      "expected": [
+        "Static import (cross-origin).",
+        "Static import (redirect)."
+      ]
+    }
+  },
+  "modules/shared-worker-import-blob-url.window.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "modules/shared-worker-import-data-url.window.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "modules/shared-worker-import.window.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "nested_worker_sync_xhr.worker.js": {
+    "skip": "XMLHttpRequest is not implemented"
+  },
+  "same-site-cookies/first-party.all.tentative.https.window.js": {
+    "skip": "Needs a document and an https WPT server"
+  },
+  "same-site-cookies/first-party.default.tentative.https.window.js": {
+    "skip": "Needs a document and an https WPT server"
+  },
+  "same-site-cookies/first-party.none.tentative.https.window.js": {
+    "skip": "Needs a document and an https WPT server"
+  },
+  "same-site-cookies/third-party.all.tentative.sub.https.window.js": {
+    "skip": "Needs a document and an https WPT server"
+  },
+  "same-site-cookies/third-party.default.tentative.sub.https.window.js": {
+    "skip": "Needs a document and an https WPT server"
+  },
+  "same-site-cookies/third-party.none.tentative.sub.https.window.js": {
+    "skip": "Needs a document and an https WPT server"
+  },
+  "semantics/interface-objects/001.worker.js": {
+    "fail": {
+      "note": "Canvas, XHR, EventSource, PromiseRejectionEvent, ProgressEvent, the File API reader classes and IndexedDB are not implemented",
+      "expected": [
+        "The ImageData interface object should be exposed.",
+        "The ImageBitmap interface object should be exposed.",
+        "The CanvasGradient interface object should be exposed.",
+        "The CanvasPattern interface object should be exposed.",
+        "The TextMetrics interface object should be exposed.",
+        "The Path2D interface object should be exposed.",
+        "The PromiseRejectionEvent interface object should be exposed.",
+        "The EventSource interface object should be exposed.",
+        "The XMLHttpRequestEventTarget interface object should be exposed.",
+        "The XMLHttpRequestUpload interface object should be exposed.",
+        "The XMLHttpRequest interface object should be exposed.",
+        "The ProgressEvent interface object should be exposed.",
+        "The FileList interface object should be exposed.",
+        "The FileReader interface object should be exposed.",
+        "The FileReaderSync interface object should be exposed.",
+        "The IDBRequest interface object should be exposed.",
+        "The IDBOpenDBRequest interface object should be exposed.",
+        "The IDBVersionChangeEvent interface object should be exposed.",
+        "The IDBFactory interface object should be exposed.",
+        "The IDBDatabase interface object should be exposed.",
+        "The IDBObjectStore interface object should be exposed.",
+        "The IDBIndex interface object should be exposed.",
+        "The IDBKeyRange interface object should be exposed.",
+        "The IDBCursor interface object should be exposed.",
+        "The IDBCursorWithValue interface object should be exposed.",
+        "The IDBTransaction interface object should be exposed."
+      ]
+    }
+  },
+  "semantics/interface-objects/003.any.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "semantics/interface-objects/004.any.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "shared-worker-from-blob-url.window.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "shared-worker-in-data-url-context.window.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "worker-performance.worker.js": {
+    "fail": {
+      "note": "XMLHttpRequest is not implemented",
+      "expected": [
+        "Resource timing seems to work in workers",
+        "performance.setResourceTimingBufferSize in workers"
+      ]
+    }
+  },
+  "WorkerGlobalScope_requestAnimationFrame.worker.js": {
+    "skip": "requestAnimationFrame is not implemented in workers"
+  }
+}
diff --git a/test/wpt/test-compression.js b/test/wpt/test-compression.js
index 23800734922a..404cb23687ca 100644
--- a/test/wpt/test-compression.js
+++ b/test/wpt/test-compression.js
@@ -2,7 +2,8 @@
 
 const { WPTRunner } = require('../common/wpt');
 
-const runner = new WPTRunner('compression');
+// Runs each spec in its own process; this suite has crashed the runner in CI.
+const runner = new WPTRunner('compression', { backend: 'process' });
 
 runner.pretendGlobalThisAs('Window');
 
diff --git a/test/wpt/test-hr-time.js b/test/wpt/test-hr-time.js
index 9e7303d3e20c..13b35e3ac139 100644
--- a/test/wpt/test-hr-time.js
+++ b/test/wpt/test-hr-time.js
@@ -5,7 +5,9 @@ const { WPTRunner } = require('../common/wpt');
 const runner = new WPTRunner('hr-time');
 
 runner.setInitScript(`
-  self.GLOBAL.isWorker = () => false;
+  if (!globalThis.DedicatedWorkerGlobalScope) {
+    self.GLOBAL.isWorker = () => false;
+  }
 `);
 runner.pretendGlobalThisAs('Window');
 
diff --git a/test/wpt/test-streams.js b/test/wpt/test-streams.js
index 71c25fbd56b2..e9d23348db07 100644
--- a/test/wpt/test-streams.js
+++ b/test/wpt/test-streams.js
@@ -2,7 +2,8 @@
 
 const { WPTRunner } = require('../common/wpt');
 
-const runner = new WPTRunner('streams');
+// Runs each spec in its own process; this suite has crashed the runner in CI.
+const runner = new WPTRunner('streams', { backend: 'process' });
 
 // Set a script that will be executed in the worker before running the tests.
 runner.pretendGlobalThisAs('Window');
diff --git a/test/wpt/test-wasm-jsapi.mjs b/test/wpt/test-wasm-jsapi.mjs
index 4e53da5bdd88..67050e67cf7b 100644
--- a/test/wpt/test-wasm-jsapi.mjs
+++ b/test/wpt/test-wasm-jsapi.mjs
@@ -15,7 +15,8 @@ try {
 }
 
 if (supportsSimd) {
-  const runner = new WPTRunner('wasm/jsapi');
+  // Runs each spec in its own process; this suite has crashed the runner in CI.
+  const runner = new WPTRunner('wasm/jsapi', { backend: 'process' });
   runner.setFlags(['--experimental-wasm-modules']);
 
   runner.runJsTests();
diff --git a/test/wpt/test-webcrypto.js b/test/wpt/test-webcrypto.js
index 409b94451ba1..a435d429af9f 100644
--- a/test/wpt/test-webcrypto.js
+++ b/test/wpt/test-webcrypto.js
@@ -6,7 +6,8 @@ if (!common.hasCrypto)
 
 const { WPTRunner } = require('../common/wpt');
 
-const runner = new WPTRunner('WebCryptoAPI');
+// Runs each spec in its own process; this suite has crashed the runner in CI.
+const runner = new WPTRunner('WebCryptoAPI', { backend: 'process' });
 
