diff --git a/Source/JavaScriptCore/API/JSContextRef.cpp b/Source/JavaScriptCore/API/JSContextRef.cpp
index 13769df..e7dad19 100644
--- a/Source/JavaScriptCore/API/JSContextRef.cpp
+++ b/Source/JavaScriptCore/API/JSContextRef.cpp
@@ -133,12 +133,12 @@
 {
     initializeThreading();
 
-    RefPtr<VM> vm = group ? PassRefPtr<VM>(toJS(group)) : VM::createContextGroup();
+    Ref<VM> vm = group ? Ref<VM>(*toJS(group)) : VM::createContextGroup();
 
-    JSLockHolder locker(vm.get());
+    JSLockHolder locker(vm.ptr());
 
     if (!globalObjectClass) {
-        JSGlobalObject* globalObject = JSGlobalObject::create(*vm, JSGlobalObject::createStructure(*vm, jsNull()));
+        JSGlobalObject* globalObject = JSGlobalObject::create(vm.get(), JSGlobalObject::createStructure(vm.get(), jsNull()));
 #if ENABLE(REMOTE_INSPECTOR)
         if (JSRemoteInspectorGetInspectionEnabledByDefault())
             globalObject->setRemoteDebuggingEnabled(true);
@@ -146,12 +146,12 @@
         return JSGlobalContextRetain(toGlobalRef(globalObject->globalExec()));
     }
 
-    JSGlobalObject* globalObject = JSCallbackObject<JSGlobalObject>::create(*vm, globalObjectClass, JSCallbackObject<JSGlobalObject>::createStructure(*vm, 0, jsNull()));
+    JSGlobalObject* globalObject = JSCallbackObject<JSGlobalObject>::create(vm.get(), globalObjectClass, JSCallbackObject<JSGlobalObject>::createStructure(vm.get(), 0, jsNull()));
     ExecState* exec = globalObject->globalExec();
     JSValue prototype = globalObjectClass->prototype(exec);
     if (!prototype)
         prototype = jsNull();
-    globalObject->resetPrototype(*vm, prototype);
+    globalObject->resetPrototype(vm.get(), prototype);
 #if ENABLE(REMOTE_INSPECTOR)
     if (JSRemoteInspectorGetInspectionEnabledByDefault())
         globalObject->setRemoteDebuggingEnabled(true);
diff --git a/Source/JavaScriptCore/API/JSScriptRef.cpp b/Source/JavaScriptCore/API/JSScriptRef.cpp
index f2ad949..791738b 100644
--- a/Source/JavaScriptCore/API/JSScriptRef.cpp
+++ b/Source/JavaScriptCore/API/JSScriptRef.cpp
@@ -41,7 +41,7 @@
 
 struct OpaqueJSScript : public SourceProvider {
 public:
-    static WTF::RefPtr<OpaqueJSScript> create(VM& vm, const SourceOrigin& sourceOrigin, const String& url, int startingLineNumber, const String& source)
+    static WTF::Ref<OpaqueJSScript> create(VM& vm, const SourceOrigin& sourceOrigin, const String& url, int startingLineNumber, const String& source)
     {
         return WTF::adoptRef(*new OpaqueJSScript(vm, sourceOrigin, url, startingLineNumber, source));
     }
@@ -97,7 +97,7 @@
     auto result = OpaqueJSScript::create(vm, SourceOrigin { sourceURLString }, sourceURLString, startingLineNumber, String(StringImpl::createFromLiteral(source, length)));
 
     ParserError error;
-    if (!parseScript(vm, SourceCode(result), error)) {
+    if (!parseScript(vm, SourceCode(result.copyRef()), error)) {
         if (errorMessage)
             *errorMessage = OpaqueJSString::create(error.message()).leakRef();
         if (errorLine)
@@ -105,7 +105,7 @@
         return nullptr;
     }
 
-    return result.leakRef();
+    return &result.leakRef();
 }
 
 JSScriptRef JSScriptCreateFromString(JSContextGroupRef contextGroup, JSStringRef url, int startingLineNumber, JSStringRef source, JSStringRef* errorMessage, int* errorLine)
@@ -119,7 +119,7 @@
     auto result = OpaqueJSScript::create(vm, SourceOrigin { sourceURLString }, sourceURLString, startingLineNumber, source->string());
 
     ParserError error;
-    if (!parseScript(vm, SourceCode(result), error)) {
+    if (!parseScript(vm, SourceCode(result.copyRef()), error)) {
         if (errorMessage)
             *errorMessage = OpaqueJSString::create(error.message()).leakRef();
         if (errorLine)
@@ -127,7 +127,7 @@
         return nullptr;
     }
 
-    return result.leakRef();
+    return &result.leakRef();
 }
 
 void JSScriptRetain(JSScriptRef script)
@@ -152,7 +152,7 @@
     }
     NakedPtr<Exception> internalException;
     JSValue thisValue = thisValueRef ? toJS(exec, thisValueRef) : jsUndefined();
-    JSValue result = evaluate(exec, SourceCode(script), thisValue, internalException);
+    JSValue result = evaluate(exec, SourceCode(*script), thisValue, internalException);
     if (internalException) {
         if (exception)
             *exception = toRef(exec, internalException->value());
diff --git a/Source/JavaScriptCore/API/tests/JSONParseTest.cpp b/Source/JavaScriptCore/API/tests/JSONParseTest.cpp
index 2797c3c..acf0297 100644
--- a/Source/JavaScriptCore/API/tests/JSONParseTest.cpp
+++ b/Source/JavaScriptCore/API/tests/JSONParseTest.cpp
@@ -38,27 +38,27 @@
 {
     bool failed = false;
 
-    RefPtr<VM> vm = VM::create();
+    {
+        Ref<VM> vm = VM::create();
 
-    JSLockHolder locker(vm.get());
-    JSGlobalObject* globalObject = JSGlobalObject::create(*vm, JSGlobalObject::createStructure(*vm, jsNull()));
+        JSLockHolder locker(vm.ptr());
+        JSGlobalObject* globalObject = JSGlobalObject::create(vm.get(), JSGlobalObject::createStructure(vm.get(), jsNull()));
 
-    ExecState* exec = globalObject->globalExec();
-    JSValue v0 = JSONParse(exec, "");
-    JSValue v1 = JSONParse(exec, "#$%^");
-    JSValue v2 = JSONParse(exec, String());
-    UChar emptyUCharArray[1] = { '\0' };
-    JSValue v3 = JSONParse(exec, String(emptyUCharArray, 0));
-    JSValue v4;
-    JSValue v5 = JSONParse(exec, "123");
+        ExecState* exec = globalObject->globalExec();
+        JSValue v0 = JSONParse(exec, "");
+        JSValue v1 = JSONParse(exec, "#$%^");
+        JSValue v2 = JSONParse(exec, String());
+        UChar emptyUCharArray[1] = { '\0' };
+        JSValue v3 = JSONParse(exec, String(emptyUCharArray, 0));
+        JSValue v4;
+        JSValue v5 = JSONParse(exec, "123");
 
-    failed = failed || (v0 != v1);
-    failed = failed || (v1 != v2);
-    failed = failed || (v2 != v3);
-    failed = failed || (v3 != v4);
-    failed = failed || (v4 == v5);
-
-    vm = nullptr;
+        failed = failed || (v0 != v1);
+        failed = failed || (v1 != v2);
+        failed = failed || (v2 != v3);
+        failed = failed || (v3 != v4);
+        failed = failed || (v4 == v5);
+    }
 
     if (failed)
         printf("FAIL: JSONParse String test.\n");
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 413d2ec..c8c60ef 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,307 @@
+2017-02-15  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Drop PassRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=168320
+
+        Reviewed by Saam Barati.
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreateInGroup):
+        Use Ref<VM> from the factory function.
+
+        * API/JSScriptRef.cpp:
+        (OpaqueJSScript::create):
+        Return Ref<> instead.
+
+        * API/tests/JSONParseTest.cpp:
+        (testJSONParse):
+        Use Ref<VM>.
+
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::finalizeCodeWithoutDisassembly):
+        Use reference since we already perform null check.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
+        Take Ref<>&& instead of PassRefPtr<>.
+
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::setStub):
+        (JSC::CallLinkInfo::setSlowStub):
+        Take Ref<>&& instead of PassRefPtr<>.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        Take RefPtr<SourceProvider>. Currently, the SourceProvider would be nullptr.
+        We will change it to Ref<SourceProvider> in https://bugs.webkit.org/show_bug.cgi?id=168325.
+
+        (JSC::CodeBlock::finishCreation):
+        Take Ref<TypeSet>&&.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setJITCode):
+        Take Ref<>&& instead.
+
+        (JSC::CodeBlock::jitCode):
+        Return RefPtr<> instead.
+
+        * bytecode/EvalCodeBlock.h:
+        (JSC::EvalCodeBlock::create):
+        Take RefPtr<>&& instead since SourceProvider woule be nullptr.
+
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        * bytecode/FunctionCodeBlock.h:
+        (JSC::FunctionCodeBlock::create):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        Take RefPtr<>&& instead since SourceProvider woule be nullptr.
+
+        * bytecode/GlobalCodeBlock.h:
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        Take RefPtr<>&& instead since SourceProvider woule be nullptr.
+
+        * bytecode/ModuleProgramCodeBlock.h:
+        (JSC::ModuleProgramCodeBlock::create):
+        (JSC::ModuleProgramCodeBlock::ModuleProgramCodeBlock):
+        Take RefPtr<>&& instead since SourceProvider woule be nullptr.
+
+        * bytecode/ProgramCodeBlock.h:
+        (JSC::ProgramCodeBlock::create):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        Take RefPtr<>&& instead since SourceProvider woule be nullptr.
+
+        * debugger/DebuggerParseData.cpp:
+        (JSC::gatherDebuggerParseDataForSource):
+        Ensure the provider is not nullptr. It is OK because we already
+        touch `provider->xxx` values.
+
+        * dfg/DFGBlockInsertionSet.cpp:
+        (JSC::DFG::BlockInsertionSet::insert):
+        Take Ref<>&& instead.
+
+        * dfg/DFGBlockInsertionSet.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::inlineCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        Pass Ref<>&& to appendBlock.
+
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        (JSC::DFG::compile):
+        Pass Ref<Plan>&&. And take Ref<>&& callback.
+
+        * dfg/DFGDriver.h:
+        * dfg/DFGGraph.h:
+        appendBlock takes Ref<>&&.
+
+        (JSC::DFG::Graph::appendBlock):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::jitCode):
+        * dfg/DFGJITFinalizer.cpp:
+        (JSC::DFG::JITFinalizer::JITFinalizer):
+        Take Ref<JITCode>&&.
+
+        (JSC::DFG::JITFinalizer::finalize):
+        (JSC::DFG::JITFinalizer::finalizeFunction):
+        (JSC::DFG::JITFinalizer::finalizeCommon):
+        Pass compilation reference since we already perform null check.
+
+        * dfg/DFGJITFinalizer.h:
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::enqueue):
+        Take Ref<Plan>&&.
+
+        * dfg/DFGWorklist.h:
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        Dereference and pass jitCode & compilation references.
+
+        * jit/GCAwareJITStubRoutine.cpp:
+        (JSC::createJITStubRoutine):
+        Return Ref<> instead.
+
+        * jit/GCAwareJITStubRoutine.h:
+        (JSC::createJITStubRoutine):
+        * jit/JIT.cpp:
+        (JSC::JIT::link):
+        Pass compilation reference since we already perform null check.
+
+        * jit/JITStubRoutine.h:
+        (JSC::JITStubRoutine::asCodePtr):
+        Take Ref<>&& instead. And this drops unnecessary null check.
+
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+        Pass Ref<> to NativeExecutable::create.
+
+        * llint/LLIntEntrypoint.cpp:
+        (JSC::LLInt::setFunctionEntrypoint):
+        (JSC::LLInt::setEvalEntrypoint):
+        (JSC::LLInt::setProgramEntrypoint):
+        (JSC::LLInt::setModuleProgramEntrypoint):
+        Use Ref<>&& instead.
+
+        * parser/SourceCode.h:
+        (JSC::SourceCode::SourceCode):
+        (JSC::SourceCode::subExpression):
+        Add constructors taking Ref<>&&.
+        We still have constructors that take RefPtr<>&&.
+        We will change it to Ref<SourceProvider>&& in https://bugs.webkit.org/show_bug.cgi?id=168325.
+
+        * parser/UnlinkedSourceCode.h:
+        (JSC::UnlinkedSourceCode::UnlinkedSourceCode):
+        Add constructors taking Ref<>&&.
+        We still have constructors that take RefPtr<>&&.
+        We will change it to Ref<SourceProvider>&& in https://bugs.webkit.org/show_bug.cgi?id=168325.
+
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::addCompilation):
+        Take Ref<Compilation>&&.
+
+        * profiler/ProfilerDatabase.h:
+        Change data structures to hold Ref<> instead of RefPtr<>.
+
+        * runtime/EvalExecutable.h:
+        (JSC::EvalExecutable::generatedJITCode):
+        Return Ref<> instead.
+
+        * runtime/ExecutableBase.h:
+        (JSC::ExecutableBase::generatedJITCodeForCall):
+        (JSC::ExecutableBase::generatedJITCodeForConstruct):
+        (JSC::ExecutableBase::generatedJITCodeFor):
+        Return Ref<> instead.
+
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::add8):
+        * runtime/Identifier.h:
+        (JSC::Identifier::add):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::setInputCursor):
+        And take Ref<> in this method.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::inputCursor):
+        Change m_inputCursor from RefPtr<> to Ref<>.
+
+        * runtime/JSPropertyNameEnumerator.cpp:
+        (JSC::JSPropertyNameEnumerator::create):
+        (JSC::JSPropertyNameEnumerator::finishCreation):
+        Take Ref<PropertyNameArray>&&.
+
+        * runtime/JSPropertyNameEnumerator.h:
+        (JSC::propertyNameEnumerator):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        Take Ref<StringImpl>&& since we do not allow nullptr in this constructor.
+
+        (JSC::JSString::create):
+        (JSC::JSString::createHasOtherOwner):
+        Take Ref<StringImpl>&& in these factory functions. And drop unnecessary assertions.
+
+        (JSC::jsSingleCharacterString):
+        Use StringImpl::create() which returns Ref<>.
+
+        (JSC::jsNontrivialString):
+        Dereference impl() since we ensure that `s.length() > 1`.
+
+        (JSC::jsString):
+        Use releaseNonNull() since we ensure that `s.length() > 1`.
+
+        (JSC::jsOwnedString):
+        Use releaseNonNull() since we ensure that `s.length() > 1`.
+
+        * runtime/ModuleProgramExecutable.h:
+        * runtime/NativeExecutable.cpp:
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::finishCreation):
+        Take Ref<JITCode>&&.
+
+        * runtime/NativeExecutable.h:
+        * runtime/ProgramExecutable.h:
+        Return Ref<JITCode>.
+
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::releaseData):
+        (JSC::PropertyNameArray::setData): Deleted.
+        This is not used.
+
+        * runtime/RegExpKey.h:
+        (JSC::RegExpKey::RegExpKey):
+        Take RefPtr<>&&.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::rep):
+        Return StringImpl& since m_reps is already initialized in the constructor.
+
+        (JSC::SmallStrings::createEmptyString):
+        Dereference StringImpl::empty().
+
+        (JSC::SmallStrings::createSingleCharacterString):
+        Use StringImpl&.
+
+        (JSC::SmallStrings::singleCharacterStringRep):
+        Return StringImpl&.
+
+        (JSC::SmallStrings::initialize):
+        Use AtomicStringImpl::add instead.
+
+        * runtime/SmallStrings.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::toStructureShape):
+        Return Ref<>.
+
+        * runtime/Structure.h:
+        * runtime/TypeLocationCache.cpp:
+        (JSC::TypeLocationCache::getTypeLocation):
+        Take RefPtr<TypeSet>&&.
+
+        * runtime/TypeLocationCache.h:
+        * runtime/TypeProfilerLog.cpp:
+        Pass Ref<>&&.
+
+        (JSC::TypeProfilerLog::processLogEntries):
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::addTypeInformation):
+        Take RefPtr<>&& since it can be nullptr.
+        And clean up "not found" code.
+
+        (JSC::TypeSet::allStructureRepresentations):
+        Use range based iteration.
+
+        (JSC::StructureShape::leastCommonAncestor):
+        We found that this method accidentally takes `const Vector<>` instead of `const Vector<>&`.
+        And internally, we just use raw pointers since these StructureShapes are owned by the m_proto trees which starts from the given Vector<>.
+
+        (JSC::StructureShape::hasSamePrototypeChain):
+        Take const reference instead. And use raw pointers internally.
+
+        (JSC::StructureShape::merge):
+        Take Ref<>&&.
+
+        * runtime/TypeSet.h:
+        (JSC::StructureShape::setProto):
+        Take Ref<>&&.
+
+        * runtime/VM.cpp:
+        (JSC::VM::getHostFunction):
+        Pass Ref<>&&.
+
+        (JSC::VM::queueMicrotask):
+        Take and pass Ref<>&&.
+
+        * runtime/VM.h:
+        (JSC::QueuedTask::QueuedTask):
+        Take Ref<>&&.
+
+        * tools/FunctionOverrides.cpp:
+        (JSC::initializeOverrideInfo):
+        We need this change due to Ref<>&& and RefPtr<>&& ambiguity of SourceCode constructors.
+        Once SourceCode is fixed to only take Ref<>&&, this change is unnecessary.
+
 2017-02-15  Csaba Osztrogonác  <ossy@webkit.org>
 