 // Experimental warnings drown out the actual test output.
 runner.setFlags(['--disable-warning=ExperimentalWarning']);
diff --git a/test/wpt/test-workers.js b/test/wpt/test-workers.js
new file mode 100644
index 000000000000..21ec86057b6e
--- /dev/null
+++ b/test/wpt/test-workers.js
@@ -0,0 +1,9 @@
+'use strict';
+
+require('../common');
+const { WPTRunner } = require('../common/wpt');
+
+const runner = new WPTRunner('workers');
+
+runner.pretendGlobalThisAs('Window');
+runner.runJsTests();
diff --git a/tools/eslint-rules/no-crypto-class-instanceof.js b/tools/eslint-rules/no-crypto-class-instanceof.js
new file mode 100644
index 000000000000..e54bfc0299cc
--- /dev/null
+++ b/tools/eslint-rules/no-crypto-class-instanceof.js
@@ -0,0 +1,179 @@
+/**
+ * @file Prevent internal code from brand-checking crypto classes with
+ *   instanceof.
+ */
+'use strict';
+
+const { isRequireCall, isString } = require('./rules-utils.js');
+
+const moduleClasses = new Map([
+  ['internal/crypto/keys', new Set([
+    'KeyObject',
+    'SecretKeyObject',
+    'AsymmetricKeyObject',
+    'PublicKeyObject',
+    'PrivateKeyObject',
+    'CryptoKey',
+    'InternalCryptoKey',
+  ])],
+  ['internal/crypto/webcrypto', new Set(['CryptoKey'])],
+  ['internal/crypto/x509', new Set([
+    'X509Certificate',
+    'InternalX509Certificate',
+  ])],
+]);
+
+const knownClassNames = new Set();
+for (const classes of moduleClasses.values()) {
+  for (const name of classes) knownClassNames.add(name);
+}
+
+function getRequiredModule(node) {
+  if (node?.type !== 'CallExpression' ||
+      !isRequireCall(node) ||
+      !isString(node.arguments[0])) {
+    return undefined;
+  }
+  return node.arguments[0].value;
+}
+
+function getPropertyName(node) {
+  if (!node) return undefined;
+  if (node.computed) {
+    return node.property.type === 'Literal' ? node.property.value : undefined;
+  }
+  return node.property.name;
+}
+
+module.exports = {
+  meta: {
+    messages: {
+      noCryptoClassInstanceof:
+        'Do not use `instanceof` to brand-check {{name}}; use its native or private brand.',
+      noCryptoKeyInstanceof:
+        'Use `isCryptoKey(value)` instead of `value instanceof CryptoKey`.',
+      noKeyObjectInstanceof:
+        'Use `isKeyObject(value)` instead of `value instanceof KeyObject`.',
+      noX509CertificateInstanceof:
+        'Use `isX509Certificate(value)` instead of `value instanceof X509Certificate`.',
+    },
+    schema: [],
+  },
+
+  create(context) {
+    const sourceCode = context.sourceCode;
+    const constructorNames = new Map();
+    const namespaceClasses = new Map();
+
+    function registerVariable(node, name, map, value) {
+      const variables = sourceCode.scopeManager.getDeclaredVariables(node);
+      for (const variable of variables) {
+        if (variable.name === name) map.set(variable, value);
+      }
+    }
+
+    function resolveVariable(node) {
+      let scope = sourceCode.getScope(node);
+      while (scope !== null) {
+        const variable = scope.set.get(node.name);
+        if (variable !== undefined) return variable;
+        scope = scope.upper;
+      }
+      return undefined;
+    }
+
+    function isGlobalReference(node) {
+      const variable = resolveVariable(node);
+      return variable === undefined || variable.defs.length === 0;
+    }
+
+    function registerRequire(node) {
+      const module = getRequiredModule(node.init);
+      const classes = moduleClasses.get(module);
+      if (classes === undefined) return;
+
+      if (node.id.type === 'Identifier') {
+        registerVariable(node, node.id.name, namespaceClasses, classes);
+        return;
+      }
+
+      if (node.id.type !== 'ObjectPattern') return;
+      for (const property of node.id.properties) {
+        if (property.type !== 'Property' ||
+            property.value.type !== 'Identifier') {
+          continue;
+        }
+        const importedName = property.key.name ?? property.key.value;
+        if (classes.has(importedName)) {
+          registerVariable(
+            node, property.value.name, constructorNames, importedName);
+        }
+      }
+    }
+
+    function declarationName(variable) {
+      if (!knownClassNames.has(variable.name)) return undefined;
+      for (const definition of variable.defs) {
+        if (definition.type === 'ClassName' ||
+            definition.type === 'FunctionName') {
+          return variable.name;
+        }
+      }
+      return undefined;
+    }
+
+    function constructorName(node) {
+      if (node.type === 'Identifier') {
+        const variable = resolveVariable(node);
+        if (variable !== undefined) {
+          const name = constructorNames.get(variable) ??
+            declarationName(variable);
+          if (name !== undefined) return name;
+        }
+        if (node.name === 'CryptoKey' && isGlobalReference(node)) {
+          return 'CryptoKey';
+        }
+        return undefined;
+      }
+      if (node.type !== 'MemberExpression') return undefined;
+
+      const property = getPropertyName(node);
+      if (node.object.type !== 'Identifier') return undefined;
+      if (node.object.name === 'globalThis' &&
+          property === 'CryptoKey' &&
+          isGlobalReference(node.object)) {
+        return 'CryptoKey';
+      }
+
+      const variable = resolveVariable(node.object);
+      const classes = namespaceClasses.get(variable);
+      return classes?.has(property) ? property : undefined;
+    }
+
+    return {
+      VariableDeclarator: registerRequire,
+
+      BinaryExpression(node) {
+        if (node.operator !== 'instanceof') return;
+
+        const name = constructorName(node.right);
+        if (name === undefined) return;
+
+        let messageId = 'noCryptoClassInstanceof';
+        if (name === 'CryptoKey' || name === 'InternalCryptoKey') {
+          messageId = 'noCryptoKeyInstanceof';
+        } else if (name.endsWith('KeyObject')) {
+          messageId = 'noKeyObjectInstanceof';
+        } else if (name.endsWith('X509Certificate')) {
+          messageId = 'noX509CertificateInstanceof';
+        }
+
+        context.report({
+          node,
+          messageId,
+          data: { name },
+        });
+      },
+    };
+  },
+};
diff --git a/tools/eslint-rules/no-keyobject-cryptokey-instanceof.js b/tools/eslint-rules/no-keyobject-cryptokey-instanceof.js
deleted file mode 100644
index 19e13437247a..000000000000
--- a/tools/eslint-rules/no-keyobject-cryptokey-instanceof.js
+++ /dev/null
@@ -1,122 +0,0 @@
-/**
- * @file Prevent internal code from brand-checking keys with instanceof.
- */
-'use strict';
-
-const { isRequireCall, isString } = require('./rules-utils.js');
-
-const CRYPTO_KEYS_MODULE = 'internal/crypto/keys';
-const WEBCRYPTO_MODULE = 'internal/crypto/webcrypto';
-
-const keyObjectClassNames = new Set([
-  'KeyObject',
-  'SecretKeyObject',
-  'AsymmetricKeyObject',
-  'PublicKeyObject',
-  'PrivateKeyObject',
-]);
-
-const cryptoKeyClassNames = new Set([
-  'CryptoKey',
-  'InternalCryptoKey',
-]);
-
-function isKeyModuleRequire(node) {
-  return node?.type === 'CallExpression' &&
-         isRequireCall(node) &&
-         isString(node.arguments[0]) &&
-         (node.arguments[0].value === CRYPTO_KEYS_MODULE ||
-          node.arguments[0].value === WEBCRYPTO_MODULE);
-}
-
-function getPropertyName(node) {
-  if (!node) return undefined;
-  if (node.computed) {
-    return node.property.type === 'Literal' ? node.property.value : undefined;
-  }
-  return node.property.name;
-}
-
-module.exports = {
-  meta: {
-    messages: {
-      noKeyObjectInstanceof: 'Use `isKeyObject(value)` instead of `value instanceof KeyObject`.',
-      noCryptoKeyInstanceof: 'Use `isCryptoKey(value)` instead of `value instanceof CryptoKey`.',
-    },
-    schema: [],
-  },
-
-  create(context) {
-    const namespaceNames = new Set();
-    const keyObjectConstructorNames = new Set();
-    const cryptoKeyConstructorNames = new Set(['CryptoKey']);
-
-    function registerRequire(node) {
-      if (!isKeyModuleRequire(node.init)) return;
-
-      if (node.id.type === 'Identifier') {
-        namespaceNames.add(node.id.name);
-        return;
-      }
-
-      if (node.id.type !== 'ObjectPattern') return;
-
-      for (const property of node.id.properties) {
-        if (property.type !== 'Property') continue;
-        const keyName = property.key.name ?? property.key.value;
-        if (property.value.type !== 'Identifier') continue;
-        const localName = property.value.name;
-        if (keyObjectClassNames.has(keyName)) {
-          keyObjectConstructorNames.add(localName);
-        } else if (cryptoKeyClassNames.has(keyName)) {
-          cryptoKeyConstructorNames.add(localName);
-        }
-      }
-    }
-
-    function constructorKind(node) {
-      if (node.type === 'Identifier') {
-        if (keyObjectConstructorNames.has(node.name)) return 'KeyObject';
-        if (cryptoKeyConstructorNames.has(node.name)) return 'CryptoKey';
-        return undefined;
-      }
-
-      if (node.type !== 'MemberExpression') return undefined;
-
-      const property = getPropertyName(node);
-      if (node.object.type === 'Identifier') {
-        if (namespaceNames.has(node.object.name)) {
-          if (keyObjectClassNames.has(property)) return 'KeyObject';
-          if (cryptoKeyClassNames.has(property)) return 'CryptoKey';
-        }
-        if (node.object.name === 'globalThis' &&
-            cryptoKeyClassNames.has(property)) {
-          return 'CryptoKey';
-        }
-      }
-
-      return undefined;
-    }
-
-    return {
-      VariableDeclarator: registerRequire,
-
-      BinaryExpression(node) {
-        if (node.operator !== 'instanceof') return;
-
-        const kind = constructorKind(node.right);
-        if (kind === 'KeyObject') {
-          context.report({
-            node,
-            messageId: 'noKeyObjectInstanceof',
-          });
-        } else if (kind === 'CryptoKey') {
-          context.report({
-            node,
-            messageId: 'noCryptoKeyInstanceof',
-          });
-        }
-      },
-    };
-  },
-};
diff --git a/tools/generate_config_gypi.py b/tools/generate_config_gypi.py
index 436767e633e1..d464d4b5859c 100755
--- a/tools/generate_config_gypi.py
+++ b/tools/generate_config_gypi.py
@@ -68,18 +68,19 @@ def translate_config(out_dir, config, v8_config):
           bool_string_to_number(config['node_enable_inspector']),
       'shlib_suffix': 'dylib' if sys.platform == 'darwin' else 'so',
       'tsan': bool_string_to_number(config['is_tsan']),
-      # TODO(zcbenz): Shared components are not supported in GN config yet.
       'node_shared': 'false',
-      'node_shared_brotli': 'false',
-      'node_shared_cares': 'false',
-      'node_shared_http_parser': 'false',
-      'node_shared_libuv': 'false',
-      'node_shared_nghttp2': 'false',
+      'node_shared_brotli': config['node_shared_brotli'],
+      'node_shared_cares': config['node_shared_cares'],
+      'node_shared_hdr_histogram': config['node_shared_hdr_histogram'],
+      'node_shared_http_parser': config['node_shared_http_parser'],
+      'node_shared_libuv': config['node_shared_libuv'],
+      'node_shared_nghttp2': config['node_shared_nghttp2'],
       'node_shared_nghttp3': 'false',
       'node_shared_ngtcp2': 'false',
       'node_shared_openssl': 'false',
-      'node_shared_sqlite': 'false',
+      'node_shared_sqlite': config['node_shared_sqlite'],
       'node_shared_zlib': 'false',
+      'node_shared_zstd': config['node_shared_zstd'],
     }
   }
   config_gypi['variables'].update(v8_config)
diff --git a/tools/license-builder.sh b/tools/license-builder.sh
index d4f4382ca655..e758857390c1 100755
--- a/tools/license-builder.sh
+++ b/tools/license-builder.sh
@@ -120,10 +120,6 @@ addlicense "gtest" "deps/googletest" "$licenseText"
 licenseText="$(cat "${rootdir}/deps/nghttp2/COPYING")"
 addlicense "nghttp2" "deps/nghttp2" "$licenseText"
 