         [Mac][cmake] Unreviewed trivial buildfix after r212169.
diff --git a/Source/JavaScriptCore/assembler/LinkBuffer.cpp b/Source/JavaScriptCore/assembler/LinkBuffer.cpp
index 9010967..5918cf9 100644
--- a/Source/JavaScriptCore/assembler/LinkBuffer.cpp
+++ b/Source/JavaScriptCore/assembler/LinkBuffer.cpp
@@ -50,7 +50,7 @@
     
     ASSERT(m_didAllocate);
     if (m_executableMemory)
-        return CodeRef(m_executableMemory);
+        return CodeRef(*m_executableMemory);
     
     return CodeRef::createSelfManagedCodeRef(MacroAssemblerCodePtr(m_code));
 }
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h b/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
index a71a486..c31cf85 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
@@ -27,7 +27,6 @@
 
 #include "ExecutableAllocator.h"
 #include <wtf/DataLog.h>
-#include <wtf/PassRefPtr.h>
 #include <wtf/PrintStream.h>
 #include <wtf/RefPtr.h>
 #include <wtf/text/CString.h>
@@ -354,9 +353,9 @@
     {
     }
 
-    MacroAssemblerCodeRef(PassRefPtr<ExecutableMemoryHandle> executableMemory)
+    MacroAssemblerCodeRef(Ref<ExecutableMemoryHandle>&& executableMemory)
         : m_codePtr(executableMemory->start())
-        , m_executableMemory(executableMemory)
+        , m_executableMemory(WTFMove(executableMemory))
     {
         ASSERT(m_executableMemory->isManaged());
         ASSERT(m_executableMemory->start());
diff --git a/Source/JavaScriptCore/bytecode/CallLinkInfo.h b/Source/JavaScriptCore/bytecode/CallLinkInfo.h
index 0a91020..91d3dd8 100644
--- a/Source/JavaScriptCore/bytecode/CallLinkInfo.h
+++ b/Source/JavaScriptCore/bytecode/CallLinkInfo.h
@@ -207,10 +207,10 @@
     void setExecutableDuringCompilation(ExecutableBase*);
     ExecutableBase* executable();
     
-    void setStub(PassRefPtr<PolymorphicCallStubRoutine> newStub)
+    void setStub(Ref<PolymorphicCallStubRoutine>&& newStub)
     {
         clearStub();
-        m_stub = newStub;
+        m_stub = WTFMove(newStub);
     }
 
     void clearStub();
@@ -220,9 +220,9 @@
         return m_stub.get();
     }
 
-    void setSlowStub(PassRefPtr<JITStubRoutine> newSlowStub)
+    void setSlowStub(Ref<JITStubRoutine>&& newSlowStub)
     {
-        m_slowStub = newSlowStub;
+        m_slowStub = WTFMove(newSlowStub);
     }
 
     void clearSlowStub()
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index eb26a6d..16c5871 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -1889,7 +1889,7 @@
 }
 
 CodeBlock::CodeBlock(VM* vm, Structure* structure, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock,
-    JSScope* scope, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
+    JSScope* scope, RefPtr<SourceProvider>&& sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
     : JSCell(*vm, structure)
     , m_globalObject(scope->globalObject()->vm(), this, scope->globalObject())
     , m_numCalleeLocals(unlinkedCodeBlock->m_numCalleeLocals)
@@ -1912,7 +1912,7 @@
     , m_vm(unlinkedCodeBlock->vm())
     , m_thisRegister(unlinkedCodeBlock->thisRegister())
     , m_scopeRegister(unlinkedCodeBlock->scopeRegister())
-    , m_source(sourceProvider)
+    , m_source(WTFMove(sourceProvider))
     , m_sourceOffset(sourceOffset)
     , m_firstLineColumnOffset(firstLineColumnOffset)
     , m_osrExitCounter(0)
@@ -2304,7 +2304,7 @@
             }
 
             std::pair<TypeLocation*, bool> locationPair = vm.typeProfiler()->typeLocationCache()->getTypeLocation(globalVariableID,
-                ownerExecutable->sourceID(), divotStart, divotEnd, globalTypeSet, &vm);
+                ownerExecutable->sourceID(), divotStart, divotEnd, WTFMove(globalTypeSet), &vm);
             TypeLocation* location = locationPair.first;
             bool isNewLocation = locationPair.second;
 
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index 1159bb3..1942ea2 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -118,7 +118,7 @@
 
 protected:
     CodeBlock(VM*, Structure*, CopyParsedBlockTag, CodeBlock& other);
-    CodeBlock(VM*, Structure*, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock*, JSScope*, PassRefPtr<SourceProvider>, unsigned sourceOffset, unsigned firstLineColumnOffset);
+    CodeBlock(VM*, Structure*, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock*, JSScope*, RefPtr<SourceProvider>&&, unsigned sourceOffset, unsigned firstLineColumnOffset);
 
     void finishCreation(VM&, CopyParsedBlockTag, CodeBlock& other);
     void finishCreation(VM&, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock*, JSScope*);
@@ -312,15 +312,15 @@
     // Exactly equivalent to codeBlock->ownerExecutable()->newReplacementCodeBlockFor(codeBlock->specializationKind())
     CodeBlock* newReplacement();
     
-    void setJITCode(PassRefPtr<JITCode> code)
+    void setJITCode(Ref<JITCode>&& code)
     {
         ASSERT(heap()->isDeferred());
         heap()->reportExtraMemoryAllocated(code->size());
         ConcurrentJSLocker locker(m_lock);
         WTF::storeStoreFence(); // This is probably not needed because the lock will also do something similar, but it's good to be paranoid.
-        m_jitCode = code;
+        m_jitCode = WTFMove(code);
     }
-    PassRefPtr<JITCode> jitCode() { return m_jitCode; }
+    RefPtr<JITCode> jitCode() { return m_jitCode; }
     static ptrdiff_t jitCodeOffset() { return OBJECT_OFFSETOF(CodeBlock, m_jitCode); }
     JITCode::JITType jitType() const
     {
diff --git a/Source/JavaScriptCore/bytecode/EvalCodeBlock.h b/Source/JavaScriptCore/bytecode/EvalCodeBlock.h
index e9e61ba..fde7b11 100644
--- a/Source/JavaScriptCore/bytecode/EvalCodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/EvalCodeBlock.h
@@ -47,10 +47,10 @@
     }
 
     static EvalCodeBlock* create(VM* vm, EvalExecutable* ownerExecutable, UnlinkedEvalCodeBlock* unlinkedCodeBlock,
-        JSScope* scope, PassRefPtr<SourceProvider> sourceProvider)
+        JSScope* scope, RefPtr<SourceProvider>&& sourceProvider)
     {
         EvalCodeBlock* instance = new (NotNull, allocateCell<EvalCodeBlock>(vm->heap))
-            EvalCodeBlock(vm, vm->evalCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, sourceProvider);
+            EvalCodeBlock(vm, vm->evalCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider));
         instance->finishCreation(*vm, ownerExecutable, unlinkedCodeBlock, scope);
         return instance;
     }
@@ -70,8 +70,8 @@
     }
         
     EvalCodeBlock(VM* vm, Structure* structure, EvalExecutable* ownerExecutable, UnlinkedEvalCodeBlock* unlinkedCodeBlock,
-        JSScope* scope, PassRefPtr<SourceProvider> sourceProvider)
-        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, 0, 1)
+        JSScope* scope, RefPtr<SourceProvider>&& sourceProvider)
+        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider), 0, 1)
     {
     }
     
diff --git a/Source/JavaScriptCore/bytecode/FunctionCodeBlock.h b/Source/JavaScriptCore/bytecode/FunctionCodeBlock.h
index 5b418b1..4f58d09 100644
--- a/Source/JavaScriptCore/bytecode/FunctionCodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/FunctionCodeBlock.h
@@ -48,10 +48,10 @@
     }
 
     static FunctionCodeBlock* create(VM* vm, FunctionExecutable* ownerExecutable, UnlinkedFunctionCodeBlock* unlinkedCodeBlock, JSScope* scope,
-        PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
+        RefPtr<SourceProvider>&& sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
     {
         FunctionCodeBlock* instance = new (NotNull, allocateCell<FunctionCodeBlock>(vm->heap))
-            FunctionCodeBlock(vm, vm->functionCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, sourceOffset, firstLineColumnOffset);
+            FunctionCodeBlock(vm, vm->functionCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider), sourceOffset, firstLineColumnOffset);
         instance->finishCreation(*vm, ownerExecutable, unlinkedCodeBlock, scope);
         return instance;
     }
@@ -68,8 +68,8 @@
     }
 
     FunctionCodeBlock(VM* vm, Structure* structure, FunctionExecutable* ownerExecutable, UnlinkedFunctionCodeBlock* unlinkedCodeBlock, JSScope* scope,
-        PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
-        : CodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, sourceOffset, firstLineColumnOffset)
+        RefPtr<SourceProvider>&& sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
+        : CodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider), sourceOffset, firstLineColumnOffset)
     {
     }
     
diff --git a/Source/JavaScriptCore/bytecode/GlobalCodeBlock.h b/Source/JavaScriptCore/bytecode/GlobalCodeBlock.h
index 9ab2226..aa29cca 100644
--- a/Source/JavaScriptCore/bytecode/GlobalCodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/GlobalCodeBlock.h
@@ -45,8 +45,8 @@
     {
     }
 
-    GlobalCodeBlock(VM* vm, Structure* structure, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock, JSScope* scope, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
-        : CodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, sourceOffset, firstLineColumnOffset)
+    GlobalCodeBlock(VM* vm, Structure* structure, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock, JSScope* scope, RefPtr<SourceProvider>&& sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
+        : CodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider), sourceOffset, firstLineColumnOffset)
     {
     }
 };
diff --git a/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h b/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h
index b3c3b11..62674ea 100644
--- a/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h
@@ -48,10 +48,10 @@
     }
 
     static ModuleProgramCodeBlock* create(VM* vm, ModuleProgramExecutable* ownerExecutable, UnlinkedModuleProgramCodeBlock* unlinkedCodeBlock,
-        JSScope* scope, PassRefPtr<SourceProvider> sourceProvider, unsigned firstLineColumnOffset)
+        JSScope* scope, RefPtr<SourceProvider>&& sourceProvider, unsigned firstLineColumnOffset)
     {
         ModuleProgramCodeBlock* instance = new (NotNull, allocateCell<ModuleProgramCodeBlock>(vm->heap))
-            ModuleProgramCodeBlock(vm, vm->moduleProgramCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, firstLineColumnOffset);
+            ModuleProgramCodeBlock(vm, vm->moduleProgramCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider), firstLineColumnOffset);
         instance->finishCreation(*vm, ownerExecutable, unlinkedCodeBlock, scope);
         return instance;
     }
@@ -68,8 +68,8 @@
     }
 
     ModuleProgramCodeBlock(VM* vm, Structure* structure, ModuleProgramExecutable* ownerExecutable, UnlinkedModuleProgramCodeBlock* unlinkedCodeBlock,
-        JSScope* scope, PassRefPtr<SourceProvider> sourceProvider, unsigned firstLineColumnOffset)
-        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, 0, firstLineColumnOffset)
+        JSScope* scope, RefPtr<SourceProvider>&& sourceProvider, unsigned firstLineColumnOffset)
+        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider), 0, firstLineColumnOffset)
     {
     }
 
diff --git a/Source/JavaScriptCore/bytecode/ProgramCodeBlock.h b/Source/JavaScriptCore/bytecode/ProgramCodeBlock.h
index 94c7a7a..8504ac4 100644
--- a/Source/JavaScriptCore/bytecode/ProgramCodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/ProgramCodeBlock.h
@@ -48,10 +48,10 @@
     }
 
     static ProgramCodeBlock* create(VM* vm, ProgramExecutable* ownerExecutable, UnlinkedProgramCodeBlock* unlinkedCodeBlock,
-        JSScope* scope, PassRefPtr<SourceProvider> sourceProvider, unsigned firstLineColumnOffset)
+        JSScope* scope, RefPtr<SourceProvider>&& sourceProvider, unsigned firstLineColumnOffset)
     {
         ProgramCodeBlock* instance = new (NotNull, allocateCell<ProgramCodeBlock>(vm->heap))
-            ProgramCodeBlock(vm, vm->programCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, firstLineColumnOffset);
+            ProgramCodeBlock(vm, vm->programCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider), firstLineColumnOffset);
         instance->finishCreation(*vm, ownerExecutable, unlinkedCodeBlock, scope);
         return instance;
     }
@@ -68,8 +68,8 @@
     }
 
     ProgramCodeBlock(VM* vm, Structure* structure, ProgramExecutable* ownerExecutable, UnlinkedProgramCodeBlock* unlinkedCodeBlock,
-        JSScope* scope, PassRefPtr<SourceProvider> sourceProvider, unsigned firstLineColumnOffset)
-        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, 0, firstLineColumnOffset)
+        JSScope* scope, RefPtr<SourceProvider>&& sourceProvider, unsigned firstLineColumnOffset)
+        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider), 0, firstLineColumnOffset)
     {
     }
 
diff --git a/Source/JavaScriptCore/debugger/DebuggerParseData.cpp b/Source/JavaScriptCore/debugger/DebuggerParseData.cpp
index 3b058ba..48f939f 100644
--- a/Source/JavaScriptCore/debugger/DebuggerParseData.cpp
+++ b/Source/JavaScriptCore/debugger/DebuggerParseData.cpp
@@ -167,9 +167,10 @@
 
 bool gatherDebuggerParseDataForSource(VM& vm, SourceProvider* provider, DebuggerParseData& debuggerParseData)
 {
+    ASSERT(provider);
     int startLine = provider->startPosition().m_line.oneBasedInt();
     int startColumn = provider->startPosition().m_column.oneBasedInt();
-    SourceCode completeSource(provider, startLine, startColumn);
+    SourceCode completeSource(*provider, startLine, startColumn);
 
     switch (provider->sourceType()) {
     case SourceProviderSourceType::Program:
diff --git a/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.cpp b/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.cpp
index d57c01c..4c93975 100644
--- a/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.cpp
+++ b/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.cpp
@@ -44,21 +44,22 @@
     m_insertions.append(insertion);
 }
 
-void BlockInsertionSet::insert(size_t index, PassRefPtr<BasicBlock> block)
+void BlockInsertionSet::insert(size_t index, Ref<BasicBlock>&& block)
 {
-    insert(BlockInsertion(index, block));
+    insert(BlockInsertion(index, WTFMove(block)));
 }
 
 BasicBlock* BlockInsertionSet::insert(size_t index, float executionCount)
 {
-    RefPtr<BasicBlock> block = adoptRef(new BasicBlock(
+    Ref<BasicBlock> block = adoptRef(*new BasicBlock(
         UINT_MAX,
         m_graph.block(0)->variablesAtHead.numberOfArguments(),
         m_graph.block(0)->variablesAtHead.numberOfLocals(),
         executionCount));
     block->isReachable = true;
-    insert(index, block);
-    return block.get();
+    auto* result = block.ptr();
+    insert(index, WTFMove(block));
+    return result;
 }
 
 BasicBlock* BlockInsertionSet::insertBefore(BasicBlock* before, float executionCount)
diff --git a/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.h b/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.h
index eecc447..b5b6a00 100644
--- a/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.h
+++ b/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.h
@@ -41,7 +41,7 @@
     ~BlockInsertionSet();
     
     void insert(const BlockInsertion&);
-    void insert(size_t index, PassRefPtr<BasicBlock>);
+    void insert(size_t index, Ref<BasicBlock>&&);
     BasicBlock* insert(size_t index, float executionCount);
     BasicBlock* insertBefore(BasicBlock* before, float executionCount);
 
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
index e5651f2..765c3b4 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -1629,7 +1629,7 @@
     ASSERT(lastBlock->terminal());
 
     // Need to create a new basic block for the continuation at the caller.
-    RefPtr<BasicBlock> block = adoptRef(new BasicBlock(nextOffset, m_numArguments, m_numLocals, 1));
+    Ref<BasicBlock> block = adoptRef(*new BasicBlock(nextOffset, m_numArguments, m_numLocals, 1));
 
     // Link the early returns to the basic block we're about to create.
     for (size_t i = 0; i < inlineStackEntry.m_unlinkedBlocks.size(); ++i) {
@@ -1640,22 +1640,22 @@
         Node* node = blockToLink->terminal();
         ASSERT(node->op() == Jump);
         ASSERT(!node->targetBlock());
-        node->targetBlock() = block.get();
+        node->targetBlock() = block.ptr();
         inlineStackEntry.m_unlinkedBlocks[i].m_needsEarlyReturnLinking = false;
         if (verbose)
             dataLog("Marking ", RawPointer(blockToLink), " as linked (jumps to return)\n");
         blockToLink->didLink();
     }
     
-    m_currentBlock = block.get();
+    m_currentBlock = block.ptr();
     ASSERT(m_inlineStackTop->m_caller->m_blockLinkingTargets.isEmpty() || m_inlineStackTop->m_caller->m_blockLinkingTargets.last()->bytecodeBegin < nextOffset);
     if (verbose)
-        dataLog("Adding unlinked block ", RawPointer(block.get()), " (many returns)\n");
+        dataLog("Adding unlinked block ", RawPointer(block.ptr()), " (many returns)\n");
     if (callerLinkability == CallerDoesNormalLinking) {
-        m_inlineStackTop->m_caller->m_unlinkedBlocks.append(UnlinkedBlock(block.get()));
-        m_inlineStackTop->m_caller->m_blockLinkingTargets.append(block.get());
+        m_inlineStackTop->m_caller->m_unlinkedBlocks.append(UnlinkedBlock(block.ptr()));
+        m_inlineStackTop->m_caller->m_blockLinkingTargets.append(block.ptr());
     }
-    m_graph.appendBlock(block);
+    m_graph.appendBlock(WTFMove(block));
     prepareToParseBlock();
 }
 
@@ -2002,9 +2002,9 @@
     
     for (unsigned i = 0; i < callLinkStatus.size(); ++i) {
         m_currentIndex = oldOffset;
-        RefPtr<BasicBlock> block = adoptRef(new BasicBlock(UINT_MAX, m_numArguments, m_numLocals, 1));
-        m_currentBlock = block.get();
-        m_graph.appendBlock(block);
+        Ref<BasicBlock> block = adoptRef(*new BasicBlock(UINT_MAX, m_numArguments, m_numLocals, 1));
+        m_currentBlock = block.ptr();
+        m_graph.appendBlock(block.copyRef());
         prepareToParseBlock();
         
         Node* myCallTargetNode = getDirect(calleeReg);
@@ -2017,9 +2017,9 @@
         if (!inliningResult) {
             // That failed so we let the block die. Nothing interesting should have been added to
             // the block. We also give up on inlining any of the (less frequent) callees.
-            ASSERT(m_currentBlock == block.get());
-            ASSERT(m_graph.m_blocks.last() == block);
-            m_graph.killBlockAndItsContents(block.get());
+            ASSERT(m_currentBlock == block.ptr());
+            ASSERT(m_graph.m_blocks.last() == block.ptr());
+            m_graph.killBlockAndItsContents(block.ptr());
             m_graph.m_blocks.removeLast();
             
             // The fact that inlining failed means we need a slow path.
@@ -2034,7 +2034,7 @@
             ASSERT(allAreClosureCalls);
             thingToCaseOn = callLinkStatus[i].executable();
         }
-        data.cases.append(SwitchCase(m_graph.freeze(thingToCaseOn), block.get()));
+        data.cases.append(SwitchCase(m_graph.freeze(thingToCaseOn), block.ptr()));
         m_currentIndex = nextOffset;
         m_exitOK = true;
         processSetLocalQueue(); // This only comes into play for intrinsics, since normal inlined code will leave an empty queue.
@@ -2052,17 +2052,17 @@
             dataLog("Finished inlining ", callLinkStatus[i], " at ", currentCodeOrigin(), ".\n");
     }
     
-    RefPtr<BasicBlock> slowPathBlock = adoptRef(
-        new BasicBlock(UINT_MAX, m_numArguments, m_numLocals, 1));
+    Ref<BasicBlock> slowPathBlock = adoptRef(
+        *new BasicBlock(UINT_MAX, m_numArguments, m_numLocals, 1));
     m_currentIndex = oldOffset;
     m_exitOK = true;
-    data.fallThrough = BranchTarget(slowPathBlock.get());
-    m_graph.appendBlock(slowPathBlock);
+    data.fallThrough = BranchTarget(slowPathBlock.ptr());
+    m_graph.appendBlock(slowPathBlock.copyRef());
     if (verbose)
-        dataLog("Marking ", RawPointer(slowPathBlock.get()), " as linked (slow path block)\n");
+        dataLog("Marking ", RawPointer(slowPathBlock.ptr()), " as linked (slow path block)\n");
     slowPathBlock->didLink();
     prepareToParseBlock();
-    m_currentBlock = slowPathBlock.get();
+    m_currentBlock = slowPathBlock.ptr();
     Node* myCallTargetNode = getDirect(calleeReg);
     if (couldTakeSlowPath) {
         addCall(
@@ -2086,17 +2086,17 @@
         landingBlocks.append(m_currentBlock);
     }
     
-    RefPtr<BasicBlock> continuationBlock = adoptRef(
-        new BasicBlock(UINT_MAX, m_numArguments, m_numLocals, 1));
-    m_graph.appendBlock(continuationBlock);
+    Ref<BasicBlock> continuationBlock = adoptRef(
+        *new BasicBlock(UINT_MAX, m_numArguments, m_numLocals, 1));
+    m_graph.appendBlock(continuationBlock.copyRef());
     if (verbose)
-        dataLog("Adding unlinked block ", RawPointer(continuationBlock.get()), " (continuation)\n");
-    m_inlineStackTop->m_unlinkedBlocks.append(UnlinkedBlock(continuationBlock.get()));
+        dataLog("Adding unlinked block ", RawPointer(continuationBlock.ptr()), " (continuation)\n");
+    m_inlineStackTop->m_unlinkedBlocks.append(UnlinkedBlock(continuationBlock.ptr()));
     prepareToParseBlock();
-    m_currentBlock = continuationBlock.get();
+    m_currentBlock = continuationBlock.ptr();
     
     for (unsigned i = landingBlocks.size(); i--;)
-        landingBlocks[i]->terminal()->targetBlock() = continuationBlock.get();
+        landingBlocks[i]->terminal()->targetBlock() = continuationBlock.ptr();
     
     m_currentIndex = oldOffset;
     m_exitOK = true;
@@ -5817,8 +5817,8 @@
                     m_currentBlock = m_graph.lastBlock();
                     m_currentBlock->bytecodeBegin = m_currentIndex;
                 } else {
-                    RefPtr<BasicBlock> block = adoptRef(new BasicBlock(m_currentIndex, m_numArguments, m_numLocals, 1));
-                    m_currentBlock = block.get();
+                    Ref<BasicBlock> block = adoptRef(*new BasicBlock(m_currentIndex, m_numArguments, m_numLocals, 1));
+                    m_currentBlock = block.ptr();
                     // This assertion checks two things:
                     // 1) If the bytecodeBegin is greater than currentIndex, then something has gone
                     //    horribly wrong. So, we're probably generating incorrect code.
@@ -5831,12 +5831,12 @@
                         ASSERT_UNUSED(
                             lastBegin, lastBegin == UINT_MAX || lastBegin < m_currentIndex);
                     }
-                    m_inlineStackTop->m_unlinkedBlocks.append(UnlinkedBlock(block.get()));
-                    m_inlineStackTop->m_blockLinkingTargets.append(block.get());
+                    m_inlineStackTop->m_unlinkedBlocks.append(UnlinkedBlock(block.ptr()));
+                    m_inlineStackTop->m_blockLinkingTargets.append(block.ptr());
                     // The first block is definitely an OSR target.
                     if (!m_graph.numBlocks())
                         block->isOSRTarget = true;
-                    m_graph.appendBlock(block);
+                    m_graph.appendBlock(WTFMove(block));
                     prepareToParseBlock();
                 }
             }
diff --git a/Source/JavaScriptCore/dfg/DFGDriver.cpp b/Source/JavaScriptCore/dfg/DFGDriver.cpp
index 14cd0d0..79377e7 100644
--- a/Source/JavaScriptCore/dfg/DFGDriver.cpp
+++ b/Source/JavaScriptCore/dfg/DFGDriver.cpp
@@ -70,7 +70,7 @@
 static CompilationResult compileImpl(
     VM& vm, CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock, CompilationMode mode,
     unsigned osrEntryBytecodeIndex, const Operands<JSValue>& mustHandleValues,
-    PassRefPtr<DeferredCompilationCallback> callback)
+    Ref<DeferredCompilationCallback>&& callback)
 {
     if (!Options::bytecodeRangeToDFGCompile().isInRange(codeBlock->instructionCount())
         || !ensureGlobalDFGWhitelist().contains(codeBlock))
@@ -96,15 +96,15 @@
     if (vm.typeProfiler())
         vm.typeProfilerLog()->processLogEntries(ASCIILiteral("Preparing for DFG compilation."));
     
-    RefPtr<Plan> plan = adoptRef(
-        new Plan(codeBlock, profiledDFGCodeBlock, mode, osrEntryBytecodeIndex, mustHandleValues));
+    Ref<Plan> plan = adoptRef(
+        *new Plan(codeBlock, profiledDFGCodeBlock, mode, osrEntryBytecodeIndex, mustHandleValues));
     
-    plan->callback = callback;
+    plan->callback = WTFMove(callback);
     if (Options::useConcurrentJIT()) {
         Worklist& worklist = ensureGlobalWorklistFor(mode);
         if (logCompilationChanges(mode))
             dataLog("Deferring DFG compilation of ", *codeBlock, " with queue length ", worklist.queueLength(), ".\n");
-        worklist.enqueue(plan);
+        worklist.enqueue(WTFMove(plan));
         return CompilationDeferred;
     }
     