-# large_pages
-licenseText="$(sed -e '/SPDX-License-Identifier/,$d' -e 's/^\/\///' "${rootdir}/src/large_pages/node_large_page.h")"
-addlicense "large_pages" "src/large_pages" "$licenseText"
-
 # deep_freeze
 licenseText="$(sed -e '/SPDX-License-Identifier/,$d' -e 's/^\/\///' "${rootdir}/lib/internal/freeze_intrinsics.js")"
 addlicense "caja" "lib/internal/freeze_intrinsics.js" "$licenseText"
diff --git a/tools/nix/sharedLibDeps.nix b/tools/nix/sharedLibDeps.nix
index 788e9efedeb8..585ceae637ef 100644
--- a/tools/nix/sharedLibDeps.nix
+++ b/tools/nix/sharedLibDeps.nix
@@ -5,6 +5,7 @@
   withSQLite ? true,
   withSSL ? true,
   withFFI ? true,
+  withPerfetto ? false,
   withTemporal ? false,
 }:
 {
@@ -21,8 +22,10 @@
     zlib
     zstd
     ;
+  abseil = pkgs.abseil-cpp;
   cares = pkgs.c-ares;
   hdr-histogram = pkgs.hdrhistogram_c;
+  highway = pkgs.libhwy;
   http-parser = pkgs.llhttp;
   nghttp2 = pkgs.nghttp2.overrideAttrs {
     version = "1.69.0";
@@ -50,6 +53,13 @@
 // (pkgs.lib.optionalAttrs withSSL ({
   inherit (import ./openssl-matrix.nix { inherit pkgs; }) openssl;
 }))
+// (pkgs.lib.optionalAttrs withPerfetto {
+  perfetto =
+    (pkgs.callPackage (builtins.fetchurl {
+      url = "https://github.com/NixOS/nixpkgs/raw/c19db427a1fdfc7591c0b0baeb4665dcef2c61da/pkgs/by-name/pe/perfetto/package.nix";
+      sha256 = "0wc4p96kwxpqr8g2a6lmlfjsffrm3dc824m7hiy0q21r2papc0ik";
+    }) { }).sdk;
+})
 // (pkgs.lib.optionalAttrs withTemporal {
   inherit (pkgs) temporal_capi;
 })
diff --git a/tools/nix/v8.nix b/tools/nix/v8.nix
index 90dadd336c8d..3c3c3ab47347 100644
--- a/tools/nix/v8.nix
+++ b/tools/nix/v8.nix
@@ -23,6 +23,8 @@
 }:
 
 let
+  useSharedAbseil = builtins.elem "--shared-abseil" configureFlags;
+  useSharedHighway = builtins.elem "--shared-highway" configureFlags;
   src =
     let
       inherit (lib) fileset;
@@ -35,7 +37,6 @@ let
         ../../node.gypi
         ../../tools/gyp/pylib
         ../../tools/gyp_node.py
-        ../../tools/v8_gypfiles/abseil.gyp
         ../../tools/v8_gypfiles/features.gypi
         ../../tools/v8_gypfiles/ForEachFormat.py
         ../../tools/v8_gypfiles/ForEachReplace.py
@@ -44,9 +45,12 @@ let
         ../../tools/v8_gypfiles/toolchain.gypi
         ../../tools/v8_gypfiles/v8.gyp
       ]
-      ++ lib.optionals (builtins.elem "--with-perfetto" configureFlags) [
-        ../../deps/perfetto
-      ]
+      ++ lib.optional (!useSharedAbseil) ../../tools/v8_gypfiles/abseil.gyp
+      ++ lib.optional (!useSharedHighway) ../../tools/v8_gypfiles/highway.gyp
+      ++ lib.optional (
+        builtins.elem "--with-perfetto" configureFlags
+        && !(builtins.elem "--shared-perfetto" configureFlags)
+      ) ../../deps/perfetto
       ++ lib.optionals (icu != null) [
         ../../tools/icu/icu_versions.json
         ../../tools/icu/icu-system.gyp
@@ -63,12 +67,16 @@ let
       potentiallyAlreadyRemovedFiles =
         # Files that are removed in the release tarball (see Makefile $(TARBALL) target)
         [ (fileset.difference ../../deps/v8/test ../../deps/v8/test/torque) ]
-        ++ (builtins.filter builtins.pathExists [
-          ../../deps/v8/samples
-          ../../deps/v8/tools/profviz
-          ../../deps/v8/tools/run-tests.py
-          ../../deps/v8/third_party/ittapi
-        ]);
+        ++ (builtins.filter builtins.pathExists (
+          [
+            ../../deps/v8/samples
+            ../../deps/v8/tools/profviz
+            ../../deps/v8/tools/run-tests.py
+            ../../deps/v8/third_party/ittapi
+          ]
+          ++ lib.optional useSharedAbseil ../../deps/v8/third_party/abseil-cpp
+          ++ lib.optional useSharedHighway ../../deps/v8/third_party/highway
+        ));
       trackedFiles =
         ({
           # This line is being modified by Makefile $(TARBALL) target, any change to it should be sync
@@ -197,9 +205,11 @@ stdenv.mkDerivation (finalAttrs: {
     find deps/v8/include -name '*.h' -print0 | while read -r -d "" file; do
       install -Dm644 "$file" -T "$out/include/''${file#deps/v8/include/}"
     done
-    find deps/v8/third_party/abseil-cpp/absl -name '*.h' -print0 | while read -r -d "" file; do
-      install -Dm644 "$file" -T "$out/include/''${file#deps/v8/third_party/abseil-cpp/}"
-    done
+    ${lib.optionalString (!useSharedAbseil) ''
+      find deps/v8/third_party/abseil-cpp/absl -name '*.h' -print0 | while read -r -d "" file; do
+        install -Dm644 "$file" -T "$out/include/''${file#deps/v8/third_party/abseil-cpp/}"
+      done
+    ''}
 