@@ -114,7 +114,7 @@
 #else // ENABLE(DFG_JIT)
 static CompilationResult compileImpl(
     VM&, CodeBlock*, CodeBlock*, CompilationMode, unsigned, const Operands<JSValue>&,
-    PassRefPtr<DeferredCompilationCallback>)
+    Ref<DeferredCompilationCallback>&&)
 {
     return CompilationFailed;
 }
@@ -123,12 +123,11 @@
 CompilationResult compile(
     VM& vm, CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock, CompilationMode mode,
     unsigned osrEntryBytecodeIndex, const Operands<JSValue>& mustHandleValues,
-    PassRefPtr<DeferredCompilationCallback> passedCallback)
+    Ref<DeferredCompilationCallback>&& callback)
 {
-    RefPtr<DeferredCompilationCallback> callback = passedCallback;
     CompilationResult result = compileImpl(
         vm, codeBlock, profiledDFGCodeBlock, mode, osrEntryBytecodeIndex, mustHandleValues,
-        callback);
+        callback.copyRef());
     if (result != CompilationDeferred)
         callback->compilationDidComplete(codeBlock, profiledDFGCodeBlock, result);
     return result;
diff --git a/Source/JavaScriptCore/dfg/DFGDriver.h b/Source/JavaScriptCore/dfg/DFGDriver.h
index 1d58d1a8..1a2d18c 100644
--- a/Source/JavaScriptCore/dfg/DFGDriver.h
+++ b/Source/JavaScriptCore/dfg/DFGDriver.h
@@ -45,6 +45,6 @@
 CompilationResult compile(
     VM&, CodeBlock*, CodeBlock* profiledDFGCodeBlock, CompilationMode,
     unsigned osrEntryBytecodeIndex, const Operands<JSValue>& mustHandleValues,
-    PassRefPtr<DeferredCompilationCallback>);
+    Ref<DeferredCompilationCallback>&&);
 
 } } // namespace JSC::DFG
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.h b/Source/JavaScriptCore/dfg/DFGGraph.h
index 6d52469..3b32920 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.h
+++ b/Source/JavaScriptCore/dfg/DFGGraph.h
@@ -442,10 +442,10 @@
     BasicBlock* block(BlockIndex blockIndex) const { return m_blocks[blockIndex].get(); }
     BasicBlock* lastBlock() const { return block(numBlocks() - 1); }
 
-    void appendBlock(PassRefPtr<BasicBlock> basicBlock)
+    void appendBlock(Ref<BasicBlock>&& basicBlock)
     {
         basicBlock->index = m_blocks.size();
-        m_blocks.append(basicBlock);
+        m_blocks.append(WTFMove(basicBlock));
     }
     
     void killBlock(BlockIndex blockIndex)
diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
index 3513b5b..db5e525 100644
--- a/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
@@ -407,7 +407,7 @@
     disassemble(*linkBuffer);
     
     m_graph.m_plan.finalizer = std::make_unique<JITFinalizer>(
-        m_graph.m_plan, WTFMove(m_jitCode), WTFMove(linkBuffer));
+        m_graph.m_plan, m_jitCode.releaseNonNull(), WTFMove(linkBuffer));
 }
 
 void JITCompiler::compileFunction()
@@ -504,7 +504,7 @@
     MacroAssemblerCodePtr withArityCheck = linkBuffer->locationOf(m_arityCheck);
 
     m_graph.m_plan.finalizer = std::make_unique<JITFinalizer>(
-        m_graph.m_plan, WTFMove(m_jitCode), WTFMove(linkBuffer), withArityCheck);
+        m_graph.m_plan, m_jitCode.releaseNonNull(), WTFMove(linkBuffer), withArityCheck);
 }
 
 void JITCompiler::disassemble(LinkBuffer& linkBuffer)
diff --git a/Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp b/Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp
index 5391158..6b65ecc 100644
--- a/Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp
+++ b/Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp
@@ -37,9 +37,9 @@
 
 namespace JSC { namespace DFG {
 
-JITFinalizer::JITFinalizer(Plan& plan, PassRefPtr<JITCode> jitCode, std::unique_ptr<LinkBuffer> linkBuffer, MacroAssemblerCodePtr withArityCheck)
+JITFinalizer::JITFinalizer(Plan& plan, Ref<JITCode>&& jitCode, std::unique_ptr<LinkBuffer> linkBuffer, MacroAssemblerCodePtr withArityCheck)
     : Finalizer(plan)
-    , m_jitCode(jitCode)
+    , m_jitCode(WTFMove(jitCode))
     , m_linkBuffer(WTFMove(linkBuffer))
     , m_withArityCheck(withArityCheck)
 {
@@ -60,7 +60,7 @@
         FINALIZE_DFG_CODE(*m_linkBuffer, ("DFG JIT code for %s", toCString(CodeBlockWithJITType(m_plan.codeBlock, JITCode::DFGJIT)).data())),
         MacroAssemblerCodePtr());
     
-    m_plan.codeBlock->setJITCode(m_jitCode);
+    m_plan.codeBlock->setJITCode(m_jitCode.copyRef());
     
     finalizeCommon();
     
@@ -73,7 +73,7 @@
     m_jitCode->initializeCodeRef(
         FINALIZE_DFG_CODE(*m_linkBuffer, ("DFG JIT code for %s", toCString(CodeBlockWithJITType(m_plan.codeBlock, JITCode::DFGJIT)).data())),
         m_withArityCheck);
-    m_plan.codeBlock->setJITCode(m_jitCode);
+    m_plan.codeBlock->setJITCode(m_jitCode.copyRef());
     
     finalizeCommon();
     
@@ -91,7 +91,7 @@
 #endif // ENABLE(FTL_JIT)
     
     if (m_plan.compilation)
-        m_plan.vm->m_perBytecodeProfiler->addCompilation(m_plan.codeBlock, m_plan.compilation);
+        m_plan.vm->m_perBytecodeProfiler->addCompilation(m_plan.codeBlock, *m_plan.compilation);
     
     if (!m_plan.willTryToTierUp)
         m_plan.codeBlock->baselineVersion()->m_didFailFTLCompilation = true;
diff --git a/Source/JavaScriptCore/dfg/DFGJITFinalizer.h b/Source/JavaScriptCore/dfg/DFGJITFinalizer.h
index 1b21f8c..b1a2bc0 100644
--- a/Source/JavaScriptCore/dfg/DFGJITFinalizer.h
+++ b/Source/JavaScriptCore/dfg/DFGJITFinalizer.h
@@ -36,7 +36,7 @@
 
 class JITFinalizer : public Finalizer {
 public:
-    JITFinalizer(Plan&, PassRefPtr<JITCode>, std::unique_ptr<LinkBuffer>, MacroAssemblerCodePtr withArityCheck = MacroAssemblerCodePtr(MacroAssemblerCodePtr::EmptyValue));
+    JITFinalizer(Plan&, Ref<JITCode>&&, std::unique_ptr<LinkBuffer>, MacroAssemblerCodePtr withArityCheck = MacroAssemblerCodePtr(MacroAssemblerCodePtr::EmptyValue));
     virtual ~JITFinalizer();
     
     size_t codeSize() override;
@@ -46,7 +46,7 @@
 private:
     void finalizeCommon();
     
-    RefPtr<JITCode> m_jitCode;
+    Ref<JITCode> m_jitCode;
     std::unique_ptr<LinkBuffer> m_linkBuffer;
     MacroAssemblerCodePtr m_withArityCheck;
 };
diff --git a/Source/JavaScriptCore/dfg/DFGWorklist.cpp b/Source/JavaScriptCore/dfg/DFGWorklist.cpp
index 114ca95..af3b63e0 100644
--- a/Source/JavaScriptCore/dfg/DFGWorklist.cpp
+++ b/Source/JavaScriptCore/dfg/DFGWorklist.cpp
@@ -223,17 +223,16 @@
     return false;
 }
 
-void Worklist::enqueue(PassRefPtr<Plan> passedPlan)
+void Worklist::enqueue(Ref<Plan>&& plan)
 {
-    RefPtr<Plan> plan = passedPlan;
     LockHolder locker(*m_lock);
     if (Options::verboseCompilationQueue()) {
         dump(locker, WTF::dataFile());
         dataLog(": Enqueueing plan to optimize ", plan->key(), "\n");
     }
     ASSERT(m_plans.find(plan->key()) == m_plans.end());
-    m_plans.add(plan->key(), plan);
-    m_queue.append(plan);
+    m_plans.add(plan->key(), plan.copyRef());
+    m_queue.append(WTFMove(plan));
     m_planEnqueued->notifyOne(locker);
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGWorklist.h b/Source/JavaScriptCore/dfg/DFGWorklist.h
index 3661e6e..28d9abf 100644
--- a/Source/JavaScriptCore/dfg/DFGWorklist.h
+++ b/Source/JavaScriptCore/dfg/DFGWorklist.h
@@ -50,7 +50,7 @@
     
     static Ref<Worklist> create(CString worklistName, unsigned numberOfThreads, int relativePriority = 0);
     
-    void enqueue(PassRefPtr<Plan>);
+    void enqueue(Ref<Plan>&&);
     
     // This is equivalent to:
     // worklist->waitUntilAllPlansForVMAreReady(vm);
diff --git a/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp b/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp
index dcf3dad..00ea651 100644
--- a/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp
+++ b/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp
@@ -81,10 +81,10 @@
             dumpDisassembly, *entrypointLinkBuffer,
             ("FTL entrypoint thunk for %s with B3 generated code at %p", toCString(CodeBlockWithJITType(m_plan.codeBlock, JITCode::FTLJIT)).data(), function)));
     
-    m_plan.codeBlock->setJITCode(jitCode);
+    m_plan.codeBlock->setJITCode(*jitCode);
 
     if (m_plan.compilation)
-        m_plan.vm->m_perBytecodeProfiler->addCompilation(m_plan.codeBlock, m_plan.compilation);
+        m_plan.vm->m_perBytecodeProfiler->addCompilation(m_plan.codeBlock, *m_plan.compilation);
     
     return true;
 }
diff --git a/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp b/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp
index 31a2ae1..bab6de1 100644
--- a/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp
+++ b/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp
@@ -132,7 +132,7 @@
 }
 
 
-PassRefPtr<JITStubRoutine> createJITStubRoutine(
+Ref<JITStubRoutine> createJITStubRoutine(
     const MacroAssemblerCodeRef& code,
     VM& vm,
     const JSCell* owner,
@@ -142,17 +142,17 @@
     CallSiteIndex exceptionHandlerCallSiteIndex)
 {
     if (!makesCalls)
-        return adoptRef(new JITStubRoutine(code));
+        return adoptRef(*new JITStubRoutine(code));
     
     if (codeBlockForExceptionHandlers) {
         RELEASE_ASSERT(JITCode::isOptimizingJIT(codeBlockForExceptionHandlers->jitType()));
-        return adoptRef(new GCAwareJITStubRoutineWithExceptionHandler(code, vm, owner, cells, codeBlockForExceptionHandlers, exceptionHandlerCallSiteIndex));
+        return adoptRef(*new GCAwareJITStubRoutineWithExceptionHandler(code, vm, owner, cells, codeBlockForExceptionHandlers, exceptionHandlerCallSiteIndex));
     }
 
     if (cells.isEmpty())
-        return adoptRef(new GCAwareJITStubRoutine(code, vm));
+        return adoptRef(*new GCAwareJITStubRoutine(code, vm));
     
-    return adoptRef(new MarkingGCAwareJITStubRoutine(code, vm, owner, cells));
+    return adoptRef(*new MarkingGCAwareJITStubRoutine(code, vm, owner, cells));
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h b/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h
index a253da3..5ee36ca 100644
--- a/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h
+++ b/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h
@@ -111,7 +111,7 @@
 // appropriate. Generally you only need to pass pointers that will be used
 // after the first call to C++ or JS.
 // 
-// PassRefPtr<JITStubRoutine> createJITStubRoutine(
+// Ref<JITStubRoutine> createJITStubRoutine(
 //    const MacroAssemblerCodeRef& code,
 //    VM& vm,
 //    const JSCell* owner,
@@ -124,7 +124,7 @@
 // this function using varargs, I ended up with more code than this simple
 // way.
 
-PassRefPtr<JITStubRoutine> createJITStubRoutine(
+Ref<JITStubRoutine> createJITStubRoutine(
     const MacroAssemblerCodeRef&, VM&, const JSCell* owner, bool makesCalls,
     const Vector<JSCell*>& = { }, 
     CodeBlock* codeBlockForExceptionHandlers = nullptr, CallSiteIndex exceptionHandlingCallSiteIndex = CallSiteIndex(std::numeric_limits<unsigned>::max()));
diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
index 62c0436..e74219b 100644
--- a/Source/JavaScriptCore/jit/JIT.cpp
+++ b/Source/JavaScriptCore/jit/JIT.cpp
@@ -829,7 +829,7 @@
     if (m_compilation) {
         if (Options::disassembleBaselineForProfiler())
             m_disassembler->reportToProfiler(m_compilation.get(), patchBuffer);
-        m_vm->m_perBytecodeProfiler->addCompilation(m_codeBlock, m_compilation);
+        m_vm->m_perBytecodeProfiler->addCompilation(m_codeBlock, *m_compilation);
     }
 
     if (m_pcToCodeOriginMapBuilder.didBuildMapping())
@@ -845,7 +845,7 @@
 
     m_codeBlock->shrinkToFit(CodeBlock::LateShrink);
     m_codeBlock->setJITCode(
-        adoptRef(new DirectJITCode(result, withArityCheck, JITCode::BaselineJIT)));
+        adoptRef(*new DirectJITCode(result, withArityCheck, JITCode::BaselineJIT)));
 
 #if ENABLE(JIT_VERBOSE)
     dataLogF("JIT generated code for %p at [%p, %p).\n", m_codeBlock, result.executableMemory()->start(), result.executableMemory()->end());
diff --git a/Source/JavaScriptCore/jit/JITStubRoutine.h b/Source/JavaScriptCore/jit/JITStubRoutine.h
index 3047212..ebfe2ef 100644
--- a/Source/JavaScriptCore/jit/JITStubRoutine.h
+++ b/Source/JavaScriptCore/jit/JITStubRoutine.h
@@ -70,11 +70,8 @@
     // the churn.
     const MacroAssemblerCodeRef& code() const { return m_code; }
     
-    static MacroAssemblerCodePtr asCodePtr(PassRefPtr<JITStubRoutine> stubRoutine)
+    static MacroAssemblerCodePtr asCodePtr(Ref<JITStubRoutine>&& stubRoutine)
     {
-        if (!stubRoutine)
-            return MacroAssemblerCodePtr();
-        
         MacroAssemblerCodePtr result = stubRoutine->code().code();
         ASSERT(!!result);
         return result;
diff --git a/Source/JavaScriptCore/jit/JITThunks.cpp b/Source/JavaScriptCore/jit/JITThunks.cpp
index 60c3cc7..de48e62 100644
--- a/Source/JavaScriptCore/jit/JITThunks.cpp
+++ b/Source/JavaScriptCore/jit/JITThunks.cpp
@@ -108,9 +108,9 @@
     } else
         forCall = adoptRef(new NativeJITCode(JIT::compileCTINativeCall(vm, function), JITCode::HostCallThunk));
     
-    RefPtr<JITCode> forConstruct = adoptRef(new NativeJITCode(MacroAssemblerCodeRef::createSelfManagedCodeRef(ctiNativeConstruct(vm)), JITCode::HostCallThunk));
+    Ref<JITCode> forConstruct = adoptRef(*new NativeJITCode(MacroAssemblerCodeRef::createSelfManagedCodeRef(ctiNativeConstruct(vm)), JITCode::HostCallThunk));
     
-    NativeExecutable* nativeExecutable = NativeExecutable::create(*vm, forCall, function, forConstruct, constructor, intrinsic, signature, name);
+    NativeExecutable* nativeExecutable = NativeExecutable::create(*vm, forCall.releaseNonNull(), function, WTFMove(forConstruct), constructor, intrinsic, signature, name);
     weakAdd(*m_hostFunctionStubMap, std::make_tuple(function, constructor, name), Weak<NativeExecutable>(nativeExecutable, this));
     return nativeExecutable;
 }
diff --git a/Source/JavaScriptCore/llint/LLIntEntrypoint.cpp b/Source/JavaScriptCore/llint/LLIntEntrypoint.cpp
index f5918b7..f7d761d 100644
--- a/Source/JavaScriptCore/llint/LLIntEntrypoint.cpp
+++ b/Source/JavaScriptCore/llint/LLIntEntrypoint.cpp
@@ -46,12 +46,12 @@
     if (vm.canUseJIT()) {
         if (kind == CodeForCall) {
             codeBlock->setJITCode(
-                adoptRef(new DirectJITCode(vm.getCTIStub(functionForCallEntryThunkGenerator), vm.getCTIStub(functionForCallArityCheckThunkGenerator).code(), JITCode::InterpreterThunk)));
+                adoptRef(*new DirectJITCode(vm.getCTIStub(functionForCallEntryThunkGenerator), vm.getCTIStub(functionForCallArityCheckThunkGenerator).code(), JITCode::InterpreterThunk)));
             return;
         }
         ASSERT(kind == CodeForConstruct);
         codeBlock->setJITCode(
-            adoptRef(new DirectJITCode(vm.getCTIStub(functionForConstructEntryThunkGenerator), vm.getCTIStub(functionForConstructArityCheckThunkGenerator).code(), JITCode::InterpreterThunk)));
+            adoptRef(*new DirectJITCode(vm.getCTIStub(functionForConstructEntryThunkGenerator), vm.getCTIStub(functionForConstructArityCheckThunkGenerator).code(), JITCode::InterpreterThunk)));
         return;
     }
 #endif // ENABLE(JIT)
@@ -59,12 +59,12 @@
     UNUSED_PARAM(vm);
     if (kind == CodeForCall) {
         codeBlock->setJITCode(
-            adoptRef(new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_function_for_call_prologue), MacroAssemblerCodePtr::createLLIntCodePtr(llint_function_for_call_arity_check), JITCode::InterpreterThunk)));
+            adoptRef(*new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_function_for_call_prologue), MacroAssemblerCodePtr::createLLIntCodePtr(llint_function_for_call_arity_check), JITCode::InterpreterThunk)));
         return;
     }
     ASSERT(kind == CodeForConstruct);
     codeBlock->setJITCode(
-        adoptRef(new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_function_for_construct_prologue), MacroAssemblerCodePtr::createLLIntCodePtr(llint_function_for_construct_arity_check), JITCode::InterpreterThunk)));
+        adoptRef(*new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_function_for_construct_prologue), MacroAssemblerCodePtr::createLLIntCodePtr(llint_function_for_construct_arity_check), JITCode::InterpreterThunk)));
 }
 
 static void setEvalEntrypoint(VM& vm, CodeBlock* codeBlock)
@@ -72,14 +72,14 @@
 #if ENABLE(JIT)
     if (vm.canUseJIT()) {
         codeBlock->setJITCode(
-            adoptRef(new DirectJITCode(vm.getCTIStub(evalEntryThunkGenerator), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
+            adoptRef(*new DirectJITCode(vm.getCTIStub(evalEntryThunkGenerator), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
         return;
     }
 #endif // ENABLE(JIT)
 
     UNUSED_PARAM(vm);
     codeBlock->setJITCode(
-        adoptRef(new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_eval_prologue), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
+        adoptRef(*new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_eval_prologue), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
 }
 
 static void setProgramEntrypoint(VM& vm, CodeBlock* codeBlock)
@@ -87,14 +87,14 @@
 #if ENABLE(JIT)
     if (vm.canUseJIT()) {
         codeBlock->setJITCode(
-            adoptRef(new DirectJITCode(vm.getCTIStub(programEntryThunkGenerator), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
+            adoptRef(*new DirectJITCode(vm.getCTIStub(programEntryThunkGenerator), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
         return;
     }
 #endif // ENABLE(JIT)
 
     UNUSED_PARAM(vm);
     codeBlock->setJITCode(
-        adoptRef(new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_program_prologue), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
+        adoptRef(*new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_program_prologue), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
 }
 
 static void setModuleProgramEntrypoint(VM& vm, CodeBlock* codeBlock)
@@ -102,14 +102,14 @@
 #if ENABLE(JIT)
     if (vm.canUseJIT()) {
         codeBlock->setJITCode(
-            adoptRef(new DirectJITCode(vm.getCTIStub(moduleProgramEntryThunkGenerator), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
+            adoptRef(*new DirectJITCode(vm.getCTIStub(moduleProgramEntryThunkGenerator), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
         return;
     }
 #endif // ENABLE(JIT)
 
     UNUSED_PARAM(vm);
     codeBlock->setJITCode(
-        adoptRef(new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_module_program_prologue), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
+        adoptRef(*new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_module_program_prologue), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
 }
 
 void setEntrypoint(VM& vm, CodeBlock* codeBlock)
diff --git a/Source/JavaScriptCore/parser/SourceCode.h b/Source/JavaScriptCore/parser/SourceCode.h
index 8f4fd38..90f547a 100644
--- a/Source/JavaScriptCore/parser/SourceCode.h
+++ b/Source/JavaScriptCore/parser/SourceCode.h
@@ -41,20 +41,27 @@
         {
         }
 
-        SourceCode(PassRefPtr<SourceProvider> provider)
-            : UnlinkedSourceCode(provider)
+        SourceCode(Ref<SourceProvider>&& provider)
+            : UnlinkedSourceCode(WTFMove(provider))
         {
         }
 
-        SourceCode(PassRefPtr<SourceProvider> provider, int firstLine, int startColumn)
-            : UnlinkedSourceCode(provider)
+        SourceCode(Ref<SourceProvider>&& provider, int firstLine, int startColumn)
+            : UnlinkedSourceCode(WTFMove(provider))
             , m_firstLine(OrdinalNumber::fromOneBasedInt(std::max(firstLine, 1)))
             , m_startColumn(OrdinalNumber::fromOneBasedInt(std::max(startColumn, 1)))
         {
         }
 
-        SourceCode(PassRefPtr<SourceProvider> provider, int startOffset, int endOffset, int firstLine, int startColumn)
-            : UnlinkedSourceCode(provider, startOffset, endOffset)
+        SourceCode(Ref<SourceProvider>&& provider, int startOffset, int endOffset, int firstLine, int startColumn)
+            : UnlinkedSourceCode(WTFMove(provider), startOffset, endOffset)
+            , m_firstLine(OrdinalNumber::fromOneBasedInt(std::max(firstLine, 1)))
+            , m_startColumn(OrdinalNumber::fromOneBasedInt(std::max(startColumn, 1)))
+        {
+        }
+
+        SourceCode(RefPtr<SourceProvider>&& provider, int startOffset, int endOffset, int firstLine, int startColumn)
+            : UnlinkedSourceCode(WTFMove(provider), startOffset, endOffset)
             , m_firstLine(OrdinalNumber::fromOneBasedInt(std::max(firstLine, 1)))
             , m_startColumn(OrdinalNumber::fromOneBasedInt(std::max(startColumn, 1)))
         {
@@ -87,7 +94,7 @@
     inline SourceCode SourceCode::subExpression(unsigned openBrace, unsigned closeBrace, int firstLine, int startColumn)
     {
         startColumn += 1; // Convert to base 1.
-        return SourceCode(provider(), openBrace, closeBrace + 1, firstLine, startColumn);
+        return SourceCode(RefPtr<SourceProvider> { provider() }, openBrace, closeBrace + 1, firstLine, startColumn);
     }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/parser/UnlinkedSourceCode.h b/Source/JavaScriptCore/parser/UnlinkedSourceCode.h
index 29ecf5b..e68ce88 100644
--- a/Source/JavaScriptCore/parser/UnlinkedSourceCode.h
+++ b/Source/JavaScriptCore/parser/UnlinkedSourceCode.h
@@ -47,15 +47,22 @@
         {
         }
 
-        UnlinkedSourceCode(PassRefPtr<SourceProvider> provider)
-            : m_provider(provider)
+        UnlinkedSourceCode(Ref<SourceProvider>&& provider)
+            : m_provider(WTFMove(provider))
             , m_startOffset(0)
             , m_endOffset(m_provider->source().length())
         {
         }
 
-        UnlinkedSourceCode(PassRefPtr<SourceProvider> provider, int startOffset, int endOffset)
-            : m_provider(provider)
+        UnlinkedSourceCode(Ref<SourceProvider>&& provider, int startOffset, int endOffset)
+            : m_provider(WTFMove(provider))
+            , m_startOffset(startOffset)
+            , m_endOffset(endOffset)
+        {
+        }
+
+        UnlinkedSourceCode(RefPtr<SourceProvider>&& provider, int startOffset, int endOffset)
+            : m_provider(WTFMove(provider))
             , m_startOffset(startOffset)
             , m_endOffset(endOffset)
         {
@@ -91,6 +98,8 @@
         int length() const { return m_endOffset - m_startOffset; }
 
     protected:
+        // FIXME: Make it Ref<SourceProvidier>.
+        // https://bugs.webkit.org/show_bug.cgi?id=168325
         RefPtr<SourceProvider> m_provider;
         int m_startOffset;
         int m_endOffset;
diff --git a/Source/JavaScriptCore/profiler/ProfilerDatabase.cpp b/Source/JavaScriptCore/profiler/ProfilerDatabase.cpp
index 8ed9f18..01cefc4 100644
--- a/Source/JavaScriptCore/profiler/ProfilerDatabase.cpp
+++ b/Source/JavaScriptCore/profiler/ProfilerDatabase.cpp
@@ -86,15 +86,13 @@
     m_compilationMap.remove(codeBlock);
 }
 
-void Database::addCompilation(CodeBlock* codeBlock, PassRefPtr<Compilation> passedCompilation)
+void Database::addCompilation(CodeBlock* codeBlock, Ref<Compilation>&& compilation)
 {
     LockHolder locker(m_lock);
     ASSERT(!isCompilationThread());
 
-    RefPtr<Compilation> compilation = passedCompilation;
-    
-    m_compilations.append(compilation);
-    m_compilationMap.set(codeBlock, compilation);
+    m_compilations.append(compilation.copyRef());
+    m_compilationMap.set(codeBlock, WTFMove(compilation));
 }
 
 JSValue Database::toJS(ExecState* exec) const
diff --git a/Source/JavaScriptCore/profiler/ProfilerDatabase.h b/Source/JavaScriptCore/profiler/ProfilerDatabase.h
index 206aa3a..b9ef36c 100644
--- a/Source/JavaScriptCore/profiler/ProfilerDatabase.h
+++ b/Source/JavaScriptCore/profiler/ProfilerDatabase.h
@@ -34,7 +34,6 @@
 #include <wtf/HashMap.h>
 #include <wtf/Lock.h>
 #include <wtf/Noncopyable.h>
-#include <wtf/PassRefPtr.h>
 #include <wtf/SegmentedVector.h>
 #include <wtf/ThreadingPrimitives.h>
 #include <wtf/text/WTFString.h>
@@ -52,7 +51,7 @@
     Bytecodes* ensureBytecodesFor(CodeBlock*);
     void notifyDestruction(CodeBlock*);
     
-    void addCompilation(CodeBlock*, PassRefPtr<Compilation>);
+    void addCompilation(CodeBlock*, Ref<Compilation>&&);
     
     // Converts the database to a JavaScript object that is suitable for JSON stringification.
     // Note that it's probably a good idea to use an ExecState* associated with a global
@@ -85,8 +84,8 @@
     VM& m_vm;
     SegmentedVector<Bytecodes> m_bytecodes;
     HashMap<CodeBlock*, Bytecodes*> m_bytecodesMap;
-    Vector<RefPtr<Compilation>> m_compilations;
-    HashMap<CodeBlock*, RefPtr<Compilation>> m_compilationMap;
+    Vector<Ref<Compilation>> m_compilations;
+    HashMap<CodeBlock*, Ref<Compilation>> m_compilationMap;
     Vector<Event> m_events;
     bool m_shouldSaveAtExit;
     CString m_atExitSaveFilename;
diff --git a/Source/JavaScriptCore/runtime/EvalExecutable.h b/Source/JavaScriptCore/runtime/EvalExecutable.h
index a6bab67..c871e5f 100644
--- a/Source/JavaScriptCore/runtime/EvalExecutable.h
+++ b/Source/JavaScriptCore/runtime/EvalExecutable.h
@@ -43,7 +43,7 @@
         return m_evalCodeBlock.get();
     }
 