     mkdir -p $out/lib/pkgconfig
     cat -> $out/lib/pkgconfig/v8.pc << EOF
diff --git a/tools/v8_gypfiles/d8.gyp b/tools/v8_gypfiles/d8.gyp
index 5b47ebf180dd..f59a155b169c 100644
--- a/tools/v8_gypfiles/d8.gyp
+++ b/tools/v8_gypfiles/d8.gyp
@@ -16,7 +16,6 @@
       'target_name': 'd8',
       'type': 'executable',
       'dependencies': [
-        'abseil.gyp:abseil',
         'v8.gyp:v8',
         'v8.gyp:v8_libbase',
         'v8.gyp:v8_libplatform',
@@ -77,6 +76,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },
   ],
diff --git a/tools/v8_gypfiles/features.gypi b/tools/v8_gypfiles/features.gypi
index a5227687d22d..d656c7492dec 100644
--- a/tools/v8_gypfiles/features.gypi
+++ b/tools/v8_gypfiles/features.gypi
@@ -161,6 +161,9 @@
     'v8_enable_pointer_compression_shared_cage%': 0,
     'v8_enable_31bit_smis_on_64bit_arch%': 0,
 
+    # Size of the contiguous read-only space reservation in the shared cage.
+    'v8_contiguous_compressed_ro_space_size_mb%': 16,
+
     # Sets -dV8_SHORT_BUILTIN_CALLS
     'v8_enable_short_builtin_calls%': 0,
 
@@ -365,7 +368,11 @@
         'defines': ['V8_COMPRESS_POINTERS_IN_MULTIPLE_CAGES'],
       }],
       ['v8_enable_pointer_compression_shared_cage==1', {
-        'defines': ['V8_COMPRESS_POINTERS_IN_SHARED_CAGE'],
+        'defines': [
+          'V8_COMPRESS_POINTERS_IN_SHARED_CAGE',
+          'V8_CONTIGUOUS_COMPRESSED_RO_SPACE',
+          'V8_CONTIGUOUS_COMPRESSED_RO_SPACE_SIZE_MB=<(v8_contiguous_compressed_ro_space_size_mb)',
+        ],
       }],
       ['v8_enable_pointer_compression==1 or v8_enable_31bit_smis_on_64bit_arch==1', {
         'defines': ['V8_31BIT_SMIS_ON_64BIT_ARCH',],
diff --git a/tools/v8_gypfiles/highway.gyp b/tools/v8_gypfiles/highway.gyp
new file mode 100644
index 000000000000..c7f915b76e2f
--- /dev/null
+++ b/tools/v8_gypfiles/highway.gyp
@@ -0,0 +1,58 @@
+{
+  'includes': ['toolchain.gypi'],
+  'targets': [
+    {
+      'target_name': 'highway',
+      'type': 'static_library',
+      'toolsets': ['host', 'target'],
+      'variables': {
+        'HIGHWAY_ROOT': '../../deps/v8/third_party/highway',
+      },
+      'all_dependent_settings': {
+        'include_dirs': [
+          '<(HIGHWAY_ROOT)/src',
+        ],
+        'conditions': [
+          ['v8_target_arch=="ia32"', {
+            'defines': ['HWY_BROKEN_TARGETS=(HWY_AVX2|HWY_AVX3)',],
+          }],
+          ['v8_target_arch=="arm64"', {
+            'defines': ['HWY_BROKEN_TARGETS=HWY_ALL_SVE',],
+          }],
+          ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
+            'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
+          }],
+          ['v8_target_arch=="s390x"', {
+            'defines': ['HWY_BROKEN_EMU128=0',],
+          }],
+          ['OS in "aix os400"', {
+            'defines': ['HWY_BROKEN_EMU128=0',],
+          }],
+          ['v8_target_arch=="arm" and arm_version==7', {
+            'defines': ['HWY_BROKEN_EMU128=0',],
+          }],
+        ],
+      },
+      'include_dirs': [
+        '<(HIGHWAY_ROOT)/src',
+      ],
+      'conditions': [
+        ['v8_target_arch=="ia32"', {
+          'defines': ['HWY_BROKEN_TARGETS=(HWY_AVX2|HWY_AVX3)',],
+        }],
+        ['v8_target_arch=="arm64"', {
+          'defines': ['HWY_BROKEN_TARGETS=HWY_ALL_SVE',],
+        }],
+        ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
+          'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
+        }],
+        ['v8_target_arch=="riscv64"', {
+          'defines': ['HWY_BROKEN_TARGETS=HWY_RVV',],
+        }],
+      ],
+      'sources': [
+        '<!@pymod_do_main(GN-scraper "<(HIGHWAY_ROOT)/BUILD.gn"  "source_set.\\"libhwy.*?sources = ")',
+      ],
+    },  # highway
+  ],
+}
diff --git a/tools/v8_gypfiles/v8.gyp b/tools/v8_gypfiles/v8.gyp
index 7c7ebc8af42a..819dffb88984 100644
--- a/tools/v8_gypfiles/v8.gyp
+++ b/tools/v8_gypfiles/v8.gyp
@@ -62,7 +62,9 @@
           'BUILDING_V8_PLATFORM_SHARED',  # Make V8_PLATFORM_EXPORT visible.
         ]
       }],
-      ['node_shared=="true"', {
+      # The V8 static libraries get linked into libv8_debug_helper too, and
+      # the local-exec TLS model is only valid in an executable.
+      ['node_shared=="true" or node_enable_v8debughelper=="true"', {
         'defines': [
           'V8_TLS_USED_IN_LIBRARY',  # Enable V8_TLS_LIBRARY_MODE.
         ],
@@ -288,17 +290,19 @@
         'v8_base_without_compiler',
         'v8_initializers',
         'v8_maybe_icu',
-        'abseil.gyp:abseil',
       ],
       'sources': [
         '<(V8_ROOT)/src/init/setup-isolate-full.cc',
       ],
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_init
     {
@@ -310,7 +314,6 @@
         'v8_base_without_compiler',
         'v8_shared_internal_headers',
         'v8_pch',
-        'abseil.gyp:abseil',
       ],
       'include_dirs': [
         '<(SHARED_INTERMEDIATE_DIR)',
@@ -320,7 +323,7 @@
         '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "\\"v8_initializers.*?sources = ")',
       ],
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
@@ -390,6 +393,9 @@
              '<(V8_ROOT)/src/builtins/builtins-intl-gen.cc',
            ],
          }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_initializers
     {
@@ -492,7 +498,7 @@
         },
       ],
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
@@ -508,7 +514,6 @@
             'v8_compiler_for_mksnapshot',
             'v8_initializers',
             'v8_libplatform',
-            'abseil.gyp:abseil',
           ]
         }, {
           'dependencies': [
@@ -521,9 +526,11 @@
             'v8_compiler_for_mksnapshot',
             'v8_initializers',
             'v8_libplatform',
-            'abseil.gyp:abseil',
           ]
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
         ['OS=="win" and clang==1', {
           'actions': [
             {
@@ -636,8 +643,14 @@
         'run_torque',
         'v8_libbase',
         'fp16',
-        'highway',
-        'abseil.gyp:abseil',
+      ],
+      'conditions': [
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
+        ['node_shared_highway=="false"', {
+          'dependencies': ['highway.gyp:highway'],
+        }]
       ],
       'direct_dependent_settings': {
         'sources': [
@@ -983,10 +996,9 @@
         'v8_libbase',
         'v8_shared_internal_headers',
         'v8_pch',
-        'abseil.gyp:abseil',
       ],
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
@@ -1001,6 +1013,9 @@
         }, {
           'sources': ['<(V8_ROOT)/src/compiler/turbofan-disabled.cc'],
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_compiler
     {
@@ -1104,7 +1119,6 @@
         'v8_zlib',
         'v8_pch',
         'simdutf',
-        'abseil.gyp:abseil',
       ],
       'includes': ['inspector.gypi'],
       'direct_dependent_settings': {
@@ -1125,8 +1139,12 @@
           'sources': [
             '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "\\"v8_base_without_compiler.*?v8_use_perfetto.*?sources \\+= ")',
           ],
-          'dependencies': [
-            '<(perfetto_gyp_file):perfetto_sdk',
+          'conditions': [
+            ['node_shared_perfetto=="false"', {
+              'dependencies': [
+                '<(perfetto_gyp_file):perfetto_sdk',
+              ],
+            }],
           ],
         }],
         ['v8_enable_snapshot_compression==1', {
@@ -1391,6 +1409,9 @@
             'libraries': ['-latomic', ],
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_base_without_compiler
     {
@@ -1412,7 +1433,6 @@
       'dependencies': [
         'v8_shared_internal_headers',
         'v8_libbase',
-        'abseil.gyp:abseil',
       ],
       'defines!': [
         '_HAS_EXCEPTIONS=0',
@@ -1438,6 +1458,9 @@
           'cflags!': ['-O3'],
           'sources': ['<(V8_ROOT)/src/torque/implementation-visitor.cc'],
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # torque_base
     {
@@ -1477,7 +1500,6 @@
 