-    PassRefPtr<JITCode> generatedJITCode()
+    Ref<JITCode> generatedJITCode()
     {
         return generatedJITCodeForCall();
     }
diff --git a/Source/JavaScriptCore/runtime/ExecutableBase.h b/Source/JavaScriptCore/runtime/ExecutableBase.h
index 5d1e0b4..62816a5 100644
--- a/Source/JavaScriptCore/runtime/ExecutableBase.h
+++ b/Source/JavaScriptCore/runtime/ExecutableBase.h
@@ -125,19 +125,19 @@
     int m_numParametersForConstruct;
 
 public:
-    PassRefPtr<JITCode> generatedJITCodeForCall()
+    Ref<JITCode> generatedJITCodeForCall()
     {
         ASSERT(m_jitCodeForCall);
-        return m_jitCodeForCall;
+        return *m_jitCodeForCall;
     }
 
-    PassRefPtr<JITCode> generatedJITCodeForConstruct()
+    Ref<JITCode> generatedJITCodeForConstruct()
     {
         ASSERT(m_jitCodeForConstruct);
-        return m_jitCodeForConstruct;
+        return *m_jitCodeForConstruct;
     }
         
-    PassRefPtr<JITCode> generatedJITCodeFor(CodeSpecializationKind kind)
+    Ref<JITCode> generatedJITCodeFor(CodeSpecializationKind kind)
     {
         if (kind == CodeForCall)
             return generatedJITCodeForCall();
diff --git a/Source/JavaScriptCore/runtime/Identifier.cpp b/Source/JavaScriptCore/runtime/Identifier.cpp
index b0c5c3e..99256d6 100644
--- a/Source/JavaScriptCore/runtime/Identifier.cpp
+++ b/Source/JavaScriptCore/runtime/Identifier.cpp
@@ -42,7 +42,7 @@
     ASSERT(c);
     ASSERT(c[0]);
     if (!c[1])
-        return *vm->smallStrings.singleCharacterStringRep(c[0]);
+        return vm->smallStrings.singleCharacterStringRep(c[0]);
 
     return *AtomicStringImpl::add(c);
 }
@@ -58,7 +58,7 @@
         UChar c = s[0];
         ASSERT(c <= 0xff);
         if (canUseSingleCharacterString(c))
-            return *vm->smallStrings.singleCharacterStringRep(c);
+            return vm->smallStrings.singleCharacterStringRep(c);
     }
     if (!length)
         return *StringImpl::empty();
diff --git a/Source/JavaScriptCore/runtime/Identifier.h b/Source/JavaScriptCore/runtime/Identifier.h
index 25e16ae..a963b433 100644
--- a/Source/JavaScriptCore/runtime/Identifier.h
+++ b/Source/JavaScriptCore/runtime/Identifier.h
@@ -218,7 +218,7 @@
     if (length == 1) {
         T c = s[0];
         if (canUseSingleCharacterString(c))
-            return *vm->smallStrings.singleCharacterStringRep(c);
+            return vm->smallStrings.singleCharacterStringRep(c);
     }
     if (!length)
         return *StringImpl::empty();
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index dd7463c..cf4e16f 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -1362,18 +1362,15 @@
 }
 
 #if ENABLE(WEB_REPLAY)
-void JSGlobalObject::setInputCursor(PassRefPtr<InputCursor> prpCursor)
+void JSGlobalObject::setInputCursor(Ref<InputCursor>&& cursor)
 {
-    m_inputCursor = prpCursor;
-    ASSERT(m_inputCursor);
-
-    InputCursor& cursor = inputCursor();
+    m_inputCursor = WTFMove(cursor);
     // Save or set the random seed. This performed here rather than the constructor
     // to avoid threading the input cursor through all the abstraction layers.
-    if (cursor.isCapturing())
-        cursor.appendInput<SetRandomSeed>(m_weakRandom.seed());
-    else if (cursor.isReplaying()) {
-        if (SetRandomSeed* input = cursor.fetchInput<SetRandomSeed>())
+    if (m_inputCursor->isCapturing())
+        m_inputCursor->appendInput<SetRandomSeed>(m_weakRandom.seed());
+    else if (m_inputCursor->isReplaying()) {
+        if (SetRandomSeed* input = m_inputCursor->fetchInput<SetRandomSeed>())
             m_weakRandom.setSeed(static_cast<unsigned>(input->randomSeed()));
     }
 }
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
index f9de641..a909679 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
@@ -44,7 +44,6 @@
 #include <JavaScriptCore/JSBase.h>
 #include <array>
 #include <wtf/HashSet.h>
-#include <wtf/PassRefPtr.h>
 
 struct OpaqueJSClass;
 struct OpaqueJSClassContextData;
@@ -379,7 +378,7 @@
     VM& m_vm;
 
 #if ENABLE(WEB_REPLAY)
-    RefPtr<InputCursor> m_inputCursor;
+    Ref<InputCursor> m_inputCursor;
 #endif
 
 #if ENABLE(REMOTE_INSPECTOR)
@@ -617,8 +616,8 @@
     JS_EXPORT_PRIVATE bool remoteDebuggingEnabled() const;
 
 #if ENABLE(WEB_REPLAY)
-    JS_EXPORT_PRIVATE void setInputCursor(PassRefPtr<InputCursor>);
-    InputCursor& inputCursor() const { return *m_inputCursor; }
+    JS_EXPORT_PRIVATE void setInputCursor(Ref<InputCursor>&&);
+    InputCursor& inputCursor() const { return m_inputCursor.get(); }
 #endif
 
 #if ENABLE(REMOTE_INSPECTOR)
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp b/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp
index dfd9651..d5f7091 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp
@@ -38,18 +38,18 @@
 {
     if (!vm.emptyPropertyNameEnumerator.get()) {
         PropertyNameArray propertyNames(&vm, PropertyNameMode::Strings);
-        vm.emptyPropertyNameEnumerator = Strong<JSCell>(vm, create(vm, 0, 0, 0, propertyNames));
+        vm.emptyPropertyNameEnumerator = Strong<JSCell>(vm, create(vm, 0, 0, 0, WTFMove(propertyNames)));
     }
     return jsCast<JSPropertyNameEnumerator*>(vm.emptyPropertyNameEnumerator.get());
 }
 
-JSPropertyNameEnumerator* JSPropertyNameEnumerator::create(VM& vm, Structure* structure, uint32_t indexedLength, uint32_t numberStructureProperties, PropertyNameArray& propertyNames)
+JSPropertyNameEnumerator* JSPropertyNameEnumerator::create(VM& vm, Structure* structure, uint32_t indexedLength, uint32_t numberStructureProperties, PropertyNameArray&& propertyNames)
 {
     StructureID structureID = structure ? structure->id() : 0;
     uint32_t inlineCapacity = structure ? structure->inlineCapacity() : 0;
     JSPropertyNameEnumerator* enumerator = new (NotNull, 
         allocateCell<JSPropertyNameEnumerator>(vm.heap)) JSPropertyNameEnumerator(vm, structureID, inlineCapacity);
-    enumerator->finishCreation(vm, indexedLength, numberStructureProperties, propertyNames.data());
+    enumerator->finishCreation(vm, indexedLength, numberStructureProperties, propertyNames.releaseData());
     return enumerator;
 }
 
@@ -60,11 +60,10 @@
 {
 }
 
-void JSPropertyNameEnumerator::finishCreation(VM& vm, uint32_t indexedLength, uint32_t endStructurePropertyIndex, PassRefPtr<PropertyNameArrayData> idents)
+void JSPropertyNameEnumerator::finishCreation(VM& vm, uint32_t indexedLength, uint32_t endStructurePropertyIndex, RefPtr<PropertyNameArrayData>&& identifiers)
 {
     Base::finishCreation(vm);
 
-    RefPtr<PropertyNameArrayData> identifiers = idents;
     PropertyNameArrayData::PropertyNameVector& vector = identifiers->propertyNameVector();
 
     m_indexedLength = indexedLength;
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h b/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h
index 3356143..5e12359 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h
@@ -38,7 +38,7 @@
     static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
 
     static JSPropertyNameEnumerator* create(VM&);
-    static JSPropertyNameEnumerator* create(VM&, Structure*, uint32_t, uint32_t, PropertyNameArray&);
+    static JSPropertyNameEnumerator* create(VM&, Structure*, uint32_t, uint32_t, PropertyNameArray&&);
 
     static const bool needsDestruction = true;
     static void destroy(JSCell*);
@@ -85,7 +85,7 @@
 
 private:
     JSPropertyNameEnumerator(VM&, StructureID, uint32_t);
-    void finishCreation(VM&, uint32_t, uint32_t, PassRefPtr<PropertyNameArrayData>);
+    void finishCreation(VM&, uint32_t, uint32_t, RefPtr<PropertyNameArrayData>&&);
 
     Vector<WriteBarrier<JSString>> m_propertyNames;
     StructureID m_cachedStructureID;
@@ -135,7 +135,7 @@
 
     normalizePrototypeChain(exec, structure);
 
-    enumerator = JSPropertyNameEnumerator::create(vm, structure, indexedLength, numberStructureProperties, propertyNames);
+    enumerator = JSPropertyNameEnumerator::create(vm, structure, indexedLength, numberStructureProperties, WTFMove(propertyNames));
     enumerator->setCachedPrototypeChain(vm, structure->prototypeChain(exec));
     if (!indexedLength && structure->canCachePropertyNameEnumerator())
         structure->setCachedPropertyNameEnumerator(vm, enumerator);
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index bcb5405..3fc677d 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -97,10 +97,10 @@
     static const unsigned MaxLength = std::numeric_limits<int32_t>::max();
     
 private:
-    JSString(VM& vm, PassRefPtr<StringImpl> value)
+    JSString(VM& vm, Ref<StringImpl>&& value)
         : JSCell(vm, vm.stringStructure.get())
         , m_flags(0)
-        , m_value(RefPtr<StringImpl>(value))
+        , m_value(WTFMove(value))
     {
     }
 
@@ -136,20 +136,18 @@
     }
 
 public:
-    static JSString* create(VM& vm, PassRefPtr<StringImpl> value)
+    static JSString* create(VM& vm, Ref<StringImpl>&& value)
     {
-        ASSERT(value);
         unsigned length = value->length();
         size_t cost = value->cost();
-        JSString* newString = new (NotNull, allocateCell<JSString>(vm.heap)) JSString(vm, value);
+        JSString* newString = new (NotNull, allocateCell<JSString>(vm.heap)) JSString(vm, WTFMove(value));
         newString->finishCreation(vm, length, cost);
         return newString;
     }
-    static JSString* createHasOtherOwner(VM& vm, PassRefPtr<StringImpl> value)
+    static JSString* createHasOtherOwner(VM& vm, Ref<StringImpl>&& value)
     {
-        ASSERT(value);
         size_t length = value->length();
-        JSString* newString = new (NotNull, allocateCell<JSString>(vm.heap)) JSString(vm, value);
+        JSString* newString = new (NotNull, allocateCell<JSString>(vm.heap)) JSString(vm, WTFMove(value));
         newString->finishCreation(vm, length);
         return newString;
     }
@@ -506,19 +504,19 @@
 {
     if (c <= maxSingleCharacterString)
         return vm->smallStrings.singleCharacterString(c);
-    return JSString::create(*vm, String(&c, 1).impl());
+    return JSString::create(*vm, StringImpl::create(&c, 1));
 }
 
 inline JSString* jsNontrivialString(VM* vm, const String& s)
 {
     ASSERT(s.length() > 1);
-    return JSString::create(*vm, s.impl());
+    return JSString::create(*vm, *s.impl());
 }
 
 inline JSString* jsNontrivialString(VM* vm, String&& s)
 {
     ASSERT(s.length() > 1);
-    return JSString::create(*vm, s.releaseImpl());
+    return JSString::create(*vm, s.releaseImpl().releaseNonNull());
 }
 
 ALWAYS_INLINE Identifier JSString::toIdentifier(ExecState* exec) const
@@ -572,7 +570,7 @@
         if (c <= maxSingleCharacterString)
             return vm->smallStrings.singleCharacterString(c);
     }
-    return JSString::create(*vm, s.impl());
+    return JSString::create(*vm, *s.impl());
 }
 
 inline JSString* jsSubstring(VM& vm, ExecState* exec, JSString* s, unsigned offset, unsigned length)
@@ -634,7 +632,7 @@
         if (c <= maxSingleCharacterString)
             return vm->smallStrings.singleCharacterString(c);
     }
-    return JSString::createHasOtherOwner(*vm, s.impl());
+    return JSString::createHasOtherOwner(*vm, *s.impl());
 }
 
 inline JSRopeString* jsStringBuilder(VM* vm)
diff --git a/Source/JavaScriptCore/runtime/ModuleProgramExecutable.h b/Source/JavaScriptCore/runtime/ModuleProgramExecutable.h
index 0c834e0..f424bad 100644
--- a/Source/JavaScriptCore/runtime/ModuleProgramExecutable.h
+++ b/Source/JavaScriptCore/runtime/ModuleProgramExecutable.h
@@ -44,7 +44,7 @@
         return m_moduleProgramCodeBlock.get();
     }
 
-    PassRefPtr<JITCode> generatedJITCode()
+    Ref<JITCode> generatedJITCode()
     {
         return generatedJITCodeForCall();
     }
diff --git a/Source/JavaScriptCore/runtime/NativeExecutable.cpp b/Source/JavaScriptCore/runtime/NativeExecutable.cpp
index b7dad2a..0f8d084 100644
--- a/Source/JavaScriptCore/runtime/NativeExecutable.cpp
+++ b/Source/JavaScriptCore/runtime/NativeExecutable.cpp
@@ -40,11 +40,11 @@
 
 const ClassInfo NativeExecutable::s_info = { "NativeExecutable", &ExecutableBase::s_info, 0, CREATE_METHOD_TABLE(NativeExecutable) };
 
-NativeExecutable* NativeExecutable::create(VM& vm, PassRefPtr<JITCode> callThunk, NativeFunction function, PassRefPtr<JITCode> constructThunk, NativeFunction constructor, Intrinsic intrinsic, const DOMJIT::Signature* signature, const String& name)
+NativeExecutable* NativeExecutable::create(VM& vm, Ref<JITCode>&& callThunk, NativeFunction function, Ref<JITCode>&& constructThunk, NativeFunction constructor, Intrinsic intrinsic, const DOMJIT::Signature* signature, const String& name)
 {
     NativeExecutable* executable;
     executable = new (NotNull, allocateCell<NativeExecutable>(vm.heap)) NativeExecutable(vm, function, constructor, intrinsic, signature);
-    executable->finishCreation(vm, callThunk, constructThunk, name);
+    executable->finishCreation(vm, WTFMove(callThunk), WTFMove(constructThunk), name);
     return executable;
 }
 