       'dependencies': [
         'v8_headers',
-        'abseil.gyp:abseil',
       ],
 
       'conditions': [
@@ -1718,6 +1740,9 @@
           ],
         }
          ],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_libbase
     {
@@ -1726,7 +1751,6 @@
       'toolsets': ['host', 'target'],
       'dependencies': [
         'v8_libbase',
-        'abseil.gyp:abseil',
       ],
       'sources': [
         '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "\\"v8_libplatform.*?sources = ")',
@@ -1745,8 +1769,12 @@
           'sources': [
             '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "\\"v8_libplatform.*?v8_use_perfetto.*?sources \\+= ")',
           ],
-          'dependencies': [
-            '<(perfetto_gyp_file):perfetto_sdk',
+          'conditions': [
+            ['node_shared_perfetto=="false"', {
+              'dependencies': [
+                '<(perfetto_gyp_file):perfetto_sdk',
+              ],
+            }],
           ],
         }],
         ['v8_enable_system_instrumentation==1 and is_win', {
@@ -1761,6 +1789,9 @@
             '<(V8_ROOT)/src/libplatform/tracing/recorder-mac.cc',
           ],
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
       'direct_dependent_settings': {
         'include_dirs': [
@@ -1801,6 +1832,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
       'defines!': [
         'BUILDING_V8_SHARED=1',
@@ -1808,7 +1842,6 @@
       ],
       'dependencies': [
         'v8_libbase',
-        'abseil.gyp:abseil',
         # "build/win:default_exe_manifest",
       ],
       'sources': [
@@ -1831,7 +1864,6 @@
         'v8_libplatform',
         'v8_maybe_icu',
         'v8_pch',
-        'abseil.gyp:abseil',
         # "build/win:default_exe_manifest",
       ],
       'sources': [
@@ -1856,7 +1888,7 @@
         },
       },
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
@@ -1878,6 +1910,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # mksnapshot
     {
@@ -1885,7 +1920,6 @@
       'type': 'executable',
       'dependencies': [
         'torque_base',
-        'abseil.gyp:abseil',
         # "build/win:default_exe_manifest",
       ],
       'conditions': [
@@ -1906,6 +1940,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
       'defines!': [
         '_HAS_EXCEPTIONS=0',
@@ -1983,7 +2020,6 @@
         'v8_libbase',
         # "build/win:default_exe_manifest",
         'v8_maybe_icu',
-        'abseil.gyp:abseil',
       ],
       'conditions': [
         ['want_separate_host_toolset', {
@@ -2003,6 +2039,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
       'sources': [
         "<(V8_ROOT)/src/regexp/gen-regexp-special-case.cc",
@@ -2440,59 +2479,6 @@
         ],
       },
     },  # fp16
-    {
-      'target_name': 'highway',
-      'type': 'static_library',
-      'toolsets': ['host', 'target'],
-      'variables': {
-        'HIGHWAY_ROOT': '../../deps/v8/third_party/highway',
-      },
-      'all_dependent_settings': {
-        'include_dirs': [
-          '<(HIGHWAY_ROOT)/src',
-        ],
-        'conditions': [
-          ['v8_target_arch=="ia32"', {
-            'defines': ['HWY_BROKEN_TARGETS=(HWY_AVX2|HWY_AVX3)',],
-          }],
-          ['v8_target_arch=="arm64"', {
-            'defines': ['HWY_BROKEN_TARGETS=HWY_ALL_SVE',],
-          }],
-          ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
-            'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
-          }],
-          ['v8_target_arch=="s390x"', {
-            'defines': ['HWY_BROKEN_EMU128=0',],
-          }],
-          ['OS in "aix os400"', {
-            'defines': ['HWY_BROKEN_EMU128=0',],
-          }],
-          ['v8_target_arch=="arm" and arm_version==7', {
-            'defines': ['HWY_BROKEN_EMU128=0',],
-          }],
-        ],
-      },
-      'include_dirs': [
-        '<(HIGHWAY_ROOT)/src',
-      ],
-      'conditions': [
-        ['v8_target_arch=="ia32"', {
-          'defines': ['HWY_BROKEN_TARGETS=(HWY_AVX2|HWY_AVX3)',],
-        }],
-        ['v8_target_arch=="arm64"', {
-          'defines': ['HWY_BROKEN_TARGETS=HWY_ALL_SVE',],
-        }],
-        ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
-          'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
-        }],
-        ['v8_target_arch=="riscv64"', {
-          'defines': ['HWY_BROKEN_TARGETS=HWY_RVV',],
-        }],
-      ],
-      'sources': [
-        '<!@pymod_do_main(GN-scraper "<(HIGHWAY_ROOT)/BUILD.gn"  "source_set.\\"libhwy.*?sources = ")',
-      ],
-    },  # highway
     {
       'target_name': 'simdutf',
       'type': 'static_library',
diff --git a/tools/v8_gypfiles/v8_debug_helper.gyp b/tools/v8_gypfiles/v8_debug_helper.gyp
new file mode 100644
index 000000000000..e869cb4f9771
--- /dev/null
+++ b/tools/v8_gypfiles/v8_debug_helper.gyp
@@ -0,0 +1,177 @@
+{
+  'variables': {
+    'V8_ROOT': '../../deps/v8',
+    'v8_code': 1,
+    # v8windbg links the helper statically. When the helper is the requested
+    # artifact it is built as a shared library instead, so a debugger
+    # extension can load it on its own.
+    'v8_debug_helper_type%': 'static_library',
+    'conditions': [
+      [ 'node_enable_v8debughelper=="true"', {
+        'v8_debug_helper_type': 'shared_library',
+      }],
+    ],
+  },
+  'includes': ['toolchain.gypi', 'features.gypi'],
+  'targets': [
+    {
+      # Intermediate target to build the debug helper. dependencies_traverse
+      # stops gyp from propagating the library up to node.gypi as a link
+      # input. The library is only supposed to be loaded by a debugger.
+      'target_name': 'build_v8_debug_helper',
+      'type': 'none',
+      'dependencies_traverse': 0,
+      'hard_dependency': 1,
+      'dependencies': [
+        'v8_debug_helper',
+      ],
+    },  # build_v8_debug_helper
+    {
+      'target_name': 'v8_debug_helper',
+      'type': '<(v8_debug_helper_type)',
+      'include_dirs': [
+        '<(V8_ROOT)',
+        '<(V8_ROOT)/include',
+      ],
+      'dependencies': [
+        'gen_heap_constants',
+
+        'v8.gyp:generate_bytecode_builtins_list',
+        'v8.gyp:run_torque',
+        'v8.gyp:v8_maybe_icu',
+        'v8.gyp:fp16',
+        'v8.gyp:v8_libbase',
+        'v8.gyp:v8_snapshot',
+      ],
+      'sources': [
+        '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/tools/debug_helper/BUILD.gn"  "\"v8_debug_helper_internal\".*?sources = ")',
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/class-debug-readers.cc",
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/class-debug-readers.h",
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/debug-macros.cc",
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/debug-macros.h",
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/instance-types.h",
+      ],
+      # Enable RTTI //build/config/compiler:rtti
+      'cflags_cc': [ '-frtti' ],
+      'cflags_cc!': [ '-fno-rtti' ],
+      'xcode_settings': {
+        'GCC_ENABLE_CPP_RTTI': 'YES',  # -frtti
+      },
+      'msvs_settings': {
+        'VCCLCompilerTool': {
+          'RuntimeTypeInfo': 'true',
+        },
+      },
+      'configurations': {
+        'Release': { # Override target_defaults.Release in common.gypi
+          'msvs_settings': {
+            'VCCLCompilerTool': {
+              'RuntimeTypeInfo': 'true',
+            },
+          },
+        },
+      },
+      'conditions': [
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
+        [ 'v8_enable_temporal_support==1 and node_shared_temporal_capi=="false"', {
+          'dependencies': [
+            '../../deps/crates/crates.gyp:temporal_capi',
+          ],
+        }],
+        [ 'v8_debug_helper_type=="shared_library"', {
+          # The entry points in debug-helper.h are only given default
+          # visibility, or dllexport on Windows, when this is defined. Node
+          # builds with hidden visibility, so without it the library exports
+          # nothing.
+          'defines': [ 'BUILDING_V8_DEBUG_HELPER' ],
+          'direct_dependent_settings': {
+            'defines': [ 'USING_V8_DEBUG_HELPER' ],
+          },
+        }],
+      ],
+    },  # v8_debug_helper
+    {
+      'target_name': 'gen_heap_constants',
+      'type': 'none',
+      'hard_dependency': 1,
+      'dependencies': [
+        'run_mkgrokdump',
+      ],
+      'direct_dependent_settings': {