@@ -58,11 +58,11 @@
     return Structure::create(vm, globalObject, proto, TypeInfo(CellType, StructureFlags), info());
 }
 
-void NativeExecutable::finishCreation(VM& vm, PassRefPtr<JITCode> callThunk, PassRefPtr<JITCode> constructThunk, const String& name)
+void NativeExecutable::finishCreation(VM& vm, Ref<JITCode>&& callThunk, Ref<JITCode>&& constructThunk, const String& name)
 {
     Base::finishCreation(vm);
-    m_jitCodeForCall = callThunk;
-    m_jitCodeForConstruct = constructThunk;
+    m_jitCodeForCall = WTFMove(callThunk);
+    m_jitCodeForConstruct = WTFMove(constructThunk);
     m_jitCodeForCallWithArityCheck = m_jitCodeForCall->addressForCall(MustCheckArity);
     m_jitCodeForConstructWithArityCheck = m_jitCodeForConstruct->addressForCall(MustCheckArity);
     m_name = name;
diff --git a/Source/JavaScriptCore/runtime/NativeExecutable.h b/Source/JavaScriptCore/runtime/NativeExecutable.h
index e4d3e04..aa56cf4 100644
--- a/Source/JavaScriptCore/runtime/NativeExecutable.h
+++ b/Source/JavaScriptCore/runtime/NativeExecutable.h
@@ -39,7 +39,7 @@
     typedef ExecutableBase Base;
     static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
 
-    static NativeExecutable* create(VM&, PassRefPtr<JITCode> callThunk, NativeFunction function, PassRefPtr<JITCode> constructThunk, NativeFunction constructor, Intrinsic, const DOMJIT::Signature*, const String& name);
+    static NativeExecutable* create(VM&, Ref<JITCode>&& callThunk, NativeFunction function, Ref<JITCode>&& constructThunk, NativeFunction constructor, Intrinsic, const DOMJIT::Signature*, const String& name);
 
     static void destroy(JSCell*);
 
@@ -79,7 +79,7 @@
     }
 
 protected:
-    void finishCreation(VM&, PassRefPtr<JITCode> callThunk, PassRefPtr<JITCode> constructThunk, const String& name);
+    void finishCreation(VM&, Ref<JITCode>&& callThunk, Ref<JITCode>&& constructThunk, const String& name);
 
 private:
     friend class ExecutableBase;
diff --git a/Source/JavaScriptCore/runtime/ProgramExecutable.h b/Source/JavaScriptCore/runtime/ProgramExecutable.h
index 85ec4b5..b67fe82 100644
--- a/Source/JavaScriptCore/runtime/ProgramExecutable.h
+++ b/Source/JavaScriptCore/runtime/ProgramExecutable.h
@@ -53,7 +53,7 @@
 
     JSObject* checkSyntax(ExecState*);
 
-    PassRefPtr<JITCode> generatedJITCode()
+    Ref<JITCode> generatedJITCode()
     {
         return generatedJITCodeForCall();
     }
diff --git a/Source/JavaScriptCore/runtime/PropertyNameArray.h b/Source/JavaScriptCore/runtime/PropertyNameArray.h
index 8d1f2860..a7afe78 100644
--- a/Source/JavaScriptCore/runtime/PropertyNameArray.h
+++ b/Source/JavaScriptCore/runtime/PropertyNameArray.h
@@ -73,9 +73,8 @@
     Identifier& operator[](unsigned i) { return m_data->propertyNameVector()[i]; }
     const Identifier& operator[](unsigned i) const { return m_data->propertyNameVector()[i]; }
 
-    void setData(PassRefPtr<PropertyNameArrayData> data) { m_data = data; }
     PropertyNameArrayData* data() { return m_data.get(); }
-    PassRefPtr<PropertyNameArrayData> releaseData() { return WTFMove(m_data); }
+    RefPtr<PropertyNameArrayData> releaseData() { return WTFMove(m_data); }
 
     // FIXME: Remove these functions.
     bool canAddKnownUniqueForStructure() const { return m_data->propertyNameVector().isEmpty(); }
diff --git a/Source/JavaScriptCore/runtime/RegExpKey.h b/Source/JavaScriptCore/runtime/RegExpKey.h
index fd5f30e..57a3f35 100644
--- a/Source/JavaScriptCore/runtime/RegExpKey.h
+++ b/Source/JavaScriptCore/runtime/RegExpKey.h
@@ -63,9 +63,9 @@
     {
     }
 
-    RegExpKey(RegExpFlags flags, const PassRefPtr<StringImpl> pattern)
+    RegExpKey(RegExpFlags flags, RefPtr<StringImpl>&& pattern)
         : flagsValue(flags)
-        , pattern(pattern)
+        , pattern(WTFMove(pattern))
     {
     }
 
diff --git a/Source/JavaScriptCore/runtime/SmallStrings.cpp b/Source/JavaScriptCore/runtime/SmallStrings.cpp
index cac5d69..60e21b6 100644
--- a/Source/JavaScriptCore/runtime/SmallStrings.cpp
+++ b/Source/JavaScriptCore/runtime/SmallStrings.cpp
@@ -39,9 +39,9 @@
 public:
     SmallStringsStorage();
 
-    StringImpl* rep(unsigned char character)
+    StringImpl& rep(unsigned char character)
     {
-        return m_reps[character].get();
+        return *m_reps[character].get();
     }
 
 private:
@@ -110,7 +110,7 @@
 void SmallStrings::createEmptyString(VM* vm)
 {
     ASSERT(!m_emptyString);
-    m_emptyString = JSString::createHasOtherOwner(*vm, StringImpl::empty());
+    m_emptyString = JSString::createHasOtherOwner(*vm, *StringImpl::empty());
     ASSERT(m_needsToBeVisited);
 }
 
@@ -119,11 +119,11 @@
     if (!m_storage)
         m_storage = std::make_unique<SmallStringsStorage>();
     ASSERT(!m_singleCharacterStrings[character]);
-    m_singleCharacterStrings[character] = JSString::createHasOtherOwner(*vm, PassRefPtr<StringImpl>(m_storage->rep(character)));
+    m_singleCharacterStrings[character] = JSString::createHasOtherOwner(*vm, m_storage->rep(character));
     ASSERT(m_needsToBeVisited);
 }
 
-StringImpl* SmallStrings::singleCharacterStringRep(unsigned char character)
+StringImpl& SmallStrings::singleCharacterStringRep(unsigned char character)
 {
     if (!m_storage)
         m_storage = std::make_unique<SmallStringsStorage>();
@@ -132,7 +132,7 @@
 
 void SmallStrings::initialize(VM* vm, JSString*& string, const char* value)
 {
-    string = JSString::create(*vm, Identifier::fromString(vm, value).impl());
+    string = JSString::create(*vm, AtomicStringImpl::add(value).releaseNonNull());
     ASSERT(m_needsToBeVisited);
 }
 
diff --git a/Source/JavaScriptCore/runtime/SmallStrings.h b/Source/JavaScriptCore/runtime/SmallStrings.h
index 263b427..f31b5cd 100644
--- a/Source/JavaScriptCore/runtime/SmallStrings.h
+++ b/Source/JavaScriptCore/runtime/SmallStrings.h
@@ -71,7 +71,7 @@
         return m_singleCharacterStrings[character];
     }
 
-    JS_EXPORT_PRIVATE WTF::StringImpl* singleCharacterStringRep(unsigned char character);
+    JS_EXPORT_PRIVATE WTF::StringImpl& singleCharacterStringRep(unsigned char character);
 
     JSString** singleCharacterStrings() { return &m_singleCharacterStrings[0]; }
 
diff --git a/Source/JavaScriptCore/runtime/Structure.cpp b/Source/JavaScriptCore/runtime/Structure.cpp
index 072c3bb..44486db 100644
--- a/Source/JavaScriptCore/runtime/Structure.cpp
+++ b/Source/JavaScriptCore/runtime/Structure.cpp
@@ -1143,10 +1143,10 @@
     }
 }
 
-PassRefPtr<StructureShape> Structure::toStructureShape(JSValue value)
+Ref<StructureShape> Structure::toStructureShape(JSValue value)
 {
-    RefPtr<StructureShape> baseShape = StructureShape::create();
-    RefPtr<StructureShape> curShape = baseShape;
+    Ref<StructureShape> baseShape = StructureShape::create();
+    RefPtr<StructureShape> curShape = baseShape.ptr();
     Structure* curStructure = this;
     JSValue curValue = value;
     while (curStructure) {
@@ -1168,7 +1168,7 @@
 
         if (curStructure->storedPrototypeStructure()) {
             auto newShape = StructureShape::create();
-            curShape->setProto(newShape.ptr());
+            curShape->setProto(newShape.copyRef());
             curShape = WTFMove(newShape);
             curValue = curStructure->storedPrototype();
         }
@@ -1176,7 +1176,7 @@
         curStructure = curStructure->storedPrototypeStructure();
     }
     
-    return WTFMove(baseShape);
+    return baseShape;
 }
 
 bool Structure::canUseForAllocationsOf(Structure* other)
diff --git a/Source/JavaScriptCore/runtime/Structure.h b/Source/JavaScriptCore/runtime/Structure.h
index c17a343..b0f43b7 100644
--- a/Source/JavaScriptCore/runtime/Structure.h
+++ b/Source/JavaScriptCore/runtime/Structure.h
@@ -46,7 +46,6 @@
 #include "Weak.h"
 #include "WriteBarrierInlines.h"
 #include <wtf/CompilationThread.h>
-#include <wtf/PassRefPtr.h>
 #include <wtf/PrintStream.h>
 
 namespace WTF {
@@ -592,7 +591,7 @@
         willStoreValueSlow(vm, propertyName, value, shouldOptimize, InferredTypeTable::OldProperty);
     }
 
-    PassRefPtr<StructureShape> toStructureShape(JSValue);
+    Ref<StructureShape> toStructureShape(JSValue);
     
     // Determines if the two structures match enough that this one could be used for allocations
     // of the other one.
diff --git a/Source/JavaScriptCore/runtime/TypeLocationCache.cpp b/Source/JavaScriptCore/runtime/TypeLocationCache.cpp
index 4c8069a..b25b466 100644
--- a/Source/JavaScriptCore/runtime/TypeLocationCache.cpp
+++ b/Source/JavaScriptCore/runtime/TypeLocationCache.cpp
@@ -32,7 +32,7 @@
 
 namespace JSC {
 
-std::pair<TypeLocation*, bool> TypeLocationCache::getTypeLocation(GlobalVariableID globalVariableID, intptr_t sourceID, unsigned start, unsigned end, PassRefPtr<TypeSet> globalTypeSet, VM* vm)
+std::pair<TypeLocation*, bool> TypeLocationCache::getTypeLocation(GlobalVariableID globalVariableID, intptr_t sourceID, unsigned start, unsigned end, RefPtr<TypeSet>&& globalTypeSet, VM* vm)
 {
     LocationKey key;
     key.m_globalVariableID = globalVariableID;
@@ -48,7 +48,7 @@
         location->m_sourceID = sourceID;
         location->m_divotStart = start;
         location->m_divotEnd = end;
-        location->m_globalTypeSet = globalTypeSet;
+        location->m_globalTypeSet = WTFMove(globalTypeSet);
 
         m_locationMap[key] = location;
         isNewLocation = true;
diff --git a/Source/JavaScriptCore/runtime/TypeLocationCache.h b/Source/JavaScriptCore/runtime/TypeLocationCache.h
index 8e6545d..008ef73 100644
--- a/Source/JavaScriptCore/runtime/TypeLocationCache.h
+++ b/Source/JavaScriptCore/runtime/TypeLocationCache.h
@@ -56,7 +56,7 @@
         unsigned m_end;
     };
 
-    std::pair<TypeLocation*, bool> getTypeLocation(GlobalVariableID, intptr_t, unsigned start, unsigned end, PassRefPtr<TypeSet>, VM*);
+    std::pair<TypeLocation*, bool> getTypeLocation(GlobalVariableID, intptr_t, unsigned start, unsigned end, RefPtr<TypeSet>&&, VM*);
 private:     
     typedef std::unordered_map<LocationKey, TypeLocation*, HashMethod<LocationKey>> LocationMap;
     LocationMap m_locationMap;
diff --git a/Source/JavaScriptCore/runtime/TypeProfilerLog.cpp b/Source/JavaScriptCore/runtime/TypeProfilerLog.cpp
index 6d98335..85c49d0 100644
--- a/Source/JavaScriptCore/runtime/TypeProfilerLog.cpp
+++ b/Source/JavaScriptCore/runtime/TypeProfilerLog.cpp
@@ -82,8 +82,8 @@
         TypeLocation* location = entry->location;
         location->m_lastSeenType = type;
         if (location->m_globalTypeSet)
-            location->m_globalTypeSet->addTypeInformation(type, shape, structure);
-        location->m_instructionTypeSet->addTypeInformation(type, shape, structure);
+            location->m_globalTypeSet->addTypeInformation(type, shape.copyRef(), structure);
+        location->m_instructionTypeSet->addTypeInformation(type, WTFMove(shape), structure);
 
         entry++;
     }
diff --git a/Source/JavaScriptCore/runtime/TypeSet.cpp b/Source/JavaScriptCore/runtime/TypeSet.cpp
index 31ea7df..fb81138 100644
--- a/Source/JavaScriptCore/runtime/TypeSet.cpp
+++ b/Source/JavaScriptCore/runtime/TypeSet.cpp
@@ -41,12 +41,12 @@
 {
 }
 
-void TypeSet::addTypeInformation(RuntimeType type, PassRefPtr<StructureShape> prpNewShape, Structure* structure) 
+void TypeSet::addTypeInformation(RuntimeType type, RefPtr<StructureShape>&& passedNewShape, Structure* structure)
 {
-    RefPtr<StructureShape> newShape = prpNewShape;
     m_seenTypes = m_seenTypes | type;
 
-    if (structure && newShape && !runtimeTypeIsPrimitive(type)) {
+    if (structure && passedNewShape && !runtimeTypeIsPrimitive(type)) {
+        Ref<StructureShape> newShape = passedNewShape.releaseNonNull();
         if (!m_structureSet.contains(structure)) {
             {
                 ConcurrentJSLocker locker(m_lock);
@@ -56,26 +56,22 @@
             // - We don't have two instances of the same shape. (Same shapes may have different Structures).
             // - We don't have two shapes that share the same prototype chain. If these shapes share the same 
             //   prototype chain, they will be merged into one shape.
-            bool found = false;
             String hash = newShape->propertyHash();
             for (auto& seenShape : m_structureHistory) {
-                if (seenShape->propertyHash() == hash) {
-                    found = true;
-                    break;
-                } 
-                if (seenShape->hasSamePrototypeChain(newShape)) {
-                    seenShape = StructureShape::merge(seenShape, newShape);
-                    found = true;
-                    break;
+                if (seenShape->propertyHash() == hash)
+                    return;
+                if (seenShape->hasSamePrototypeChain(newShape.get())) {
+                    seenShape = StructureShape::merge(seenShape.copyRef(), WTFMove(newShape));
+                    return;
                 }
             }
 
-            if (!found) {
-                if (m_structureHistory.size() < 100)
-                    m_structureHistory.append(newShape);
-                else if (!m_isOverflown)
-                    m_isOverflown = true;
+            if (m_structureHistory.size() < 100) {
+                m_structureHistory.append(WTFMove(newShape));
+                return;
             }
+            if (!m_isOverflown)
+                m_isOverflown = true;
         }
     }
 }
@@ -222,8 +218,8 @@
 {
     auto description = Inspector::Protocol::Array<Inspector::Protocol::Runtime::StructureDescription>::create();
 
-    for (size_t i = 0; i < m_structureHistory.size(); i++)
-        description->addItem(m_structureHistory.at(i)->inspectorRepresentation());
+    for (auto& shape : m_structureHistory)
+        description->addItem(shape->inspectorRepresentation());
 
     return description;
 }
@@ -367,30 +363,30 @@
     return *m_propertyHash;
 }
 
-String StructureShape::leastCommonAncestor(const Vector<RefPtr<StructureShape>> shapes)
+String StructureShape::leastCommonAncestor(const Vector<Ref<StructureShape>>& shapes)
 {
-    if (!shapes.size())
+    if (shapes.isEmpty())
         return emptyString();
 
-    RefPtr<StructureShape> origin = shapes.at(0);
+    StructureShape* origin = shapes[0].ptr();
     for (size_t i = 1; i < shapes.size(); i++) {
         bool foundLUB = false;
         while (!foundLUB) {
-            RefPtr<StructureShape> check = shapes.at(i);
+            StructureShape* check = shapes[i].ptr();
             String curCtorName = origin->m_constructorName;
             while (check) {
                 if (check->m_constructorName == curCtorName) {
                     foundLUB = true;
                     break;
                 }
-                check = check->m_proto;
+                check = check->m_proto.get();
             }
             if (!foundLUB) {
-                origin = origin->m_proto;
                 // This is unlikely to happen, because we usually bottom out at "Object", but there are some sets of Objects
                 // that may cause this behavior. We fall back to "Object" because it's our version of Top.
-                if (!origin)
+                if (!origin->m_proto)
                     return ASCIILiteral("Object");
+                origin = origin->m_proto.get();
             }
         }
 
@@ -529,25 +525,23 @@
     return base;
 }
 
-bool StructureShape::hasSamePrototypeChain(PassRefPtr<StructureShape> prpOther)
+bool StructureShape::hasSamePrototypeChain(const StructureShape& otherRef)
 {
-    RefPtr<StructureShape> self = this;
-    RefPtr<StructureShape> other = prpOther;
+    const StructureShape* self = this;
+    const StructureShape* other = &otherRef;
     while (self && other) {
         if (self->m_constructorName != other->m_constructorName)
             return false;
-        self = self->m_proto;
-        other = other->m_proto;
+        self = self->m_proto.get();
+        other = other->m_proto.get();
     }
 
     return !self && !other;
 }
 
-PassRefPtr<StructureShape> StructureShape::merge(const PassRefPtr<StructureShape> prpA, const PassRefPtr<StructureShape> prpB)
+Ref<StructureShape> StructureShape::merge(Ref<StructureShape>&& a, Ref<StructureShape>&& b)
 {
-    RefPtr<StructureShape> a = prpA;
-    RefPtr<StructureShape> b = prpB;
-    ASSERT(a->hasSamePrototypeChain(b));
+    ASSERT(a->hasSamePrototypeChain(b.get()));
 
     auto merged = StructureShape::create();
     for (auto field : a->m_fields) {
@@ -574,12 +568,12 @@
 
     if (a->m_proto) {
         RELEASE_ASSERT(b->m_proto);
-        merged->setProto(StructureShape::merge(a->m_proto, b->m_proto));
+        merged->setProto(StructureShape::merge(*a->m_proto, *b->m_proto));
     }
 
     merged->markAsFinal();
 
-    return WTFMove(merged);
+    return merged;
 }
 
 void StructureShape::enterDictionaryMode()
diff --git a/Source/JavaScriptCore/runtime/TypeSet.h b/Source/JavaScriptCore/runtime/TypeSet.h
index 22f178d..0c37003 100644
--- a/Source/JavaScriptCore/runtime/TypeSet.h
+++ b/Source/JavaScriptCore/runtime/TypeSet.h
@@ -63,13 +63,13 @@
     Ref<Inspector::Protocol::Runtime::StructureDescription> inspectorRepresentation();
     void setConstructorName(String name) { m_constructorName = (name.isEmpty() ? ASCIILiteral("Object") : name); }
     String constructorName() { return m_constructorName; }
-    void setProto(PassRefPtr<StructureShape> shape) { m_proto = shape; }
+    void setProto(Ref<StructureShape>&& shape) { m_proto = WTFMove(shape); }
     void enterDictionaryMode();
 
 private:
-    static String leastCommonAncestor(const Vector<RefPtr<StructureShape>>);
-    static PassRefPtr<StructureShape> merge(const PassRefPtr<StructureShape>, const PassRefPtr<StructureShape>);
-    bool hasSamePrototypeChain(PassRefPtr<StructureShape>);
+    static String leastCommonAncestor(const Vector<Ref<StructureShape>>&);
+    static Ref<StructureShape> merge(Ref<StructureShape>&&, Ref<StructureShape>&&);
+    bool hasSamePrototypeChain(const StructureShape&);
 
     HashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash> m_fields;
     HashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash> m_optionalFields;
@@ -85,7 +85,7 @@
 public:
     static Ref<TypeSet> create() { return adoptRef(*new TypeSet); }
     TypeSet();
-    void addTypeInformation(RuntimeType, PassRefPtr<StructureShape>, Structure*);
+    void addTypeInformation(RuntimeType, RefPtr<StructureShape>&&, Structure*);
     void invalidateCache();
     String dumpTypes() const;
     String displayName() const;
@@ -103,7 +103,7 @@
 private:
     bool m_isOverflown;
     RuntimeTypeMask m_seenTypes;
-    Vector<RefPtr<StructureShape>> m_structureHistory;
+    Vector<Ref<StructureShape>> m_structureHistory;
     StructureSet m_structureSet;
 };
 
diff --git a/Source/JavaScriptCore/runtime/VM.cpp b/Source/JavaScriptCore/runtime/VM.cpp
index 974c310..c2239fd 100644
--- a/Source/JavaScriptCore/runtime/VM.cpp
+++ b/Source/JavaScriptCore/runtime/VM.cpp
@@ -549,8 +549,8 @@
     UNUSED_PARAM(intrinsic);
 #endif // ENABLE(JIT)
     return NativeExecutable::create(*this,
-        adoptRef(new NativeJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_native_call_trampoline), JITCode::HostCallThunk)), function,
-        adoptRef(new NativeJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_native_construct_trampoline), JITCode::HostCallThunk)), constructor,
+        adoptRef(*new NativeJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_native_call_trampoline), JITCode::HostCallThunk)), function,
+        adoptRef(*new NativeJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_native_construct_trampoline), JITCode::HostCallThunk)), constructor,
         NoIntrinsic, signature, name);
 }
 
@@ -868,9 +868,9 @@
     typeProfiler()->dumpTypeProfilerData(*this);
 }
 
-void VM::queueMicrotask(JSGlobalObject* globalObject, PassRefPtr<Microtask> task)
+void VM::queueMicrotask(JSGlobalObject* globalObject, Ref<Microtask>&& task)
 {
-    m_microtaskQueue.append(std::make_unique<QueuedTask>(*this, globalObject, task));
+    m_microtaskQueue.append(std::make_unique<QueuedTask>(*this, globalObject, WTFMove(task)));
 }
 
 void VM::drainMicrotasks()
diff --git a/Source/JavaScriptCore/runtime/VM.h b/Source/JavaScriptCore/runtime/VM.h
index 088008a..527b8f8 100644
--- a/Source/JavaScriptCore/runtime/VM.h
+++ b/Source/JavaScriptCore/runtime/VM.h
@@ -192,15 +192,15 @@
 public:
     void run();
 
-    QueuedTask(VM& vm, JSGlobalObject* globalObject, PassRefPtr<Microtask> microtask)
+    QueuedTask(VM& vm, JSGlobalObject* globalObject, Ref<Microtask>&& microtask)
         : m_globalObject(vm, globalObject)
-        , m_microtask(microtask)
+        , m_microtask(WTFMove(microtask))
     {
     }
 
 private:
     Strong<JSGlobalObject> m_globalObject;
-    RefPtr<Microtask> m_microtask;
+    Ref<Microtask> m_microtask;
 };
 
 class ConservativeRoots;
@@ -659,7 +659,7 @@
     bool enableControlFlowProfiler();
     bool disableControlFlowProfiler();
 
-    JS_EXPORT_PRIVATE void queueMicrotask(JSGlobalObject*, PassRefPtr<Microtask>);
+    JS_EXPORT_PRIVATE void queueMicrotask(JSGlobalObject*, Ref<Microtask>&&);
     JS_EXPORT_PRIVATE void drainMicrotasks();
     void setGlobalConstRedeclarationShouldThrow(bool globalConstRedeclarationThrow) { m_globalConstRedeclarationShouldThrow = globalConstRedeclarationThrow; }
     ALWAYS_INLINE bool globalConstRedeclarationShouldThrow() const { return m_globalConstRedeclarationShouldThrow; }
diff --git a/Source/JavaScriptCore/tools/FunctionOverrides.cpp b/Source/JavaScriptCore/tools/FunctionOverrides.cpp
index 38a51c1..ef89435 100644
--- a/Source/JavaScriptCore/tools/FunctionOverrides.cpp
+++ b/Source/JavaScriptCore/tools/FunctionOverrides.cpp
@@ -125,7 +125,7 @@
     newProviderStr.append(origHeader);
     newProviderStr.append(newBody);
 
-    auto newProvider = StringSourceProvider::create(newProviderStr, SourceOrigin { "<overridden>" }, "<overridden>");
+    Ref<SourceProvider> newProvider = StringSourceProvider::create(newProviderStr, SourceOrigin { "<overridden>" }, "<overridden>");
 
     info.firstLine = 1;
     info.lineCount = 1; // Faking it. This doesn't really matter for now.
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 0f1a665..607bfe3 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2017-02-15  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Drop PassRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=168320
+
+        Reviewed by Saam Barati.
+
+        * bindings/js/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        Use Ref and pass it to SourceCode.
+
+        * replay/ReplayController.cpp:
+        (WebCore::ReplayController::frameNavigated):
+        Pass reference.
+
 2017-02-15  Xabier Rodriguez Calvar  <calvaris@igalia.com>
 
         [GStreamer][MSE][EME] Handle protection event also at decryptor level
diff --git a/Source/WebCore/bindings/js/ScriptSourceCode.h b/Source/WebCore/bindings/js/ScriptSourceCode.h
index 26bc5f3..06a8edc 100644
--- a/Source/WebCore/bindings/js/ScriptSourceCode.h
+++ b/Source/WebCore/bindings/js/ScriptSourceCode.h
@@ -45,21 +45,21 @@
 public:
     ScriptSourceCode(const String& source, const URL& url = URL(), const TextPosition& startPosition = TextPosition(), JSC::SourceProviderSourceType sourceType = JSC::SourceProviderSourceType::Program)
         : m_provider(JSC::StringSourceProvider::create(source, JSC::SourceOrigin { url.string() }, url.string(), startPosition, sourceType))
-        , m_code(m_provider, startPosition.m_line.oneBasedInt(), startPosition.m_column.oneBasedInt())
+        , m_code(m_provider.copyRef(), startPosition.m_line.oneBasedInt(), startPosition.m_column.oneBasedInt())
         , m_url(url)
     {
     }
 
     ScriptSourceCode(CachedScript* cachedScript, JSC::SourceProviderSourceType sourceType, Ref<CachedScriptFetcher>&& scriptFetcher)
         : m_provider(CachedScriptSourceProvider::create(cachedScript, sourceType, WTFMove(scriptFetcher)))
-        , m_code(m_provider)
+        , m_code(m_provider.copyRef())
         , m_cachedScript(cachedScript)
     {
     }
 
     ScriptSourceCode(const String& source, const URL& url, const TextPosition& startPosition, JSC::SourceProviderSourceType sourceType, Ref<CachedScriptFetcher>&& scriptFetcher)
         : m_provider(JSC::StringSourceProvider::create(source, JSC::SourceOrigin { url.string(), WTFMove(scriptFetcher) }, url.string(), startPosition, sourceType))
-        , m_code(m_provider, startPosition.m_line.oneBasedInt(), startPosition.m_column.oneBasedInt())
+        , m_code(m_provider.copyRef(), startPosition.m_line.oneBasedInt(), startPosition.m_column.oneBasedInt())
         , m_url(url)
     {
     }
@@ -77,7 +77,7 @@
     const URL& url() const { return m_url; }
     
 private:
-    RefPtr<JSC::SourceProvider> m_provider;
+    Ref<JSC::SourceProvider> m_provider;
     JSC::SourceCode m_code;
     CachedResourceHandle<CachedScript> m_cachedScript;
     URL m_url;
diff --git a/Source/WebCore/replay/ReplayController.cpp b/Source/WebCore/replay/ReplayController.cpp
index 5ebe583..bf358dc 100644
--- a/Source/WebCore/replay/ReplayController.cpp
+++ b/Source/WebCore/replay/ReplayController.cpp
@@ -421,7 +421,7 @@
     // We store the input cursor in both Document and JSDOMWindow, so that
     // replay state is accessible from JavaScriptCore and script-free layout code.
     frame.document()->setInputCursor(*m_activeCursor);
-    frame.script().globalObject(mainThreadNormalWorld())->setInputCursor(m_activeCursor.get());
+    frame.script().globalObject(mainThreadNormalWorld())->setInputCursor(*m_activeCursor);
 }
 
 void ReplayController::frameDetached(Frame& frame)