+        'sources': [
+          '<(SHARED_INTERMEDIATE_DIR)/heap-constants-gen.cc',
+        ],
+      },
+      'actions': [
+        {
+          'action_name': 'run_gen_heap_constants',
+          'inputs': [
+            '<(V8_ROOT)/tools/debug_helper/gen-heap-constants.py',
+          ],
+          'outputs': [
+            '<(SHARED_INTERMEDIATE_DIR)/heap-constants-gen.cc',
+          ],
+          'action': [
+            '<(python)',
+            '<(V8_ROOT)/tools/debug_helper/gen-heap-constants.py',
+            '<(SHARED_INTERMEDIATE_DIR)',
+            '<@(_outputs)',
+          ]
+        }
+      ]
+    },  # gen_heap_constants
+    {
+      'target_name': 'run_mkgrokdump',
+      'type': 'none',
+      'hard_dependency': 1,
+      'dependencies': [
+        'mkgrokdump',
+      ],
+      'actions': [
+        {
+          'action_name': 'run_gen_heap_constants',
+          'inputs': [
+            '<(V8_ROOT)/tools/run.py',
+          ],
+          'outputs': [
+            '<(SHARED_INTERMEDIATE_DIR)/v8heapconst.py',
+          ],
+          'action': [
+            '<(python)',
+            '<(V8_ROOT)/tools/run.py',
+            '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mkgrokdump<(EXECUTABLE_SUFFIX)',
+            '--outfile',
+            '<@(_outputs)',
+          ]
+        }
+      ]
+    },  # run_mkgrokdump
+    {
+      'target_name': 'mkgrokdump',
+      'type': 'executable',
+      'include_dirs': [
+        '<(V8_ROOT)',
+        '<(V8_ROOT)/include',
+      ],
+      'dependencies': [
+        'v8.gyp:v8_snapshot',
+        'v8.gyp:v8_libbase',
+        'v8.gyp:v8_libplatform',
+        'v8.gyp:v8_maybe_icu',
+        'v8.gyp:fp16',
+        'v8.gyp:generate_bytecode_builtins_list',
+        'v8.gyp:run_torque',
+      ],
+      'conditions': [
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
+      ],
+      'sources': [
+        '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/test/mkgrokdump/BUILD.gn"  "mkgrokdump.*?sources = ")',
+      ]
+    },  # mkgrokdump
+  ],
+}
diff --git a/tools/v8_gypfiles/v8windbg.gyp b/tools/v8_gypfiles/v8windbg.gyp
index 13d4306f224e..14823f60c0cb 100644
--- a/tools/v8_gypfiles/v8windbg.gyp
+++ b/tools/v8_gypfiles/v8windbg.gyp
@@ -24,7 +24,7 @@
         '<(V8_ROOT)/include',
       ],
       'dependencies': [
-        'v8_debug_helper',
+        'v8_debug_helper.gyp:v8_debug_helper',
         'v8.gyp:v8_libbase',
       ],
       'sources': [
@@ -40,129 +40,5 @@
         ],
       },
     },  # v8windbg
-    {
-      'target_name': 'v8_debug_helper',
-      'type': 'static_library',
-      'include_dirs': [
-        '<(V8_ROOT)',
-        '<(V8_ROOT)/include',
-      ],
-      'dependencies': [
-        'gen_heap_constants',
-
-        'abseil.gyp:abseil',
-        'v8.gyp:generate_bytecode_builtins_list',
-        'v8.gyp:run_torque',
-        'v8.gyp:v8_maybe_icu',
-        'v8.gyp:fp16',
-        'v8.gyp:v8_libbase',
-        'v8.gyp:v8_snapshot',
-      ],
-      'sources': [
-        '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/tools/debug_helper/BUILD.gn"  "\"v8_debug_helper_internal\".*?sources = ")',
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/class-debug-readers.cc",
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/class-debug-readers.h",
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/debug-macros.cc",
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/debug-macros.h",
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/instance-types.h",
-      ],
-      # Enable RTTI //build/config/compiler:rtti
-      'cflags_cc': [ '-frtti' ],
-      'cflags_cc!': [ '-fno-rtti' ],
-      'xcode_settings': {
-        'GCC_ENABLE_CPP_RTTI': 'YES',  # -frtti
-      },
-      'msvs_settings': {
-        'VCCLCompilerTool': {
-          'RuntimeTypeInfo': 'true',
-        },
-      },
-      'configurations': {
-        'Release': { # Override target_defaults.Release in common.gypi
-          'msvs_settings': {
-            'VCCLCompilerTool': {
-              'RuntimeTypeInfo': 'true',
-            },
-          },
-        },
-      },
-    },  # v8_debug_helper
-    {
-      'target_name': 'gen_heap_constants',
-      'type': 'none',
-      'hard_dependency': 1,
-      'dependencies': [
-        'run_mkgrokdump',
-      ],
-      'direct_dependent_settings': {
-        'sources': [
-          '<(SHARED_INTERMEDIATE_DIR)/heap-constants-gen.cc',
-        ],
-      },
-      'actions': [
-        {
-          'action_name': 'run_gen_heap_constants',
-          'inputs': [
-            '<(V8_ROOT)/tools/debug_helper/gen-heap-constants.py',
-          ],
-          'outputs': [
-            '<(SHARED_INTERMEDIATE_DIR)/heap-constants-gen.cc',
-          ],
-          'action': [
-            '<(python)',
-            '<(V8_ROOT)/tools/debug_helper/gen-heap-constants.py',
-            '<(SHARED_INTERMEDIATE_DIR)',
-            '<@(_outputs)',
-          ]
-        }
-      ]
-    },  # gen_heap_constants
-    {
-      'target_name': 'run_mkgrokdump',
-      'type': 'none',
-      'hard_dependency': 1,
-      'dependencies': [
-        'mkgrokdump',
-      ],
-      'actions': [
-        {
-          'action_name': 'run_gen_heap_constants',
-          'inputs': [
-            '<(V8_ROOT)/tools/run.py',
-          ],
-          'outputs': [
-            '<(SHARED_INTERMEDIATE_DIR)/v8heapconst.py',
-          ],
-          'action': [
-            '<(python)',
-            '<(V8_ROOT)/tools/run.py',
-            '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mkgrokdump<(EXECUTABLE_SUFFIX)',
-            '--outfile',
-            '<@(_outputs)',
-          ]
-        }
-      ]
-    },  # run_mkgrokdump
-    {
-      'target_name': 'mkgrokdump',
-      'type': 'executable',
-      'include_dirs': [
-        '<(V8_ROOT)',
-        '<(V8_ROOT)/include',
-      ],
-      'dependencies': [
-        'abseil.gyp:abseil',
-        'v8.gyp:v8_snapshot',
-        'v8.gyp:v8_libbase',
-        'v8.gyp:v8_libplatform',
-        'v8.gyp:v8_maybe_icu',
-        'v8.gyp:fp16',
-        'v8.gyp:generate_bytecode_builtins_list',
-        'v8.gyp:run_torque',
-      ],
-      'sources': [
-        '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/test/mkgrokdump/BUILD.gn"  "mkgrokdump.*?sources = ")',
-      ]
-    },  # mkgrokdump
   ],
 }
diff --git a/typings/globals.d.ts b/typings/globals.d.ts
index fcdfe4ada94b..d8270a6a7fea 100644
--- a/typings/globals.d.ts
+++ b/typings/globals.d.ts
@@ -25,6 +25,8 @@ import { MessagingBinding } from './internalBinding/messaging';
 import { ModulesBinding } from './internalBinding/modules';
 import { OptionsBinding } from './internalBinding/options';
 import { OSBinding } from './internalBinding/os';
+import { PerformanceBinding } from './internalBinding/performance';
+import { PermissionBinding } from './internalBinding/permission';
 import { ProcessBinding } from './internalBinding/process';
 import { ProcessWrapBinding } from './internalBinding/process_wrap';
 import { ProfilerBinding } from './internalBinding/profiler';
@@ -73,6 +75,8 @@ interface InternalBindingMap {
   modules: ModulesBinding;
   options: OptionsBinding;
   os: OSBinding;
+  performance: PerformanceBinding;
+  permission: PermissionBinding;
   process: ProcessBinding;
   process_wrap: ProcessWrapBinding;
   profiler: ProfilerBinding;
diff --git a/typings/internalBinding/crypto.d.ts b/typings/internalBinding/crypto.d.ts
index f532cf6a0c75..eb40d33c513c 100644
--- a/typings/internalBinding/crypto.d.ts
+++ b/typings/internalBinding/crypto.d.ts
@@ -1,6 +1,8 @@
 declare namespace InternalCryptoBinding {
   type Buffer = Uint8Array;
-  type ByteSource = string | ArrayBuffer | SharedArrayBuffer | ArrayBufferView;
+  type BufferSource = ArrayBuffer | SharedArrayBuffer | ArrayBufferView;
+  type OptionalBufferSource = BufferSource | undefined;
+  type ByteSource = string | BufferSource;
   type OptionalByteSource = ByteSource | undefined;
   type JwkKey = Record<string, string | string[] | boolean | undefined>;
   type KeyFormatDER = 0;
@@ -300,6 +302,8 @@ declare namespace InternalCryptoBinding {
       algorithm: string,
       data: ByteSource,
       outputLength?: number,
+      functionName?: OptionalBufferSource,
+      customization?: OptionalBufferSource,
     ): CryptoJobForMode<M, ArrayBuffer>;
   }
 
@@ -640,6 +644,11 @@ declare namespace InternalCryptoBinding {
     digest(encoding?: string): string | Buffer;
   }
 
+  interface MacHandle {
+    update(data: ByteSource, encoding?: string): boolean;
+    final(encoding?: string): string | Buffer;
+  }
+
   interface CipherBaseHandle {
     update(data: ByteSource, inputEncoding?: string): Buffer;
     final(): Buffer;
@@ -751,6 +760,27 @@ declare namespace InternalCryptoBinding {
     toLegacy(): object;
   }
 
+  interface NativeX509CertificateConstructor {
+    readonly prototype: X509CertificateHandle;
+    new(value: X509CertificateHandle | ArrayBufferView): X509CertificateHandle;
+  }
+
+  interface X509CertificateConstructor {
+    readonly prototype: object;
+    new(buffer: string | ArrayBufferView): object;
+  }
+
+  interface InternalX509CertificateConstructor {
+    readonly prototype: object;
+    new(value: X509CertificateHandle | ArrayBufferView): object;
+  }
+
+  type CreateX509CertificateClassCallback =
+    (NativeX509Certificate: NativeX509CertificateConstructor) => [
+      X509Certificate: X509CertificateConstructor,
+      InternalX509Certificate: InternalX509CertificateConstructor,
+    ];
+
   interface CipherInfo {
     name: string;
     nid: number;
@@ -806,6 +836,8 @@ export interface CryptoBinding {
     credential: InternalCryptoBinding.PreparedSecretKeyData,
     iv: InternalCryptoBinding.ByteSource | null,
     authTagLength?: number,
+    ctsMode?: 'CS1' | 'CS2' | 'CS3',
+    xtsStandard?: 'GB' | 'IEEE',
   ) => InternalCryptoBinding.CipherBaseHandle;
   DiffieHellman: new (
     sizeOrKey: number | InternalCryptoBinding.ByteSource,
@@ -818,8 +850,22 @@ export interface CryptoBinding {
     xofLen?: number,
     algorithmId?: number,
     algorithmCache?: Record<string, number>,
+    functionName?: InternalCryptoBinding.OptionalBufferSource,
+    customization?: InternalCryptoBinding.OptionalBufferSource,
   ) => InternalCryptoBinding.HashHandle;
   Hmac: new () => InternalCryptoBinding.HmacHandle;
+  Mac: new (
+    algorithm: string,
+    algorithmId: number,
+    algorithmCache: Record<string, number>,
+    key: InternalCryptoBinding.PreparedSecretKeyData,
+    digest?: string,
+    cipher?: string,
+    iv?: InternalCryptoBinding.OptionalBufferSource,
+    customization?: InternalCryptoBinding.OptionalBufferSource,
+    salt?: InternalCryptoBinding.OptionalBufferSource,
+    outputLength?: number,
+  ) => InternalCryptoBinding.MacHandle;
   KeyObjectHandle: new () => InternalCryptoBinding.KeyObjectHandle;
   SecureContext: new () => InternalCryptoBinding.SecureContextHandle;
   Sign: new () => InternalCryptoBinding.SignHandle;
@@ -926,8 +972,15 @@ export interface CryptoBinding {
     PublicKeyObject: InternalCryptoBinding.KeyObjectSubtypeConstructor,
     PrivateKeyObject: InternalCryptoBinding.KeyObjectSubtypeConstructor,
   ];
+  createX509CertificateClass(
+    callback: InternalCryptoBinding.CreateX509CertificateClassCallback,
+  ): [
+    X509Certificate: InternalCryptoBinding.X509CertificateConstructor,
+    InternalX509Certificate: InternalCryptoBinding.InternalX509CertificateConstructor,
+  ];
   getBundledRootCertificates(): string[];
   getCachedAliases(): Record<string, number>;
+  getCachedMacAliases(): Record<string, number>;
   getCertificateCompressionAlgorithms(): string[];
   getCipherInfo(
     nameOrNid: string | number,
@@ -939,7 +992,12 @@ export interface CryptoBinding {
   getCurves(): string[];
   getExtraCACertificates(): string[];
   getFipsCrypto(): 0 | 1;
+  getFipsCryptoGeneration(): bigint;
   getHashes(): string[];
+  getMacs(): string[];
+  isCryptoKey(key: unknown): boolean;
+  isKeyObject(key: unknown): boolean;
+  isX509Certificate(value: unknown): boolean;
   getKeyObjectSlots(key: object): InternalCryptoBinding.KeyObjectSlots;
   getOpenSSLSecLevelCrypto(): number | undefined;
   getSSLCiphers(): string[];
@@ -953,6 +1011,8 @@ export interface CryptoBinding {
     outputEncoding: string,
     outputEncodingId?: number,
     outputLength?: number,
+    functionName?: InternalCryptoBinding.OptionalBufferSource,
+    customization?: InternalCryptoBinding.OptionalBufferSource,
   ): string | InternalCryptoBinding.Buffer;
   parseX509(data: InternalCryptoBinding.ByteSource): InternalCryptoBinding.X509CertificateHandle;
   privateDecrypt: InternalCryptoBinding.PublicKeyCipher;
@@ -963,6 +1023,7 @@ export interface CryptoBinding {
   secureBuffer(length: number): Uint8Array | undefined;
   secureHeapUsed(): bigint | undefined;
   setEngine?(engine: string, flags: number): void;
+  setupFipsIndicatorChannel(): void;
   setFipsCrypto(fips: boolean | number): void;
   startLoadingCertificatesOffThread(): void;
   testFipsCrypto(): 0 | 1;
diff --git a/typings/internalBinding/encoding_binding.d.ts b/typings/internalBinding/encoding_binding.d.ts
index 0774a21f25e2..70d6d51172e7 100644
--- a/typings/internalBinding/encoding_binding.d.ts
+++ b/typings/internalBinding/encoding_binding.d.ts
@@ -1,5 +1,6 @@
 export interface EncodingBinding {
   encodeInto(source: string, dest: Uint8Array): void;
+  encodeIntoResults: Uint32Array;
   encodeUtf8String(str: string): Uint8Array;
   decodeUTF8(buffer: ArrayBufferView | ArrayBuffer | SharedArrayBuffer, ignoreBOM?: boolean, hasFatal?: boolean): string;
   toASCII(input: string): string;
diff --git a/typings/internalBinding/performance.d.ts b/typings/internalBinding/performance.d.ts
new file mode 100644
index 000000000000..fa9a3810fc7a
--- /dev/null
+++ b/typings/internalBinding/performance.d.ts
@@ -0,0 +1,134 @@
+declare namespace InternalPerformanceBinding {
+  interface HistogramBase {
+    count(): number;
+    countBigInt(): bigint;
+    min(): number;
+    minBigInt(): bigint;
+    max(): number;
+    maxBigInt(): bigint;
+    mean(): number;
+    exceeds(): number;
+    exceedsBigInt(): bigint;
+    stddev(): number;
+    percentile(percentile: number): number;
+    percentileBigInt(percentile: number): bigint;
+    percentiles(percentiles: Map<number, number>): void;
+    percentilesBigInt(percentiles: Map<number, bigint>): void;
+    reset(): void;
+    skewness(): number;
+    kurtosis(): number;
+    cdf(value: number): number;
+    countAt(value: number): number;
+    ksTest(other: HistogramBase): number;
+    percentilesAt(
+      percentiles: Map<number, number>,
+      values: Float64Array,
+    ): void;
+    linearBuckets(stepSize: number, buckets: Map<number, number>): void;
+    logBuckets(
+      firstBucket: number,
+      base: number,
+      buckets: Map<number, number>,
+    ): void;
+    welchTest(
+      other: HistogramBase,
+      confidence: number,
+    ): [number, number, number, number, number];
+    mannWhitneyTest(other: HistogramBase): [number, number, number];
+    cohensD(other: HistogramBase): number;
+    cliffsD(other: HistogramBase): number;
+    percentileCI(percentile: number, confidence: number): [number, number, number];
+    ewmaMean(): number;
+    ewmaStddev(): number;
+    ewmaErrorRate(): number;
+  }
+
+  interface ELDHistogram extends HistogramBase {
+    start(reset?: boolean): void;
+    stop(): void;
+    close(callback?: () => void): void;
+    hasRef(): boolean;
+    ref(): void;
+    unref(): void;
+    getAsyncId(): number;
+    asyncReset(resource: object, executionAsyncId?: number): void;
+    getAsyncContextFrameForDebuggingOnly(): unknown;
+    getProviderType(): number;
+  }
+
+  interface Histogram extends HistogramBase {}
+
+  class Histogram {
+    constructor(
+      lowest: number | bigint,
+      highest: number | bigint,
+      figures: number,
+      halfLife?: number,
+      threshold?: number,
+    );
+    record(value: number | bigint): void;
+    recordDelta(): void;
+    recordCorrected(
+      value: number | bigint,
+      expectedInterval: number | bigint,
+    ): void;
+    add(other: Histogram): number;
+    subtract(other: Histogram): number;
+  }
+
+  interface Constants {
+    NODE_PERFORMANCE_GC_MAJOR: number;
+    NODE_PERFORMANCE_GC_MINOR: number;
+    NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP: number;
+    NODE_PERFORMANCE_GC_INCREMENTAL: number;
+    NODE_PERFORMANCE_GC_WEAKCB: number;
+    NODE_PERFORMANCE_GC_FLAGS_NO: number;
+    NODE_PERFORMANCE_GC_FLAGS_CONSTRUCT_RETAINED: number;
+    NODE_PERFORMANCE_GC_FLAGS_FORCED: number;
+    NODE_PERFORMANCE_GC_FLAGS_SYNCHRONOUS_PHANTOM_PROCESSING: number;
+    NODE_PERFORMANCE_GC_FLAGS_ALL_AVAILABLE_GARBAGE: number;
+    NODE_PERFORMANCE_GC_FLAGS_ALL_EXTERNAL_MEMORY: number;
+    NODE_PERFORMANCE_GC_FLAGS_SCHEDULE_IDLE: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_GC: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_HTTP: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_HTTP2: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_NET: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_DNS: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_QUIC: number;
+    NODE_PERFORMANCE_MILESTONE_TIME_ORIGIN_TIMESTAMP: number;
+    NODE_PERFORMANCE_MILESTONE_TIME_ORIGIN: number;
+    NODE_PERFORMANCE_MILESTONE_ENVIRONMENT: number;
+    NODE_PERFORMANCE_MILESTONE_NODE_START: number;
+    NODE_PERFORMANCE_MILESTONE_V8_START: number;
+    NODE_PERFORMANCE_MILESTONE_LOOP_START: number;
+    NODE_PERFORMANCE_MILESTONE_LOOP_EXIT: number;
+    NODE_PERFORMANCE_MILESTONE_BOOTSTRAP_COMPLETE: number;
+  }
+}
+
+type PerformanceObserverCallback =
+  | ((name: string,
+      type: string,
+      startTime: number,
+      duration: number,
+      details: unknown) => void)
+  | ((entry: unknown) => void);
+
+export interface PerformanceBinding {
+  Histogram: typeof InternalPerformanceBinding.Histogram;
+  constants: InternalPerformanceBinding.Constants;
+  observerCounts: Uint32Array;
+  milestones: Float64Array;
+  setupObservers(callback: PerformanceObserverCallback): void;
+  installGarbageCollectionTracking(): void;
+  removeGarbageCollectionTracking(): void;
+  notify(type: string, entry: unknown): void;
+  loopIdleTime(): number;
+  createELDHistogram(
+    interval: number,
+    samplePerIteration: boolean,
+  ): InternalPerformanceBinding.ELDHistogram;
+  markBootstrapComplete(): void;
+  uvMetricsInfo(): [number, number, number];
+  now(): number;
+}
diff --git a/typings/internalBinding/permission.d.ts b/typings/internalBinding/permission.d.ts
new file mode 100644
index 000000000000..5fe422d1820b
--- /dev/null
+++ b/typings/internalBinding/permission.d.ts
@@ -0,0 +1,6 @@
+type Buffer = Uint8Array;
+
+export interface PermissionBinding {
+  has(scope: string, reference?: string | Buffer | null): boolean;
+  drop(scope: string, reference?: string | Buffer | null): void;
+}